* Bound and sanitize CI failure excerpts with linear ANSI stripping
* Fix excerpt regression checks and reduce bounded marker overhead
* Require signal proof for benchmark timeouts and load consumer fixtures portably
* Validate benchmark timeout framing and run required cases with a pinned CI baseline
* Strip dense generic ANSI escapes with bounded forward scanning
* Use the standard UTF8 encoder for byte-cap test oracles
* Gate CI log performance suites behind a dedicated job
The wall-clock performance suites run about 1k child workloads up to 63 MiB, so they were sharing runners with unit tests and could fail on noise. They now run only in their own `check_log_performance` job, opted in with `ORCA_CHECK_LOG_PERF=1`.
- Remove the pinned-baseline checkout and `ORCA_CHECK_LOG_BASELINE_DIR`. The baseline comparison is now a manual step that reads the pinned ref from local Git history.
- Run the current-implementation checks with `compareBaseline: false`, which skips baseline builds and audits.
* Inline check-log fixture and drop dedicated perf CI job
- Replace the captured failure-log JSON with a synthetic log built by `createCheckLogFixture()`, so no scraped job output or provenance metadata is kept in the repo.
- Remove the `check_log_performance` CI job. The log performance suites now run only when `ORCA_CHECK_LOG_PERF=1` is set, as a manual benchmark.
- Update the benchmark scripts and tests to use the new fixture helper and drop the `fixturePath` parameter.
* feat(checks): add optional job log outcome
* fix(checks): preserve host capture lifetimes and safe outcomes
* fix(checks): retrieve and retry bounded failed-job logs
* test(checks): cover queued snapshots and captured error safety
* test(checks): verify sanitized host excerpts and paired failures
* test(checks): identify measurements and preserve paired cleanup
* Keep check details load failures safe and localized
* Describe failed check logs as bounded excerpt context
* Normalize check log excerpts once at renderer ingress
* feat(checks): add optional job log outcome
* fix(checks): preserve host capture lifetimes and safe outcomes
* fix(checks): retrieve and retry bounded failed-job logs
* test(checks): cover queued snapshots and captured error safety
* test(checks): verify sanitized host excerpts and paired failures
* test(checks): identify measurements and preserve paired cleanup
* Use the generated check-log fixture in host retrieval tests
* Keep check details load failures safe and localized
* Describe failed check logs as bounded excerpt context
* Normalize check log excerpts once at renderer ingress
* Repair ingestion test fixture and benchmark names after dependency merge
* fix(agent-hooks): retained agent exits survive restart, late PID-less hooks, and same-second attaches
- Persist proven exits with the hook store's status file and restore them on hydrate (#29359).
- Clear a retained exit only on evidence of a successor agent: a different process identity
or a new turn/session, never a PID-less late hook from the ended session (#29356).
- Forget a pane's earlier exits when a remote worker attaches, so the attach fence no longer
rounds up and drops exits in the creation second (#29293).
