Commit Graph
2650 Commits
Author SHA1 Message Date
OrcaWinandOrcaWin a891e3612c chore: remove remaining Vitest patch (#34878)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-28 01:10:32 -07:00
Neil a21f79dee4 Fix copying from Codex started manually in remote shells (#34715)
* fix(terminal): forward copies from Codex started in remote shells

* test(terminal): capture PowerShell copy probe exit status

* fix(terminal): preserve configured shell arguments for remote profiles

* test(terminal): isolate profile result from system startup output

* test(terminal): run native daemon shell probes with Node

* fix(terminal): keep an inherited remote-viewer marker out of local panes

An Orca started from a remote viewer's pane inherits ORCA_REMOTE_VIEWER_CLIPBOARD,
which would make every local Codex fake an SSH session. Treat the marker as
per-spawn identity so only explicit launch env carries it.
2026-10-28 00:50:37 -07:00
OrcaWinandOrcaWin fdfc5e2569 test: remove 36 low-value capability, schema and config cases (#34708)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-28 00:35:45 -07:00
OrcaWinandOrcaWin f44b782492 perf(browser): reuse startup profile metadata during hydration (#34748)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-28 00:33:45 -07:00
OrcaWinandOrcaWin 7cdfebdc1b Revert iteration checks and custom Vitest selection (#34834)
* revert: remove iteration checks and custom Vitest selection

* chore: use upstream affected-test selection

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-28 00:11:04 -07:00
NeilandClaude 1eaaf85e9f Land the WSL project mover dark (merges only after verify-15b, the flag-off audit and green CI) (#34059)
* test(orcad-migration): pin the SSH manifest through the real dormant collectors

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(orcad-migration): read the dormant-state export through a source-kind scope

A local-WSL scope lives on host local and owns only its projects, so host-wide
matches stay an SSH whole-host rule. SSH bytes are pinned by the collector golden.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): export a local WSL move's signed manifest with its dormant state (D1b-3c)

Collects the scoped projects, their groups and every dormant-state kind through the
local-WSL export scope, rewrites UNC paths to the distro's, and returns blockers for
anything the collectors can't carry instead of dropping it. Automations move disabled,
as the wire requires, and come back as a list to re-enable on the host after commit.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset an interrupted move to zero, or finish it once the host proves a commit

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): abort a move by its identity when its manifest is too large for a request

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): cap a new move's manifest below the request limit, and move forward on a by-reference commit only once the host flushed it

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): remove only the newest move of a distro, so its chain stays readable

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(runtime): clients read a migrated pane's scrollback from its host (D1b-6d-1)

* fix(runtime): hold a remote pane only when its host is known to serve scrollback, and never read bytes in render (D1b-6d-1)

* fix(runtime): route the scrollback read by the tab's own host, never the focused one (D1b-6d-1)

* fix(runtime): resolve the scrollback host through resolveOwner and use the shared RPC error check, after main moved both (D1b-6d-1)

* feat(wsl-mover): a moved project's existing chats stay listed and resumable on this computer (D1b-7a)

* fix(wsl-mover): moved-project chats go through the layout owner instead of writing layout directly (D1b-7a)

* test(wsl-mover): run the moved-project chat runtime test in the Node runtime (D1b-7a)

* test(wsl-mover): read the hidden local row through main's per-host hidden-repo API (D1b-7a)

* feat(wsl-mover): rewrite the desktop's routing and seed the host's session after a move (D1b-7c)

Registers the main-side desktop rewrite stores ui-routing, session-globals and host-session-seed. Adds a +2 main layout-writer baseline line for wsl-move-main-rewrite-stores.ts: these are one-shot, ledgered move rewrites, and no LayoutCommand can set focus or seed a runtime host's partition.

* fix(wsl-mover): finish the main rewrite before the window loads, keep one copy of each moved tab, and copy instead of move (D1b-7c)

* feat(wsl-move): rewrite renderer stores for moved projects and keep their UI through catalog prunes (D1b-7d)

Registers the renderer-side desktop rewrite stores quick-open-history, file-view-preferences and notebook-environments. The renderer copies each moved workspace's entry to its WSL host key, marks it applied in the same storage, and records the ledger entry; main requests a storage flush first and accepts only the main window. Committed moves are re-listed for re-application at every startup. Catalog prunes keep filters, hook trust and setup-script dismissals of moved repos.

* fix(wsl-move): import the migration manifest types from main's orcad-migration folder (D1b-7d)

* fix(wsl-move): import wslUncPathToLinux from shared wsl-paths in the manifest exporter, where 7d moved it (D1b-7d)

* feat(wsl-mover): rewrite a moved project's orchestration history on the desktop (D1b-7e)

Settled local worker dispatches and their worker-terminal rows in a moved
project take the WSL host's worktree id, in one ledgered, idempotent store.
Chat workers, live rows, federated attachments and JSON receipts stay as
written; automations keep their unchanged local copy (the scheduler only
advances it). Per-table dispositions for orchestration.db.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): hold the orchestration store while a worker in scope is live; skip federated rows (D1b-7e review)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): copy in-app browser logins into the WSL host on a move (D1b-7f)

A committed WSL move now copies each in-app browser profile's cookies once into
the WSL host's stable route partition (owner decision 3a), merging without
overwriting what the host jar holds and never touching the source. Where that
is infeasible (no deployment link so no stable partition, the destination is
not a WSL host or is gone, or the partition name is held by another identity)
the host starts fresh and the move journal records why (3b). Registered as the
ledgered browser-cookies rewrite store; it runs only once browser sessions and
an app window exist. WSL_MOVE_DESKTOP_REWRITE_REGISTRY_COMPLETE stays false.

* feat(wsl-mover): retain moved source rows, reconcile them on start, and plan delta moves (D1b-8)

* fix(wsl-mover): keep the retained mark out of the WSL move manifest (D1b-8)

* feat(wsl-mover): the move driver runs a WSL move end to end, with production gate facts and journaled restore folders

One entry point (and preview/start/cancel/listUnfinished IPC for D1b-9) plans the move, gates
terminals on the hook server's agent status, the close-tab process probe, running automation runs
and live dispatches, pauses and proves exit, stages, sends blobs, commits only from
blobs-transferred (#29825), and finishes on the desktop. Any failure resets to zero or goes forward
when the host committed. Restore folders and the automations to turn back on are kept in the
journal; the host turns those automations back on after commit, retried until it confirms.
A real-PTY test pauses daemon shells, and runs on a real distro in the WSL orcad lane.

* feat(wsl-mover): move dialog with preview, blockers, progress and result behind the internal WSL hosts gate (D1b-9)

* fix(wsl-mover): move dialog hides instead of blocking, follows runs after a reload, and lets a start settle an unfinished move (D1b-9 review)

* fix(wsl-mover): word an unfinished earlier move as still finishing (D1b-9)

* test(wsl-mover): type the e2e's fake move state instead of reading it through Reflect (D1b-9)

* WIP(wsl-mover): 7f-2 registry complete, coverage proof, startup re-apply (D1b-7f-2)

* test(wsl-mover): registry-complete lifecycle, stale-focus restart, unload re-apply (D1b-7f-2)

* fix(wsl-mover): share the session focus write so the re-apply adds no layout writer (D1b-7f-2)

* fix(wsl-mover): redo additive rewrites once at a stale window's unload; behavioural coverage proof (D1b-7f-2 review)

* test(wsl-mover): the IPC record test now finishes the rewrite with the registry complete (D1b-7f-2)

* fix(wsl-mover): fence worktree-less spawns by cwd and re-prove terminal exit before commit (R46, WIP)

* test(wsl-mover): pin the commit re-proof, browser jar identity and repeated move generations (R45, R46, R47)

* fix(wsl-mover): fence any spawn by its folder and name the re-proof's reason (R46 review)

* fix(wsl-mover): a terminal in a known folder outside the move never blocks it (R46 follow-up)

* test(wsl-mover): kill the real move driver at every point against a real host store; abort a reset move's leftover stage on reconnect

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry unsaved drafts into the moved project; round-trip every fixture through the real export, driver and host import

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset a move waiting on a distro that is proven unregistered; test updates mid-move (R41), lost distros (R38) and two desktops (R39)

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): list the D1b-10 real-SQLite mover tests

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): type the fault test's journal hook without a cast

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset for a lost distro even when its kept host fails to connect, never for a renamed one; compare filled-in repo keys only where the source lacked them

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry markdown frontmatter visibility and closed-terminal-tab tombstones into the moved project

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): read the persisted stage through a typed record, not Reflect

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(telemetry): report how WSL moves end, by phase and reason code (R43)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(telemetry): report a pause refusal's reason, an outcome for a thrown run, and only real transport errors as unreachable

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(agent-hooks): a WSL host's orcad never removes the hook entries the WSL bridge shares (R42)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(agent-hooks): a WSL host's Codex account-home launch with hooks off skips too; mark the R42 guard to drop with the bridge

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): "Use on this computer again" brings a moved project back as it was before the move

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): judge a bridge WSL pane's foreground inside its distro

On Windows every live bridge pane's own process is wsl.exe, so the busy-terminal gate read every
open WSL terminal as running a program and refused the move. Read the pane's terminal foreground
process group inside the distro (processes carry ORCA_PANE_KEY): only shells means idle, anything
else blocks, and an unreadable guest stays unverifiable.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): only the selected projects' session rows can refuse a WSL move

The session eligibility check treated host local's whole partition as the move's, as the SSH
conversion does. So an agent session or unsaved draft in any other project on this desktop, or in a
project an earlier move retained, refused every later WSL move from that distro.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sign the manifest as the journal and the host read it

The digest was computed over in-memory rows. A value with toJSON (a Date on a row added this
session) canonicalized to {} when signing but to its string once written to the journal or sent to
the host, so the first move after adding a project reset with orcad_migration_manifest_digest_mismatch
until a restart reloaded the row. Normalize through JSON before signing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry a slept pane's scrollback from its daemon checkpoint

The move sleeps every pane first, and a slept pane's history lives only in the daemon's checkpoint,
never in a renderer snapshot. The export carried renderer snapshots only, so moved terminals opened
empty. After Sleep the driver reads each paused pane's checkpoint (as cold restore would replay it)
and the export carries it under the pane's own snapshot ref; the snapshot channel serves those bytes,
checked against the signed hash. SSH conversions pass no reader and are unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): say why when a move can't be prepared, instead of a bare reset

An export or journal failure after the pause (a digest mismatch, on awin) was rethrown and shown as
"everything was put back" with no reason. Nothing is journaled yet at that point, so refuse with the
error named instead.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): retry a renderer store main refused to record

The renderer applied a store and wrote its marker, but ignored a refused ledger record (gated-off,
failed, not-main-window), so a committed move stayed unfinished and refused every later move of the
distro until the next app start. Log the reason and retry with backoff until it lands.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a WSL pane is idle only when its shell has nothing else

