The sheet now builds its lists from the desktop's own eligibility rule, so a server's
per-workspace-environment SSH repo never appears or wins a server's row. A connect reply that
arrives after the picked target changed no longer overwrites the newly shown target's state.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
A hosts-list read slower than the poll stopped the feed for good, since the next tick was
scheduled when the read started; it is now scheduled from the finish. A server workspace now
reads connected only when the desktop relays to it, so a server with no status yet is not shown up.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
useWorkspaceOnPairedHost says the workspace runs on the paired desktop itself; its doc
states the rule (hide actions whose only result is an editor tab) and its known gap.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The desktop and a server can each have an SSH target with the same id. The gate's state, Connect
progress and detected agents were keyed by that id alone, so switching to the server's target showed
the desktop's "connected" until the server answered, and let create through.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The sheet's controller already owns whether it is open, so it now reads the desktop's
server list and names itself; the overlay's mirrored visibility state and the list-side
hook go away. A server row no longer offers Sleep, which would sleep it on the desktop.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
A server workspace's host has no desktop window, so New Note left an unopenable
untitled.md each tap. It now hides under the same route rule as Open in Session, and
the no-window fallbacks no longer push a screen after the user has moved on.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The desktop's composer offers a paired server's own SSH repos and connects them through that
server. The phone left them out only because ssh.* was the Mac's own; it now reaches the server
(#26519), so the drawer's existing SSH gate connects through the picked repo's server client.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
useRelayHosts moves from workspace-server.ts into relay-hosts-feed.ts, so every reader (workspace screens now, the new-workspace sheet next) subscribes through the feed's own module. No behaviour change.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The previous fix offered the servers but still named them from the host list's rows,
so a sheet opened from Home showed a server's raw id under Run on. The sheet now takes
both the servers and their names from the server-list feed while it is open.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The sheet's run targets came from the host list's server rows, which never load while
the sheet is open (the list deliberately pauses its refresh behind it). From Home's
New Workspace that left only the desktop's repos. The sheet now reads the desktop's
server-list feed itself while it is open.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
A server workspace polled mobileRelay.hosts.list beside the host list's own read, so
the phone could ask the desktop twice per tick and the row badge and the screen could
disagree. One feed per desktop client now owns that read; both readers join it.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
A server workspace's host has no editor tabs, so the review screen no longer offers
Open in Session there, and a new markdown note whose files.open answers
renderer_unavailable opens in the file preview instead of a raw error toast.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The Run on picker showed a server's raw environment id behind "Remote ·" and
always a monitor glyph; it now takes the host list's badge labels and icon, as
the desktop's picker does. Server rows also made the desktop row read "This
computer" because its platform was only read for a mixed desktop catalog.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The phone read the desktop's connection state for a server workspace, so a stopped
server kept a green dot and "Loading tabs" spun forever. The workspace route now
narrows that state by the server's health from mobileRelay.hosts.list, reusing the
existing disconnected session UI and refetching tabs when the server returns.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
A headless orca serve has no renderer, so files.openDiff / files.open answer
renderer_unavailable and the Changes tap showed that raw code. On that refusal the
phone now opens its review screen (git.diff) or file preview (files.read) instead.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): show SSH host health on the workspace row host badge
Rows on an SSH host the desktop cannot reach looked healthy on the phone. The badge now
adds the desktop sidebar's own word ("devbox · Disconnected"), derived by the same shared
function from the connection status ssh.listTargetSummaries already sends; old desktops keep today's badge.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): name an unhealthy SSH host even in a single-host list
The desktop card shows SSH status on any host count, so the phone now reads target summaries
whenever a repo is on SSH and badges an unhealthy host alone too. Labels and health share one
target-to-host keying, and a hook-level test pins the reply-to-row wiring.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): clear stale SSH host badges and announce them without the dot
A catalog that no longer spans hosts or holds an SSH repo now clears the health and label maps,
so a host that left cannot keep badging rows. The badge gets a screen-reader label ("devbox,
Disconnected") instead of reading the middle dot.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): type the single-host health fixtures inline so the test tsc passes
Fixtures hoisted into consts widened their health maps to string, which the now-required
hostHealthById rejects under the tests-typecheck ratchet; passing them inline keeps the union.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): re-record the repo-metadata goldens for SSH host health
The settled metadata state now carries hostHealthById, and an SSH-only catalog now reads the
target summaries so a lone unhealthy host can be badged. Scoped re-record via rpc-recording.mts.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The desktop no longer sends a freshness flag, so the phone's schema drops it.
The relay capability list names the delegated-devices constant instead of
repeating its literal, which also retires a now-circular type check.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The workspace-layout refactor deletes the notifier path these used; sleep and
wake on a server come back later as server-side layout.sleep / layout.wake.