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-hooks): provider-aware successor turns clear a retained exit; older spool replays keep it
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-hooks): another provider reporting clears a retained exit; same-second spool stamps count as successors
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-hooks): judge a successor claim by the sender's own identity
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-hooks): provider switches clear an exit only from hooks; drop pre-exit spool replays
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(ssh): an opted-in desktop serves its browser to a managed SSH host's orca CLI again
* fix(ssh): scope bridged pages through the renderer, render them as desktop pages, and route the e2e
* fix(ssh): bridge refuses file URLs and clipboard reads, revokes on disconnect, closes desktop tabs
* fix(ssh): judge bridged paste chords as the page sees them; accept long workspace ids
* fix(ssh): bridged clipboard denial follows popups; revoked commands never leave the browser queue
* fix(ssh): refuse option-like host values bound for agent-browser argv; report undeliverable results
* fix(ssh): bound bridged error results and fall back when the host refuses one
* fix(ssh): bridge only routed host tabs, and bound bridged page scripts by a deadline and revocation
* fix(ssh): cap waiting bridged commands below the desktop socket's result capacity
* fix(ssh): bridge revokes on routing changes, checks each page's route at run time, and cancels host-driven downloads
* fix(ssh): name the bridge registry's owner type
* fix(ssh): bridge refuses pages showing a local document, and never starts a command past orcad's deadline
* fix(ssh): bridged commands may leave Chromium error pages, and stop starting before orcad's deadline
* fix(ssh): ask for a fresh opt-in to host CLI control saved before it drove the desktop browser
* test(ssh): type the bridge registry deadline test
* fix(agents): stop the wake sweep from forking sessions that live SSH panes still own
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(agents): only treat an ssh-bound leaf as owned while its target is unreachable
A connected target's live-PTY map is authoritative: sleep kills the PTY but keeps
its id. Cross-worktree session dedupe ignores finished and invalid records, the
same records claim-key dedupe skips.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agents): use the tab pty only for a single-leaf layout when judging ssh ownership
In a split tab the tab-level pty can belong to another leaf.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: route wake-sweep fixtures through one checked store setter
* fix(agents): a record whose host moved can't claim a session in the wake sweep
* fix(agents): a cross-workspace claim must name the same machine as the record
* fix(agents): resolve each record's machine from its own catalog or stamp evidence
* fix(agents): judge a cross-workspace claim's host from owner rows, not the focused server
The focus-read ratchet rejects new reads of the routing default; comparing two
records' machines needs only each record's own workspace owner row.
* fix(agents): resolve a folder workspace's host before it can claim a session
---------
Co-authored-by: Robert Nisipeanu <github@nisipeanu.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(ssh): finish the macOS launch-session warning's gaps (#29382)
Check it on automatic restores, once per SSH connection; create the data root
before recording; inherit a session only from this root's verified daemon; and
let only a verified restart clear the warning.
* fix(ssh): recheck the launch session per reconnect generation, after the restore update
* fix(ssh): reapply a known ended session to a replaced status; leave an unreadable daemon's attribution unknown
* fix(ssh): expire live launch-session verdicts, and drop an answer outlived by its connection or server
* [CI] Keep transport-only tests outside the app store graph
* [CI] Advance the updater install clock in failure tests
* [CI] Avoid descriptor formatting in replay clip counts
* [CI] Advance native-chat test observation clocks
* [CI] Restore observation timers after failed test setup
* [CI] Clean up final headless daemons during public close
* [CI] Keep serializer test oracle out of production smoke triggers
* [CI] Keep three unit fixtures out of production smoke triggers
* [CI] Bound frozen-clock close callbacks in tests
* [CI] Avoid the app-store graph in feedback dialog tests
* [CI] Keep hidden popup fixture compositor frames active
* test(ci): reuse mobile runtime fixture for pairing listeners
* test: restore native chat clocks before rig cleanup
getTerminalInteractiveWait read only the line tail, which drops the rows
below the cursor Claude parks inside its dialog, so the query answered
"no wait" while the trust dialog owned the screen. For Claude panes it
now reads the rendered screen (bounded, discarded if newer output or a
pane exit overtakes the read) and lets a dialog seen there stand unless
a newer working or explicit idle signal clears it. Other agents keep the
synchronous path, so concurrent queries still share one hook probe.
Ported from #28187 onto the split runtime modules.
Co-authored-by: JMensch <james@jamesmensch.com>
A sortOrder-only change now bumps a separate sortOrderEpoch. The sidebar sort
recomputes on it only while the active mode ranks by persisted sortOrder (Smart
before a live signal, or Manual), neither of which saves the order, so live
Smart still cannot loop on its own saves.
Fixes#29336
The relay caches one status row per pane, so a hook that lands while the
desktop is away overwrites the PostToolUse that ended the request the
desktop still shows as waiting. On reconnect the desktop gets only the
newer working row and its permission hold keeps the stale wait.
The relay now keeps a bounded list of Claude requests it saw end
(PostToolUse/PostToolUseFailure tool_use_id plus child owner) for the
same launch and session, and sends it beside the replayed row as a new
optional field. The desktop releases a held wait only when a replay
lists that exact request from the same host, launch and session. Older
peers ignore the field and keep today's behaviour.
