starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-02 16:02:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
11,705 Commits 8,826 Branches 1,117 Tags
a3b8eeff83270de70f25a9efd24684ea64b99da7
Commit Graph
68 Commits
Author SHA1 Message Date
Neil f737f3499f fix(relay): stream an oversized fs.listFiles reply instead of refusing it (#17954) 
Opening Orca's own checkout over SSH cannot list its files in one response frame.
22,617 tracked paths average 58 characters, so the 20,001-row page the client asks
for serializes to 1,223,415 bytes — past `DISPATCHER_CONTROL_QUEUE_MAX_BYTES`, so
`sendResponse` demotes it to the `legacy-response` lane, where an unrelated
producer backlog can refuse it as an opaque `ResponseOverCapacity`. Break-even is
around 49 characters of average path; any `packages/<name>/src/...` monorepo is
over the line.

Picking a ceiling to refuse at does not fix that, it just moves where it shows up
and refuses listings that would have been delivered. `__streamResponse` already
exists for exactly this on the git methods, and it is its own negotiation in both
directions: an old client never sends it and gets the plain array on the
legacy-response lane as before, and an old relay ignores it and answers plainly,
which the client detects by the sentinel marker being absent. So fs.listFiles opts
into it — no new method, no new opcode, nothing to advertise — and the size of a
listing stops being a correctness question.

The response-stream registry becomes one per relay, shared by FsHandler and
GitHandler. A second registry is not an option and the header of
git-response-stream.ts says why: a client keys reassembly on `streamId` alone, so
two would hand out the same id and cross-feed chunks, and only the handler that
registers `git.responseAck` can credit the window a pump parks on.

Also declares `maxResults` on the runtime-RPC `files.listAll` and forwards it.
The mechanism "the client names its cap, so a full page reads as truncation" was
wired only on the Electron IPC hop; web and mobile were saved incidentally by
`remoteFileContentBudget` defaulting the cap inside `listRuntimeFiles`. A new
optional field is additive in both directions (wire rule 1).

The new Docker-gated spec is claimed by run-ssh-docker-e2e.mjs. The sharded e2e
lanes set no ORCA_E2E_SSH_DOCKER, so a Docker-gated spec that no runner names
self-skips everywhere and still reports green — pr-e2e-gate-contract enforces that.

Closes #12547
 2026-09-02 05:36:54 -07:00
Neil 91a35b9257 Split relay Git handler responsibilities (#17217) 
* Split speech session lifecycle

* Split terminal output scheduler pipeline

* Split mobile browser pane modules

* Prune resolved max-lines suppressions

* Split pane tree equalization logic

* Extract mobile troubleshoot screen styles

* Split external automation manager

* Split main window service attachments

* Split hosted review creation checks

* Split automation dispatch event handling

* Split settings navigation metadata

* Split daemon initialization lifecycle

* Split GitLab item dialog

* Split relay dispatcher layers

* Split mobile host screen

* Retarget mobile view settings source test

* Split runtime file client layers

* Split ports panel layers

* Split runtime environments pane layers

* Split local PTY provider responsibilities

* Split CDP bridge responsibilities

* Split relay Git handler responsibilities

* Track moved relay Git fetch audit

* Fix F3-speech for #17123

* Fix F1-cycle for #17131

* Fix F4-navtest for #17157

* Fix F2-allowlist for #17161
 2026-08-29 20:19:09 -07:00
Jinjing 7e76bb3aec Fix rebase race by fetching to private ref before rebasing (#15990) 
* Fix rebase race by fetching to private ref before rebasing

`git pull --rebase` is vulnerable to concurrent fetches modifying remote-tracking refs during execution. Fetch to a temporary private ref (refs/orca/rebase/*) first, then rebase from that stable ref to avoid the race condition.

* Fix rebase race by fetching to private ref with timeout

Concurrent fetches can interfere with remote-tracking refs between
fetch and rebase. Use a unique private ref and 60-second timeout to
isolate each rebase operation and prevent hangs on stalled remotes.
Extract gitPullRebaseFromBase to a dedicated module.

* fix rebase race by fetching to private ref with timeouts

Concurrent fetches can replace FETCH_HEAD and remote-tracking refs between
fetch and rebase, causing the rebase to fail. Fetch to a temporary private
ref instead, use --no-write-fetch-head when available (Git 2.29+), and
serialize FETCH_HEAD access for older versions. Add process termination
barriers to ensure proper cleanup and extend timeouts for SSH operations.

* Fix rebase race by fetching to both private and tracking refs

Concurrent fetches between source and rebase can replace remote-tracking refs,
causing rebases to use stale bases. Now fetch to both a private ref and the
remote-tracking ref simultaneously, ensuring the tracking ref stays current.

Also improves process termination for WSL guests with process-group tracking,
fixes process-tree termination timeouts on POSIX, and serializes FETCH_HEAD
operations for linked worktrees through their shared Git directory.

* Add WSL setsid --wait probe and barrier termination timeout

Probe for `setsid --wait` support and fall back to unwrapped execution for BusyBox compatibility. Add a deadline for process termination barriers to prevent hanging when tree termination cannot be verified. Update tests for cross-platform compatibility.

* Add wsl-process-group-termination to WSL invocation allowlist

* Serialize per-worktree git mutations to fix rebase race

Introduce operation locking for each worktree to prevent concurrent
mutations (like rebase) from interfering with each other. Ensures
rebasing a linked worktree doesn't affect the source worktree state.
Add SIGKILL fallback if process termination barriers cannot verify
tree termination.

* Serialize pull and fastForward operations per-worktree

- Extract generic git operation lock to reuse locking pattern
- Refactor existing locks to use the generic implementation
- Apply per-worktree serialization to pull and fastForward to prevent races

* Route WSL group termination through runWslProcess

ce743a4fd0 silenced the wsl-invocation boundary guard by appending
wsl-process-group-termination.ts to the allowlist. That fixture only
grows when the scanner learns to see a spawn it was blind to, and only
shrinks for a migration -- this was new code on this branch, so the
entry was the boundary regressing rather than the guard getting honest.

Migrate the kill instead. terminate() now calls runWslProcess with the
script form (`<shell> -c <script> -- <args>`), which keeps the group id
in $1, so the payload is unchanged. The script is plain POSIX, so it
must not pin shell: 'bash'; it calls only builtins and coreutils on the
default PATH and reads no login environment, so loginPath is 'none'.

wrapGuestArgs() is untouched: its argv is spliced into git/runner.ts's
own wsl.exe invocation, which is a long-standing allowlist entry.

The unit test now mocks runWslProcess and asserts the spec shape --
distro, loginPath, the group id in args -- so a regression back to a raw
spawn fails here as well as at the boundary guard.

* Assert cleanup is defined before accessing properties
 2026-08-24 12:11:55 -07:00
Neil 77f23b013f refactor(shared): drop the shared/types barrel and import from the real modules (#14447) 
#14397 split `shared/types.ts` into 46 per-domain modules but kept the path as
a re-export barrel so the import sites did not have to change. This removes
the barrel: every consumer now imports from the module that actually declares
the type, and `src/shared/types.ts` is deleted.

Barrels hide where a type lives, make every consumer look like it depends on
the whole domain, and let an unrelated edit invalidate a module that ~2,000
files transitively import.

2,323 import declarations across 2,321 files. Rewritten mechanically: each
specifier was resolved to an absolute path via the TypeScript AST and
recomputed, rather than string-substituted, so alias forms (`@/../../shared/
types`) and per-specifier `type` modifiers survive.

