* feat(speech): spell dictionary terms in dictation, with repo terms and Whisper prompt
* test(speech): pin host repo terms for phone dictation
* fix(speech): keep symbol terms whole, accept null setup params, resolve SSH repos
* refactor(speech): key transcript words once and type phone terms at the reply schema
* refactor(speech): merge speech-types imports in the speech IPC
* feat(runtime): tell phones when the desktop refreshes a PR
* fix(runtime): name every checkout a coalesced PR read stood for
* fix(runtime): don't count a read that couldn't load checks as a checks change
* feat(mobile): keep dictating after leaving the session, with a floating pill
* feat(mobile): translate the dictation pill and its toasts
* fix(mobile): type away words without claiming the terminal, and keep the pill above screens
* fix(mobile): float the pill above bottom bars, reopen the owner's own screen, and tell a refused start wherever you are
* fix(mobile): float the dictation pill above the source control bar
* fix(mobile): keep pill state out of the host context and reopen the starting screen first
* refactor(mobile): subscribe the pill only while it shows and trim the session dictation hook
* fix(mobile): key bar clearances by symbol
* feat(mobile): save the chat when the app leaves the foreground
A swipe-kill from the app switcher can end the app before the page is
hidden: iOS fires visibilitychange only at background, and Android Recents
leaves the activity resumed. The shell now sends an appInactive frame on
iOS inactive and Android window blur, to pages that declare they read it,
and the page saves any chat rows the store doesn't hold yet.
* fix(mobile): keep the leave callback out of render
* fix(mobile): notice a changed middle row before skipping a chat save
* perf(mobile): show accounts from the last snapshot
* fix(mobile): never count a stored accounts snapshot as live
* test(mobile): pin when accounts usage counts as live
* fix(mobile): date accounts reads by when they were sent and block switches until live
* fix(mobile): show accounts usage only from this screen's own read, drop replies from before a reconnect
* fix(mobile): stop Review's branch compare re-reading back to back during git bursts
fetchHostQuery re-read a compare as soon as it landed marked by a git event, so a burst of gitStatusChanged events with reads slower than the event spacing kept the desktop running compares back to back, and kept going after Review closed. A re-read now goes at once only after a quiet spell (a write's own event), otherwise floorMs after the last read landed, and stops once Review's build is no longer current. A superseded build no longer evicts the entry a newer build is reading.
* fix(mobile): show each compare that lands during a git burst while Review reads it again
* fix(mobile): keep note edits when a later compare lands on a shown Review build
* perf(mobile): open Home with last-known workspaces and counts
* fix(mobile): keep disconnected desktops on Home and judge agents by the client's connect time
* fix(mobile): store the seeded Home counts before removing the old snapshot
* fix(mobile): floor router reads after failures, catch up reads that span a stream reopen, seed the wide host list from Home
* fix(mobile): keep the old Home snapshot until the store can take it, and never re-date stored totals
* perf(mobile): key Home's counts in the host list module so the page boot never loads Home's code
* test(mobile): type the Home catalog adapter's modules with type imports
* perf(mobile): read Home's stored rows in one batch beside the host list, and keep mark-read a delta read
* perf(mobile): paint Home's desktop rows without waiting for the stored counts
* perf(mobile): restore Home's stored rows after the desktop list paints, from its host ids
* perf(mobile): read Home's counts on the connected edge itself, not a render later
* feat(mobile): keep commit, PR and review drafts across kills
* refactor(mobile): build commit, PR and review drafts on the shared draft fields, and clear only the text that was sent
* fix(mobile): keep a toggle made during Write with AI, the edit note while its sheet closes, and a newer PR edit after an earlier save
* test(mobile): wait for the saved review note row instead of sleeping
* perf(mobile): keep a hash of the PR text an edit was typed against, not a second copy
* feat(mobile): open chats on their last messages after a relaunch
The phone's store keeps each chat's newest rows (up to 512 KiB, 500 rows)
and its resume point, written when a turn settles, on hidden and when the
chat closes. A relaunched session opens on its stored chat tab, paints the
saved rows, and resumes from the stored cursor; the live read restates what
the agent is doing. Offline, the composer line says when the copy is from.