A server row's Sleep behaves exactly as on feat/mobile-remote-workspaces.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
Preserve names entered after selecting a work item in desktop, mobile and folder creation. Reuse the existing source and last-generated-name state, and avoid repeating source naming when a delayed base lookup finishes.
Verified the current-main merge composition: 70 focused tests and renderer typecheck pass; newer execution-host routing and folder launch checks remain intact. The reviewed PR head has no failed or pending CI checks and no unresolved review threads.
* fix(mobile): agents for workspaces another runtime owns show why
The paired host no longer lists its own agents for a workspace another Orca
server owns: preflight.detectAgents refuses with workspace_on_other_runtime,
and the phone shows 'Agents on Another Server - Pair that server directly'.
The phone also recognises an unambiguous runtime-owned repo row itself, so an
older host is never asked.
* fix(mobile): a shared repo id with a runtime-owned row defers to a refusing host
Rows on several hosts can share a repo id, and the first row's SSH connection
could name the paired host's own target. When any row is runtime-owned the phone
now asks a host that advertises preflight.other-runtime-refusal.v1 to decide by
worktree, and shows the other-server row on an older host.
* fix(mobile): keep the agent-loader change inside the web bundle budget
Move the refusal code beside its capability in protocol-version, read the
capability in the loader, and test the runtime: prefix directly: importing
execution-host into the loader split a web bundle chunk (129 > 128 assets).
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* Let a Grok chat list and stop the commands it left running in the background
A command Grok backgrounded (a dev server, a watcher, a monitor) showed only as a
transcript line: it never reached the background-tasks card above the composer, so
it could not be seen as running or stopped from Orca. Grok's subagents and Claude's
and Codex's background commands already list and stop there.
The ACP lane that publishes Grok's subagents as child records now also publishes
its background-task rows: a running task as a live background command or monitor,
an ended one as removed, derived from the rows the journal admitted. A Stop for one
of them goes through the same adapter route to Grok's own per-task kill
(x.ai/task/kill); Grok's completion notice ends the row, and a task Grok no longer
holds is removed at once. A refusal reports the task as not stopped; no answer or an
unreadable one leaves the outcome unknown.
Each Grok process is checked once at start with a no-target kill, beside the
existing subagent check. Only Grok naming the method unknown hides Stop.
* Settle a Grok task's transcript row when Stop finds it already gone
When Grok answered a Stop with already_exited or not_found, the card row was
removed out of band while the transcript row kept saying it was running, and a
later restated running notice could bring the card row back with Stop. The
answer now settles the transcript row through the translator, like the
subagent Stop, so the card row leaves because its row settled, the existing
no-relight rule keeps it gone, and a completion Grok still sends after
already_exited writes the real result. Also covers /clear being refused while
a Grok background command runs.
* fix(mobile): a new pairing scan supersedes a stale relay pairing journal
* fix(mobile): a late recovery cannot overwrite a newer pairing; only a relay-hello 4401 abandons a journal
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* Pair native chat tool results in linear time with provider identity
* Preserve orphan tool output and independent disclosure identity
* Keep mobile tool detail attached to its command after row changes
* Keep named mobile results open across copied history refreshes
* Let a Codex chat stop a sub-agent from the background-tasks strip
A Codex sub-agent showed in the background-tasks strip with no Stop, and
the chat's own Stop interrupts only the main turn, so a helper ran on until
it finished. Codex's app-server takes `turn/interrupt` for any loaded thread,
sub-agent threads included, so a sub-agent row's Stop now interrupts the
turn Orca saw that sub-agent run, through the same background Stop route
Codex commands use.
Codex's -32600 refusal (no active turn, another turn, thread not found)
means the run the row showed is over, so the Stop is quiet; any other
refusal says the task wasn't stopped; a timeout or lost contact is
unconfirmed. A live run showed Codex holds an interrupt that lands as the
turn ends until the sub-agent's next turn ends, so a timeout on a run the
session has since seen end is quiet too. Older clients' `codex-agent:` rows
name no host record and stay unstoppable.
* Stop a Codex sub-agent's own sub-agents and commands with it, and hold Stopping per run
A sub-agent Stop interrupted only that helper's turn, so the commands it was
running (Codex keeps a turn's processes when the turn is interrupted) and the
helpers it had spawned kept going, and its row stayed in the strip. The Stop
now interrupts the helper's run and every descendant's run, then terminates
the processes those threads hold where the app-server has background
terminals. The interrupt goes through interruptCodexTurn, and a small
codex-background-task-stops module composes the sub-agent and terminal stops,
so the terminals module is terminals only again.
A Codex helper keeps one row id (its thread id) across runs, so a confirmed
Stop's held button carried over to the helper's next run. Both clients now
hold it for the run it was pressed on, read from the row's invocation.
