* fix(vm-recipes): hide an in-progress VM checkout in every window, the phone and the jump palette
A VM create's checkout was hidden only in the sidebar of the window that
started the create. Windows now publish their pending VM checkouts to the
main process, which shares every window's set with all windows and
filters the paired phone's host workspace list and workspace context.
The jump palette and the sidebar read the shared set, and a grouped VM
project no longer draws an empty-project placeholder while its create
is pending. A window's set is dropped when it closes, crashes or reloads.
* test(project-groups): reset leaked runtime environment revisions between files
A recipe VM create registers the VM's project before its environment
checks run, so the VM's primary checkout showed as a normal workspace
next to the pending row while the checks ran or were paused on a
failure. Hide that checkout in both sidebar list models until the
create adopts it (or makes its worktree). A cancelled or failed create
keeps it hidden while its VM is cleaned up; a VM that could not be
cleaned up is shown again so it can be removed.
* refactor: group agent launch, status, and messaging owners
* refactor: consolidate direct owner imports
* refactor: import pane ownership directly in status listeners
* test(e2e): give the provisioned-root VM a reachable git remote
VM creates now run the environment checks before creating the workspace
(#40152). The fixture VM's origin pointed at a GitHub URL it cannot push
to, so the git push check failed and the create paused on the build
sheet; the spec then read the VM's primary checkout before it was
adopted. Point the VM checkout at a local bare repo so the checks pass.
* test(e2e): wait for the provisioned root's adoption, not its listing
The VM's primary checkout appears under its branch name once its project
is set up, before the environment checks finish and adoption writes
ephemeralVmCheckoutMode. Poll for the adopted row instead.
* test(vm): pin file saves in a recipe-created Orca server workspace (#11762)
* test(vm): wait for the save round trip, let the app reconnect itself, edit a plain-text file
* test(vm): say why the recipe save spec needs a longer timeout
* refactor: group renderer workspace ownership and navigation
* refactor: use the defining WSL rewrite store identifier
* refactor: route new upstream consumers to workspace owners
* refactor: consolidate connection owner test imports
* refactor: preserve upstream review-owner test retirement
* refactor: move atomic publication to its filesystem owner
* refactor: group shared browser definitions by feature
* refactor: bind proxy process and session contracts to defining owners
* refactor: consolidate direct session contract type imports
* refactor: retain atomic publication test timing under moved owner
* fix(benchmark): resolve historical tunnel framing source before loading
* feat(setup): slim the setup-script prompt and make long imported scripts collapsible
* fix(setup): require the full imported script on screen before saving
* style(setup): use the ghost button colour for the script toggle
* style(setup): keep the source path readable in the narrow prompt card
* feat(setup): title imports, restore the package-manager card, keep the review dialog inside the viewport
* fix(setup): count every script line, keep the e2e import spec in step with the new copy
The active terminal refits a frame after the browser splits mount and can
refocus xterm after the spec focused the Reload button, so Ctrl+C reached
the shell instead of arming grab. Refocus until the toolbar keeps focus.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor: use concrete browser and input owners
* refactor: bind remote runtime callers to concrete transport owners
* Use checked subscription mock argument types
* Type browser lease mock with its subscription contract
* refactor: bind sleeping VM status probe test to socket owner
* fix(sidebar): let the divider resize instead of scrolling the workspace list
The 4px scrollbar strip past the seam covered the visible divider pixel, so
grabbing the divider over a scrolling list dragged the scrollbar. Drop the
strip and start the resize handle on the divider; the native scrollbar inside
the sidebar is unchanged.
* fix(sidebar): trim the resize handle's outer reach by 1px
* fix(browser): show site favicons on remote host browser tabs
Host-run browser tabs mirrored to a paired client always showed the
globe: the host's session-tab snapshot carried no favicon. Hosts now
publish the active page's icon URL as an optional faviconUrl, capped at
2 KB and dropped when it points at the host's loopback. Headless hosts
pick it up from page-favicon-updated and publish only when it changes;
desktop hosts include it in the existing graph-sync key. Clients keep
their current icon when an older host omits the field.