* test(mobile): keep the relaunch test typechecking
* i18n(mobile): translate the offline as-of line
* perf(mobile): encode chat copies in slices off the settle frame
* perf(mobile): keep three visited terminals mounted and release hidden WebGL
* fix(mobile): scope the mounted-terminal LRU to the terminal frame
* fix(mobile): keep chat's lease-only stream when a terminal pane unmounts
* fix(mobile): report a hidden terminal's cell box only once it is shown
* perf(mobile): keep hidden terminals' WebGL contexts instead of rebuilding them on every switch
* perf(mobile): back off spare page refills after an unclaimed drop or memory warning
* fix(mobile): skip a spare whose store read outlived an unclaimed drop
* fix(mobile): arm the spare refill timer on whole milliseconds
* fix(mobile): floor event-driven reads after failures and catch up reads that span a stream reopen
* test(mobile): pin the event router's read floor after a refused read in a recording
* feat(mobile): keep Tasks and new-workspace drafts across kills
Task comments (per item and project row), the New issue title and body,
and the New workspace note now live in device-store draft rows. They come
back after the form closes or the app is killed, and only into an empty
field. A comment's setter stays bound to its item, so a send that settles
after the user moved on clears the right row.
* fix(mobile): rebuild comment sends when the draft's item changes
* fix(mobile): key the workspace note by host and keep cleared fields cleared
* fix(mobile): clear only the note a finished create sent
* fix(mobile): count clearing an empty draft field as the user's choice
* perf(mobile): cap field drafts, read sheet drafts on open, retry a failed read once
* fix(mobile): retry a failed draft read after a pause and keep New issue text typed during a create
* fix(mobile): save draft text again once a failed store read can be retried
* fix(mobile): remove a stored draft when an unread field is cleared
* perf(github): use the desktop's PR fallback rule on the phone and forward refreshes
* fix(github): keep a merged fallback PR while the phone has no head
* feat(runtime): tell phones when relay hosts change
* fix(runtime): keep the relay host backstop live and watch every list input
* fix(mobile): hold the relay host feed only for desktops that announce changes
* perf(runtime): watch relay host inputs only while phones read the list
Codex reports both approved and denied automatic approval reviews on the
guardianWarning channel. Orca rendered every one as a yellow "safety review
warning", so routine approvals looked like problems. Approved reviews now
render as a neutral "approved this action" notice on desktop and mobile;
denials and timeouts keep the warning tone.
Co-authored-by: Sean876-alt <224890246+Sean876-alt@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(dictation): wait as long as the host's cloud deadline when a paired phone or browser stops
* fix(dictation): compute the host's cloud deadline from its exact sample count
* fix(dictation): store Auto as Toggle plus hold-to-record so older builds keep a working shortcut
* test(mobile): type the Auto mode settings fake instead of casting
* fix(dictation): migrate a stored Hold without hold-to-record
* fix(dictation): keep phone mode segments typed and clear hold-to-record when a phone picks Hold
* refactor(dictation): reuse the shared mode settings in the migration and phone writes
* fix(dictation): stop a phone's cloud dictation at the 10-minute limit with a notice
* test(dictation): pin the cap flag on every phone chunk reply
* perf(dictation): skip decoding phone audio the host will drop past the cloud cap
Deleting a recipe workspace from the phone removed only its checkout and
left the VM this desktop created for it running. Only the desktop window
ran the destroy.
The relaying desktop now tags the rows of workspaces whose VMs it created
with the environment's name, and says whether deleting will destroy it.
The phone's delete sheet names the environment, and its delete asks for
the destroy (`destroyHost: true`). The desktop then owns that removal:
- it runs as a workspace lifecycle delete
- the environment's Orca removes the checkout and must answer positively.
An older Orca that answers on acceptance is polled until the workspace
is gone.
- the VM is destroyed through the shared cleanup, behind any running wake
or suspend, and only when no other workspace remains on it
- the result reports host.state truthfully: destroyed, kept, or
left-running (no destroy step)
The environment's own error codes reach the phone unchanged, and a failed
removal shows its message on the phone instead of only a haptic.
Removals that don't ask for the destroy (older phones, the CLI, other
clients) keep today's behavior. No CLI API changes.
Based on #39235 by jutaz, a port of #28435.