Four cases the mechanical pass had to handle, each found by a gate rather than
by reading the diff:

- Modules inside `src/shared` import the barrel as `./types`, not
  `shared/types`. A pre-filter on the latter string skipped 176 of them and
  left imports dangling at a deleted file, which surfaced as confusing
  `Property 'x' is optional in type 'Repo' but required in Pick<Repo, ...>`
  errors rather than "module not found".
- The barrel RENAMED one type on the way through
  (`WorkspaceSource as WorkspaceCreateTelemetrySource`), so the original name
  in the owning module has to be re-aliased at each consumer.
- Three test files put `;(globalThis as ...)` on the line after the import.
  TypeScript parses that `;` as the import statement's terminator, so
  replacing through `statement.getEnd()` deletes it and breaks ASI. The
  rewrite now stops at the module specifier.
- A file that already imported directly from a module got a SECOND import
  from it, because the barrel re-exported those same names — which trips
  `import/no-duplicates` under `--deny-warnings`. A post-pass merges
  declarations sharing a specifier and type-only-ness; the `import type` plus
  `import` pair from one module is left alone, since that form is allowed.

Splitting one barrel import into several genuinely adds lines, which pushed
`terminal-layout-pty-ownership.ts` to 301 counted lines: its 107-character
import must wrap, and neither local type collapses onto one line (101 and 116
characters). Rather than contort a type declaration to fit a line budget,
`collectLeafIds` and `pruneLeaves` move to `terminal-pane-layout-tree.ts` —
they are pure structural operations on the layout tree and independent of PTY
ownership. `visible-worktrees.ts` similarly loses its own mini-barrel
re-export of `isDefaultBranchWorkspace`, with the four real consumers
repointed at the declaring module. No `max-lines` bypass added.

Verified: cold `tsc --noEmit` green on node, cli, and web (buildinfo deleted
first — these projects are `composite: true` and reuse stale caches); the full
`pnpm lint` green, not just bare oxlint — the narrower local check is what let
the duplicate imports reach CI; max-lines ratchet OK at 344.
 2026-08-13 22:48:24 -07:00
Neil 3713dd7376 perf(git): reuse pinned OIDs for SSH file diffs (#13586) 
Forward the renderer's already-pinned {mergeBase, headOid} to the SSH relay so a single-file branch diff reads the two blobs directly instead of rediscovering live HEAD. Six sequential git processes become two concurrent reads, and a branch move mid-review no longer changes which revision is displayed.

Equivalence with the legacy route is proven against real Git across 14 change types; wire compatibility is proven over a real SSH socket against relay bundles built from main and from the pre-merge-base.
 2026-08-11 02:18:29 -07:00
Jinjing debf4affe7 Display total lines of code change in branch header (#12771) 
* Add branch line total chip to source control header

Display the total lines added and removed across a branch from its fork point, measured via `git diff <mergeBase>`. Only computed when the chip is visible (request gate on merge base OID), with 500ms soft deadline to protect status latency and 15s hard timeout. Deduplicated across concurrent pollers and cached alongside line stats. Omitted on failure — always shows exact or nothing, never a partial estimate. Updates throughout the stack: native git status, relay, renderer store/API, and UI components.

* Pin branch line total to app locale

Format line counts using the app's configured locale instead of the system
locale, ensuring consistent cross-platform display and test reliability.

* test: wait for coalescer joins instead of fixed sleep

Hold the diff until the second status pass actually takes the
branch-total coalescer lease instead of using a fixed 400ms sleep.
Fixes timing-dependent flakiness on slow machines.
 2026-08-05 14:46:00 -07:00
Jinjing a000839465 Add first prompt to agent session history rows (#12085) 
* Add first user prompt to AI Vault session history rows

Re-parse transcripts on demand to extract and display the untruncated first
user prompt for copy/reuse. List scans omit the body (payload/perf); UI loads
it when session details expand. Grok sessions extract the typed ask from
<user_query> envelope, skipping injected <user_info> bootstrap rows. Supports
Claude, Codex, Grok, and OpenCode agents.

* fix(ai-vault): split SessionTime out to pass max-lines lint

AiVaultSessionDetails exceeded the 400-line oxlint limit after adding
first-prompt UI; move SessionTime into its own module.

* fix(ai-vault): handle corrupt transcripts and fix OpenCode prompt captur

Corrupt transcripts now resolve null instead of rejecting the IPC call, matching behavior for other unavailable cases. OpenCode SQLite parsing now correctly captures all text parts from the earliest user message only, fixing truncation of large prompts and padding of small ones. Add stale-response guard in the UI to prevent late results from overwriting the current session when tabs switch. Consolidate text slicing via `sliceAtCodeUnitLimit` to avoid surrogate-pair splits across all callers.

* test(ai-vault): add first-user-prompt UTF-16 safety tests

Ensure truncation at safety limits doesn't split UTF-16 surrogate pairs,
preventing corruption of astral characters in captured prompts.

* fix(ai-vault): key first-prompt-card by session.id

Remounting the card on session switches prevents late responses from
a previous load from writing stale data into the component's refs.
Also improves conversation-turn key stability.

* fix(ai-vault): preserve first prompt after preview truncation

* refactor(ai-vault): improve first user prompt capture robustness and per

- Add 15s timeout to full-prompt load to prevent indefinite loading states
- Extract seedFullFirstUserPrompt helper for reuse across parsers
- Prevent AI-generated summaries from becoming the copyable first prompt
- Fix truncation detection in OpenCode SQLite by probing for N+1 rows
- Optimize text bounding to apply safety limit before toLowerCase
- Gate synthetic OpenCode path detection on agent type, not just # presence
- Add test coverage for remote execution host handling

* Fix FirstPromptCard loading state stranded by stale promise reuse

Clears loadPromiseRef during cleanup to prevent the dedupe handle from
causing StrictMode remounts to await stale in-flight requests. Stops loading
when session becomes non-loadable mid-request. Adds tests for StrictMode
double-invoke resolution and main-process timeout scenarios.

* refactor(ai-vault): split session parsers into modular files

Split secondary-parsers into individual files per agent type (copilot,
cursor, hermes, opencode) for improved modularity. Add test coverage
for first-user-prompt envelope handling: unwrap user_query tags and
reject bare user_info dumps.

* fix(ci): clear max-lines and flaky portal readiness check

Collapse an accidental multi-line regex wrap in ssh-connection-utils that
pushed counted lines to 301. Harden the latched-readiness test's ready
transition so CI load can re-observe attach after MutationObserver gaps.

* fix(ssh): extract proxy command helpers to pass max-lines

Move resolveEffectiveProxy/spawnProxyCommand out of ssh-connection-utils
so oxfmt line wrapping cannot push that file over the 300-line lint cap.