* fix(browser): publish a remote tab icon on arrival, not on every swap
Read the headless favicon through the agent browser bridge so the
runtime stays free of Electron imports, publish only when a page gains
an icon so animated icons ride later publishes, and drop IPv4-mapped
loopback icon hosts.
* fix(browser): clear a remote tab icon when a cross-origin load starts
A load that fails on the new origin never commits, so clearing only on
did-navigate kept the old site's icon beside the failed URL. Also give
the runtime tests' bridge fakes the new favicon getter.
* test: give the session-tab bridge fakes the favicon getter
* refactor: organize browser guest lifecycle owners
* test: resolve cross-version client owners and pre-ticket baseline
* test: record the released terminal registry path
* fix(runtime): keep a restored tab selected after orca serve restarts
Since #38844 a cold rebuild restores the saved tab groups, and a saved
group's null active tab was kept as an explicit "nothing selected". A
headless server never saves its own selection, so after a restart its
workspaces listed every terminal with none selected. Saved groups now
only declare a null selection when the session also saved an active
group; otherwise the restored tab stays selected, as before.
* test(e2e): bring layout-compat and paired-client specs up to current behavior
- old-phone baseline: phone snapshots carry tabGroupLayout since #38844.
- tab composition: drop onto where the active tab sits once a drag
undocks it; create the server-placed browser page on the server, since
a phone's create through the desktop is desktop-hosted (#37705); the
desktop serves its phone the server page it mirrors (#36447).
- project removal: retry the host's "can't answer yet" terminal list and
wait for a terminal whose shell has spawned.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
When dom-ready fired while webview.getWebContentsId() threw, the
registration callback bailed out on the ownership fence (ownsGuest(null)
is always false), so validateAfterResume never ran and the page stayed
unregistered until some unrelated caller happened to read the ID. Fence an
unidentified guest by webview ownership only, so validation retries until
the ID reads.
The recovery spec's registered-page oracle now ignores tab list rows with
loaded: false: since #35563 tab list also reports tab-bar pages that have
no registered guest, so unregistered pages no longer drop out of it.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
- setup-script-import: imported setups are saved from the Review setup
script dialog since #37937.
- github-url-smart-input-transition: the GitLab source lists through
gitlab:listWorkItems since #32005, so stub that channel.
- structured-chat-tabs-open-close: the Claude catalog probe also sends an
initialize request for sign-in discovery since #37191.
- golden-core-flows: onboarding launches the chosen agent in the fresh ~
workspace (#37898), whose first launch asks the per-repo agent folder
trust question (#38946); answer it before adding a project.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
- profile-state restart: runNow now returns the saved pending row (#38217)
- codex account switch: click the backdrop clear of the sidebar seam strip (#38288)
- claude sidebar agent view: drop the removed subagent indicator check (#34558)
- IME preedit continuity: refit after changing the font, like font zoom
- agent send picker: bind local fixture panes to a live PTY so reattach keeps them
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor(main): organize SSH transport and managed server owners
* Remove orphan deploy readiness fixture and shrink test baselines
* refactor(wsl): import lock records from their defining owner
* refactor(wsl): use the canonical deferred update contract
* refactor(mobile): give relay and encryption concrete owners
* refactor(mobile): organize session and review feature owners
* refactor(mobile): organize RPC and host ownership
* test(mobile): point render fixtures at concrete owners
* refactor(mobile): use explicit type-only owner imports
* refactor: import journal queue state from defining owners
* refactor(shared): organize execution and automation owners
* fix: retain type imports used by surviving test cases
* refactor: finish work item owners and refresh validation metadata
* test: infer reconnect status fixture type
* test(claude): resolve source files beside same-named directories
* test(runtime): group repository creation mock registrations
* chore(lint): bump oxlint to 1.91, add perf lint rules and perf audits
* fix(lint): await promises returned inside try/catch/finally for return-await
Prepare typescript/return-await with error-handling-correctness-only: await
returns whose catch or finally was meant to cover them, and suppress the eight
sites where the catch must not re-handle the returned promise.