Review of #32343: reading only the terminal's foreground group let background jobs, nohup and
disowned work, setsid daemons and a script waiting at read pass as idle, and the move's Sleep would
end them. Scan the pane shell's subtree, its session and every process carrying its key; any
non-shell process, or a shell running a script, blocks.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): never leave behind an agent whose key may be the selected project

Review of #32343: scoping the session check to the selected projects let an unqualified key for a
repo id another host also registers fall out of both the transfer and the refusal. Such a key now
refuses. Adds tests that fail on the old code: another project's live agent with its tab open and
its draft don't refuse, the same kinds of state in the selected project still do.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): refuse an unreadable slept checkpoint, prefer it, and spool it to disk

Review of #32343:
- A checkpoint behind an unreadable log (or an unreadable one) refuses with the pane named instead
  of carrying stale history.
- For a pane the move just slept the checkpoint is the newest copy, so it wins over an older
  renderer buffer or snapshot.
- Buffers spool to a per-move folder and only their hashes and sizes stay in memory; the snapshot
  channel reads them by offset. The folder is removed whatever the outcome.
- A journal write that landed before it threw is reset, so no orphan record blocks the next move.

awin's checkpoints were 310-615 KB, well inside the 5 MB per-pane cap, so nothing there is trimmed.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): retry a failed listing, never a record another window was refused

Review of #32343: not-main-window can't clear by waiting, while a listing failure is transient.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sign the manifest as the host parses it

The likelier cause of awin's digest mismatch: the signature covered the exported objects, but the
manifest parser keeps only the fields it knows, so a session field it drops (one a sleep can
write) left the journal and the host hashing something else. Sign the parsed form, and warn when the
parser dropped anything, since such a field does not move.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): split the journal step out of the driver, and format

The review fixes took wsl-move-driver.ts past the line limit; the export-and-journal step moves to
its own module unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a slept pane passes the busy check; say what each move dropped or lacked

Re-run on awin (c5d263c77c):
- Every slept pane read unverifiable: the distro was asked about panes whose wsl.exe had already
  exited, and found no shell. Only a pane the host still sees running is asked now.
- A live pane read unverifiable when the WSL relay above its shell carried the pane key too; the
  pane's shell is now the topmost tagged shell.
- The parser-dropped-fields warning names the paths, and the slept-history reader logs how many
  panes it carried, could not read, or found no checkpoint for, so the next run says why a moved
  terminal opened empty.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read the history of panes slept before the move too

verify-3 on awin: panes the user slept earlier in the session have no live terminal, so the move
listed 0 of 0 panes and moved them empty. Their layout still names the session whose checkpoint
holds the history; read those too, live panes first.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): moved panes paint their history, slept panes are found without a reload, and an older undo names the newer move

- A moved tab's first mount reads its history from the host even before this window has the host's status; it used to mount empty and never ask again.
- The window reports the panes it slept (main retires their binding on Sleep), checked against the moved workspaces before their history is read.
- A tab's Windows shell choice is dropped on purpose, not by the parser.
- "Use on this computer again" on an older move names the projects of the newer one to bring back first.

* fix(wsl-mover): moved panes read their history, an idle agent passes, refusals name tabs and show

- The manifest carries no desktop PTY binding: the host kept them, so the client took each moved
  pane for a live terminal, skipped the scrollback read and opened a fresh prompt.
- Progress counts the terminal history it sends while staging, not only the blobs.
- "Use on this computer again" shows a refusal in a dialog; the toast sat behind the update notice.
- Unreadable slept history names the tab by its title and is refused in the preview too.
- A bridge pane whose one job is an agent CLI lets the hook status decide: idle passes, working blocks.

* fix(wsl-mover): a split agent tab's shell panes restart as shells, not fresh agents

A moved (or any headless-restored) agent tab with a plain shell split beside the agent
pane brought every split back as a new agent: the start path used the tab-wide
launchAgent for each pane that had no recorded session. Tab-wide launch evidence now
applies only to a tab's sole pane, as the renderer already treats it.

Found in the D1b-10 real-host run on awin (report bug 6).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): restore folders of panes slept before the move; keep browser tabs

D1b-10 real-host run on awin (report bug 7, with bug 8 pinned), and verify-3:

- A pane slept before the move had no live terminal, so its last folder never reached
  the restore hints and it reopened at the project root (verify-3 lost `deep/`). The
  pause step now adds the panes the saved session or the window still binds, through
  the slept-pane listing that already feeds their history, so hints and history read
  the same panes.
- The move pauses projects through Sleep, which closes a workspace's browser tabs, so
  a moved project lost its in-app browser tab. A move's Sleep request now asks the
  renderer to keep them; an older renderer ignores the field.
- A moving project's unsaved draft carries (the host-session seed lays it back); a
  test pins that it never refuses the move.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sweep journal writes that died before their rename

A killed journal write left <id>.json.<pid>.<ts>.tmp in the move journal forever
(D1b-10 real-host run, report bug 10). Once per directory and process, the journal now
removes another process's temporaries older than a minute; its own writes and a
write another instance may still be finishing are kept.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): move dialog and add-host fixes from the real-host run

D1b-10 real-host run on awin, report bug 9:
- A host that will not connect now refuses as host-unavailable, in the preview and
  at start, instead of "Orca could not check these projects" / an unexpected error.
- A run that ends without committing reports its result on the progress channel, so
  a window that only follows the run (reloaded mid-move, or started elsewhere) leaves
  "Moving… Preparing" for the result instead of sticking there until a reload.
- The preview counts terminal panes, as the terminal blockers do, not tabs.
- Small transfers read in B or KB, not "0.0 MB of 0.0 MB".
- A distro that stopped after the add-host list was read refreshes the list, so the
  button becomes Start and add, with a message that says so.
- The add-host copy no longer says bridge projects keep working "as they are" with
  no mention that they can move to the host.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a sleeping WSL pane keeps its shell's folder

Bash on the bridge reports no folder, so a slept pane's checkpoint kept
its spawn folder and the move reopened every pane at the project root.
Before the final checkpoint of a Sleep, read the shell's folder inside
the distro (the busy check's probe, now with /proc/<pid>/cwd) and store
it. Internal WSL hosts gate and Windows only.

* fix(wsl-mover): moved browser tabs and drafts survive the moving window

The window open across a move saved its mirror of the host's tabs over
the host partition, and the unload's redo skipped any workspace that
mirror named, so the seed's browser tab and draft never came back. The
redo now adds the carried browser tabs and this desktop's drafts beside
that mirror, never replacing what it holds. A seeded draft is bound to
the host, as the SSH move's draft rename binds it.

* fix(wsl-mover): a pane whose only history is a stored snapshot cold-restores it for every client

A moved (or imported) pane carries its history only as a stored scrollback snapshot,
which no paired client's mirrored layout names, so the host started a fresh shell and
every desktop showed an empty prompt. Before starting such a pane, the host now seeds
a terminal session from the snapshot, so the start cold-restores it like any
interrupted session. Reproduced end to end in wsl-move-host-pane-history.spec.ts.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): seed history only for WSL-moved local panes, once per pane

Review of the first version: it seeded any pending pane with a saved snapshot,
including SSH panes (which would be asked to reattach a session the remote never
had) and ordinary panes. Now only panes of a project a committed WSL move brought
here (its import receipt names it) and never an SSH workspace. The session id is
the pane's own, so a later start reuses the folder the pane has since written,
or its clean exit, and never replays the stale snapshot; meta.json is written
last, by rename. Tests pin the gate, the reuse, and the legacy history restore
the seed relies on; the e2e adds the not-moved control.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): seed only panes the move carried; show history once; redo a cut-short seed

Second review: narrow the seed from per-repo to per-pane (a tab created after the
move's import is the host's own), redo a seed a crash left without meta.json, and
prove on a windowless host (as the distro's orcad is) that the desktop paints the
moved history exactly once - its mirrored layout never names the snapshot, so it
never reads it too - and that the moved browser tab is listed.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): refuse "Use on this computer again" while files are unsaved

An unsaved file's beforeunload silently vetoed main's reload after a release, so the
window kept the moved layout with panes bound to dead terminals (awin verify-5).
The renderer now asks for those files to be saved first; main logs a vetoed reload.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log where an open pane's history, folder and busy verdict come from

awin verify-5 saw an open pane carry 140 B after 3,000 lines, reopen at its root, and
stay "cannot check" after its job was killed elsewhere. None reproduces off Windows,
since all three run through wsl.exe; these lines name the gap on the next run.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): an open pane keeps its shell folder through a move

Bash on the bridge reports no folder, so an open pane's checkpoint kept only its
spawn folder and `cd deep/er` reopened at the project root (awin verify-5). The
pause now reads each live pane's shell folder inside its distro before Sleep ends
the shell, and the restore hint prefers it.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry a slept pane's history once, not twice

Cold restore fills scrollbackAnsi from snapshotAnsi for a normal screen, so both
hold the whole buffer; the move concatenated them, carrying every line twice, and
the per-pane cap then kept only the newest ~1,040 of 2,000 lines (awin verify-6).
The move now carries the normal buffer once, as cold restore replays it.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): ask the distro when Windows can't observe a pane after a relaunch

After an app relaunch, Windows reads a reattached bridge pane's wsl.exe children as
unverifiable, so every live bridge pane stayed "cannot check" and blocked every
move until it was slept (awin verify-6). The gate now asks the distro about panes
Windows cannot observe too; only a pane whose shell the distro also can't find
stays unverifiable. Also formats the earlier commits' tests.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): name a terminal's pane after a relaunch before judging it

A terminal the runtime rediscovers after a relaunch carries no pane key until a
layout names it again, and the gate read every paneless terminal as unverifiable,
so no move could start after a restart (awin verify-6). The gate and the pause now
take the pane main's PTY bookkeeping binds the terminal to.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read manifest diff paths through a typed record, not Reflect.get

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): type the slept-pane modes fixture instead of asserting it

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move gate reads panes a relaunched window has not reopened

After an app relaunch, every live WSL bridge pane read "cannot check" and blocked every
move (awin verify-6, item 5). Root cause: the daemon adapter's hasPty only knows sessions
this app process spawned or reattached. A pane the relaunched window had not reopened is
still running in the daemon and listed by the runtime, but the inspection pre-check read
hasPty=false as terminal_gone, so the probe was unverifiable. Reproduced on macOS with a
two-launch e2e: an idle pane in an unopened workspace inspected as
{verdict:'unverifiable', reason:'terminal_gone'} after the relaunch. The same run showed the
runtime still holds the pane's original paneKey, so the paneKey theory is refuted.