Co-authored-by: Justas Brazauskas <brazauskasjustas@gmail.com>
* refactor: move atomic publication to its filesystem owner
* refactor: group shared browser definitions by feature
* refactor: bind proxy process and session contracts to defining owners
* refactor: consolidate direct session contract type imports
* refactor: retain atomic publication test timing under moved owner
* fix(benchmark): resolve historical tunnel framing source before loading
* feat(mobile): cancel dictation in place and show which device is transcribing
* fix(mobile): give each composer its own dictation cancel target
* fix(mobile): keep the dictating composer row on one line
* refactor(mobile): share the dictation mic face and measure the cancel target per platform
* feat(dictation): remove filler words from text the phone recognizes itself
Phones that dictate with their own recognizer (Automatic or This phone)
never send text through the computer, so its filler pass never saw it.
The page's on-device speech adapter now runs the same shared text
pipeline on the phone's live and final text, in the language of the
locale the recognizer started in, and honours the computer's Remove
Filler Words switch, which the host now reports in its dictation setup.
An older host that doesn't report it leaves the switch on, its default.
* test(mobile): expect both commas to go around a mid-sentence filler on the phone too
* feat(mobile): show folder workspace Source Control on the phone
A folder workspace now has Source Control on the phone: one row per attached
worktree (repo, name, branch, ahead/behind, change count), read from the host
list's own lineage projection and each worktree's git.status. Tapping a row
opens that worktree's existing Source Control in place; Back returns to the list.
* fix(mobile): folder Source Control routing, back, hidden reads and failure states
- A desktop worktree under a server's folder is listed and opens with desktop routing and gates.
- A child opened in the dock gets Back to the folder list beside Close.
- Rows and the catalog stop reading while the screen is covered, as the single-worktree screen does.
- Offline, failed and missing-folder states; rows whose status can't be read say Unavailable.
- Server rows poll like the host list; branch shown without refs/heads/.
- Perf contract: git.status reads per signal at N and 10N rows.
* perf(mobile): folder Source Control reads summaries and rebuilds only on lineage changes
- Rows read a status summary without per-file line stats; relayed servers' rows open no desktop event stream.
- Membership resolves over a projection of lineage and label fields, so agent and terminal churn rebuilds nothing.
- A row whose re-read failed or whose host reported readError shows Unavailable.
- A connection still coming up shows loading, not offline.
- Perf contracts at N/10N rows and H/10H catalog rows.
* perf(mobile): folder membership keys on lineage only; child status reads update the folder list
Membership resolves again only when a row's lineage fields change, keying
only rows the catalog replaced; labels come from the current rows. A child
Source Control's newer status read is handed to the folder list's summary,
so Back shows what an action did without another read.
* fix(mobile): folder summary takes child reads as they land and ignores server health
Membership depends only on each relayed server's installation, so health
and relay flips no longer resolve the folder again. A child Source
Control hands each status read to the folder summary as it is accepted,
so a summary read answering just after can't hide it, and an older read
never replaces a newer summary failure.
* fix(mobile): folder summary skips restored and cached reads that could undo newer ones
Persisted status is marked restored before anyone hears of it, so a
child screen never hands an earlier launch's status to the folder list.
A cached read caught up on opening writes only an idle summary and never
cancels one in flight. Perf contracts count real lineage serializations,
committed row renders and summary publications.
* fix(mobile): clear the restored mark on any answer but the restore's own
A live answer timed before the stored record, as after a clock
correction, is still this launch's, so its reads and the folder summary
treat it as confirmed.
* fix(mobile): the restore's own write skips clearing its mark only once
A listener replacing restored data as it hears of it writes this
launch's answer, so the mark clears for it too.
* test(mobile): type folder Source Control test fixtures without assertions
* test(mobile): name mocked modules with type-only namespace imports
* feat(mobile): show folder worktrees as cards on the sheet surface
Each attached worktree is its own grouped card on the grey sheet
surface, the look the phone's option sheets use, so rows read apart
from the page.
* fix(mobile): keep folder Source Control's states on the card surface
Loading, empty, error and the list now share the sheet surface, so the
screen no longer changes background between states.
Review rebuilt only when a git.status read changed, so a base move that left this worktree's status as it was kept the old compare (also cached 30 s). The compare entries now take git.status's gitStatusChanged signal. A status read that lands after the signal marked the shown compare rebuilds Review without re-keying worktree diffs, and a compare read that lands marked is read again.