Validated against hooks captured from a real Claude Code 2.1.301 session.
Part of #28186.
Co-authored-by: JMensch <james@jamesmensch.com>
Detach the page's debugger before destroying its offscreen window, so a live
screencast closes before its in-flight snapshot can call capturePage on the
half-destroyed page (an Electron segfault). Also wait for the paired workspace's
first terminal in the link-routing e2e so its late focus cannot hide the pane.
The desktop keeps the toggle and its dismissed-suggestion flag in its own
profile, but the host read its own copy on create, so local main never
fast-forwarded and the suggestion toast kept returning. Send both with
worktree.create, like nestWorkspaces; older clients keep the host's value.
Fixes STA-6997
* fix(remote): send again a tab close the paired host never received
Closing a paired host's tab prunes the local mirror at once and asks the host
to close it. When the connection dropped mid-close the renderer cleared its
close intent, so the host's next snapshot after reconnect brought the tab
back. A user close that fails without reaching the host is now held: the tab
stays hidden, and the close is sent again when a snapshot proves the host is
reachable and still lists it, up to three times before the tab is shown.
* fix(remote): replay held closes at snapshot receipt, pinned to their pairing
Codex review: an unchanged reconnect snapshot is filtered before apply, so the
replay now fires when any snapshot is received; a replay is refused once the
environment is re-paired; replays survive a subscription reinstall and
re-assert their hide; giving up re-accepts the current snapshot so the tab
actually returns.
* fix(remote): consume held closes only on authoritative snapshots, and unhide evicted ones
Codex review: an unpublished or retired-epoch frame could drop a pending
replay, and an evicted replay kept its tab hidden with nothing left to send.
* fix(remote): keep held closes through incomplete inventories, and re-hide in-flight ones
Codex review: a real-epoch snapshot can omit tabs it is unsure of, so absence
no longer drops a held close; and a snapshot listing a tab whose close is in
flight re-asserts its hide after a subscription reinstall.
* fix(remote): re-list the worktree after a failed close replay
Codex review: subscriptions are change-driven, so an idle worktree might never
publish the snapshot that makes the next attempt due.
* fix(remote): re-list the worktree as soon as a close is held
Codex review: an idle host may publish nothing after a held close, so the first
replay also needs a scheduled re-list.
terminal send/read/wait listed --environment and --pairing-code with no
description, and a paired server's handle sent without --environment failed
as terminal_handle_stale with no hint that a server flag was missing.
Refs STA-6812
Main refuses to remove an SSH host its managed server still holds, so the
host card's Remove confirmed and then showed a raw IPC error. Detect the
managed host before confirming and offer Managed servers, whose Stop and
Forget release the host; strip the IPC wrapper from other removal errors.
* fix(agent-resume): quote resume commands for the remote host's reported OS
A Windows SSH host's resume line was always quoted for POSIX because any
connectionId resolved to linux. Use the platform the host reported, and
honour a remote cmd.exe tab's own shell override.
Fixes STA-3779
* fix(agent-resume): keep WSL quoting on a Windows SSH host; seed host state in quoting tests
* fix(agent-resume): apply reported host OS to SSH hosts only
* fix(agent-resume): read the SSH host's platform from the resolved host id
Keeps the focus-read ratchet flat: no second worktree-routing lookup.
The execution host upgrades a remote worker's fleet/show verdict to exited
only on its own proof: the hook store retains a proven agent exit (fenced to
the attachment, cleared by a replacement agent), and after a reboot the
process table proves the PTY gone. Lost contact stays unverifiable.