* Test that a sub-agent Stop leaves siblings alone and skips terminates after a timeout
Adds direct tests of the per-run Stop hold (including an older host's roster),
matches the desktop hold comment to mobile's, and reuses the one 10 s bound.
* feat(native-chat): offer Codex Ultrafast as a speed choice
Codex lists Ultrafast as a third service tier for eligible models and
accounts (GPT-6.1 Sol). Codex chats saved Fast as on/off, which cannot
hold a third tier. The Codex speed is now a Standard/Fast/Ultrafast
choice built from the tiers the model lists; the tier id is still
resolved from the catalog at each send. Older clients keep their Fast
toggle: the host still reports Fast on/off and accepts it as a speed.
* refactor(native-chat): save the Codex tier id instead of a speed name
The chat now keeps the tier id Codex lists (serviceTier: default,
priority, ultrafast) and sends it as-is on turn/start; Codex drops a
tier the model no longer lists with its own warning. This removes the
saved per-model tier map, the send-time lookup and the reconcile code.
The unused fastModeTierByModel catalog field is deleted. Older clients
still get Fast on/off, derived from the model's tier named Fast. Also
drops the pnpm-lock.yaml churn the first commit picked up.
* test(pi): drop the removed fastModeTierByModel catalog field
* fix(native-chat): review round 1 for Codex service tiers
- Accept an older client's fastMode write through the Codex adapter; it
was refused before reaching the tier alias.
- Bump the saved model catalog schema so catalogs from before
serviceTiers re-list instead of offering a Fast toggle with no tier.
- Keep only the reported tier on the record, not the Fast it implies.
- Drop a reported tier, not only a picked one, when the next model does
not list it.
- Localize Standard inside the speed choice only.
- Return the options answer directly instead of a one-field wrapper.
* fix(native-chat): review round 2 for Codex service tiers
Keep a tier Codex reports for the thread (it accepts unlisted ones such
as flex); read the legacy Fast tier beside an empty serviceTiers list.
* fix(native-chat): review round 3 for Codex service tiers
A reported tier the old model listed and the new one does not resets to
Standard on a model switch, and the reported tier itself stays pickable.
* fix(native-chat): keep a re-picked reported Codex tier
The thread's reported tier is never reset by the unlisted-tier drop, so a
re-picked Flex survives the next read, a model switch, and the turn.
* refactor(native-chat): one rule for which Codex tier a model offers
Standard, a tier the model lists, or the thread's reported tier that no
model lists. The setter and the unlisted-tier reset share it, replacing
the separate reported-tier and model-switch guards.
* test(native-chat): drop the removed fastModeTierByModel field from main's new catalog test
* fix(agents): one host-routed agent-detection entry point
preflight.detectAgents / refreshAgents take an optional { worktreeId } and the
host resolves that workspace's project runtime (WSL included) or SSH target.
Gated by preflight.workspace-scoped.v1; old peers keep the host default.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): route detection by the worktree's own host record
A repo id shared by local and SSH rows made the first row pick the detection
host. Resolve the worktree from the host's list and apply the shared
execution-host routing rule; ambiguous rows refuse. Dashboard falls back to the
host-default list until a workspace's own list loads.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): refuse an ambiguous workspace instead of probing the host
Only selector_not_found keeps the host default; selector_ambiguous now fails
closed. Adds runtime-level coverage of the lookup.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): refuse an ambiguously owned folder workspace
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agents): quick-launch runtime target carries the workspace
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Claude <noreply@anthropic.com>
The open question below a queued card already says the agent is waiting,
so the card's own caption said the same thing twice. A card behind an open
question is now plainly queued (the 'turn' hold): same Steer, Delete and
More actions, same sending rules, no caption. The 'awaiting-answer' hold
and its pending-prompt input fed only that caption, so both go, on desktop
and in the phone app, along with the now-unused locale key.
Co-authored-by: Claude <noreply@anthropic.com>
Extract subprocess execution and process contracts into @orca/process-host with explicit public entry points, independent checks, and one Node 18 compatible CommonJS runtime. Migrate application consumers and integrate package builds, dependency selection, import enforcement, and runtime resource staging.
Preserve daemon startup ownership and profile isolation, and qualify development rebuild recovery and concurrent output publication. Remove unnecessary aliases, test forwarding exports, and a duplicate output scan.
Validation: full typechecks, changed-code quality, package and artifact checks, native Windows builds/types plus 306 runtime tests, and independent native reviews.
Matched full E2E controls on original main and unchanged reviewed head both pass all 17 applicable tests (nine skips). Earlier intermittent E2E failures are documented in the PR; no assertions were weakened. The final combined-tree audit preserves both branches with no import-boundary violations.
* fix(mobile): keep chat drafts and the sidebar reachable on iPad
Chat composer drafts now live in a module-level store keyed by host,
workspace and tab, so leaving the session screen no longer drops them.