The gate now passes includeUnattached, which skips that pre-check and asks the daemon,
which still refuses a session it no longer runs. Other callers keep the old behaviour.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): an idle stub agent passes the move gate once its Stop arrives

awin verify-6 item 5d was inconclusive: p4's stub agent answered, but the preview stayed
"agent-working". Replaying the D1b-10 stub's hook payloads through the real hook server and
the gate's fact collection shows Stop settles the pane to done and the gate reads ready, so
the Stop path is not at fault. The run's screenshot (ev/p4-agent2.png) shows the likely cause:
the harness launched the stub twice in p4, and one instance sat at its prompt having fired
only SessionStart. The stub fires SessionStart at launch, which Orca's Codex normalizer treats
as a turn start, so a stub never given a prompt reads as working. No product change.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): an unreachable daemon reads as unverifiable for the move gate

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): browserless host e2e and stale-window unit test for moved browser tabs and drafts

The distro's server has no browser of its own; an e2e-only switch (never in a packaged app)
starts the headless server the same way. With the desktop's per-host copy as a move leaves it,
the moved browser tab and pre-move draft show as tabs. The unload redo after a move rewritten
under an open window keeps both, whether the host published first or the rewrite seeded first.

* fix(wsl-mover): moved browser tabs and drafts survive the prepared reload after a move

"Reload now" backs up unsaved files by dispatching a synthetic unload first. That first unload
staged the window's mirror of the host (no browser tab, no draft) and drained the redo mark, so
the window, still open, saved its mirror again and the real reload had nothing to redo. The redo
now runs at every unload of the stale window and a last time when its document is replaced
(did-navigate), and only then is the mark drained.

* test(wsl-mover): the undo-path test's store answers the unsaved-file check

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read workspace records through the selectors

Main's new workspace-record read ratchet flags the mover's direct reads; the move dialog, the moved
projects section and its store helpers now read through workspace-record-selectors, and the scope
rows' catalog names its own fields. Prunes the layout-writer baseline to its actual count.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the dialog e2e expects the slept panes the start request now names

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved terminal's pane key comes from paneOfPty

Main's L80 census allows only paneOfPty and the switch-guarded writers to read a PTY record's pane
copies; the WSL move's live-terminal list now reads through it.

Co-Authored-By: Claude <noreply@anthropic.com>

* style: format the imports the main merge repointed

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): carry each moved pane's daemon checkpoint as a terminal-history blob the host restores once

Replaces the host-side stored-scrollback seed (#32789) with an installed interrupted session the pane's first start claims.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): the desktop sends each paused pane's checkpoint as its terminal-history blob

Drops the snapshot-ref spooling and the restore-hints blob for moved panes: one source (the pane's daemon checkpoint) carries history and folder.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(wsl-mover): register WSL move wiring from its own module

Keeps register-core-handlers under the max-lines limit.

* fix(wsl-mover): one import from ./ui in the move wiring

* refactor(wsl-mover): build the manifest's session before the payload

* style(wsl-mover): one import from stable-pane-id after the main merge

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): drop the e2e for the stored-snapshot seed this redesign deletes

The moved pane's history now comes from its own checkpoint; wsl-move-restore-lifecycle.spec.ts
covers it once, across reloads.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): keep #32668's two layout writers in the baseline until 2/3 deletes them

Main's layout-writer ratchet now counts main-process writers; wsl-move-echoed-browser-tabs.ts, the
file the hold-and-reload in 2/3 deletes, writes two. Restore redesign 2/3 removes the entry.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): move the project you have open into a host that has its own focus

The carried session named this desktop's focus, and a host that already focused another project
refused it (orcad_migration_dormant_focus_conflict:activeRepoId), so moving the project you had
open reset with "Nothing was moved" (awin verify-7 N1). The desktop's focus names nothing on the
host and the desktop rewrites its own focus after the move, so the export now carries none and
the host keeps its own. The reset result also says why the move stopped.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): startup removes the slept-history spools of moves the journal dropped

A run killed mid-pause is reset at the next startup without its process, so its export documents
(25 KB per pane on awin verify-7) stayed under wsl-move-slept-scrollback for good.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a woken WSL pane keeps its folder unless the probe proves it gone

The cold restore checked a WSL pane's folder with stat over \\wsl.localhost, which waits for a
stopped distro and fails for reasons other than absence. After a rollback the pane stayed blank
about 15 s, then opened at the project root without its folder (awin verify-7, 5e). It now uses
the bounded wsl.exe probe every other restore uses, which keeps the folder unless proven missing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved pane's new shell prompt starts on its own line

The carried screen ends on the old shell's prompt with the cursor after it, so the host's new
shell printed its prompt beside it (`$ $`, awin verify-7). The exported checkpoint now ends the
normal screen with a line break; a TUI's screen and an unfinished escape are left as they are.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): wait on conditions, a fixed clock and stated reasons instead of sleeps

Main's flaky-test ratchet flags the mover's tests:
- The browser-draft and pane-history e2e slept fixed seconds. They now wait on what they slept
  for: the host's tabs mirrored, the host terminal's last line, the moved tabs shown, the pane
  painted.
- The journal sweep test read the wall clock; it runs on a fixed fake time.
- Each longer per-test timeout says why it needs the time.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(wsl-mover): start the WSL mover from its own startup module

The mover's startup (rewrite stores, interrupted-move recovery, retention, retry) lived inline in
main-process-ready-foundation.ts. With main, the host reconnect and D1c branches each adding a
few lines on top, the file passed the max-lines limit in the combined build. It moves as one
unit to wsl-move-startup.ts; the foundation keeps the one call and its ordering.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): hold the window's saves from commit until main reloads it (restore redesign 2/3)

The window open across a move hydrated before the desktop rewrite, so every save it made
(session, UI, the unload checkpoint behind Reload now) wrote stale state back, and three files
re-applied the rewrite after it: echoed browser tabs, the seeded view state's redo and the
stale-window reapply. Now main holds that window's saves from the commit request until its
reloaded page has loaded, and reloads it itself once the rewrite is on disk. Use on this computer
again takes the same path, replacing its per-project release hold.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): only a settled commit reloads the window it held

A rewrite pass that ends while a commit request is out (another move's retry) must not reload
the window early: the reloaded page could save its view of projects the host is publishing.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): prune the deleted re-apply writers from the layout baseline

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move's pause sleeps a workspace again before refusing

A workspace whose pane was still restoring, or had just spawned, could miss its final checkpoint
on the first Sleep and stay awake; the move then refused with "Orca could not pause the terminals"
although a second Sleep stopped it (awin verify-7, 6e). The pause now sleeps the failed workspaces
up to twice more, a second apart, and refuses only when they keep failing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a move retries a workspace whose pause failed instead of refusing at once

When one workspace of a move failed to pause, the move was refused right away with
host_terminal_stop_failed, and the retry added for awin verify-7 never ran (awin verify-8, 6e).
The window rolls a failed workspace's panes back and reports that rollback as an error. The
pause's persist step waited on every workspace and failed on that error, so the whole pause
call threw instead of returning the failed workspace. The retry only ran on a returned failure,
and the move's first pause had no retry at all.

The persist step now fails only on errors from workspaces main reported as slept; main already
reports the failed ones. Both of the move's pauses sleep a failed workspace up to twice more
before refusing. Each attempt is a fresh pause with its own id, so a re-sleep is not counted
as a duplicate.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): e2e for the restart-style restore and undo (restore redesign 3/3, WIP)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved pane's first subscriber gets its whole replayed history

The host replays a moved pane's checkpoint once, but every remote subscribe snapshot carried at
most 1000 rows, so the desktop's first view of a 2,000-line pane lost its first half. Only for
panes whose session is a moved one, the subscribe snapshot now tries 5000 rows first, then 2000,
then the usual ladder, within the same byte budget.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the restore lifecycle e2e waits for the printer instead of sleeping

Main's flaky-test ratchet flags it: it now waits until the host terminal shows the printer's
last line before the pane sleeps, and each longer timeout says why.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): undo after reloads and a restart wakes split panes live, each with its history once

The undo e2e now follows a real move: main's own Sleep pauses a split tab, the committed move runs
its desktop rewrite and retention at startup, the window reloads three times and the app restarts,
then "Use on this computer again". The project comes back slept (no live terminal until opened),
and opening it wakes both panes from their checkpoints, history once, taking input.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): carried and retained agents resume once across move, reloads and undo

The move e2e now carries the pane's idle Codex session to the host (its session file where the
distro keeps it): the agent resumes in the moved pane's folder on the first open and no reload
resumes it again. The undo e2e gives pane A an idle agent: after the undo it resumes there, once,
and pane B starts none.

Verify-6 item 5d (an idle agent read as working): the awin stub posts Codex's SessionStart at
launch, which Orca reads as a turn start; Codex posts it with the first prompt. The gate test now
pins that a resumed agent passes until its next prompt starts a turn.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): read the undo e2e's agent record without a cast

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): parse the undo e2e's agent records instead of reflecting into them

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the lifecycle e2e shows the moved pane when its agent does not start

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): start the carried agent by its recorded absolute command

A login shell may reset PATH (Ubuntu CI did), so the stub is named by the launch config the move
carries, as a recorded agent command is.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): say where a resumed moved pane started when it is not its folder

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): print login profiles that move a shell when the resumed pane is outside its folder

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): keep the CI runner's login-profile cd out of the moved pane's folder check

Blacksmith's /etc/profile.d/blacksmith.sh ends with cd "$GITHUB_WORKSPACE", so every login
shell on CI, restored or new, plain or agent, starts there. Reproduced in Ubuntu 24.04 with the
same profile line: a plain restored pane lands in GITHUB_WORKSPACE too, and with it unset the
moved pane and its resumed agent start in the pane's folder. Orca spawns the shell in the right
folder; the runner's profile moves it.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): judge the resumed pane's folder by where its shell started

Blacksmith's /etc/profile.d/blacksmith.sh sources the job env and cds into GITHUB_WORKSPACE, so on
CI every login shell, plain or agent, restored or new, moves there after Orca starts it in the
pane's folder (reproduced in Ubuntu 24.04 with that profile line; a plain restored pane moves too).
The check now accepts the pane's folder as PWD or as the OLDPWD a profile cd left behind.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): undo stops the host's copy of the project before its agents resume here

"Use on this computer again" resumed the project's agents here while the host's copies kept
running, so one agent session ran on both sides and two writers shared its transcript (awin
verify-7, 6c). Undo now sleeps the project's workspaces on the host and waits until none of their
terminals runs. A host that does not answer, or whose terminals do not exit, keeps the move and
says so; a host the user removed runs nothing, so the project comes back.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): e2e: undo stops the host's running copy before the project comes back

A paired host holds the moved project under the move's ids with its terminal still running; after
"Use on this computer again" none of the host's terminals for it runs. Fails with the host stop
removed (the host's terminal stays at 1).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): "Use on this computer again" refuses only for the move's own unsaved files

An unsaved file in any project refused bringing a moved project back, so p6's draft README
blocked undoing p9 (awin verify-8). The window reload no longer stops on an unsaved file, and
only the move's own workspaces come back from their pre-move state. The window now tells main
which workspaces have unsaved files; main refuses only if the move holds one of them, before it
stops anything on the host, and the window names just those files.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a refused "Use on this computer again" leaves the host's terminals running