Fixes#24353
Co-authored-by: Claude <noreply@anthropic.com>
* fix(terminal): log a failed pane reveal instead of rethrowing it
The bridge already replies false when the reveal throws, so the rethrow only
surfaced as an uncaught renderer error after the caller had its answer.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(terminal): refuse terminal.reveal from paired clients
It moves this host's window. terminal.focus lets a paired client do that only
by asking for host navigation, and the callers this method serves (the CLI and
companion apps on the same machine) never arrive as paired clients.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(terminal): show a paired server's terminal in this desktop on terminal switch
A paired `orca serve` host has no window, so `orca terminal switch --environment <name>`
resolved the handle there, answered `navigated: false`, and the desktop stayed put (#24688).
Add `terminal.reveal`, a desktop runtime method that names a pane by worktree, tab and leaf, as
the owning host knows them, and runs the Agent Dashboard's click-to-focus sequence before raising
the window. When a paired server cannot navigate, `terminal switch` asks the desktop on this
machine to reveal the terminal instead.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(e2e): terminal switch on a paired server moves the desktop on this machine
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: update terminal manifest count after main and assert the revealed pane renders
Main added a terminal method since this branch was cut, so the characterization
count is 39 with terminal.reveal. The e2e now proves the target pane is visible
in the DOM, not only selected in the store.
Co-authored-by: Velm14 <Velm14@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Velm14 <Velm14@users.noreply.github.com>
* perf(ssh): a web-mirror reveal reads its pane alongside the activation, not after it
* fix(ssh): an early pane read never erases an incarnation the activation learned
* fix(mobile): resume Agent Session History rows in an SSH workspace that can read them
* fix(mobile): keep transcript-referencing resumes on the transcript's own host
* fix(web): mount offline and reload when the paired host is unreachable at startup
* fix(web): treat a socket interrupted during startup as an unreachable host
* fix(web): tie the reload-on-reconnect to its startup pass
* fix(serve): give each Linux account its own Xvfb display instead of sharing :99
* fix(serve): require the spawned Xvfb to be alive before using its display
* feat(layout): add the dark layout.apply channel and route pane splits through main behind ORCA_LAYOUT_OWNER
A build made with ORCA_LAYOUT_OWNER=main registers layout.apply: main applies the
window's layout command to the stored partition through the shared applyLayoutCommand,
minting new ids. A user split then waits for main's answer and mounts the pane id main
minted. Every other build substitutes 'window', so neither branch is compiled in.
* fix(layout): write only the records a layout.apply command touched
A load-then-save rewrite also normalizes records the command never touched. The command's
effect is now the diff between the save before and after it, written onto the stored
partition record by record. A split whose main reply says a paired server holds the tab
splits as today.
* fix(layout): write a load-supplied record whole and check that patched partitions reload to the command's result
* feat(layout): close, rename and equalize panes through main behind ORCA_LAYOUT_OWNER
In a layout-owner build the window's pane close, title change and equalize go through
layout.apply and the window shows main's answer. A window pane close keeps the legacy
close's rules: the tab's last pane is refused, a pane restarted since main read the close is
left alone, every partition holding the tab closes it, and the tab's remote session id follows
the remaining pane. The rules sit behind a command field only layout.apply sets.
* fix(layout): close the tab when a racing pane close leaves the window one pane
* fix(layout): leave an unmounted tab alone when main refuses its last pane
* feat(layout): move panes and save divider ratios through main behind ORCA_LAYOUT_OWNER
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* test(layout): a taken pane drop whose pane closed does nothing
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* test(layout): pin the window's pane move to main's saved tree, and the drops main cannot take
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* fix(layout): close a user's pane even if its terminal restarted, as today
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* test(layout): pin the restarted-pane close directly, not through a made-up profile state
Claude-Session: 10569c9a-a0a1-4fc9-8469-0edfb7aed125
* fix(layout): leave a split to today's path only when the workspace's row names a paired server
The split switch point asked which host to route to with a helper that falls back to the focused
server, so a focused server could claim a workspace whose row names no owner. Use the same owner
test the tab mirror uses.
* test(layout): type the split owner mock without a cast
* test(layout): type the layout-owner command mocks with the real signature
* test(layout): type the gesture command mock with the real signature
* fix(layout): close the dark path's gaps: unmounted split panes, refused or failed splits and moves, ratios during a move, release guard
- A pane main saved but the window could not mount (source pane or manager gone during the await)
is closed again in main, so it does not come back on restart.