On iPadOS 26 windowed mode the window buttons covered the top-left
header controls; a native launch hook adds their height to the root
safe area. A hidden sidebar now shows a Show sidebar button in the
session header.
* fix(mobile): preserve draft edits across chat remounts
* test(mobile): type sidebar header fixture as a partial controller
* Let a Codex chat stop a command it left running in the background
A command Codex started and left running (a dev server, a watcher) showed in
the background-tasks strip above the composer with no Stop, because Codex
reported no stop it could honour. Codex 0.140+ has one: the app-server's
experimental thread/backgroundTerminals/terminate names the process by the
processId on the command's item, and thread/backgroundTerminals/list shows
what still runs.
The command tracker now keeps each command's processId. The first time a
running command carries one, the session probes its own app-server once with
a one-row list; a listing marks the app-server's backgrounded commands
stoppable and the session as offering per-row Stop and Stop all, through the
fields the strip already reads. Any refusal (an older Codex answers "unknown
variant"), timeout or malformed answer leaves it as today: no Stop.
A Stop terminates each named process, then confirms against the thread's own
list. A thread Codex says it unloaded counts as stopped; a dropped connection
does not, since lost contact is no proof a process ended. An app-server that
times out is not asked again. The killed process's own item/completed removes
its row, as before.
* Ask Codex again after a probe gets no answer, and say when a background Stop fails
A background-terminal probe that timed out or lost its request used to hide
Stop for the rest of the app-server's life. Only a refusal by name (unknown
variant, method not found) or a malformed listing now settles it as
unsupported; anything else is asked again on the next update.
A background Stop whose agent failed (a process still listed after its stop,
a timeout) used to answer "nothing stopped" and the button simply came back.
The host now refuses it, so both clients show their usual notice: "The
background task wasn't stopped." This covers Claude's background Stop too.
* Say a background Stop wasn't stopped only when the agent shows it still running
A timeout or lost contact with the agent leaves the outcome unknown, so it now answers
with the existing outcome-unknown refusal instead of "The background task wasn't stopped."
* Keep a background task's Stop in its stopping state until the row leaves
A confirmed Stop re-enabled its button for the moment between the host's answer
and the roster dropping the row. The button now holds while the host says it
stopped the task and the strip still lists it, on desktop and phone; a failed,
unconfirmed or nothing-stopped answer, or the row coming back, offers Stop again.
* Keep Grok's own subagent Stop refusal quiet, and a reply about another subagent unconfirmed
* Report Grok's own refusal of a subagent Stop as not stopped
Grok answers an ended or unknown subagent with a normal reply, so a JSON-RPC refusal means it did nothing and the subagent still runs.
* fix(native-chat): the host owns the send queue; the window keeps no saved outbox
The desktop kept each structured chat's unsent messages in localStorage and
sent them in order, so one message whose fate was unknown froze every later
send, Retry dropped it silently, failed sends could not be discarded, and an
offline chat could send hours later. The host already records every message
and owns the queue; the window now only sends.
- One in-memory sender for composer, launch prompts and messages sent from
outside the chat. One send in flight per chat; a transport failure resends
the same id for up to 30 s; a refusal that proves nothing was recorded puts
the text back in the composer with the reason; a send that went out and was
never answered shows an in-doubt line with Send again and holds nothing up.
- The host's "unknown" rows get the same in-doubt line and Send again, from
the journal, in every window.
- A message an older build left in localStorage is never sent: the host's
conversation outline decides what goes back to the composer, and the copy is
deleted once that is saved.
* fix(native-chat): send through the structured chat RPC wrapper, with its timeouts
The sender called the runtime RPC directly, skipping the per-method timeouts
every other structured chat call gets. Only a remote host's request skips the
compatibility check the sender already ran.
* fix(native-chat): an unconfirmed send goes back to the composer, with no new row line
The common pattern draws nothing extra on a message whose delivery is in
doubt once its turn is over, and puts a failed send's text back in the
composer with the reason. So a send nobody answered in time, or one a host
answers in a way that proves nothing, goes back to the composer worded as
unconfirmed, and a host "unknown" row shows nothing extra. Removes the in-doubt
phase, Send again, and its strings.
A host's made-up row for an id its journal lost now reads as unconfirmed, not
as recorded, so that message comes back instead of vanishing.
* test(native-chat): pin that nothing resends a send given back as unconfirmed
* fix(native-chat): sends survive a tab close, never resend after a Stop, and keep remote images
- A normal tab close lets sends on their way settle; what the host never took
goes back to the conversation's draft. Only a cancelled launch or a worktree
purge drops them.
- After any Stop, a send already on its way is never sent again under its id:
a doubtful answer, or a resend that was due, hands its text back worded as
unconfirmed.
- A returned image keeps the SSH connection it lives on; the connection never
goes to the host.