* capture first user prompt by ordering OpenCode messages by creation time

- Add `readOpenCodeMessagesInOrder` to rebuild transcript by timestamp, handling
  corrupt/partial files gracefully instead of discarding sessions
- Extract SSH proxy command tests to dedicated file; add backpressure handling
  and stderr draining to prevent proxy process stalls
- On Windows, reject unsafe characters in ProxyCommand values instead of
  pretending to escape them; properly format cmd.exe invocation with verbatim
  arguments
- Expand ProxyJump chains into -J plus final hop, mirroring OpenSSH behavior
- Decouple portal readiness reapply budget from flip-count budget via explicit
  constant
 2026-08-02 18:45:55 -07:00
Jinjing 05206046f6 chore: condense code comments (#12008) 
* chore: condense code comments

* chore: shorten more code comments

* clarify PTY agent session descendant cleanup behavior

Refine the comment on ptyAgentSessionIds to more accurately describe
when agent sessions sweep their descendant process trees and note the
exception on immediate Windows shutdown.
 2026-08-01 14:24:31 -07:00
NeilandOrca a49d68f8c2 perf(git): overlap getBranchCompare's head-of-chain reads (#10895) 
* perf(git): overlap getBranchCompare's head-of-chain reads

Four git spawns ran strictly in series before any compare work began:
branch --show-current, the base-ref probe, rev-parse HEAD, and rev-parse <base>.

Three are independent -- compareRef is display-only metadata and HEAD's oid does
not depend on the base ref -- so they now run concurrently. The fourth was
redundant outright: the probe already runs `rev-parse --verify --quiet
<ref>^{commit}` and discarded the oid it printed, which was then re-resolved by a
second spawn. resolveWorktreeBaseCommitOid returns that oid so it can be reused;
hasWorktreeBaseCommitRef now delegates to it, leaving its other 4 callers
untouched.

3.6-3.7x on a short remote base label (192ms -> 52ms), 1.44x on an
already-qualified refs/... base, which skips the probe by design.

Reuse is keyed by ref: resolveWorktreeAddBaseRef returns at its first successful
candidate, so only that ref's oid is ever read back. Peeling is safe because only
refs/heads and refs/remotes candidates reach the probe, where ^{commit} is a
no-op.

No new git features: this removes a spawn rather than adopting an option.

Co-authored-by: Orca <help@stably.ai>

* fix(git): preserve compare semantics across providers

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>
 2026-07-27 17:17:03 -07:00
JinjingandOrca 772081577e Fix fork PR/MR worktree creation race via durable review-head refs (#10429) 
* Fix fork PR/MR worktree creation race via durable review-head refs

When creating a fork PR/MR worktree, concurrent `git fetch origin` operations
clobber the shared FETCH_HEAD, causing the wrong commit to be checked out.
Fetch PR/MR heads into dedicated per-review refs (`refs/orca/pull/<N>`,
`refs/orca/merge-requests/<N>`) that persist and isolate each head from other
fetches. Gracefully keep the compare-base when the fetch fails but the local
ref already exists, avoiding silent fallback to the wrong branch on transient
network errors.

* Bound PR/MR head fetches with 60s timeout

Prevent PR/MR creation from hanging when a remote is stalled or
unreachable. Both GitHub and GitLab head fetches now enforce a
60-second timeout, matching the bound used in the create-path
fetch. Durable refs (refs/orca/pull/*, refs/orca/merge-requests/*)
decouple the ref from FETCH_HEAD, preserving legacy client semantics.

* test: align CI expectations with main PowerShell/sparse regressions

PR checks merge into main, which recently changed PowerShell launch args
(cwd restore after profiles) and sparse-checkout detection (require
core.sparseCheckout). Derive PowerShell spawn args from the production
resolver, mock the sparse config flag, reset shared worktree list scan
cache between tests, and stop requiring floating polls to avoid getRepos
hydration.

* Address review follow-ups on durable review-head refs

- Unify PR review-head remote selection: local and SSH GitHub paths share
  resolveGitHubReviewHeadRemote, which prefers the remote mapping to the
  hosting GitHub project (upstream before origin, matching work-item/API
  candidate order) so contributor clones fetch refs/pull from the repo
  that actually hosts the PR.
- Soft-keep durable review heads: when the PR/MR head fetch fails but
  refs/orca/pull/<N> / refs/orca/merge-requests/<iid> still resolves,
  keep the pinned SHA (warn) instead of failing resolve, mirroring the
  compare-base fallback. Extracted shared compare-base soft-keep into
  compare-base-ref-fetch.ts.
- Extract fetchGitLabMergeRequestHeadRef (local + SSH) parallel to the
  GitHub helper; bound its local fetch with the shared 60s timeout.
- Share relay-style fetch validation (positive safe-integer id, remote
  not starting with "-") between relay and local helpers via
  review-head-tracking-ref.ts; move REVIEW_HEAD_FETCH_TIMEOUT_MS there.
- Drop the githubPullRequestHeadLocalRef re-export; resolve head SHAs via
  rev-parse --verify <ref>^{commit}.
- Add GitLab anti-FETCH_HEAD regression test plus durable-head soft-keep
  and remote-selection unit tests.

Co-authored-by: Orca <help@stably.ai>

* test: supply live getRepos for terminal-retirement hydrates

Main's headless tab hydrate (#9343) skips worktree keys whose repo is not
in getRepos. Retirement tests that rebuild mobile tabs from a persisted
session now advertise the fixture repo as live so PR Checks merge stays green.

* fix(editor): extract RichMarkdownEditor props to stay under max-lines

Main's SSH external-image wiring (#10323) pushed RichMarkdownEditor.tsx over
the 400-line tsx budget, failing PR Checks lint on every merge into main.
Move the props type into a sibling module so the component stays under the
limit without disabling max-lines.

* Make durable review-head refs remote-identity scoped

Embed remote name + URL hash into refs/orca/pull|merge-requests refs to prevent soft-keep from serving wrong project's PR/MR when FETCH_HEAD is clobbered by concurrent fetch. Fetch functions now return the written ref path (writer-authoritative) so callers rev-parse exactly what was fetched, not re-derive identity. Soft-keep only applies to transient errors (timeout, network); fails hard on missing refs, auth failures, and stale relay. Relay returns localRef so client avoids re-hashing (URL normalization can disagree).

---------

Co-authored-by: Orca <help@stably.ai>
 2026-07-24 12:53:18 -07:00
NeilandOrca aab112933e Revert "fix(memory): bound OOM-prone accumulators (#10179)" (#10255) 
Co-authored-by: Orca <help@stably.ai>
 2026-07-23 18:35:31 -07:00
Neil 8f40ddf328 fix(memory): bound OOM-prone accumulators (#10179) 2026-07-23 06:22:56 -07:00
OrcaWinandBrennan Benson e109e78ebf fix(source-control): keep huge change sets responsive (#9477) 
* fix(source-control): keep huge change sets responsive

* Fix cancellation and retry handling for capped status

* Harden capped status for conflict-heavy repositories

* Harden capped status recovery and cancellation

* fix(source-control): preserve capped status correctness

* fix(source-control): translate submodule status at render time

---------

Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
 2026-07-20 14:50:12 -07:00
NeilandOrca 0989128287 refactor(comments): slim verbose comments in shared/cli/relay/preload (#9544) 
Collapse multi-line explanatory comment blocks into single-line "why" statements
per AGENTS.md ("Document the Why, Briefly"): drop restatements of the code and
mechanism narration; keep the non-obvious reason, external refs, and directives.

Comments-only — verified no code changed via a Babel/esbuild comment-strip
token-equality gate against origin/main; typecheck and oxlint clean.

Area: shared, cli, relay, preload. 26 files changed, 1039 insertions(+), 3300 deletions(-).