- A split main refuses because its copy lacks the workspace, tab or pane, or a failed call, splits
as today; a refused or failed move moves as today.
- Divider ratios committed while a move is in flight wait for the window's move, then go to main.
- The orcad bundle gets the ORCA_LAYOUT_OWNER define when the switch is on.
- Packaging and the orcad template refuse ORCA_LAYOUT_OWNER=main and any output a dark build marked.
- workspace-layout-record-patch.ts: no non-null assertions; plain comment for the map depth.
* test(layout): count a split pane as mounted from the split mock's own results
* fix(layout): act as today whenever main lacks the target or the call throws, not just for splits
- sendPaneCommandToLayoutOwner runs asToday for workspace/tab/pane_not_found and a thrown call, so
close, rename and equalize fall back like split and move; a handler that throws no longer runs the
fallback too.
- A close main refuses as its last pane, while this window still has others, closes as today.
- A move whose local step throws still releases held divider ratios.
- Drop the orcad output marker: nothing read it; the template build refuses the switch itself.
* test(layout): plain names for the last-pane fallback test and the marker comment
* docs(layout): say plainly what an indeterminate write can leave behind
* fix(layout): finish the main merge with this branch's versions of the layout-owner files
* test(build): copy the layout-owner build guard into the compiler-cache checkout fixture
* fix(layout): write a folded legacy row in its loaded form when a layout.apply command touches its claim
A legacy terminal row the load folds into a tab-bar tab stays stored as is. Closing the tab it
repeats, or giving it a tab-bar entry by moving it, let the next load resolve the claim the other
way: the row came back or took the other tab's terminal. Such a command now writes the row as
the load had it; every other record still stays as stored.
* feat(layout): accept tab moves, group splits and group sizes on layout.apply
Group sizes have no tab, so they go to the workspace's routed partition.
* refactor(layout): move the window's layout.apply sender out of the terminal pane folder
Tab groups send through it too; it now also acts as today when main lacks the group.
* feat(layout): reorder, move and split tab groups, and save group sizes, through main behind ORCA_LAYOUT_OWNER
A tab drop and Move Tab to Split wait for main's answer and then show main's placement, with main's
new group id; group divider sizes are drawn while dragging and saved by main when the drag ends.
Closing an empty group needs no command: main never holds an empty group.
* fix(layout): review fixes for tab moves through main
- Read a folded row's terminals with the loader's own claim rule, so rows sharing only an SSH
session are covered too, and drop the row's remote session entry with it.
- The record-patch test allows a folded row only in its loaded form.
- A tab drag ends at once; main's answer shows the move after.
- A lone group main moved whole is placed so only when this window's group is lone too.
* refactor(layout): adopt only a folded row's pane layout beside its row
A row's remote session entry is carried through load and save unchanged, so adopting it from the
load changed nothing (the earlier commit's message overstated it).
* feat(layout): record a window's terminal tab close through layout.apply
closeTabs can now record each terminal tab it closes, or does not find, as closed for the given
reason (pruned as a partition's records are), so a start that commits later is refused, as today's
close records it. layout.apply takes one tab's close with the window's reason: main forces it in
every holder partition, marks a user close's launches, stops no terminal (the window already did,
sparing any another tab shares), and leaves a workspace it lacks to today's close. A sibling the
load supplied that the close only renumbered is no longer written.
* feat(layout): send the window's terminal tab close to main behind ORCA_LAYOUT_OWNER
The window still closes the tab and stops its terminals itself; main records the close through
layout.apply instead of the close intent, which stays for paired servers and when main lacks the
workspace.
* fix(layout): review fixes for the tab close through main
- The window's close sends through a store-free sender, so the store no longer imports itself.
- Main marks a user close's launches by the terminal's own id.
- A recorded close prunes the whole partition's close records, as today, not one workspace's.