Undo stopped the host's copies of the move's terminals before it checked whether the move could
be released, so an undo refused because a later move builds on it still killed the host's shells
and agents; the agents then resumed again (awin verify-9, X1). Undo now runs every refusal first:
unsaved files, a running move, a newer move in the chain, and whether the host answers for every
workspace. Only then does it stop anything, and a host that cannot answer for one workspace has
none of them stopped.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move gate finds a pane the window has not reopened since a relaunch

A pane the window has not shown since an app relaunch has no spawn-time pane key in main, so
the move gate's guest busy check could not find its shell. The gate now falls back to main's
own pane record. The Sleep half of the relaunch gap (awin verify-9, X2) moved to main with
#33398 and #33425.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log who spawns each WSL pane and whether its cold restore came with it

After an undo reload a restored, inactive terminal tab showed only a prompt: something spawned
its session 2 s after the reload, before the window showed it, and its checkpoint never replayed
(awin verify-10). No log named the spawner. Each WSL pane spawn or reattach now logs its
session, spawn intent, whether it was new, whether a cold restore came with it, and the four
caller frames above the daemon client, for verify-11 to capture.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the undo host-copy e2e says why it needs its longer timeout

Main's flaky-test ratchet flags an unexplained per-test timeout.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): record the WSL spawn caller where it enters the daemon router

verify-11's `[wsl-spawn-origin]` lines named only the daemon client's own frames
(createOrAttachSpawn ← doSpawn ← withDaemonRetry): the async spawn path drops the caller.
The caller's frames are now captured synchronously at the router's `spawn` entry and logged
with the spawn, so verify-12 can name what starts a restored pane before its window shows it.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): capture the WSL spawn caller where every daemon spawn enters

verify-12 still logged "caller":[]. The router only wraps the daemon client when
legacy daemons exist; otherwise the bare client is the installed provider, so the
router capture never ran. Capture at the client's spawn entry (keyed by the
minted id too) and raise the stack limit so the async caller frames survive.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log the seed and the daemon's screen for WSL cold restores

verify-13's second-cycle `$ $` checkpoint shows the daemon's own screen
without the fresh-shell blanking (old prompt still in the viewport,
scrollbackLines 0), which the macOS daemon harness never reproduces.
Log the seed's shape and tail with the spawn, and the daemon's screen
3 s after a WSL cold restore, so the next run shows where it is lost.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): keep an open host pane from restarting its agent during undo

"Use on this computer again" slept the host workspace and waited for its
terminals to go. A host pane open in the window saw its terminal exit and
resumed the agent on the host 1.6 s later, after the stop had already
counted zero, so the reloaded window resumed a second copy here (awin
verify-14, 6c). Refuse this window's terminal and agent starts on that host
from before the stop until the reloaded page has loaded (capped at 2 min),
and lift the fence when undo is refused.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): pre-landing cleanup for the dark landing

- Strip the verify-only spawn-origin and cold-restore-screen logging and the
  per-pane process warning.
- Read a pane's stored scrollback from its host only for WSL hosts; SSH and
  paired-server tabs no longer hold for a placeholder or ask their host.
- Limit the ambiguous-owner refusal to WSL moves; SSH conversions match as
  before.
- Drop the duplicate split-tab launch check (main fixed it in the projection,
  #32418).
- Reword comments that cited internal verify runs.

* fix(terminal): save a woken terminal's first history as a full snapshot

A wake that reused the Sleep-time cold-restore cache reopened the history
writer without asking for a full checkpoint, so the new process's output was
appended to the pre-wake checkpoint, which lacks the fresh-shell padding the
seed gave the daemon. The next save that replayed checkpoint + log (quit's
final save, or a relaunch's adoption) printed the new shell's prompt on the
restored one's row (`$ $`). Mark a full checkpoint for a new process in that
path, as the uncached cold-restore path already does.

* fix(terminal): keep ConPTY's viewport top through a width change, checked against a captured transcript

A captured ConPTY 1.23 resize (wsl.exe) shows it keeps the line at the top
of its viewport through every resize and repaints only that viewport. xterm
keeps the cursor's rows instead: a wider grid that rejoins wrapped rows pulls
rows out of scrollback (ConPTY's repaint then overwrites them), and a
narrower one that rewraps pushes rows into it (the repaint then repeats
them). The windowsPty row rule covered neither. ConPTY-backed emulators now
put the top line back on its row after a resize.

* feat(wsl-mover): D3a move orchestrator skeleton (dark) (#33802)

* feat(wsl-mover): D3a move orchestrator skeleton, dark behind the internal WSL hosts gate

* fix(wsl-mover): exhaustive orchestrator telemetry transition

* feat(wsl-mover): D3a T2 trigger, confirmed-running host readiness and T3 guard

* fix(wsl-mover): D3a review fixes (stuck moving, user release parks, A1 timer, deferred backoff, chain restore, GUID-only R38, uncounted window failures, backoff docs, restore settle, coalesced wakes)

* fix(wsl-mover): restore chain order without mutating

* fix(wsl-mover): D3a never touches a WSL host whose Remove is pending (E11 pendingStop)

* fix(wsl-mover): D3a survives an unreadable journal, honours a release mid-step, replays wakes after Restore, re-checks pendingStop before readying a host

* refactor(wsl-mover): orchestrator ports in their own module

* test(wsl-mover): warm the orchestrator wiring import before its first test

* fix(wsl-mover): a user Remove of a WSL host declines its move until the user adds it or retries

* test(wsl-mover): one checked cast in the host user-action test

* fix(wsl-mover): D3a review 3 — removal-pending clears, start re-checks after the window answers, non-blocking replies, replay in finally; split orchestrator modules under max-lines

* test(wsl-mover): index check style

* test(wsl-mover): core handler test mocks the move orchestrator wiring

* fix(wsl-mover): every user Remove of a WSL host declines its move; readying a host re-checks the decline before connect or add

* fix(wsl-mover): a failed sidecar save or step error never rejects a fire-and-forget trigger

* test(wsl-mover): split orchestrator tests under max-lines with shared fake ports

* fix(wsl-mover): report a host Remove before its cleanup, so a failed cleanup keeps the decline

* fix(wsl-mover): keep the moved-pane history wire surface off outside a WSL host

Register session.readTerminalScrollback, advertise its capability and the
terminal-history migration blob, and install that blob only on a WSL move's
destination (the WSL host's orcad, or an e2e host standing in for one).
Restoring a pane only probes for a moved pane's history there too. The
journal's orphaned-write sweep is limited to the WSL move journal, so SSH
migration journals behave as on main. Pin the advertised blob kinds again.

* fix(wsl-mover): user moves connect the host, automatic ones never boot; gate D3a's selector; tolerate a missing environment list

- The dialog's preview and start reach the host through service.connect (may boot, lifts a park);
  the orchestrator and its startup recovery keep the no-boot path (A1, E9). A host with a Remove
  pending is never connected either way.
- WslMoveDialogHost's active-distro selector does no worktree lookup with the flag off.
- hostScrollbackEnvironmentId returns null before the environment list loads; the mount test
  fixture supplies a WSL host.

* fix(wsl-mover): D3a waits out a move still being retained; orchestrator-over-driver tests (#34087)

* fix(wsl-mover): D3a waits out a move still being retained instead of failing attempts; orchestrator-over-driver integration tests

* fix(wsl-mover): D3a counts an unverifiable in-flight refusal, caps uncounted waits at a day (parks as stuck) and re-checks a done distro waiting on retention

* fix(wsl-mover): cap D3a's uncounted waits by checks, not wall clock; any in-flight detail counts

* fix(wsl-mover): a user's move leaves an already-ready host connected as is

service.connect bumps the liveness generation and re-ensures the server; the orchestrator readies
the host before the driver runs, so the driver connects only a host that is not ready.

* Revert "fix(terminal): keep ConPTY's viewport top through a width change, checked against a captured transcript"

This reverts commit ecd8f07396.

* test(wsl-mover): the orchestrator's automatic path never reconnects a serving host, and adds a bridge host once (E9)

* fix(wsl-mover): keep session.readTerminalScrollback in the RPC manifest; gate its registration

Gating the method out of ALL_RPC_METHODS dropped it from the generated params catalog. It is
static again, so the catalog types it, and the dispatcher leaves it unregistered on any host that
does not serve moved panes' history (method-not-found there, as before).

* fix(wsl-mover): undo returns focus from the host copy, so the reload does not reopen it

verify-15b 6c: undo stopped the host's copy of p9, but the window's focus still named the host
copy (the move pointed it there), so the reloaded window opened that workspace, the host
re-created its pane as a visible user-resume, and, since #34054 resumes a restored host pane's
agent from the hook store, Codex resumed on the host beside the one restored here. With writes
held and before the reload, undo now points focus at the project's copy here, reusing the move's
focus writer with the inverse patch.

* fix(wsl-mover): undo turns the host's copies of the move's automations off before releasing

After "Use on this computer again" the desktop's retained copy of a moved automation runs again,
while the host's copy stayed on: both ran against the same files. Before each move is released,
undo now turns off, on the host, that move's automations whose copy here is on (one off here keeps
the user's choice there). A host that cannot be reached refuses as host-unreachable and one that
refuses as failed, releasing nothing, like the terminal stop.

* fix(wsl-mover): undo turns host automations off before stopping terminals, and back on if it refuses

d3-gate-audit: with the automation step after the terminal stop, a refusal there left the host's
terminals and agents killed while undo refused, breaking X1. Per move, undo now turns the
automations off first (a step that undoes cleanly), then stops the terminals, then releases. A
terminal stop that fails turns back on what was turned off, and a disable that fails partway
turns back on what it had turned off before it throws.

* fix(wsl-mover): roll back undo's host automation step on any later refusal; review lows

- Any refusal after the automations went off (terminal stop, release failure or supersede) turns
  back on exactly what this attempt turned off. One it cannot is recorded on the move
  (hostAutomationsLeftOff), shown in the unfinished-move notice and retried by the rewrite retry.
- The spawn fence is released in a finally, and the port answers failed instead of throwing on an
  unreadable environment store.
- A host with a pending Remove (E11) is left alone with its own refusal copy; the
  host-automations refusal tells the user to connect the host.

* fix(wsl-mover): undo carries the host's automation states back and leaves each running in one place

Owner decision on d3a's item 5: undo reads every one of the move's automations on the host, turns
off each host copy that is on, and, with the release, gives the copy here the host's state (the
user's latest choice; one deleted there reads as off). An automation turned off on the host after
the move no longer comes back on here, and one turned on there no longer keeps running against a
project the host no longer owns. A refused undo restores the host's flags and changes nothing
here.