- An older build's saved message the host recorded and then rejected is left
to the host's own row, never handed back.
* fix(native-chat): a Stop or a tab close never resends a send already out, and a kept card is the card's
A Stop that landed while a same-id resend was being readied (its timer
fired, its request not out yet) let that resend go out after the Stop.
The sender now tracks whether a request is awaiting its answer: a Stop
hands back every send between attempts as unconfirmed, lets one whose
request is out settle from its answer, and never issues a request after
it. A normal tab close withdraws the same way instead of doing nothing,
so nothing more goes out and nothing is dropped.
A send the host rejected but kept as a card (keptAsQueuedMessageId) is
the card's, from its reply or the journal, and never goes back to the
composer.
Adds the freeze tests: a send whose fate is unknown holds later sends
no longer than its deadline, and one the host can neither confirm nor
deny releases the next at once.
* fix(native-chat): read a resend's turned-away call or reused id as unproven
Ports the send-answer proof contract. A call the host turned away before
running it (method_not_found, invalid_argument, unauthorized) proves only
that this request wrote nothing, so it reads as never sent on a first
attempt only; on a resend an earlier attempt may have landed, and it goes
again under the same id. A resent id the host says was already used for
other content (messageIdReused) proves nothing either, like an expired or
conflicting id.
Pins the rest of the contract: any row the host returns is its own, a
thrown error is no answer whatever its code, and an older build's
refused, held or outlived-Stop copy is handed back once and never sent.
* refactor(native-chat): type the structured composer's send with its attachment type
Keeps NativeChatStructuredSession.tsx within the file length limit.
* refactor(native-chat): drop the kept-card guards the sender never needed
A kept send's row is a rejection that was never a Stop's, so the sender
already reads it as recorded, from its reply or the journal. The test
that pins it stays; the two extra checks only covered a kept row that is
also a withdrawal, which the host never writes.
* test(native-chat): route launch tests' sends through the client wrapper the sender calls
The sender sends through callStructuredAgentSession, but these launch
tests replaced that module with a factory that answered nothing (and still
named a probe that no longer exists), so every launch prompt resent until
its 30 s deadline and the tests timed out. Each factory now hands sends to
the runtime RPC mock the tests already answer, and expectations of a local
send no longer ask for the remote-only compatibility option.
* fix(native-chat): hand a message back without importing the composer's attachment hook
The worktree purge reaches the launch prompt, which hands text back, and
the attachment hook's imports reach the store. A test that builds the
real store behind a mocked one then waited on itself and hung. Handing
back now writes images to the draft store directly, as the hook's helper
did, and a test pins that each returned image keeps its SSH connection.
* fix(native-chat): one send per chat, with no line of sends behind it
A chat with a send out took further messages into an in-memory line and
sent them one by one. A message typed behind one in doubt then hit its
own 30 s deadline and came back as not sent without ever going out.
Now, as the common pattern does, a chat takes one send at a time: while
it is out, Send is disabled and Enter leaves the text in the box. The
sender refuses a second send instead of lining it up, so the 30 s
deadline always runs from the send itself. A Stop or a tab close stops
the one send: settled from its answer if its request is out, handed back
as unconfirmed between attempts, or silently if it never went out.
Notes sent from outside the chat while its send is out stay with their
sender (not ready); a launch prompt that meets the person's own first
message waits in the composer instead of being lost.
* fix(native-chat): give a Stop-withdrawn note back to its chat once its notes were cleared
Notes sent from outside a chat clear once their message is recorded. A
message the host recorded as pending and a Stop then withdrew came back
only to its sender, which had already let go of it, so the text was
lost. The chat's draft now takes it, as an earlier build's outbox did.
* test(native-chat): type the composer-actions probe without a cast
* chore(native-chat): drop outbox wording left in comments and an empty locale group
* fix(native-chat): pace failed checks, keep the host's reason, and hold the chat for its launch prompt
- A send whose checks failed before its request went out (an unreachable
or incompatible host, an unreadable history) was tried again at once,
about a thousand times a second for 30 s. Attempts are now paced by
the attempts made, whether or not their request went out.
- A host that refuses every resend by throwing (native chat turned off,
a journal that won't open) gave back only "couldn't confirm". The
host's reason now comes first, still without claiming not sent.
- A launch's prompt now holds the chat's one send from the click, drawn
as sending, so a message typed while the chat starts can't overtake
it; it goes out once the chat exists, and a cancelled launch frees it.
- Notes whose send nobody could confirm say so instead of "did not
accept", and notes launched into a new chat let go of their text once
that chat's composer holds it.
- An open chat keeps drawing a recorded send until its row arrives, so a
reply that beats the history no longer makes the message flicker out.
* fix(native-chat): hold a chat's sends until it has started, and send a failed chat's message with its restart
A message sent to a chat still starting went out at once to a host that
had no record of the chat yet, read for a fence it could not get, and
came back as not sent. A message sent to a chat whose start failed
restarted it but no longer went with the restart.