* fix(worktrees): drop sleeping-agent records of removed worktrees
A sleeping-agent record can outlive its tab. The bulk purge matched
records only by the pane key's tab, so such a record survived, was
persisted, and drew a sidebar row for the deleted worktree until the
runtime host connected. The single removal path also awaits after
terminal shutdown clears the records, leaving a window where a
provider-session event routed by worktree id writes one back.
Drop records (and their launch configs) by record.worktreeId in both
paths.
* test(worktrees): type the sleeping-record fixtures instead of casting
---------
Co-authored-by: Nawapat Buakoet <nawapat.b@covest.finance>
* fix(remote-runtime): probe sockets and reset backoff on wake, and keep late resubscribes revivable
Rebuilt from #23359 on current main. On OS resume or network return every
remote-runtime socket pings once and is replaced if it stays silent for 8 s,
the shared-control retry ladder restarts from its short delays, and a
resubscribe that fails or opens after the pane's recovery window latched is
parked so resume/online can revive it.
Co-authored-by: Meapri <104259736+Meapri@users.noreply.github.com>
* fix(remote-terminal): revive a latched remote pane when its host answers again
A pane whose ~3 min auto-recovery window ran out only came back on an OS
online/resume event or a Reconnect click. A Tailscale or VPN route that
returns fires neither, so the pane stayed dead over a working link even
though the host shell was alive. The environment's shared control socket
reaching ready again is now the revive signal: the pane advances its backoff
or replays its attach, exactly as Reconnect does.
Adds e2e repros for paired runtimes and managed SSH hosts: 30 s silent and
reset outages, and a silent outage longer than the recovery window.
* fix(remote-terminal): hold the control-ready reviver only while a pane is recovering
* fix(remote-runtime): re-probe a wake check whose deadline fired late, and trim the SSH outage spec
---------
Co-authored-by: Meapri <104259736+Meapri@users.noreply.github.com>
* fix(native-chat): refuse to start or send on a host that ignores Ask for approval
* fix(native-chat): hide Continue on a host held for its permission mode
* fix(native-chat): hold queued cards and goal turns on a held host; re-check on reconnect
* fix(native-chat): hold goal objectives and start retries on a held host; re-ask while held
* test(native-chat): give the remote Continue test a host that applies permission modes
* fix(settings): let an unfinished SSH access link be retried or cancelled
A failed link to a paired server keeps its durable pending operation so it
can resume, but the control only offered a new link with a fresh request
id, which main refuses, and no cancel. The pending state then blocked
environment rm and re-pairing with no way out. Show the unfinished
operation with Retry and Cancel, both sent under its saved request id, and
make the removal refusal say where to resolve it.
* test: match the pending SSH access refusal
The background wake a phone triggers on the desktop host resumed slept agent
records with no host PTY inventory check. In a worktree the desktop is not
looking at, a pane whose PTY the daemon still runs (e.g. after a renderer
restart) reads as unowned, so the wake forked a second claude --resume onto
the live transcript. Route it through the activation gate, which resumes only
records whose PTY the host inventory shows exited and declines when the
inventory cannot be read. (STA-3859)
* fix(status-bar): show usage from the host that owns the accounts
With an SSH-managed or paired Orca server owning the focused workspace's
accounts, the usage badges read that host's accounts snapshot instead of
this device's local poll. An older host that publishes no usage reads
"Usage unavailable", and loss of contact is an unverifiable verdict.
* fix(status-bar): keep remote usage fresh and honest across stream loss and owner switches
* fix(status-bar): never borrow the viewer's setup flags for a remote usage owner
* fix(status-bar): an outage stops a still-fetching remote usage slot from loading
* fix(status-bar): route usage by the focused workspace owner and fix a narrowing error
* fix(serve): drive hook titles and first-work rename without a window
Headless orca serve never opens a window, and both the synthetic agent titles
(Hermes readiness) and first-work branch/workspace rename were driven only from
the window's hook listener. Subscribe both to the hook store directly at
startup, and feed synthetic frames to the runtime tracker before the window
check, so they run in serve and desktop alike.