Co-authored-by: Orca <help@stably.ai>
 2026-07-20 03:34:44 -07:00
Jinjing f1d2fe5c65 perf(git-status): duty-cycle, cancel, and cache status polling to cut idle git load (#8922) 
* feat(git-status): batch, cancel, and cache git status polling to cut idl

- Add a single duty-cycled refresh scheduler (activity debounce + 60s
  safety timer) replacing multiple overlapping intervals, so status
  polling no longer runs near-continuously on large repos (#7983).
- Let safety refreshes reuse cached numstat line counts instead of
  re-running diff --numstat every cycle, invalidated by head change,
  known mutations, and a bounded TTL.
- Thread AbortSignal/request-token cancellation through IPC, RPC, and
  relay layers so a superseded or backgrounded git:status call is
  killed instead of finishing wastefully.
- Fix automatic upstream/status apply ordering so a slow, older
  refresh can no longer clobber a newer result, and so an earlier
  refresh still applies when a later one fails.

* Fix aborted git status scans being mistaken for completed empty results

- An aborted scan/numstat pass now always rejects instead of silently
  resolving, so a cancelled request can't look like a valid empty status.
- Stop clearing the line-stats cache key on abort, since an aborted pass
  never wrote to it — clearing was evicting a concurrent scan's healthy
  snapshot and forcing a redundant numstat recompute.

* Fix aborted git status scans resolving as completed results

Cancelled scans could still resolve with partial or stale data instead of
rejecting, letting callers treat an aborted refresh as a valid status. Also
stop counting aborted scan duration toward catch-up refresh pacing, which
was stretching the next refresh interval by the full length of a cancelled
(often slow) scan.

* Add cancellable, generation-aware git status polling to cut stale scans

- Route git.status through an abortable subscription per requestToken so
  cancelStatus can actually abort the remote scan instead of being a
  no-op, preventing wasted work and stale responses overwriting fresher
  state.
- Bump the git status polling generation on push-target changes so an
  in-flight refresh against the old remote/branch can't apply stale
  upstream data to the new one.
- Guard the stale-conflict poller against writes after unmount.
- Retire pre-purge line-stat scans in the cache so an older in-flight
  scan can't repopulate a key after a token-scoped purge.
 2026-07-15 19:09:14 -07:00
Kaynan Sampaio de CamargokaynanBrennan Benson
 		6e2a4a824d fix(worktrees): stop surfacing prunable git worktrees as live workspaces (#8409) 
* fix(worktrees): stop surfacing prunable git worktrees as live workspaces

A worktree still registered in git but whose directory was deleted
(git's `prunable` state) was enumerated as a normal workspace,
producing repeated pty:spawn DaemonProtocolError / fs:readDir ENOENT
loops and a blank pane.

- Parse the `prunable` porcelain field (Git >= 2.36) in both the main
  and relay worktree-list parsers.
- For Git < 2.36 (no `prunable` field), probe each linked worktree
  path for existence on the fallback line-block path, skipping locked
  registrations to mirror git's own prunable rules.
- Omit prunable worktrees from the detected-workspace enumeration only;
  removal/cleanup flows keep seeing them.
- Extend the real-binary compatibility contract with the 2.36
  `prunable` boundary.

Fixes #8389

Claude-Session: https://claude.ai/code/session_018Rg1Bpq4GGwmz613hq6RSD

* fix(worktrees): pin the prunable/locked porcelain annotations to their real Git 2.31 boundary

The prunable and locked annotations landed in Git 2.31, five releases
before `worktree list -z` (2.36); only -z defines the capability
fallback boundary. Correct the compatibility contract so a future
matrix entry in the 2.31-2.35 range passes, and reword the fallback
comments: on 2.31-2.35 the annotations still parse and the existence
probe is a backstop; only Git <2.31 relies on it outright.

* fix(worktrees): omit prunable registrations from the Space scan

A prunable registration has no directory to size or reclaim, so Space
rendered it as a dead "Missing" row whose checkbox stayed disabled with
no prune/remove affordance (reported on macOS after a reboot cleared
/private/tmp under 16 registrations). Skip prunable entries in the scan,
matching the workspace enumeration; removal flows list worktrees
separately and still see them.

---------

Co-authored-by: kaynan <kaynan.camargo@terceiro-sky.com.br>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
 2026-07-15 15:24:15 -07:00
Brennan Benson 64be819790 fix(runtime): harden watcher and PTY teardown ownership (#8661) 
* fix(runtime): retain watcher and PTY teardown ownership

* fix(runtime): restore watchers after interrupted cleanup

* fix(runtime): prevent stale watcher revival

* test(runtime): cover watcher shutdown ownership

* test(daemon): model physical PTY exit

* fix(daemon): keep shutdown terminating when disposal cannot prove exit

A rejecting host.dispose() (unreapable child past its exit deadline) left
the shutdown RPC without its process.nextTick(shutdown) and skipped socket
cleanup in shutdown(), stranding the daemon as an unreachable orphan after
the stale-daemon replacement flow unlinks its socket. Log and continue:
daemon exit reparents the child to init instead of blocking on it.

* fix(runtime): keep local watching alive after an idle-kill deadline miss

An idle child that outlived the exit deadline set shutdownRequested on the
shared desktop supervisor, which has no retire-and-replace path — every
later subscribe rejected supervisor_disposed and the roots were cached
unwatchable, silently ending local file watching for the session. The idle
path owns zero records, so there is no double-watch hazard; the zombie
keeps its capacity reservation until physical exit and the next subscribe
gets a fresh child.

* fix(renderer): resync replayed paired-web file watches

Transparent replay removed the implicit resync the old close-and-rebuild
path provided: a replayed files.watch only reports changes from its own
native setup, so changes during the reconnect gap were silently lost.
Deliver a conservative overflow to consumers once the replayed watch is
ready, matching the overflow-after-interruption contract everywhere else.

* fix(runtime): address teardown review findings

* fix(runtime): retry watches after teardown deadlines

* Fix PTY descendant leaks on forced teardown

* Fix jitter-sensitive terminal lifecycle test
 2026-07-15 15:23:35 -07:00
Brennan BensonandBrennan Benson 1a6abc87d1 Suppress Git Credential Manager OAuth popup loop in Orca-run git — clone, terminals/agents, setup hooks (fixes #7652) (#7986) 
* Suppress Git Credential Manager OAuth popup on git clone (fixes #7652)

Orca's git runner disables the interactive credential prompt on every git
call that goes through gitExecFileAsync/gitStreamStdout, but the two raw
'git clone' spawns (desktop repos:clone and the runtime clone path) passed
no env, so they inherited process.env with no guard. On Windows a clone
that needs GitHub auth then makes Git Credential Manager pop its
'Connect to GitHub' OAuth window, and in a network-restricted intranet the
browser/device flow never completes while git's credential retry re-pops it.

Apply nonInteractiveGitEnv() to both clone spawns so the prompt is
suppressed (GCM_INTERACTIVE=never, credential.interactive=false,
GIT_TERMINAL_PROMPT=0). The credential *helper* is kept, so cached-token
clones for private repos still work; only the interactive fallback popup is
disabled and the clone fails fast with a clear error instead.

* Suppress GCM OAuth popup in agent terminals and setup hooks too (#7652)

The clone-spawn fix stopped Orca's own managed git from popping Git
Credential Manager, but git run in terminals and setup scripts inherited
process.env with no guard. That is the more likely source of the reported
loop: agents are told to run 'git pull --rebase'/'git fetch'/retry 'git
push' (preamble + conflict/push-failure prompts), and each retry re-pops
GCM's 'Connect to GitHub' window in a network-restricted intranet.