While a chat starts, Send stays off and Enter leaves the text in the box,
as with a send already out. A text message sent to a chat whose start
failed restarts it and goes as the restart's first message, through the
same staged-prompt path a launch prompt takes: it holds the chat's one
send slot, drawn as sending, until the chat exists, and comes back to
the composer if the restart fails again. Notes wait while a chat starts
and ride a failed chat's restart, keeping their text until it is sent.
* chore(native-chat): test the queue request, rejection words and card hand-offs; drop an unused clear
- Pin which sends ask the host to queue, the moved rejection wording,
and that a queue send whose card was handed off and then refused or
withdrawn, or whose replay names a withdrawn card, is never handed
back.
- The send-at-most-once gate now says what the desktop promises after a
reload: it never sends the id again, and hands the text back.
- The legacy read names when it goes, and drops the notice clear nothing
called.
* fix(native-chat): keep a sent launch prompt's entry, and give back at once what can't go out
- Cleaning up a launch prompt released its send slot even after the
prompt had gone out, which deleted the entry the sender keeps once the
host records it. A launch prompt recorded as pending and then
withdrawn by a Stop was lost from both the chat and the box, and an
open chat dropped the new chat's first message before its row arrived.
The slot now gives back only a reservation that was never sent.
- A send stopped before its request went out by something trying again
won't clear (this client and the server can't talk, or the host
refused the history read) kept Send off for 30 s and then said Orca
couldn't reach the agent. It now comes back at once with its own
cause: not sent, since nothing went out, or unconfirmed if an earlier
attempt did. Transport errors keep the paced retries.
* fix(native-chat): notes keep their own text through a new agent's launch
Notes sent to a New agent whose start failed came back to the notes and
also sat in the new chat's composer, so sending both delivered the text
twice. The notes keep their text until it goes out (they hold it from
the click), so the launch now says so and no composer gets a copy, on a
failed start or a refused prompt alike. The tests that asserted the copy
in the composer pinned the old double ownership and now assert the
notes are its only owner.
Notes that rode a failed chat's restart and ended unconfirmed now say
Orca couldn't confirm them, as notes sent directly do, instead of that
the agent did not accept them.
* chore(native-chat): the send-once gate says what the desktop keeps across a reload
The desktop keeps a send's id in memory only: a send still unsettled at a
reload or crash is not resent and not handed back. The coverage notes no
longer credit the renderer tests with durable identity across a remount.
* fix(native-chat): say once why notes sent to a new agent did not go
Since notes keep their own text through a new agent's launch, a prompt
the host refused, nobody could confirm, or that found the chat's send
taken came back to the notes with nothing said anywhere: the chat shows
no notice for text its caller keeps. The notes menu now reports it once,
with the toast a send to an existing chat already uses: not accepted,
couldn't confirm, or not ready. A start that failed still says so in the
new chat instead.
* fix(native-chat): retry a history refusal the host says clears, and name it at the deadline
A send stopped before its request went out came back at once for any
refusal of the history read, including ones the host names as clearing
(its journal briefly unavailable, a chat detached while the host quits),
so the automatic retry was lost. Only a version mismatch and refusals
that won't clear come back at once now; the rest go again on the paced
schedule, and if the deadline still finds nothing sent, the words are
the host's refusal rather than Orca couldn't reach the agent.
* feat(native-chat): a send makes one request, and nothing ever sends it again
The desktop resent a message under its own id for up to 30 s when the
answer was lost. A send now makes exactly one request, as the common
pattern's clients do:
- An answer that is lost, dropped or proves nothing hands the text back
at once with "couldn't confirm… check the chat".
- A failure before the request goes out (the environment check, the
history read for the fence, a refused connection) means nothing went
out: the text comes back at once with its own reason, or as not sent.
- The 30 s cap stays on the one request, so a host that never answers
can't hold Send.
Nothing ever resends, so nothing can go out after a Stop: a Stop only
takes back a send still in its pre-send checks. The resend state goes
with it (tries, generation, awaiting, stopped, the resend timer, the
send-answers-proof probe, and the first-attempt/resend split in the
evidence), and the send-once gate says the desktop never resends.
* fix(native-chat): notes keep the chat's line, and a send held behind a rewind says it was not sent
- Only a send whose text belongs to the chat's composer clears the chat's line. Notes sent from
outside the chat no longer wipe a "couldn't confirm... Check the chat" line that explains text
already back in the box.
- A send the host turns away behind a rewind it could not confirm went back as "not sent" but said
"couldn't confirm what happened. Check the chat". It now gives the rewind's reason and says the
message was not sent.
- Reliability gate names the single-request test and records a fresh evidence run; the sender
test drops its leftover resend mocks and a duplicate Stop test.