* chore(lint): enable return-await (error-handling-correctness-only); exempt secondary-scan directives in the changed gate
* refactor(mobile): move file preview discard modal into its own module
Keeps MobileFilePreviewScreen under the 400-line limit after merging main.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* feat(cli): one enclosing-workspace rule, --environment local, and copyable workspace addresses
current/active and cwd inference now pick the innermost workspace of either kind (worktree or
folder workspace); at equal depth the caller terminal's own workspace wins, otherwise the choice
is refused as ambiguous. --environment local names this machine's own Orca over an ambient
ORCA_ENVIRONMENT or pairing code. worktree ps/show/current print an environment: line and an
address: line (JSON environment, address, addressUnavailable, parent) that always carries its
--environment, and name a parent's environment only when it is verified.
* test: answer the folder catalog read in agent launch cwd tests
* feat(cli): worktree rm refuses current/active and names the selector to pass
Removal needs an explicit workspace, as git worktree remove needs a path. The refusal runs before
rm decides between a worktree and a folder workspace, and reports what current resolves to now
(one selector, the ambiguous choices, or none) in text and as invalid_argument data.
* fix(cli): keep the remote-environment guidance when rm refuses current
* fix(cli): surface folder-catalog failures for omitted targets; no address for a duplicated folder parent
* fix(cli): surface a worktree-list failure for omitted browser and terminal targets too
* test(cli): folder rm refuses current/active before the folder removal path
* fix(cli): refuse a cwd owner whose folder host can't be derived instead of skipping it
* fix(cli): compare cwd owners by filesystem identity, refuse every equal-path tie, surface worktree-list failures
Paths on the caller's own filesystem compare by realpath (reusing resolveRealPathSync), so /tmp
and /private/tmp aliases find the deeper owner in both the folder prefilter and ranking; other
hosts' paths stay lexical. Equal-depth owners with different repo registrations now refuse without
a caller instead of picking by catalog order. An omitted target no longer swallows worktree.list
method_not_found; only the optional folder reads fall back.
* fix(cli): read the realpath helper from shared so the packaged CLI ships it
* refactor(cli): move the catalog row type and unresolved-owner refusal out of the selection/catalog cycle
* fix(cli): resolve every caller-filesystem workspace path, not only basename matches
A workspace registered through a differently named symlink was skipped by the basename gate.
Containment now realpaths cwd and each row on the caller's own filesystem once per command,
shared by the folder prefilter and ranking; folder hosts are derived first so another host's
paths are never resolved locally.
* test: answer the folder catalog read in the ambiguous orchestration-check caller test
* feat(cli): --parent-environment names where a worktree's parent lives
worktree create and worktree set take --parent-environment <local|saved id|name>
next to --parent-worktree. The parent is resolved in that environment only, and
sent to the child as a verified cross-store ref after the child's cross-machine
capability check. Without the flag, the parent stays in the child's environment;
active/current always mean this machine's own Orca.
Preflight failures happen before any change: environment_not_paired,
environment_unavailable, LINEAGE_PARENT_NOT_FOUND / LINEAGE_PARENT_AMBIGUOUS
naming the searched environment, and incompatible_runtime with data.environment
and data.requires.
* fix(cli): parent lookup errors name and list the environment searched
LINEAGE_PARENT_AMBIGUOUS and LINEAGE_PARENT_NOT_FOUND now always carry
data.environment and a listing command for the environment the parent was
looked up in, for parents in another environment and in the child's own. Steps
inherited from the runtime listed the caller's default route instead.