Apply the credential-prompt guard to:
- setup/archive/hook scripts (hooks.ts non-WSL exec env), which run
  unattended on worktree create/archive.
- the shared PTY host env (buildPtyHostEnv), via a small
  applyTerminalGitCredentialPromptGuard helper. Agent terminals are
  guarded unconditionally (they cannot dismiss a GUI popup); user
  terminals are guarded by default via the new
  terminalSuppressGitCredentialPrompt setting so power users can opt out.

The credential helper is kept, so cached gh auth still works; only the
interactive fallback prompt is disabled. Verified end-to-end in a real
Orca terminal (GIT_TERMINAL_PROMPT=0 + GCM_INTERACTIVE=never by default;
absent when the opt-out is set).

* Scope user-terminal credential guard to Windows, add settings toggle, forward guard into WSL (#7652)

* Retrigger PR checks (Actions dropped the synchronize dispatch for 57e7ce249)

* Keep shell locale out of the terminal/hook credential guard (#7652 review fix)

* Fix Fable review findings: guard WSL hook branch, wire settings search, catalog keyword keys, sparse-env askpass, one-shot agent classification (#7652)

* fix(terminal): harden Git credential popup guard

* test(pty): cover SSH credential guard setting

* fix(git): guard remote clones and setup runners

* fix(git): scope credential guards to unattended work

---------

Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
 2026-07-14 15:23:06 -07:00
Jinjing 527c692b71 Improve git pull on remote (#8524) 
* Fall back to a merge when a divergent pull has no reconciliation strateg

- Git 2.27+ refuses `git pull` on divergent branches unless pull.rebase or
  pull.ff is configured. Retry with `--no-rebase` (Git's historical default)
  so pulls succeed out of the box on fresh hosts.
- Skip the fallback whenever the caller already specified a reconciliation
  strategy (e.g. --ff-only, --rebase) so explicit policies still fail as
  expected on divergence.
- Applied identically in the local git pull path and the relay/SSH git
  handler so both surfaces behave the same way.

* Refactor divergent-pull merge fallback into shared helper

Extracts the retry-as-merge logic (duplicated between local git and
relay SSH pull paths) into `runPullWithDivergenceFallback` in
git-remote-error.ts, so both callers share one implementation and
test coverage.
 2026-07-13 12:42:55 -07:00
SiddOrcaSiddharth AhireJinwoo-H
 		deb8152c9a fix(relay): treat staging paths as literals (#8358) 
* fix(relay): treat staging paths as literals

* docs(relay): document pathspec collision fixture

* docs(relay): document staging mutation contracts

* chore(relay): remove redundant staging comments

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Siddharth Ahire <siddharth@Siddharths-MacBook-Air.local>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
 2026-07-12 21:04:13 -07:00
Neil acb35ee649 Fix git submodule path cache retention (#7687) 2026-07-11 01:30:19 -07:00
Neil 3d3e0ea0b1 perf(file-explorer): batch and debounce ignored checks (#8103) 2026-07-10 19:10:01 -07:00
Neil 533992bdda fix(git): cache unsupported capabilities per host (#8109) 
* fix(git): cache unsupported capabilities per host

Old Git worktree, ref-search, and merge-tree fallbacks retried unsupported flags on recurring operations, flooding subprocess traces. Centralize capability probing per native, WSL, and SSH execution host, coalesce concurrent probes, and retry periodically for in-place Git upgrades.

* fix(git): recognize real old-Git merge-tree rejection

* test(git): enforce real binary compatibility matrix

* fix(ci): preserve Git compatibility test ownership

* fix(git): retain supported capability state
 2026-07-10 18:19:36 -07:00
Jinwoo HongandOrca c9919e57b3 fix(remote): harden terminal, relay, and SSH reliability (#8141) 
Co-authored-by: Orca <help@stably.ai>
 2026-07-10 12:56:17 -07:00
Neil 26224196f5 perf(worktrees): avoid auto-maintenance in create fetches (#8039) 
* perf(worktrees): avoid auto-maintenance in create fetches

Git's opportunistic maintenance can keep an already-complete exact-base fetch open for seconds. Disable it per command for create-base refreshes only, leaving ordinary fetch maintenance and exact-ref freshness unchanged.

* docs(worktrees): explain create fetch maintenance scope

* test(worktrees): account for fetch config prefixes

* fix(worktrees): cover Git 2.29 auto maintenance
 2026-07-10 02:31:47 -07:00
Brennan BensonBrennan BensonClaude
 		b7e84aea3c Fix automatic branch rename for non-English git locales (#8012) 
* Fix automatic branch rename for non-English git locales

A gettext-enabled git (Homebrew git, most Linux distro gits) under a
non-English locale translates every diagnostic, including the `fatal:`
prefix, so Orca's stderr phrase parsers stop matching. The first-message
branch auto-rename was the headline casualty: isNoUpstreamError missed
the translated no-upstream error, branchHasUpstream failed closed to
"has upstream", and the rename settled silently and permanently.

- Force LC_ALL=C on all Orca-spawned machine-parsed git: the local
  prompt-guard env chokepoint, the three relay git spawn sites, and both
  local clone spawns (progress + failure-message parsing). User
  terminals are untouched.
- Replace the boolean upstream check with a tri-state probe: rename
  proceeds only on a proven missing upstream; an unreadable probe now
  raises the rename-failed badge and retries instead of settling.

Fixes #7808

🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>

* Consolidate untranslated-git-locale into runner and relay primitives

Replace the five per-site LC_ALL=C patches with one shared
UNTRANSLATED_GIT_OUTPUT_ENV (LANGUAGE=en LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8) injected inside the git runner primitives
(promptGuardGitEnv, gitSpawn, gitExecFileSync, gitExecFileAsyncBuffer)
and a relay buildRelayGitEnv() helper, so every current and future
machine-parsed git spawn is covered by construction — including the
fs-handler-git-fallback sites the per-site approach missed. The UTF-8
English locale keeps a UTF-8 LC_CTYPE for hooks git spawns; LANGUAGE is
pinned because gettext consults it before LC_ALL.

WSL-routed git gets the same values as a shell assignment prefix built
in resolveCommand, since spawn env cannot cross the wsl.exe boundary —
closing the WSL gap the first pass accepted.

Also scrub credential-bearing remote URLs from the probe-failed message
surfaced on the worktree card.

🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>

* Scrub credential-bearing URLs from clone failure messages

---------

Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-10 01:03:16 -07:00
Brennan BensonOrcaBrennan Benson
 		e7ee15f4b2 Improve workspace cleanup list (#7053) 
* Improve workspace cleanup list

Co-authored-by: Orca <help@stably.ai>

* Address workspace cleanup review feedback

Co-authored-by: Orca <help@stably.ai>

* Fix workspace cleanup perf findings

Co-authored-by: Orca <help@stably.ai>

* Avoid stale cleanup progress cache

Co-authored-by: Orca <help@stably.ai>

* Complete workspace cleanup perf fixes

Co-authored-by: Orca <help@stably.ai>

* Fix worktree list option forwarding

Co-authored-by: Orca <help@stably.ai>

* Address workspace cleanup review nits

Co-authored-by: Orca <help@stably.ai>

* Fix workspace cleanup removal review findings

- Fail a queued removal that now needs a force the user never approved
  (confirm-time approvedCandidates snapshot compared in preflight)
- Reword the 120s removal timeout to say removal continues in background
- Wire suppressPreservedBranchToast into cleanup removals
- Stop statting a repo after the first activity metadata timeout
- Document the WSL 9P best-effort stat gap; drop unused locale key

Co-authored-by: Orca <help@stably.ai>

* Split workspace-cleanup slice test to satisfy max-lines

Rebasing onto latest main pushed the combined store-slice test over the
800-line cap. Extract shared fixtures into a test harness and split the
suite into scan-progress and removal-preflight files instead of adding a
forbidden max-lines suppression.