* fix(wsl-mover): the left-off automation retry re-reads the move after the host round trip

d3-gate-audit: the retry wrote back the snapshot it read before awaiting the host, so an undo that
released the move meanwhile could be undone, or a phase advance rolled back. It now re-reads the
record after the await, writes nothing for a move that is gone, and removes only the ids it
turned on, keeping everything else current.

* fix(wsl-mover): undo records the user's automation choice before turning any off, and takes turns with the retry

d3a re-review and d3-gate-audit:
- Undo reads every moved automation on the host, records those states on the move before turning
  anything off, and applies them here as part of the release step (undone if the release then
  refuses). An earlier attempt's record wins, so one left off by a failed rollback, or by a crash,
  keeps its choice (on) here instead of reading as off.
- A disable the host drops mid-loop carries what it could not turn back on on its error; those
  are recorded as left off, shown in the unfinished-move notice and retried.
- Undo's per-move steps and the left-off retry take turns, and the retry re-reads the move inside
  its turn, so a release during a retry neither resurrects the move nor leaves the host copy on.
- At startup, an undo a crash interrupted sends what it read as on back on through the retry.

* fix(wsl-mover): a left-off retry that finds the move released turns its host copies back off

If a move is released while the retry is turning a left-off automation back on, the host copy
would run for a project that is local again. After the round trip the retry re-reads the move;
when it is gone it turns what it just turned on back off (best effort, logged).

* fix(wsl-mover): a restart keeps a left-off automation's choice; undo's rollback never skips the host

d3a re-review:
- Startup settling keeps the recorded choice (on) for what it sends to the retry, and undo also
  reads any id on the left-off list as on, so a later undo after a restart and failed retries keeps
  it on here.
- A failed revert of the copies here no longer skips turning the host's copies back on; each
  revert write is tried on its own.
- Turning automations back on stops at a host that stops answering, leaving the rest as left off,
  instead of waiting on each in turn while undo's turn is held.

* fix(wsl-mover): undo always asks the host for the move's terminals, refusing a host that does not answer

verify-15c: with the host's orcad stopped, "Use on this computer again" for p7 proceeded, and after
a normal undo p6's host shell kept running. Undo's host-copy stop took the host workspaces to stop
from this computer's session, which after a move keeps only a moved project's chats: a project
with none named no workspace, so undo asked the host nothing (no reachability check, nothing
stopped) and released it. The stop now always lists the host's terminals first, adds every
workspace of the move's scope that runs one, and refuses as host-unreachable when the host does
not answer, answers with an error, or cuts the list short.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-10-28 00:02:37 -07:00
4b1967bdd8 feat(i18n): add Turkish UI language (#34718)
* feat(i18n): add Turkish UI language

Register Turkish (tr) as a built-in UI language alongside en, zh, ko, ja,
es, fr and pt: language setting, system-locale detection, renderer and
main-process lazy catalogs, Settings picker label in every catalog,
Settings search keyword, onboarding picker, docs, README link and a
Turkish style glossary (config/i18n-turkish.md).

tr.json comes from the community Turkish catalog (#22200, refreshed in
#31316), reconciled with the current en.json: keys retired from en.json,
entries whose English source changed since the refresh, and entries with
placeholder mismatches are dropped and fall back to English until the
next translation pass.

Supersedes #31316.

Co-authored-by: Uğur Pala <mail@ugurpala.com>
Co-authored-by: mert <mmerttpz@gmail.com>
Co-authored-by: Mehmet Efe Aytaş <mehmetefeaytas@icloud.com>

* feat(i18n): complete Turkish catalog

Translate the 1,432 keys tr.json was missing, restore the count placeholder
in six Turkish singular forms, and order the catalog like en.json.

* fix(i18n): apply Turkish translation review

Correct 32 mistranslations (wrong meaning, translated command names and
example paths, swapped placeholders) and 525 glossary and grammar issues
that two independent review passes both flagged.

* fix(i18n): Turkish review fixes and dotted-I settings search

Fold U+0307 from lowercased Turkish İ so settings search matches plain-i
queries, fix sampled Turkish meaning/terminology issues, and align the
glossary casing rule with the catalog.

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Uğur Pala <mail@ugurpala.com>
Co-authored-by: mert <mmerttpz@gmail.com>
Co-authored-by: Mehmet Efe Aytaş <mehmetefeaytas@icloud.com>
2026-10-27 23:46:17 -07:00
OrcaWinandOrcaWin 8916bf36aa fix(mobile): release queued inbound frames after transport teardown (#34777)
* fix(mobile): release queued inbound frames when transports close

* test(mobile): run relay inbound retention regressions in every runner

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 23:40:36 -07:00
52a43ed99e feat(i18n): add Russian UI language (#34717)
* feat(i18n): add Russian UI language

Register `ru` as a built-in UI language using the catalog from #33370,
reconciled against current en.json: keys pruned from English were dropped,
stale translations whose English source changed were removed, and the
catalog verifier now accepts CLDR few/many forms for an existing `_other`
family.

Co-authored-by: Vyacheslav Scherbinin <gentslava@mail.ru>

* fix(i18n): drop Russian _one entries superseded by count placeholders

Main now interpolates the count in English _one strings (#34693), so the
literal-1 Russian forms no longer match their source.

* feat(i18n): complete Russian catalog and add terminology glossary

Translate the 650 remaining English keys and the few/many plural forms for
every count family, and document the Russian glossary and style conventions.

* fix(i18n): apply reviewed Russian translation corrections

Fix mistranslations and grammar flagged in a full-catalog review, and align
terminology with the glossary: рабочее дерево for worktree, рабочее
пространство for workspace, пул-реквест and файлы cookie.

* fix(i18n): resolve Russian plural forms in main-process strings and align ru terminology

translateMain now resolves literal _one/_other keys through the CLDR plural
family like translate(), so native dialogs pick Russian few/many forms. The
plural helpers move to src/shared for reuse. apply-translation-delta accepts
locale-only plural categories sourced from English _other. ru.json follows the
glossary for account/session/prompt and uses a single ellipsis character.

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Vyacheslav Scherbinin <gentslava@mail.ru>
2026-10-27 23:18:15 -07:00
OrcaWinandOrcaWin 6fcbce32b9 fix(mobile): release cancelled relay stream captures immediately (#34745)
* fix(mobile): release cancelled relay subscription callbacks

* test(mobile): run relay cancellation GC regression tests by default and in CI

Expose GC via v8 flags so the collection cases no longer skip under the default pool or Bun, run the file on Node in mobile CI, and drop cases that already passed on main.

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 23:06:33 -07:00
OrcaWinandOrcaWin 0866cb1b08 fix: bound local iteration checks and show live progress (#34700)
* fix: bound local iteration checks and show live progress

* fix: harden check lifecycles and cached test evidence

* fix: preserve process instrumentation and fixture lifecycles

* fix: give fixture unref spy a portable function type

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 23:04:23 -07:00
b62f9bf624 feat(i18n): add Traditional Chinese (zh-Hant) UI locale (#29795)
* feat(i18n): add Traditional Chinese (zh-Hant) UI locale

Adds 繁體中文 as a selectable UI language and derives its catalog from
zh.json rather than translating English afresh, so the reviewed Simplified
terminology and Orca glossary decisions carry over.

The conversion needed three corrections beyond OpenCC's `cn -> twp`:

- One pass only. `twp`'s phrase dictionary is not idempotent (it maps
  進程->程序 and 程序->程式), and iterating to a fixed point makes output
  worse: it rewrites the correct Taiwan 游標 to 遊標, and 程序 to 程式 where
  the source meant an OS process.
- 16 terms where `twp` emits a form Taiwan does not use, each confirmed
  against Microsoft's VS Code zh-Hant language pack (許可權 0 vs 權限 84,
  賬戶 0 vs 帳戶 111, and so on).
- 進程 vs 程序 collapse in `twp` output. Taiwan calls an OS process 行程, so
  the generator consults the Simplified source to disambiguate; daemon copy
  reads 守護行程, not 守護程式.

Also pins `load: 'currentOnly'` on both i18next instances. i18next's default
expands `zh-Hant` into ['zh-Hant', 'zh', 'en'], so a key missing from the
Traditional catalog would silently render Simplified.

zh-Hant.json is generated and compared byte-for-byte, so the new check is
wired into verify:localization-catalogs to fail when a Simplified edit skips
regeneration.

Refs #10592

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(i18n): fail the zh-Hant check on an unreadable zh.json

The generator caught every error from reading and parsing zh.json, so a
malformed or unreadable Simplified catalog logged "absent here" and exited
0 without ever comparing the generated Traditional catalog. Only ENOENT
means there is nothing to derive, so every other failure now propagates.

Tests cover the three paths the catch was conflating: an absent zh.json
still passes for the combined verifier's synthetic fixtures, malformed
JSON throws, and a directory where the catalog belongs throws EISDIR
rather than reporting the file as missing.

Co-Authored-By: Claude Code <noreply@anthropic.com>

* feat(i18n): ship Traditional Chinese (Taiwan) as a maintained built-in catalog

Keeps the zh-Hant locale from this PR and makes it a hand-maintained
catalog like the other built-ins, without the OpenCC generator:

- Catalog reconciled with current en.json. Per key it prefers the
  Taiwan-reviewed copy from #22402 (which carries #14223), falls back to
  the zh-derived copy here, and drops entries whose English changed.
  A review pass then applied Taiwan terms (代理程式, 工作階段, 存放庫,
  分頁, 列/欄) and 「」 quotes. Glossary: config/i18n-traditional-chinese.md.
- Label 繁體中文(台灣)in every catalog, the picker, onboarding and search.
- Detection maps zh-TW/zh-HK/zh-MO/zh-Hant* to zh-Hant; zh-CN/zh-SG/zh-Hans
  stay on zh. Both i18next instances use load: 'currentOnly' so missing
  keys fall back to English, not Simplified.
- Drops opencc-js, the generator scripts and their verify hook.

Co-authored-by: hungchihsueh <84211143+hungchihsueh@users.noreply.github.com>
Co-authored-by: chilung-cgu <b0423031@gmail.com>

* feat(i18n): translate remaining Traditional Chinese (Taiwan) catalog keys

Fill the 2,043 keys added to en since the source PRs branched, following
the Taiwan glossary, and extend the glossary with skill, automation,
usage, review, token and related terms.

* fix(i18n): review Traditional Chinese (Taiwan) catalog wording

Apply 629 reviewed corrections across the full catalog: 30 meaning or
untranslated-text fixes and 599 glossary and phrasing fixes (終端機, 用量,
API 金鑰, clearer counts and actions). Each edit was cross-checked by an
independent review pass.