* docs(cli): a local address names the Orca that printed it
* refactor(main): organize runtime implementation owners
* test: retire wall-clock CLI title recovery case
* refactor: route new folder mutation to runtime store owner
* test: import folder mutation store contract from its owner
* fix(mobile): re-subscribe Home and the follow-up preference after the client event stream ends
* fix(mobile): try a refused client event wire once per connected edge
* refactor(mobile): mark replayed client event readies in the shared stream
* test(e2e): give the phone feed socket client a state listener
A Smart-sort save rewrote every listed worktree's rank whenever the order
changed, so every repository on the host got an order-only
worktreesChanged event. planWorktreeSortOrderUpdates now keeps the
longest run of rows whose ranks already descend in the requested order
and re-ranks only the rest. It falls back to the full re-rank when a gap
is too tight for distinct whole ranks, or when the planned ranks would
not descend strictly (float rounding at huge ranks).
When the requested order holds a row the write cannot save (WSL-move
fenced or unknown host), the write keeps the full re-rank, since that
row's unqualified rank may belong to a same-ID twin and must never
anchor a partial re-rank.
Replaces #37142.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: BTForIT <223167996+BTForIT@users.noreply.github.com>
* feat(cli): match folder workspaces by path: and name:, and keep same-id ps rows apart
Adds one runtime matcher for worktrees and folder workspaces. With the new
matchFolderWorkspaces opt-in (advertised as workspace-selector.folder-match.v1),
path: and name: also match folder workspaces; branch:, issue: and identity:
stay repo-backed. Several matches refuse with each choice's kind, host, path
and selector; a folder id shared by two folder workspaces refuses with the
repair step. The CLI resolves path:/name: through it, so terminal, file and
ports commands reach a folder workspace, and create/set parents record a
folder parent. Explicit ambiguous parents report LINEAGE_PARENT_AMBIGUOUS.
worktree ps now keeps rows that share an id on different hosts apart, with
their own host, identity, metadata and activity; activity whose host can't
be proven attaches to neither.
* test: let the cross-version ps harness pass the host-qualified summary lookup
* fix(cli): read each ps row's own host session; qualify folder selector help
* fix(runtime): refuse unscoped duplicate folder ids; hand lineage the matcher's typed result
Unscoped folder:<id> refuses a duplicated id even when only one copy's host
is derivable; a host-scoped lookup still picks that host's copy. A wsl: hook
stamp counts as local host evidence. The lineage controller receives the
worktree-or-folder candidate directly instead of re-deriving the kind.
* docs(cli): guide the ambiguity fallback through truncated ps and id: selectors
* fix(cli): report an ambiguous parent by its own choices; cover per-host sessions
* fix(cli): send parents to the runtime parent resolver as typed; translate WSL paths for folders too
Parent selectors skip the CLI's show-based folder lookup, so worktree.create
and worktree.set classify them with parent rules: a folder spanning hosts is
a valid parent, and ambiguity reports LINEAGE_PARENT_AMBIGUOUS. Caller-distro
Linux path translation now also matches folder workspaces.
* chore(rpc): import the computer-use recovery data directly instead of through an alias
* fix(runtime): report a missing set parent as LINEAGE_PARENT_NOT_FOUND, as create does
worktree set and worktree create now share one explicit-parent error
conversion: several matches give LINEAGE_PARENT_AMBIGUOUS and none give
LINEAGE_PARENT_NOT_FOUND, so a missing parent is no longer reported as a
bare selector_not_found that could mean the child.