---------

Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
 2026-07-09 16:24:20 -07:00
Neil ce687221d3 lint(unicorn): enable prefer-number-properties, prefer-array-find, prefer-array-index-of (#7516) 
Enable three unicorn rules — one correctness, two performance — and fix every
existing violation repo-wide so the rules pass as errors.

prefer-number-properties (76 sites)
- parseInt/parseFloat/NaN -> Number.* : safe aliases (autofixed).
- isNaN -> Number.isNaN (12 sites, hand-converted): global isNaN coerces its
  argument, Number.isNaN does not. Verified every call site already passes a
  number (Number.parseInt results, number-typed fields, Date.getTime()), so the
  conversion is behavior-preserving today and guards against a future non-numeric
  argument silently coercing.

prefer-array-find (26 sites)
- .filter(pred)[0] -> .find(pred); .filter(pred).at(-1) / .pop() -> .findLast(pred).
  Drops the intermediate array and short-circuits.

prefer-array-index-of (5 sites)
- .findIndex(x => x === v) -> .indexOf(v).

Verified: typecheck (node/cli/web) clean, 53 affected suites pass (1679 tests),
oxlint clean repo-wide. mobile/ uses findLast safely (already ships ES2023
.toReversed()); config scripts and e2e helpers run on Node 24.
 2026-07-05 23:56:37 -07:00
NeilandOrca 46646d7ff1 chore(lint): upgrade oxlint to 1.71 + enable 7 new rules (autofixed backlog) (#6841) 
* chore(lint): upgrade oxlint to 1.71 and enable 7 new rules

Upgrade oxlint 1.67.0 -> 1.71.0 (1.72 was blocked by the repo's 3-day
minimum-release-age supply-chain guard; nothing here needs it). The
bump is a no-op on the existing config.

Enable 3 error rules (backlog autofixed to zero in this commit) and
4 warn rules (surface signal without gating CI):

error (autofixed, behavior-preserving):
- unicorn/prefer-node-protocol        (~1531 sites: bare builtin -> node:)
- typescript/no-import-type-side-effects (~36: all-inline-type -> import type)
- unicorn/no-array-reverse            (19: copy-then-reverse -> toReversed)

warn (real signal, current fires are test-only/correct):
- unicorn/no-array-fill-with-reference-type  (aliasing footgun guard)
- typescript/no-unsafe-function-type         (bans bare Function type)
- unicorn/prefer-array-flat-map              (map().flat() -> flatMap())
- unicorn/prefer-regexp-test                 (.match() in bool ctx -> .test())

mobile/.oxlintrc.json extends root, so it inherits all 7; the autofix
ran from root and covered mobile/ too.

Verification (all green): oxlint 0 errors (root+mobile+aux configs),
oxfmt clean, typecheck (node+cli+web), vitest 22795 passed / 0 failed,
builds (electron-vite + web + cli) succeed. node: rewrites confirmed to
skip embedded SSH/CLI string payloads (AST-only); all toReversed sites
verified to operate on fresh copies or write-once locals.

* chore(lint): bump mobile oxlint to 1.71 so inherited rules parse

mobile/ is a standalone pnpm project pinning its own oxlint@1.67, which
lacks unicorn/no-array-fill-with-reference-type (needs >=1.70). Since
mobile/.oxlintrc.json extends the root config, mobile CI's 'cd mobile &&
oxlint' failed to parse the new rule. Bump mobile to match root (1.71).

Verified in mobile/: oxlint 0 errors, oxfmt --check clean, tsc --noEmit
pass, vitest 978 passed / 0 failed.

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>
 2026-06-29 22:38:29 -07:00
Brennan Benson 929ad7dbde Fix deleting a worktree's preserved branch over SSH (#6480) 2026-06-29 00:39:45 -07:00
lvfenandJinjing b776506809 Support submodule diffs and upstream-base compares in Source Control (#6350) 
* feat(source-control): show submodule diffs with lazy expansion

Dirty submodules now expand inline in Source Control to reveal their
inner changes, with file-level diffs that are read-only from the parent
worktree. Inner status is fetched lazily only when a submodule is
expanded, so status polling never recurses into (possibly nested)
submodules. Adds a submodule-status path across local and SSH runtimes
and git providers.

* feat(source-control): add compare-against-current-branch setting

Adds a global setting (default off) that defaults the Source Control
compare base to the current branch's upstream so the panel prioritizes
local changes instead of the full delta versus the repository default
branch. When the branch has no upstream, the compare view falls back to
working-tree-only. This affects only the compare/diff view; the Pull
Request and rebase merge target are unchanged.

* refactor(source-control): extract submodule status hook and entry-action gates

Moves the lazy submodule-expansion state into a useSourceControlSubmoduleStatus
hook and centralizes per-row stage/unstage/discard eligibility into
source-control-entry-actions, shrinking SourceControl.tsx and keeping the
read-only submodule rules consistent across the row UI, bulk actions, and tests.
The hook adds a generation guard so a slow submodule-status response from a
previous worktree (common over SSH) can't write stale status into the current
panel. On the relay side, configured submodule paths are read through a
short-TTL per-instance cache so a burst of diff clicks does not re-read
.gitmodules over the SSH link. Adds tests for the new modules.

* fix(source-control): address submodule/compare review feedback

- Degrade git.submoduleStatus to an actionable reconnect hint when an older
  SSH relay lacks the RPC, mirroring clone()/worktreeIsClean fallbacks.
- Keep the branch-compare summary while upstream status is still loading so
  it no longer flickers when switching worktrees with prefer-upstream on.
- Mark the compare-base switch as type="button" to avoid form submission.
- Add diff base / source control keywords to the Git settings search catalog.
- Assert the compare-base toggle's own switch state and updateSettings call.

* fix(source-control): address second-round submodule/compare review feedback

- Route submodule inner diffs through resolveSubmoduleWorktreePath so a
  crafted .gitmodules path can't escape the selected worktree
- Clear statusReadsInFlight alongside the diff dedupe on git mutations so a
  post-mutation getStatus() can't join a stale in-flight read
- Clear the SSH diff dedupe in getSubmoduleStatus to mirror getStatus
- Derive list-view selection from the submodule-injected rows so expanded
  submodule children are selectable
- Refresh commit history when the upstream compare base changes

* Support staged submodule expansion and refine default compare base

- Support expanding and diffing staged submodule changes (HEAD vs index) independently of unstaged changes (index vs worktree).
- Track submodule expansion states using a compound key of area and path to prevent conflicts between staged and unstaged listings.
- Update the compare-against-upstream setting to a segmented control for the "Default Compare Base" policy.
- Fall back to the repository default branch when comparing a branch with no upstream, preventing comparison views from unexpectedly disappearing.