* fix(i18n): polish sampled zh-Hant strings and drop redundant locale test

Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: hungchihsueh <84211143+hungchihsueh@users.noreply.github.com>
Co-authored-by: chilung-cgu <b0423031@gmail.com>
2026-10-27 22:49:49 -07:00
OrcaWinandOrcaWin 9558439018 perf(i18n): ship only main-process strings in the main bundle (#34711)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 22:46:57 -07:00
OrcaWinandOrcaWin ca2154945b ci: run advisory e2e lanes on free hosted runners (#34725)
The layout oracle merge gate keeps Blacksmith via fast_runners: true; the
advisory e2e call, nightly schedule and layout-owner dispatch run on
ubuntu-24.04.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 22:08:17 -07:00
OrcaWinandOrcaWin 8b7f8c88ce ci: run terminal perf on demand only, on a hosted runner (#34726)
* ci: run terminal perf on demand only, on a hosted runner

The nightly failed every run: the presented-frame guard accepts only
GitHub-hosted Xvfb displays, but the workflow ran on Blacksmith. Drop the
schedule, move dispatch runs to ubuntu-24.04 and document local use.

* docs: record the first hosted terminal perf result

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 21:48:08 -07:00
Brennan Benson b4131707fd fix(onboarding): complete default-agent setup for No agent (#31463)
* fix(onboarding): count an explicit no-agent choice as configured

* fix(onboarding): preserve historical setup migration eligibility

* Route setup progress workspace reads through selector
2026-10-27 21:15:26 -07:00
OrcaWinandOrcaWin ee09f979fa test: remove 78 low-value cases and four entire suites (#34687)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 21:00:57 -07:00
Brennan Benson 8d908764dc Revert "Keep same-machine folders with matching Git remotes in separate projects (#32272)" (#34662)
* Revert "Keep same-machine folders with matching Git remotes in separate projects (#32272)"

This reverts commit 29a5f89b8a.

On a machine with several clones of one repo, #32272 moved the oldest clone
into the shared cross-host project. Shared Windows QA machines have several
orca clones, so everyone's sidebar "orca" project suddenly gained that
machine's main checkout and its worktrees. Revert until the intended
grouping is decided.

Conflicts resolved against later main: Settings files moved into
settings/repository (imports adjusted), and two test files later deleted on
main stay deleted.

* Use checked types in restored test fixtures

* Combine restored fixture type imports
2026-10-27 20:38:35 -07:00
Samuel VilaandNeil 66134086bd fix(cli): strip terminal control sequences from Linear text in CLI output (#31677)
Linear-provided titles, states, assignees, projects, labels, workspace
names and error messages were printed verbatim, so remote text could
emit OSC/CSI/C1 sequences or forge extra output lines. Move terminalSafe
into src/shared/terminal-safe-text.ts, add terminalSafeLine (collapses
CR/LF), and apply it to every Linear text field in the human-readable
formatters. --json output is unchanged.

Fixes #20478

Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
2026-10-27 20:30:08 -07:00
76d4b01969 chore(i18n): gate unreferenced catalog keys in the extraction check and retire 1,644 of them (#22056)
* chore(i18n): add a detector for catalog keys no source references

A key can leave the code without leaving the catalog: a feature is reverted, a
setting is rewritten in place, a component is deleted. Nothing fails, so the
entries stay. Every locale carries them, translators spend effort on strings no
screen renders, and coverage numbers understate how much is actually translated.

`verify:localization-extraction` already reports an unreferenced set, but it
cannot be deleted as-is: i18next-cli does not see a key held in a data structure
(`{ key: '…' }`) or passed as a variable, and 18 files do exactly that. So this
requires two independent conditions — extraction misses the key AND the exact
string appears in no source literal under src/ or mobile/.

Two properties matter and both were found the hard way:

- Plural variants are judged by their base key. i18next appends the CLDR
  category at runtime, so `…_one` never appears in a source file even though the
  base does. Without this the scan eats every plural in the catalog.
- The scan is iterative. Removing a base key can strand the variants that
  survived on its account, so it must be re-run until it reports none.

Registered as `verify:localization-orphans` but deliberately left out of the
lint chain: it reports 1,401 keys on current main, so gating now would fail CI.
The prune and the gate come together in a follow-up.

* test(i18n): cover the orphan detector's two non-obvious rules

Both rules decide whether a key is live, and both are easy to break without
noticing: the plural rule keeps `…count_one` when only `…count` appears in
source, and the literal scan is the sole evidence for keys extraction cannot
see — held in a data structure or passed as a variable.

Extracting them as pure functions changes no behaviour: the detector still
reports 14,459 keys, 12,887 referenced, 1,401 orphans, and --check still
exits 1.

* chore(i18n): rename the detector's key pattern constant

main gained the anti-slop rule no-shape-in-symbol-names after this branch
was cut, and KEY_SHAPED trips it once the branch is merged with main.
Renamed to CATALOG_KEY_PATTERN; no behaviour change.

* chore(i18n): name the orphan detector like the other localization verifiers

CODEOWNERS routes /config/scripts/*localization*.mjs to the localization owner, and find-orphaned-catalog-keys.mjs matched neither that pattern nor *locale*, so a change to it asked nobody for review. The file now carries the name of the npm script that runs it, verify:localization-orphans.

* fix(i18n): report stranded plural variants in the same pass as their base key

isKeyReferenced kept a plural variant alive whenever en.json still carried its base key, even when no source reached that base key. The base key was reported and the variants were not, so a prune needed a second run to find them. Only a base key that extraction or a source literal references keeps its variants now; the --check message drops the re-run advice and names the override tables, which sit outside the scan roots.

* fix(i18n): let the literal scan accept every key-shaped literal

The scan captured only literals of seven characters or more and then applied CATALOG_KEY_PATTERN, which has no such floor. A live key shorter than that, held in a data structure, would have been reported as an orphan. en.json has no key that short today, so the result is unchanged; the capture now leaves the shape decision to the one pattern.

* fix(i18n): stop the orphan scan when a source root cannot be read

collectSourceFiles swallowed every readdir error, so a directory it could not read contributed no literals and a key named only there would have been reported as safe to delete. Only a missing mobile/ root is skipped now, since a checkout without the mobile app is still a complete desktop scan; any other error stops the scan.

* style(i18n): wrap one line of the orphan detector to the formatter's width

* chore(i18n): fold the orphan-key detector into the extraction check and retire 1,644 unreferenced keys

verify-localization-extraction.mjs now filters its own unreferenced set by
source literals (src/ and mobile/), plural base keys and dynamic prefixes
composed inside translate calls, and fails when any key is named nowhere.
That replaces the standalone verify-localization-orphans.mjs script and its
second extraction pass.

The prune is recomputed on current main: 1,644 keys leave all seven locale
catalogs, 285 stale entries leave the key-override tables, and
en-runtime-required.json is regenerated.

Supersedes #19801.

Co-authored-by: Evgenii <413011+smwbev@users.noreply.github.com>

* chore(i18n): scope the unused-key scan to src/ and require a dotted dynamic prefix

mobile/ edits do not trigger the extraction check, so literals there must not
decide its verdict; a dotless runtime-built prefix would keep unrelated keys alive.

Co-authored-by: Evgenii <413011+smwbev@users.noreply.github.com>

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Evgenii <413011+smwbev@users.noreply.github.com>
2026-10-27 20:29:43 -07:00
OrcaWinandOrcaWin 0323d28498 test: remove 49 low-value test cases (#34678)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 20:13:46 -07:00
Neil 68f0c7999f perf(editor): reuse model owner keys in closed-tab cleanup (#34691)
Each openFiles change (e.g. a dirty toggle) re-resolved every tab's owner
route twice. Cache owner keys per tab until an owner input changes, so a
single-tab update resolves only that tab.
2026-10-27 20:12:02 -07:00
8b64ec281a ci: restore main's Vitest transform cache in PR unit shards (#34512)
* ci: restore main's Vitest transform cache in PR unit shards

Main produces per-shard transform caches on a schedule; PR shards restore
the newest one for the same config/lockfile/runtime policy. A Vitest cache
key generator folds each literal specifier's resolution candidates into the
per-module key so newly added files that shadow a resolution invalidate the
importer, and bails on glob-expanded dynamic imports.

* ci: list the resolution key plugin in the node tsconfig project

* ci: accept Vitest's CACHEDIR.TAG when sealing the unit module cache

Vitest 5.0.5 tags its cache root, which made every seal fail with
'invalid cache entry name' so no producer cache was ever saved.

* ci: reseed the unit module cache when any cache-key input lands on main

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
2026-10-27 20:04:56 -07:00
Neil 6bb0c14a98 refactor: group native chat text presentation (#34647) 2026-10-27 19:48:24 -07:00
OrcaWinandOrcaWin 1df26abf60 ci(adhoc): package Mac architectures on 6-vCPU runners (#34673)
Each 12-vCPU arch job spends ~3 of its ~7 minutes waiting on Apple's
notary service; packaging itself runs at the same speed as the hourly
build's 6-vCPU runner. Halve the per-minute rate.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 19:44:18 -07:00
OrcaWinandOrcaWin 261eb660e3 ci(mac): fail the packaging step when overlapped notarization throws (#34658)
electron-builder's temp-file cleanup registers async-exit-hook, whose
beforeExit handler calls process.exit(0). The overlap script reported
failures through process.exitCode, so a thrown build exited 0: the
retry wrapper logged success and skipped its second attempt (hourly run
40608643418). Exit explicitly instead, as electron-builder's own CLI
guards against the same hook.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 19:44:14 -07:00
OrcaWinandOrcaWin e0f32dcac1 ci: seed hosted Linux packaging and mobile bundle caches on main, and stop PR-local saves (#34672)
- Warm electron-builder-linux-<versions> and the hosted ubuntu-24.04 Electron native modules
- PRs restore hosted Linux Electron native modules without saving
- Replace mobile verify's bundler-cache with a restore of a warmup-saved bundle
- Drop the pnpm store cache where a direct install was faster (mobile main, glibc-floor containers)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 19:40:29 -07:00
OrcaWinandOrcaWin e1838023cc test: remove 70 low-value test cases (#34665)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 19:25:02 -07:00
ef6e661449 fix(runtime): accept Muse's composer when the voice-input label is absent (#25695)
* fix(runtime): accept Muse's composer when the voice-input label is absent

Muse labels its composer's top rule "Voice input" only where voice is
available, so on Linux the readiness predicate never matched and
worker-start timed out at agent_readiness. Keep the voice-label match and
also accept the composer itself: a rule (two or more rule chars) directly
before the prompt glyph after the latest Muse banner, so a shell prompt like
'~/app ❯' or '╰─❯' under a printed banner is still not ready.

Fixes #25005

Co-authored-by: j33pia <242526320+j33pia@users.noreply.github.com>
Co-authored-by: Nawapat Buakoet <nawapat.b@covest.finance>

* fix(runtime): escape Muse composer regex so the orcad bundle stays ASCII

---------

Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: j33pia <242526320+j33pia@users.noreply.github.com>
Co-authored-by: Nawapat Buakoet <nawapat.b@covest.finance>
2026-10-27 19:12:13 -07:00
Neil 61337dfb33 chore(ratchet): gate event-loop-blocking calls in the daemon, PTY and orcad code (#34614)
* fix(daemon): read the PTY process table without blocking on terminal kill and resize

The terminal daemon force-killed a session by running ps and reading
/proc/<pid>/stat synchronously, and checked the resize foreground group
with execFileSync('ps'). A slow or wedged ps froze every terminal the
daemon serves for up to the ps timeout on each call.