* feat(claude): sync the terminal theme into Claude Code
* fix(claude): retry missed theme reloads, keep settings key order, search entry
* fix(claude): persist theme ownership before settings writes, skip deliberate themes, restore only on toggle
* fix(claude): gate theme sync on Claude Code 2.1.119, follow Orca's Claude config dirs, keep restores owed
* refactor(theme): point markdown Monaco rules at the shared contrast helpers
* fix(claude): lock theme ownership edits across Orca processes, retry missed theme reloads with backoff
* test(e2e): opt-in real Claude Code theme sync journey; retry theme reloads for up to five minutes
* fix(claude): keep theme takeover recoverable when settings writes or the lock fail; steadier e2e journey
* fix(claude): serialize theme publication with takeover and restore, per-file reload retries; record the real-Claude e2e in the isolated home
* fix(claude): retry an owed restore publish, stop off-state retries, reread settings right before writing
* fix(claude): republish theme files under the cross-process lock
* refactor(theme): point chat selection contrast at the shared helpers
* feat(claude): default theme sync on for new profiles; offer it once to existing users at their next Claude launch
* fix(claude): offer theme sync to every existing profile, confirm only after the save, honest offer copy
* fix(claude): right-align the theme sync offer's two actions, primary last
RpcDispatcher now requires its method list, so these suites can no longer consume
the default manifest. Suites that still reach the registry through the RPC server
keep the guard.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Keep default underline and strikeout colors visible while hiding block font glyphs, including link-hover shorthand resets. Restore only owned decoration overrides and preserve explicit colors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: report agent launch failures once with actionable recovery
* fix: keep terminal launch controls shown but waiting while the host connects
Replace per-row pending metadata with one derived terminal-readiness flag on
the agent menu model, kept out of picker identity keys. Terminal buttons and
rows stay mounted and disabled while SSH or a paired server is still
connecting; chat and Configure stay usable, and the terminal default is not
changed. Repo targets with no workspace yet read the repo host's facts.
Invalid Source Control arguments keep their existing actionable message.
* fix: keep launch readiness and failure ownership consistent across pickers and fallbacks
A host that is still connecting now declines a terminal launch silently at the
launcher, including shortcuts and fallbacks, instead of reporting a failure.
A terminal fallback refused behind a visible chat reports through that chat's
notice rather than a second toast. The agent picker stays usable while only a
terminal waits; an armed terminal rechecks readiness on Enter; a configured
chat option no longer inherits the terminal's waiting state; waiting terminal
controls say why. Invalid CLI arguments name the actual problem for every
caller, the no-agent shortcut message is restored, and prospective repo
readiness no longer rescans repos on unrelated store writes.
* fix: keep the handoff dialog open when a host-waiting launch opens nothing
A session continuation launched through the host's admission now waits for
that launch to settle before reporting the handoff. When the host declines the
chat and its terminal fallback is declined while the host is still connecting,
nothing opens, so the dialog stays open for a retry instead of closing with no
session and no message.
* fix: let the handoff dialog close while its session is starting
Cancel, Escape and outside clicks now close the Hand Off dialog even while a
start is in flight; Start stays disabled with its spinner. Closing aborts agent
detection if it is still running, and a dialog closed during detection starts
nothing. A launch already sent settles on its own and reports through its
existing owners. The in-flight start belongs to the request it was made for, so
a late finish never closes, completes or blocks a dialog reopened since.
* test: replace type assertions in launch refusal tests with typed fixtures
* refactor: name the setup panel's launch helper launchSurface
* perf: resolve a picker's terminal host only when ownership changes
The terminal readiness check rebuilt the target's ownership chain and ran
the full OS resolver on every store write, for every mounted picker. Each
picker now keeps its target host and re-resolves it only when an ownership
slice changes; other writes read just that host's connection and contact
facts. Local hosts read nothing. The launcher's own pending decline uses
the same host pieces from execution-host-facts, so the rule has one copy.
* perf: word a declined chat's fallback failure without re-saving launches
Wording the failed chat's notice after its terminal fallback was refused
re-saved every retained launch record, though the wording itself is never
saved. Listeners now hear about it without a save; lifecycle changes still
save. The refused-fallback test moves to its own file and counts saves at
two sizes.
* test: narrow refused launch outcomes where tests read the opened tab
launchAgentInNewTab now returns a refusal instead of a tab when the
launcher declines, so tests that read the opened tab's surface or
completion narrow it first. Fixes the web typecheck.
* fix: keep Configure usable and show one reason on a waiting agent row
While the host connected, each New Chat agent row was marked
aria-disabled, so its Configure button read as disabled to assistive
tech and keyboard. The row now only blocks its launch and points to its
"Connecting…" reason. A row shows one reason, the one that stops its
launch now, and the agent name keeps its width so it is not cut to a
single letter.