* Fix submodule staging behavior, WSL caching, and double-click toggles

- Namespace submodule path cache per WSL distro to prevent cross-distro
  collisions.
- Preserve the staged area of child entries when expanding unstaged
  submodules so staged inner changes do not open empty diffs.
- Prefix oldPath with the submodule path for renamed inner entries.
- Ignore click events where detail > 1 to prevent double-clicks from
  instantly collapsing newly expanded submodules.

* Secure submodule path resolution and prevent stale status updates

* Extract and centralize submodule path validation into a new
  `resolveSubmoduleWorktreePath` helper to prevent path traversal
  exploits when resolving paths from untrusted `.gitmodules` files.
* Invalidate submodule expansion state and increment the query
  generation whenever the active runtime environment or connection
  route changes, preventing out-of-order responses from writing
  stale data.

* Set git identity via CLI config options in test commits

- Extract test email and name into constants.
- Use `-c` config flags to pass user identity to `git commit` dynamically.
- This ensures commits succeed in submodule checkouts or CI environments
  where a local or global identity is not configured.

---------

Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
 2026-06-28 23:43:33 -07:00
Brennan BensonandOrca 6015ad07a0 Show working tree in file explorer for repos using a separate Git directory (#6482) 
Co-authored-by: Orca <help@stably.ai>
 2026-06-28 11:46:59 -07:00
Brennan BensonandNeil 829f8d9618 Reduce duplicate diff loading work (#6389) 
* Deduplicate in-flight diff reads

* Clear diff dedupe for ref-moving SSH operations

* Clear diff dedupe for worktree ref mutations

* Document diff dedupe mutation invalidation

---------

Co-authored-by: Neil <neil@stably.ai>
 2026-06-25 18:47:26 -07:00
Brennan BensonandOrca 8228155e4d Improve preserved branch cleanup after squash merges (#6014) 
Co-authored-by: Orca <help@stably.ai>
 2026-06-21 18:48:59 -07:00
Jinjing 5903b4a742 fix: address pull reconciliation policy errors (#5562) 2026-06-16 20:13:46 -07:00
Brennan BensonandOrca 7077736602 Create folder workspaces from project groups (#5474) 
Co-authored-by: Orca <help@stably.ai>
 2026-06-16 18:04:50 -07:00
Jinwoo HongandOrca e3bf7d8614 feat(mobile): pickers, workspace parity, active-workspace focus, tap-to-open, source-control parity, artifact viewing (#5330) 
Co-authored-by: Orca <help@stably.ai>
 2026-06-15 22:02:51 -07:00
Trevin ChowandJinjing 3ec1a36ba9 feat: add safe fork upstream sync setting (#5408) 
* add safe fork upstream sync setting

* fix fork sync review feedback

* Review safe fork sync setting

* Fix local preflight env typing

* Fix onboarding flow SSR test tooltip provider

---------

Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
 2026-06-15 19:41:45 -07:00
+3
Jinwoo HongOrcaBryant UngClaude Fable 5Neilgithub-actions[bot]JinjingBorjaParker RexBrennan BensonTrevin Chowbuf0-bot[bot]orca-bug-scan-bot
 		36277801e4 Make remote hosts first class: concurrent multi-host workbench (#5071) 
* Restore the outlined server card for host headers

Feedback: the bordered card with the server glyph made it clearer that
a host section is a separate machine, not just another group. Bring
that back while keeping the recent quieting: no status dot when
healthy (marks only for connecting/blocked/error/disconnected), no
'This computer' detail on the local host, and collapse/menu/count
behavior unchanged.

Co-authored-by: Orca <help@stably.ai>

* Anchor host badge to its label, indent rows under host cards

Sidebar polish from review:
- The count badge sat in dead space between the label and the
  hover-only chevron/menu; it now hugs the label like repo headers
- Rows under a host card get a left inset so projects and workspaces
  visibly belong to the machine above them
- A host whose only visible row is a collapsed repo group counted 0
  while the group badge said 9; host counts now fall back to header
  counts for groups contributing no visible items

Co-authored-by: Orca <help@stably.ai>

* Two-tier sticky headers: pinned host card above pinned group header

When scrolling inside a host section, the host card now stays pinned at
the top (z-30) while project/status group headers hand off beneath it
(z-20, offset by the pinned card height). The host is the outer
hierarchy level, so it is the most persistent context — previously the
first repo header replaced it, losing 'which machine am I on' exactly
when it mattered. The pinned card keeps its collapse/menu/warning
affordances. Handoff rules: the next host card pushes the previous one
out at the viewport top; a group pins only once it reaches the slot
beneath the host card, and a previous host's group can never pin under
the next host. Without host sections the logic degrades to the original
single-tier behavior.

Co-authored-by: Orca <help@stably.ai>

* Revert host-section row indent

The two-tier sticky host card now provides continuous 'inside this
machine' context at any scroll depth, making the static indent
redundant — and it cost 12px of sidebar width on every row while
making multi-host layouts misalign with single-host ones. Host cards
bracketing their sections plus the pinned header carry the ownership
signal on their own.