* fix(serve): narrow the hook event for the rename entry
* fix(serve): a new turn's working title reaches the tracker unseen; keep spinners across window reopen
A moved host's workspaces are owned by its managed server, so the Ports
panel showed the server's port scan and dropped the forwarding list and
Add button, though the SSH connection under the server's tunnel still
carries and restores this client's forwards. Show that host's forwards and
Add control above the server's scan. A forward listens on this machine,
so its rows open in the system browser here.
* fix(remote-files): open HTML, PDFs and images too large for one reply on a paired runtime
files.read stops at 512 KiB and files.readPreview at about 3 MB (one 4 MiB
reply, after base64), so larger files on a paired runtime failed to open.
Read them in chunks with the files.stat and files.readChunk methods hosts
already have, and refuse a save the host's 1 MiB frame cap would answer by
closing the connection.
Fixes#29306Fixes#26062
Co-authored-by: sotashimozono <shimozono-sota631@g.ecc.u-tokyo.ac.jp>
* fix(remote-files): keep a UTF-8 BOM when paging a large remote text file
* fix(remote-files): pin a paged read to one pairing and compare ctime
* fix(remote-files): pin the pairing before a remote read's first request
---------
Co-authored-by: sotashimozono <shimozono-sota631@g.ecc.u-tokyo.ac.jp>
* fix(orcad): log and survive recoverable process errors, stop cleanly on fatal ones
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(orcad): a fatal fault during an existing stop still exits as a failure
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(browser): the remote browser tunnel goes through the server's outbound proxy
A client-rendered browser tab on a paired server reaches sites through a
tunnel the server opens. The server dialed each destination with a bare TCP
connect, so a network that only allows traffic through a proxy refused it,
while the server's own browser (which honors the proxy) worked.
The native tunnel connector now picks the upstream proxy the same way the
server's browser sessions do: Orca's proxy setting first, else
HTTPS_PROXY/ALL_PROXY/HTTP_PROXY, each with its own bypass list, never for
loopback. HTTP(S) proxies are reached with CONNECT (with basic auth from the
URL), a no-auth SOCKS5 proxy through the existing SOCKS client; a proxy kind
it cannot speak fails the open instead of leaking around the proxy.
Fixes#29154
* fix(browser): match Chromium bypass semantics for Orca's proxy setting; keep HTTPS-proxy tunnels half-open; tolerate raw percent in proxy credentials
* fix(browser): full-glob bypass rules and trailing-dot loopback names stay off the tunnel proxy
* fix(browser): scheme-qualified and IPv6 CIDR bypass rules match like Chromium
* fix(browser): expanded IPv6 loopback from the SOCKS front end stays off the tunnel proxy
* test(browser): loopback spellings the SOCKS front end hands the tunnel stay direct
Remote panes cannot echo a keystroke before one round trip, so past ~150ms
RTT their own typing fell out of the fast paint lane. Each pane now keeps the
recent minimum input-to-output delay and adds it (clamped to 500ms) to the
redraw and synchronized-frame windows; local panes measure ~0 and keep the
existing windows.
Linear: STA-5314
* fix(daemon): a daemon update never hands a live old-daemon session id to the new daemon
Refs #26296
* fix(daemon): reconnect an older daemon through its inventory before refusing a spawn
* fix(daemon): reattach the current daemon's own session before consulting older daemons
* fix(daemon): reconnect the current daemon too before an older daemon can refuse its session
* fix(terminal): read a Windows ConPTY terminal as painted, not with PSReadLine's overwritten history prediction
* fix(terminal): bound the ConPTY rendered read, honor visible-only probes, and fill the line limit
* test(serialize): record the ConPTY capture's pre-existing wrap-pending cursor restore
* test(agent-hooks): guard that a slow last-status rename never stalls hook traffic
Regression guard for #22804 (STA-8446).
* test(agent-hooks): flush while the older rename is held so the stale-rename race is exercised
Jinjing
NeilandClaude
OrcaWinandOrcaWin
Jinwoo Hong