* test: cover distinct repo targets and host freshness in the picker perf contract
Pickers for workspaces not created yet now count repo reads cold and after
another host's row is republished, at two scales with a repeated-target
control, and assert no unaffected renders. Two freshness controls follow
the cached host: an owner moving from local to a connecting SSH host and
back, and a paired server that is still checking versus verified with its
OS.
* fix: mark a waiting agent launch unavailable while Configure and chat stay usable
An agent row's launch item also held its Configure button (New Chat) or
its start-in-chat button (the + menu). Disabling the row while the host
connected disabled those too; leaving it enabled made the waiting launch
read as available and then do nothing.
The launch item and those controls are now siblings. While the host
connects the launch item is marked unavailable, dimmed and described
"Connecting…", and stays focusable so arrow keys still reach the
controls beside it. Configure and chat keep their own state. A chat
started from Configure or the chat button goes through the row's guarded
launch and closes the menu, without choosing the waiting item.
* fix: release the agent row button's press listeners when a press is cancelled
Each press on the button beside an agent row added a window listener that
only a pointerup removed, so cancelled touches and closed menus left them
behind. A press now owns one handler that removes both listeners on
release, cancel, the next press or the row closing; drag release onto the
button still chooses it.
* fix: give the agent launch row item its own menu item variant
The launch item beside Configure or the chat button restyled the shared
menu item (transparent focus, dimmed while unavailable), which the design
system gate rejects. That treatment is now the menu item's launch-row
variant; the rendered rows are unchanged.
* fix: route the menu's terminal host by owner and repair the e2e and ja checks
The menu's terminal readiness now reads workspace records through the
workspace record selectors and picks a not-yet-created workspace's repo by
the host it names, without the focused-host fallback; with no host named
it settles only when the id has one row, which reads the same. Its cached
host is re-checked when the settings slice changes instead of reading the
focus setting. E2E unit tests narrow refused launch outcomes, and the two
new ja strings write Agent as the rest of the catalog does.
* test: count a launch as opened only when it returned a surface
A refused launch now returns its refusal instead of null, so the parity
check asks whether a surface opened.
* perf: keep menu readiness on the workspace's owner and index the twin fallback
Terminal readiness re-resolved every mounted menu's host on any settings
write, and an unstamped worktree whose project is listed both here and by
a paired server walked the whole repo catalog to resolve. Readiness now
resolves an existing workspace's host from its resource owner only, never
the focused default a row-less setup terminal is created on, so settings
writes leave it alone. The shared-project check reads that project's rows
from the existing per-snapshot repo index instead of the whole catalog.
Setup terminals and every route keep their behavior.
* test: assert which readiness pickers render on each detected-twin update
The detected-twin perf contract now checks render deltas per update: a
catalog republication renders no picker, and stamping the first workspace
with a checking server, then that server reporting its OS, renders only
that workspace's pickers.
* test: give the structured chat fixture's owner stub the menu's resource host
The fixture replaces the whole worktree owner module with a stub, so the
menu readiness check's new resource-host export was missing and the
picker path threw before launching. The stub now answers both exports
with the scenario's owner host.
* Keep launch failures with one action owner on current menus
* Align Start work regression with its remote launch target
* Narrow refused launch outcomes in current contract tests
* Assert notified refusals in existing launch regressions
* Assert the refused keyboard launch receipt
* Narrow successful web runtime launches in tests
* Keep agent menu labels left aligned
* Keep merged launch reporting within existing checks
* Keep direct launch argument reads within the file limit
* perf(mobile): show the workspace list from memory and refresh it on desktop changes
* fix(mobile): import the host list queries type without an import() annotation
* fix(mobile): keep host labels on a not-connected read and update the phone feed e2e helper
* fix(mobile): keep the event router listening when its stream ends while opening
* fix(mobile): reuse the shared read-view base and remount for the cache-return recording
OrcaWinandOrcaWin
Neil
Kelvin Amoaba
Jinwoo Hong
Jinjing
Brennan Benson