* fix(native-chat): a send ends even when putting its text back fails
If writing the returned text into the chat's draft threw, the send never settled: it stayed
"sending", the chat refused every later send until a reload. The send now always ends after a
hand-back, the failure is logged, and the chat's line adds "Couldn't save your message."
* fix(native-chat): a message typed during /clear stays in the box and follows the chat
A /clear moves the chat to a new conversation, and its host refuses any send while it runs. A
message sent then went out, came back refused into the old conversation's draft with its line, and
vanished when the chat moved on: the box and the line now belong to the new conversation.
- A /clear holds the chat's one send slot while it runs: Enter does nothing, Send shows busy and
the text stays in the box, as for a send that is out. Notes sent from outside get "busy".
- Once it moves the chat, the old conversation keeps taking no send until the view leaves it, and
what is left of its draft moves into the new conversation's draft, after anything there: when the
composer's /clear settles, and again when the view moves.
* fix(native-chat): no "Send message?" or queue clear while the chat's send is out
While a send is out (or a /clear runs) the chat takes no message, yet Enter over a held queue still
opened "Send message?", and Clear queue deleted every card before its message was refused. Enter now
does nothing there and the text stays; Clear queue re-checks and deletes nothing if a send went out
after the question opened.
* refactor(native-chat): take the /clear draft carry out of this change
Moving the old conversation's draft into the one a /clear replaces it with fixes a bug main has too
(text left in the box during a /clear stays with the old conversation), so it goes in its own change.
Kept here: a /clear holds the chat's send slot while it runs, and the conversation it moved away from
takes no send until the view leaves it.
* fix(native-chat): a /clear's hold on sends always ends
- A view that unmounted while a /clear that moves the chat was out left the old conversation
holding its sends until a reload: the late reply kept the hold for a view that was gone. The
reply now releases it.
- The local call for a conversation command has no deadline of its own, so a /clear that never
answers kept Send off for good. The hold now also ends at the command's deadline (195 s, the one
the remote call already uses), whichever comes first.
* test(native-chat): opening a chat an older build left stuck; hand back its copy in send order
Pins, through the real chat hook, sends, legacy recovery and draft store,
what opening such a chat does: the queued messages behind a message the
host recorded in doubt come back to the composer once, in order, with the
"not sent" or "couldn't confirm" wording; the chat is free to send under
its read's fence; nothing happens while the chat has no fence here.
The legacy reader now hands entries back in the order they were sent
(queuedAt), as the older build's reader did, instead of array order.
* fix(native-chat): a send this window turned away for a re-paired server comes back as not sent
A managed server's update rotates its pairing, and this window's main
process then answers the next call itself, before forwarding anything,
with runtime_environment_changed. The send read that thrown answer as
proving nothing, so the person was told Orca couldn't confirm a message
that never left. It is now handed back as not sent, with the reason.
Every other thrown answer still reads as unconfirmed once the request
may have gone out.
* Save a new chat's first message during create
* Align opening-message types with the user-message wire
* Keep chat publication and cleanup outside store initialization
* Complete the create refusal fixture ledger
* test(native-chat): prove a created first message waits for the agent's start and is handed over once
* refactor(native-chat): keep the host and session hook under the line limit after the main sync
* test(native-chat): a chat created with its first message and no pick still teaches its agent's default
After the main sync, a created chat's agent starts from the delivery loop rather than the create
call. Grok (through the real ACP adapter and model catalog) and Claude (through the real adapter)
each still report the model their own config resolved to once the chat reads its options.
* feat(mobile): let the page own the wide host area, one sidebar only
On wide layouts a detail route's page session ran app/h/_layout.tsx inside
the detail pane, judged itself wide, and drew a second host sidebar beside
the native one.
- The page draws the host sidebar only when init carries the new optional
`ownsHostArea` fact, never from its own width.
- The page manifest's `/h/[hostId]` route declares `canOwnHostArea`.
- On wide layouts the native host route mounts one host-area page session.
A declaring bundle serves it with every served route's grants, so hops
stay in the page, and the native layout drops its sidebar. Without the
declaration, or without a bundle, the session answers native-route and
every wide detail route stays native.
- The owner is recorded per host so the layout and switches agree and a
relaunch does not flash.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): decide the wide host area per session, without a stored owner
Round 1 kept a per-host owner record that the native layout trusted. When
the record said the page owned the area, a detail route opened natively
(deep link, notification, handoff, narrow-to-wide with a detail pushed)
showed no sidebar at all.
- Drop the record. A wide session decides from the manifest it already
read: it is served only when the host route declares canOwnHostArea,
and it rebuilds when the layout class changes.
- The native layout hides its sidebar only on the host route, while that
host's page session is serving, as the shell screen reports through a
layout context. Detail routes keep the native sidebar, and a page there
draws none, so there is exactly one.