* fix(mobile): paint host labels and relay server rows from the phone's store on relaunch
* refactor(mobile): reuse the SSH target summary schema for stored host labels
* perf(mobile): answer a page's ready that arrived before its bridge host
A page's ready can reach the shell before the screen has built its bridge
host (the host waits on the client and the host profile read). It used to
be dropped, so init waited for the page's next retry, up to 2 s later.
Keep the latest ready per session and answer it once the host exists.
* perf(mobile): keep one prewarmed page document while Home is shown
While native Home is on screen, boot one page document for the most
recently connected host with a cached build, parked invisibly in the
window. Opening a page from that build adopts it instead of building a
WebView, which removes the WebView start and script parse from the tap.
The spare is dropped when Home is left without a claim (2 s grace), on
background, memory pressure, its own failure and before the cache deletes
its files. It is never kept beside a shown page, and only phones with
more than 3 GiB of RAM (4 GB phones) get one. A parked page is told to
stop asking for init; the adopting view answers the ready it sent.
Builds on Jinwoo's spare pool and replay work in #32203 and #32204.
Co-authored-by: Jinwoo-H <73622457+Jinwoo-H@users.noreply.github.com>
* fix(mobile): unregister the shell's memory callbacks from the context that registered them
---------
Co-authored-by: Jinwoo-H <73622457+Jinwoo-H@users.noreply.github.com>
The native shell view now hosts a MobileWebShellDocument that owns the
WebView, its scheme handler or request intercept, the network block, the
bridge and the navigation policy. The view keeps layout, the back-edge
swipe and its React events. Nothing changes for a page; this is the seam
a prewarmed spare page needs.
Based on Jinwoo's page split in #32202.
Co-authored-by: Jinwoo-H <73622457+Jinwoo-H@users.noreply.github.com>
The host stops the old agent (about 0.6 s for Claude, up to 3 s with slow
MCP servers) before it writes the divider, so the old transcript lingered.
Linear: STA-14361
* Keep inherited fork actions with the original chat
* Keep fork boundary tests aligned with inherited actions
* Keep inherited fork actions with their original chat
* Keep fork refusal tests within their typecheck projects
* Allow phone forks for supported agents beyond Claude and Codex
* Gate inherited tip forks on host original-chat support
* Require current host proof for inherited fork offers
* Bind inherited fork actions to the current host runtime
* Keep unsent browser forks definitive and offer accurate retry guidance
* Offer copied tip forks only at the fork point and name their source
* Offer forks on all completed copied replies
* Explain which original response can be forked
* perf(session-history): answer Workspace and Project from their own sessions
Workspace and Project send scopeOnly. The scanner then skips listing and parsing cwd-bucket agents (Claude, Pi, CodeBuddy) outside the scope, keeps the recency pass for the other agents but returns only its in-scope rows, and checks name-matched Claude buckets file by file when their newest transcripts name no in-scope cwd. The tab move lookup and All keep the full scan.
* test(session-history): pin that scope-only drops out-of-scope recency rows
* fix(session-history): keep every row main shows when scope-only skips bucket agents
Parse the whole recency window and keep all of its in-scope rows, bound unverified bucket files apart from confirmed ones and let their parse decide, and keep a scope's rows on screen across a depth change.
* fix(session-history): keep Pi listed for scope-only and let scoped rows stand in across scopes
OMP shares Pi's folder under PI_CODING_AGENT_DIR and Pi's listing decides which files OMP parses, so scope-only keeps listing Pi. Workspace and Project rows now stand in for any scope but All, since the renderer filter narrows them.
* fix(session-history): serve scope-only from a cached full list and NFC-fold bucket names
All and Project send the same paths, so a cached All list answers Project without a rescan. Bucket names and scope prefixes are compared NFC-folded, since CodeBuddy and Pi keep the cwd's own Unicode form.
* fix(session-history): match NFD-named buckets by encoding both Unicode forms
Claude replaces each non-alphanumeric code unit with a dash, so normalizing an encoded name can't recover an NFD cwd. Encode the NFD spelling of each scope path too, and drop the post-encoding NFC fold.
* refactor(session-history): build the scope matcher only for scope-only scans and tighten comments
Kelvin Amoabaandzhangxaochen
OrcaWinandOrcaWin
NeilandJustas Brazauskas
Jinjing