Both paths now use the async process-table read (runProcess with a
timeout that kills the child). SubprocessHandle.forceKill may return a
promise; the termination controller awaits it so a refused signal still
releases the claim for a retry. A force-kill or SIGWINCH whose root
exits while ps runs signals nothing, since the captured groups could
already be recycled. ConPTY force-kill stays synchronous so dispose()
still sees the node-pty kill it must not repeat. The in-process
provider's app-quit sweep keeps the blocking variant. The ps dialect
and table readers move to posix-pty-process-table.ts.

Refs #34410
Refs #33870

* fix(daemon): address review on async PTY process-table reads

Guard only the root-pid fallback on exit so proven groups are still swept
after dispose, wait out at most one ps dialect probe, move the sync-launch
baseline entry with the table reader, and keep tests cross-platform.

Refs #34410
Refs #33870

* fix(daemon): keep the PTY open until an in-flight force-kill sweep finishes

A sweep whose root exits mid-read must not signal: the freed TTY may
belong to another terminal. Dispose therefore defers destroy() until the
sweep settles, so its hangup cannot end the root first.

Refs #34410
Refs #33870

* test(daemon): build the destroy-tracking PTY mock without a type assertion

Refs #34410
Refs #33870

* fix(pty): make the local graceful-deadline force-kill async and stub ps in tests

The in-process provider's graceful-deadline timer now uses the async
group sweep; the app-quit sweep and the root-signal path stay
synchronous. Tests that drove force-kill through fixture pids now stub
the async process-table read instead of querying the host, and a new
test pins that waiters do not chain behind a failed dialect probe.
Session ids are only read for rows on the root's terminal.

Refs #34410
Refs #33870

* fix(pty): hold PTY teardown until an in-flight force-kill sweep settles

Orphan cleanup could destroy a local PTY while the graceful-deadline
sweep was still reading the process table, neutralizing its fallback
kill and hanging up the root first. Both the daemon handle and the
local provider now defer teardown through PendingPtyGroupSweep.

Concurrent force-kill callers in the daemon now await the shared
in-flight request, so a joiner's physical-exit budget starts after the
signals are sent and it sees their rejection.

Refs #34410
Refs #33870

* fix(pty): let disposal and orphan cleanup join the in-flight force-kill sweep

Session disposal now joins the controller's shared force-kill request
instead of starting a second sweep. Local orphan cleanup decides its
escalation only after a pending graceful-deadline sweep settles, so a
refused sweep is escalated before the handle is released rather than
leaving the retry with a neutralized kill.

Refs #34410
Refs #33870

* fix(daemon): SIGKILL live PTY groups before a shutdown deadline exit

The old synchronous sweep sent its signals before the shutdown deadline
timer could run; the async sweep can still be reading the process table
when it fires. The deadline now SIGKILLs each live session's process
group synchronously before exiting (node-pty roots lead their own
group), falling back to the root pid when the group kill is refused.
POSIX only.

Refs #34410
Refs #33870

* chore(ratchet): gate event-loop-blocking calls in the daemon, PTY and orcad code

The terminal daemon and orcad serve every pane from one event loop, so a
synchronous child launch or file write there freezes all of them. A new
count ratchet tracks execFileSync/spawnSync/execSync, runProcessSync,
appendFileSync and writeSync per file under src/main/daemon,
src/main/pty, src/main/runtime and src/main/orcad; counts may only go
down. It reuses the sync-spawn ratchet's import-aware call collector,
now extracted to gated-call-use-collector.mjs, so aliases, namespace
imports and re-exports count and same-named methods on other objects
do not.

Refs #34410
Refs #33870
2026-10-27 19:05:34 -07:00
ansonlotiniatandOrcaWin 73f3fcd873 fix(i18n): standardize Simplified Chinese product terminology (#15464)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:52:13 -07:00
OrcaWinandOrcaWin 4f9b331570 test: remove 45 low-value cases and two suites (#34646)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:41:50 -07:00
Neil ca272a78c0 fix(daemon): read the PTY process table without blocking on terminal kill and resize (#34603)
* fix(daemon): read the PTY process table without blocking on terminal kill and resize

The terminal daemon force-killed a session by running ps and reading
/proc/<pid>/stat synchronously, and checked the resize foreground group
with execFileSync('ps'). A slow or wedged ps froze every terminal the
daemon serves for up to the ps timeout on each call.

Both paths now use the async process-table read (runProcess with a
timeout that kills the child). SubprocessHandle.forceKill may return a
promise; the termination controller awaits it so a refused signal still
releases the claim for a retry. A force-kill or SIGWINCH whose root
exits while ps runs signals nothing, since the captured groups could
already be recycled. ConPTY force-kill stays synchronous so dispose()
still sees the node-pty kill it must not repeat. The in-process
provider's app-quit sweep keeps the blocking variant. The ps dialect
and table readers move to posix-pty-process-table.ts.

Refs #34410
Refs #33870

* fix(daemon): address review on async PTY process-table reads

Guard only the root-pid fallback on exit so proven groups are still swept
after dispose, wait out at most one ps dialect probe, move the sync-launch
baseline entry with the table reader, and keep tests cross-platform.

Refs #34410
Refs #33870

* fix(daemon): keep the PTY open until an in-flight force-kill sweep finishes

A sweep whose root exits mid-read must not signal: the freed TTY may
belong to another terminal. Dispose therefore defers destroy() until the
sweep settles, so its hangup cannot end the root first.

Refs #34410
Refs #33870

* test(daemon): build the destroy-tracking PTY mock without a type assertion

Refs #34410
Refs #33870

* fix(pty): make the local graceful-deadline force-kill async and stub ps in tests

The in-process provider's graceful-deadline timer now uses the async
group sweep; the app-quit sweep and the root-signal path stay
synchronous. Tests that drove force-kill through fixture pids now stub
the async process-table read instead of querying the host, and a new
test pins that waiters do not chain behind a failed dialect probe.
Session ids are only read for rows on the root's terminal.

Refs #34410
Refs #33870

* fix(pty): hold PTY teardown until an in-flight force-kill sweep settles

Orphan cleanup could destroy a local PTY while the graceful-deadline
sweep was still reading the process table, neutralizing its fallback
kill and hanging up the root first. Both the daemon handle and the
local provider now defer teardown through PendingPtyGroupSweep.

Concurrent force-kill callers in the daemon now await the shared
in-flight request, so a joiner's physical-exit budget starts after the
signals are sent and it sees their rejection.

Refs #34410
Refs #33870

* fix(pty): let disposal and orphan cleanup join the in-flight force-kill sweep

Session disposal now joins the controller's shared force-kill request
instead of starting a second sweep. Local orphan cleanup decides its
escalation only after a pending graceful-deadline sweep settles, so a
refused sweep is escalated before the handle is released rather than
leaving the retry with a neutralized kill.

Refs #34410
Refs #33870

* fix(daemon): SIGKILL live PTY groups before a shutdown deadline exit

The old synchronous sweep sent its signals before the shutdown deadline
timer could run; the async sweep can still be reading the process table
when it fires. The deadline now SIGKILLs each live session's process
group synchronously before exiting (node-pty roots lead their own
group), falling back to the root pid when the group kill is refused.
POSIX only.

Refs #34410
Refs #33870
2026-10-27 18:36:30 -07:00
6631e5f6b6 fix(i18n): give each reused localization key its own sentence (#34648)
* fix(i18n): give each reused localization key its own sentence

Thirteen keys were shared by call sites that say different things. The
catalog holds one value per key, so the second site rendered the first
site's text: "Move X left" on the right-move button, "Use X repo color"
on the icon picker, "lines above" on the expand-below control, "Open X
issues" on the open-in-Linear action, and similar for status icons,
reclaimable workspaces, remote uploads, automation destination notices,
the add-project button and MiniMax credential errors.

Split every divergent site onto its own key with translations in all
locales, sync the runtime-required catalog, and make
verify-localization-catalog reject a key reused with different fallback
text so the collision cannot come back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(i18n): pluralize the remote upload toast with i18next count

The toast passed an English "s" as {{value1}}, so ja/ko/zh rendered
"ファイルs", "파일s" and "文件s". The catalog gate requires every locale to
keep the source placeholders, so dropping {{value1}} per locale is not an
option; use count plurals (_one/_other) like nativeDropTempCopyFailed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* docs: add one-line docstrings to the functions this change touches

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(i18n): reject reused fallback keys before --fix writes en.json

A missing key used with two different fallback sentences had its first
sentence written to en.json before the reused-fallback check failed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:28:23 -07:00
beb53a7f9e ci: keep hourly and daily macOS builds on Blacksmith (#34640)
Hosted macos-15 fails afterPack's packaged x64 terminal host boot check
(hourly run 40608643418: timed out waiting for the PTY), so no
latest-mac.yml is published. Windows, template qualification and routing
jobs stay on hosted runners.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
2026-10-27 18:18:20 -07:00
OrcaWinandOrcaWin 2cd3e6d6a3 ci: narrow churny cache keys and move PR-local cache saves to main (#34600)
* ci: narrow native, launcher and packaging cache keys and stop PR-local saves

* ci: hash Rust crate sources, not build outputs, in launcher and hook keys

* ci: fail closed on unlocked native packages and cover transitive key inputs

* ci: resolve the Windows Rust cache scope with a script, not a nested local action

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:14:29 -07:00
OrcaWinandOrcaWin 17667304b9 fix(i18n): render revised UI copy and fail on fallback drift (#34642)
* fix(i18n): render revised UI copy and fail on fallback drift

en.json kept stale values for 47 translate() keys whose source fallback was
rewritten, so the revised copy never rendered in any language.

- Adopt the newer source copy into en.json and retranslate zh/ko/ja/es/fr/pt.
- Move copy whose meaning changed to new keys (artifacts sign-in, remote host
  access link / name, ssh config picker, jump palette automation label, Claude
  subagent navigation hint) so stale translations cannot survive.
- Split five keys shared by different sentences at the sites the extractor
  flagged (activity group-by, automation destination notices, Linear open
  action, workspace options label).
- Fix catalog/source mistakes: onboarding "notify you know" typo, crash report
  double dot and missing space, mobile search keyword "app", remote server
  restart warning repeating "live tabs", and stale source fallbacks where the
  catalog was right (Ghostty import, Skills button, too-many-changes banner,
  card style and chat UI descriptions).
- verify-localization-extraction now fails on fallback drift and prints the
  en.json and source values with how to fix it.