- Phones read and render nothing new.
- The host-area page can read and write every workspace-scoped key of its
host (chat tabs, live-input handles), as a per-workspace session does.
Claude-Session: lane-ipad-page-owns-host
* test(mobile): type the layout-class doubles rather than assert them
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): keep detail pages through a layout flip, guard capped keys
- A wide/narrow flip rebuilds a session only on the host route or under a
bundle without canOwnHostArea, where the answer changes. A detail page
under a declaring bundle keeps its document, scroll and draft.
- In the host-area page, a workspace key the 32-entry init cap leaves out
is named in storageOversize, so the page cannot replace the device's
chat-tab list from a default. The init frame bounds that list to the
page's schema; the host still refuses every key in the full list.
- A leaving host-area session clears only its own report.
Claude-Session: lane-ipad-page-owns-host
* refactor(mobile): host-area ownership from the reducer, storage read on demand
- The serving report is a focus-scoped boolean, so a host pushed over
another no longer leaves the first one's area unclaimed after the pop.
- The reducer takes `layout-changed {wide}`: it keeps the session when the
route view is unchanged and restarts it otherwise; `routeViewOf` returns
`ownsHostArea`.
- One web override, `usePageOwnsHostArea`; the native rule is inline in the
host layout.
- A host-area page reads a host workspace key from the shell on demand
(`native.storage.read`, granted to that session only) instead of init
enumerating the store.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): host-area page reads back its own workspace-key writes
A page read right after a page write of the same key is answered from the
page's own value, not from a shell that may not have the notify yet. A
refused read crosses as an error, never as an unset key.
Claude-Session: lane-ipad-page-owns-host
* refactor(mobile): read-your-writes from the shell's mirror, final review fixes
- The shell answers a workspace-key read from the mirror, which every
shell-side write updates synchronously (removals held as known-absent),
and reads the store only on a miss. The page shim's written-keys set
goes.
- `onLayoutChanged` compares the route view field by field; the session
is created with its layout and the layout effect fires on `wide` alone.
- The device verb dispatcher's type excludes the storage read.
- The sidebar matrix mounts the real shell screen to decide the report.
Claude-Session: lane-ipad-page-owns-host
* feat(mobile): host-area page takes the whole screen from the download on
The native sidebar steps aside once the manifest says the page owns the
host area: fetching, activating, ready and the failure screens after them
are full screen, as on a phone. It stays while the host is being checked.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): host-area workspace-key read survives a write during it
On a mirror miss the read went through the mirror's hydrate, which drops
its answer when any mirrored write lands meanwhile, so a stored key read
as unset right after a relaunch. A miss now reads the store directly, and
a store failure rejects rather than reading as unset.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): a wide detail session hands the host route to the shell
A session opened on its own under a page that can own the host area
kept a hop to the host route in-page (a missing worktree's notice, or
leaving the session), drawing a second host list beside the native
sidebar. Its pairs now leave the host route out, so the hop goes to the
shell, which opens the area-owning session. Phones keep the hop in-page.
Claude-Session: lane-ipad-page-owns-host
* test(mobile): a phone mount's layout dispatch leaves the session alone
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): leaving a wide detail session returns to the host area
The leave-session chevron and the missing-worktree bounce hand the host
route to the shell on a wide layout, which pushed it: a second host-area
session over the session, with Back reopening the session. On a wide
layout the shell now dismisses to this host's route instead, taking the
href's params, or replaces the session when nothing is below it. Phones
still push.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): a narrow-wide flip restarts a detail session's page
The route view comparison now counts the paired routes, so a detail
session under a page that can own the host area restarts on a flip
instead of keeping the narrow pairs, whose host-route pair let the page
draw a second host list beside the native sidebar.
Claude-Session: lane-ipad-page-owns-host
* refactor(runtime-rpc-terminal-io): clean up Phase 3-3.8 code
- One admission prologue and one unary invocation shared by both RPC dispatchers
- Delete rpc schema re-export shims; import from the shared params catalog
- Delete the unregistered duplicate markdown tab method module
- Collapse multiplex installer stage types; add isMultiplexStreamAttached
- One source-identity guard in the ACK recovery snapshot
- Single stream teardown in the renderer multiplexer
- De-duplicate RPC method declarations; derive dispatch options from RpcContext
- Share viewport-frame decoding and one head-trim loop for pending queues
- Single sendTerminal call in sendTerminalStreamInput
* test: point cross-version and scope checks at the moved browser tab-create schema; run transport parity test under Node
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(mobile): size onboarding slides from the modal viewport
* fix(mobile): ignore zero-width onboarding viewport layouts
* test(mobile): model slide progress in onboarding width test
Jinwoo-H
Jinwoo Hong
Neil
OrcaWinandm4air
Brennan Benson