Closes #25572

* fix(i18n): translate es live tab/pane counts used in server restart warning

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:09:28 -07:00
06008d20df fix(i18n): select whole count sentences at twelve more call sites (#27974)
* fix(i18n): select whole count sentences at twelve more call sites

Twelve strings were a noun plus a plural ending passed as an
interpolation value, so every non-English locale got a Latin "s" glued
to its own noun whenever the count was not one. Each call site now
chooses between two whole sentences with a single {{count}}, the same
Singular/Plural pattern #27907 uses for three Settings strings.

ja, ko and zh drop the stray ending. es and fr keep what they rendered
for one and get grammatical plural sentences. The "commits ahead"
tooltip in the compare summary takes the wording the catalogs already
have for the identical sentence, because three translations treated the
ending as an object. Legacy keys stay in the catalogs.

Fixes #27973

* fix(i18n): name commits in Korean in the compare-summary tooltip

The Korean pair for the "commits ahead" tooltip was copied from
compareBaseCommitsAheadOne/Other, which keep the English "commit" and
"commits". Both sentences now say 커밋 with the 개 counter, the form
#27907 uses for its Korean count sentences, so the tooltip no longer
carries an English plural.

The locale test also requires ja, ko and zh to use one sentence for
both counts. It fails on the previous Korean pair.

* fix(i18n): take the Korean count sentences from the audit review

Eleven of the twelve Korean pairs still put the number before the noun
with no counter ("3 라벨"), the order left over from dropping the
English plural ending. They now read noun, number, counter
("라벨 3개", "멤버 3명"), the wording abruption supplied in review of
#27974. The "commits ahead" pair already had that form and is unchanged.

Three sentences are also reworded to follow the English: a failed
discard no longer says the files could not be deleted, the group toast
says how many of the contained projects remained, and "restricted key"
is spelled out as an API key with restricted access.

The 22 values are recorded in locale-ko-key-overrides.json, next to the
other reviewed Korean strings.

* chore(i18n): credit the Korean count sentences to their reviewer

The Korean wording applied in f6bbcaf341 was supplied by abruption as a
patch in review of #27974 and went in byte for byte. That commit could
not carry a co-author trailer, so this empty one does.

Co-authored-by: YEONGUK LEE <contact@abruption.dev>

* fix(i18n): drop the twelve keys the count sentences replaced

No call site reads the twelve noun-plus-ending keys any more, so they
leave the six catalogs, as #28185 did for the keys it replaced. With
them go the three Korean override entries for those keys and the one
value ko-ui-semantic-mistranslations.test.ts pinned for the old
sshImportSynced text; the sentence it guarded is now the
sshImportSyncedSingular/Plural pair, covered by
count-sentence-locales.test.ts. en-runtime-required.json is
regenerated.

* fix(i18n): give remote drop uploads their own count keys; drop low-value tests

- Remote terminal drop uploads used the runtime keys with a different
  fallback ('to remote…'); split them into uploadingFileToRemote{Singular,Plural}
  with translations in all catalogs.
- Remove mock-translate tests and the catalog-pinning count-sentence test;
  verify:localization-* already enforces key and placeholder parity.
- Trim the 'why whole sentences' comments.
- Regenerate en-runtime-required.json.

* fix(i18n): natural zh/ja count strings and es host-import wording

---------

Co-authored-by: YEONGUK LEE <contact@abruption.dev>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 18:00:21 -07:00
OrcaWinandOrcaWin 3b4ae900d3 test: remove 19 low-value cases and three suites (#34628)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:57:15 -07:00
YEONGUK LEEandOrcaWin 7efd2c4b7a fix(i18n): localize desktop Setup terminal titles (#28602)
* fix(i18n): localize desktop setup terminal titles

* test(runtime): declare orcad's English Setup terminal title in composition parity

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:51:39 -07:00
07ea055d4e fix(i18n): interpolate the settings-search empty-state query instead of concatenating translated fragments (#19693)
* fix(i18n): interpolate the settings-search empty-state query

The empty state rendered three sibling JSX nodes: a translated prefix
`No settings found for "`, the raw query, then a translated closing `"`.
English reads correctly only because English puts the quoted term after
the verb. Korean and Chinese put it before, so translators given the
leading fragment in isolation localized it as a complete clause and the
query was concatenated after the sentence had already ended:

  ko: "에 대한 설정을 찾을 수 없습니다.screen reader"
  zh: 找不到“的设置screen reader”

No value for the prefix key can fix this. A fixed prefix/suffix split
hard-codes one word order into the code, and the position where a
language needs the interpolated value is exactly what differs between
languages — so any single split is wrong for some locale by
construction. The message has to be one string with a placeholder, which
moves the decision of where the query goes from the JSX into each
locale's catalog entry.

Replace the fragments with one `{{value0}}` message under a new key.
The old keys are retired rather than reused: their translations are
clause fragments and would be wrong under the new shape. Korean and
Chinese get the natural order; es/fr/ja reassemble their own existing
fragments around the placeholder. ko/zh are also pinned in the
cross-locale key overrides next to the existing precedent for this same
fragment-concatenation class, so a catalog regeneration cannot
reintroduce the clause form.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(i18n): drop assertions the expected-message table already makes

Three of the file's assertions restated what the per-locale exact-match
table proves on its own, and one setup step was dead:

- "carries the query placeholder in every locale" — an exact match on the
  rendered sentence cannot pass if a catalog value lost `{{value0}}`,
  since the query would be missing from the output. Its `undefined` skip
  branch was also unreachable: the catalogs it iterates are the same six
  the table covers.
- "closes the ko/zh clause after the query" — `toBe` on the full string
  already fixes where the clause sits relative to the query.
- `beforeEach(changeLanguage('en'))` — the remaining table test sets its
  own language per case, and the catalog test reads the JSON directly and
  never consults i18n.

Verified by mutation rather than assumed. Each of these makes the
trimmed file fail, so nothing the deleted assertions guarded is now
unguarded:

  ko value loses {{value0}}              1 failed / 6 passed
  es value loses {{value0}}              1 failed / 6 passed
  ko puts the clause before the query    1 failed / 6 passed
  zh ends with the query                 1 failed / 6 passed
  a retired fragment key returns in ja   1 failed / 6 passed

Clean: 7 passed. With the rest of the change reverted to main and this
file kept: 6 failed / 1 passed. The docblock keeps the reason the shape
changed and loses the retelling of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:34:46 -07:00
OrcaWinandOrcaWin db3520d522 fix(i18n): use whole count sentences instead of appending English 's' in JSX (#34622)
* fix(i18n): use whole count sentences instead of appending English 's' in JSX

* fix(i18n): drop unrelated reformatting in McpConfigSection

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:34:40 -07:00
53ba8adc7f fix(i18n): improve Korean disabled-state labels (#34155)
* 한국어 비활성 상태 라벨을 문맥에 맞게 수정

사용량 통계의 비활성 상태는 비활성으로, 터미널 색상 대비의 Off 옵션은 끔으로 수정했습니다. 활성 상태의 기존 활성화됨 표현은 유지했습니다.

번역 재생성 시에도 두 표현이 유지되도록 한국어 키별 보정 설정에 반영했습니다.

* fix(i18n): pair Korean usage badge enabled label with 비활성

* fix(i18n): translate remaining Korean runtime RPC startup failure strings

Carried over from #14044.

Co-authored-by: JeongSu <zz1996zz@naver.com>

---------

Co-authored-by: Willy <willy@Willy-MacBookPro.local>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: JeongSu <zz1996zz@naver.com>
2026-10-27 17:34:31 -07:00
676c30c3fb fix(i18n): distinguish Korean workspace and worktree labels (#24769)
Correct 22 Korean labels to match the workspace or worktree named by
their English source. Pin the same values in the Korean key overrides
and cover catalog values and repair-policy stability with regression tests.

Fixes #11727

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:34:27 -07:00
Neil ea532813b1 refactor: group native chat turn presentation (#34629) 2026-10-27 17:33:03 -07:00
OrcaWinandOrcaWin 6a395dc4c4 test: remove 76 low-value cases and three suites (#34612)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 17:09:30 -07:00
Neil b930606ee9 chore(wsl): require the allowlist check in any file that hand-builds a wsl.exe exec (#34615)
resolveCommand only checks what it resolves, so a file that also builds its
own wsl.exe exec no longer passes the import check on a resolveCommand call
alone. Note editor --remote wsl+<distro> launches as out of scope.
2026-10-27 16:53:48 -07:00
OrcaWinandOrcaWin 965286939d ci: sweep caches on idle non-main branches every three hours (#34605)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 16:53:14 -07:00
Neil 5784e146de feat(wsl): internal distro allowlist that keeps WSL execs out of other distros on shared test boxes (#34539)
* feat(wsl): internal distro allowlist for WSL execs on shared test boxes

ORCA_INTERNAL_WSL_DISTRO_ALLOWLIST (comma-separated distro names) keeps every
wsl.exe call out of distros not on the list: process-host's resolveSpawn,
the main and daemon node-pty spawns, and the two codex-accounts calls that
bypass process-host. Pure list/status/version calls stay allowed; any other
form must name an allowlisted distro, and --shutdown or a default-distro exec
is refused. A malformed value refuses every distro and logs once. Unset, the
check reads the variable and returns, so behavior is identical to today.

* fix(wsl): cover every direct wsl.exe exec with the internal distro allowlist

- Restore #34525's worktree-create payload and captured-host test, reverted by
  accident in the first commit.
- Check the allowlist in execFileCapture, the choke point for WSL Git, gh and
  worker-thread captures, and before the WSL git-read probe, the Codex hook
  path canonicalization and the CLI login spawn. The WSL watcher now spawns
  through process-host.
- Stop scanning wsl.exe argv at the first positional argument, which wsl.exe
  runs in the default distro.
- check-process-host-imports fails on any direct wsl.exe exec outside
  process-host that does not call assertWslDistroAllowed.

* fix(wsl): check the distro allowlist where resolveCommand produces the wsl.exe form

Every Git, gh and glab path into a distro resolves through resolveCommand, so
gitExecFileSync, gitSpawn, git stream reads and wslAwareSpawn are covered too;
the execFileCapture check is now redundant and removed. The import check also
treats buildWslExecArgs as a wsl.exe exec and accepts resolveCommand as covered.
2026-10-27 16:19:13 -07:00
OrcaWinandOrcaWin 791502fae4 ci: move secondary, scheduled and contract workflows to GitHub-hosted runners (#34568)
* ci: move secondary, scheduled and contract workflows to GitHub-hosted runners

Public-repo standard hosted runners are free under Enterprise. Release, build,
benchmark, e2e and unit workflows stay on Blacksmith. ci-xterm-cache seeds both
cache stores since its PR consumer's pool is undecided.

* test(pi): resolve the smoke bundle's external packages from the repo

#34148 pulled zod into the commit-message planner graph; the bundle in the
OS temp dir could not resolve it on any runner.

* ci(unit): use four workers on the hosted four-core x64 runner

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
2026-10-27 16:15:14 -07:00