Co-authored-by: Orca <help@stably.ai>

* Checkpoint multi-host sidebar and project-first notes

Co-authored-by: Orca <help@stably.ai>

* Add project-first compatibility persistence

Co-authored-by: Orca <help@stably.ai>

* Expose project host setup APIs

Co-authored-by: Orca <help@stably.ai>

* Group sidebar rows by project setup

Co-authored-by: Orca <help@stably.ai>

* Document project-first host model discussion

Co-authored-by: Orca <help@stably.ai>

* Resolve workspace creation through project host setups

Co-authored-by: Orca <help@stably.ai>

* Stamp workspace ownership with project host setup

Co-authored-by: Orca <help@stably.ai>

* Add project host setup existing folder API

Co-authored-by: Orca <help@stably.ai>

* Summarize project-first host model discussion

Co-authored-by: Orca <help@stably.ai>

* Add project host setup CLI commands

Co-authored-by: Orca <help@stably.ai>

* Allow CLI worktree creation by project host setup

Co-authored-by: Orca <help@stably.ai>

* Add workspace host setup picker

Co-authored-by: Orca <help@stably.ai>

* Add project host setup settings summary

Co-authored-by: Orca <help@stably.ai>

* Make project host setup settings navigable

Co-authored-by: Orca <help@stably.ai>

* Stabilize project host setup settings selector

Co-authored-by: Orca <help@stably.ai>

* Add project host existing-folder setup form

Co-authored-by: Orca <help@stably.ai>

* Update project host model implementation status

Co-authored-by: Orca <help@stably.ai>

* Keep projects outermost in default sidebar view

Co-authored-by: Orca <help@stably.ai>

* Update project-first sidebar status

Co-authored-by: Orca <help@stably.ai>

* Show host context in project sidebar groups

Co-authored-by: Orca <help@stably.ai>

* Show unavailable hosts in workspace run target

Co-authored-by: Orca <help@stably.ai>

* Import missing project host from composer

Co-authored-by: Orca <help@stably.ai>

* Clone project host setup from composer

Co-authored-by: Orca <help@stably.ai>

* Persist project host setup method

Co-authored-by: Orca <help@stably.ai>

* Clone project hosts over SSH

Co-authored-by: Orca <help@stably.ai>

* Improve SSH clone cancellation cleanup

Co-authored-by: Orca <help@stably.ai>

* Backfill workspace project host ownership

Co-authored-by: Orca <help@stably.ai>

* Gate project host setup runtime capability

Co-authored-by: Orca <help@stably.ai>

* Preserve independent project host setups

Co-authored-by: Orca <help@stably.ai>

* Add project host setup update API

Co-authored-by: Orca <help@stably.ai>

* Add project host setup delete API

Co-authored-by: Orca <help@stably.ai>

* Add project host setup create API

Co-authored-by: Orca <help@stably.ai>

* Expose project host setup lifecycle in renderer store

Co-authored-by: Orca <help@stably.ai>

* Handle independent project host setups in settings

Co-authored-by: Orca <help@stably.ai>

* Add pending host setup action in project settings

Co-authored-by: Orca <help@stably.ai>

* Show pending project host setup status in composer

Co-authored-by: Orca <help@stably.ai>

* Report pending setup state in workspace target resolution

Co-authored-by: Orca <help@stably.ai>

* Use shared host registry for project setup choices

Co-authored-by: Orca <help@stably.ai>

* Add settings clone flow for project host setups

Co-authored-by: Orca <help@stably.ai>

* Gate unavailable project host setup options

Co-authored-by: Orca <help@stably.ai>

* Gate unavailable project setup hosts in settings

Co-authored-by: Orca <help@stably.ai>

* Stream SSH clone progress to renderer

Co-authored-by: Orca <help@stably.ai>

* Update project host model status notes

Co-authored-by: Orca <help@stably.ai>

* Add CLI project host setup clone command

Co-authored-by: Orca <help@stably.ai>

* Make add project host aware

Co-authored-by: Orca <help@stably.ai>

* Complete project host setup validation

Co-authored-by: Orca <help@stably.ai>

* Recover floating workspace terminal WebGL atlas on reopen (#5069)

Co-authored-by: Orca <help@stably.ai>

* Fix stale terminal daemon spawn health (#5064)

Co-authored-by: Orca <help@stably.ai>

* Suspend floating workspace terminal WebGL while the panel is closed (#5073)

Co-authored-by: Orca <help@stably.ai>

* Fix source control branch compare base (#5074)

Co-authored-by: Orca <help@stably.ai>

* Fix workspace-creation tour panel clipped by the Create Worktree dialog (#5078)

* Fix workspace-creation tour panel clipped by the composer dialog

The tour panel portals into dialog/sheet content that clips overflow, but
its position was clamped against the window viewport. With the Project
field spanning nearly the dialog's full width, the panel landed past the
dialog's right edge and overflow-hidden cut it down to a sliver. Clamp
hosted panels within the host's bounds instead, so the panel flips below
the target and stays fully visible.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Add JSDoc docstrings to satisfy CodeRabbit docstring coverage check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Test hosted contextual tour overlay positioning

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>

* release: v1.4.56

* Handle buffer overflows gracefully and truncate diffs fairly (#5083)

- Gracefully fall back to file-name summaries when staged diffs exceed
  node/ssh execution maxBuffer limits, preventing generation failures.
- Split oversized diffs by file and allocate budget via water-filling,
  ensuring single huge files do not starve smaller human changes.
- Clip truncated diff sections on line boundaries to avoid half-lines.

* Wrap AI generation controls with tooltips and clean i18n dependencies (#5087)

- Wrap the AI generation button in a tooltip so users can see the
  disabled reason or the action description on hover.
- Add unit tests verifying tooltip triggers and aria-label safety.
- Simplify memo dependencies in settings metadata and worktree palette
  by using 'useTranslation()' to handle language-change rerenders
  directly without needing 'i18n.language'.

* fix: address review findings (#5088)

* Fix localization in repository hooks and base ref suggestion toast (#5089)

* Fix localization in base ref toast and custom hook description

- Localize the "commit"/"commits" plural nouns in the base ref toast.
- Translate missing suggestion toast strings for JA, KO, and ZH locales.
- Pass `{{artifact_url}}` as a literal template variable to translate
  calls to prevent i18next from treating it as a dynamic placeholder.

* Fix localization reactivity in RepositoryHooksSection

Move static variables containing translation calls into helper functions
and subscribe to translation updates using useTranslation. This ensures
that localized options, descriptions, and error messages refresh
dynamically when the user changes the UI language.

* Fix task page labels after language changes (#5086)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.57

* Fix automation tabs showing a shell instead of the live agent (#5099)

* Fix automation tabs showing a shell instead of the live agent

Opening a background automation's terminal tab showed a bare shell while
the agent (Claude) kept running headless — the sidebar updated but the
pane was attached to the wrong PTY.

On first mount the restored ptyId equals the tab ptyId, and
isSessionOwnedByWorktree() returns true for it, so connectPanePty routed
the still-live eagerly-spawned PTY into the daemon-reattach branch
(transport.connect({ sessionId })), which spawns a fresh shell and
orphans the live agent PTY instead of adopting it via attach()+replay.

Part A: gate the deferred reattach on the absence of a live eager buffer.
A live eager buffer means the PTY is a still-running local session to
adopt (attach + replay), not a daemon session to re-connect. Daemon
reattach and remote PTYs are unaffected (gated on the eager buffer).

Part B: publish never-mounted background automation tabs into the runtime
graph (gated on a live eager buffer) so the live agent PTY binds to its
real tab instead of surfacing as an orphan `pty:<id>` terminal — fixing
`orca terminal list`, the CLI, and automation session-reuse.

Adds a characterization test (fails on the old code, passes now) and a
runtime-graph publish test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Harden eager PTY tab adoption

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>

* Fix i18n label spacing in menus and settings (#5108)

* fix i18n label spacing

* Fix localized account runtime labels

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>

* Improve localization catalog sync workflow (#5110)

Co-authored-by: Orca <help@stably.ai>

* Add Warp terminal theme import (#4714)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.58

* Tidy README badge layout

* Handle integration credential decrypt failures (#4683)

Co-authored-by: Orca <help@stably.ai>

* Fix git repo telemetry for repo adds (#5121)

Co-authored-by: Orca <help@stably.ai>

* Add feature interaction usage bucket telemetry (#5119)

Co-authored-by: Orca <help@stably.ai>

* Reset WebGL glyph atlases globally to stop cross-terminal glyph corruption (#5122)

Co-authored-by: Orca <help@stably.ai>

* perf(windows): fix 60s startup ACL walk and OpenCode streaming freeze, with benchmark harnesses (#5124)

* release: v1.4.59-rc.0

* Fix packaged shell PATH order (#5125)

Co-authored-by: Orca <help@stably.ai>

* Add Floating Workspace contextual tour (#5062)

* Add floating workspace contextual tour

Co-authored-by: Orca <help@stably.ai>

* Clarify floating workspace tour intro copy

Co-authored-by: Orca <help@stably.ai>

* Differentiate floating workspace tour steps instead of repeating examples

Co-authored-by: Orca <help@stably.ai>

* Lead floating workspace tour with the user benefit

Co-authored-by: Orca <help@stably.ai>

* Pitch floating workspace tour around cross-repo agents

Co-authored-by: Orca <help@stably.ai>

* Refine floating workspace tour step 1 copy

Co-authored-by: Orca <help@stably.ai>

* Anchor floating workspace tour step 2 on the minimize control

Co-authored-by: Orca <help@stably.ai>

* Restore floating workspace tour step 2

Co-authored-by: Orca <help@stably.ai>

* Anchor floating workspace tour steps on New Terminal and New Markdown Note

Co-authored-by: Orca <help@stably.ai>

* Retitle floating workspace tour step 2 as scratchpad

Co-authored-by: Orca <help@stably.ai>

* Add why-comments for tour selector fallback and placement flipping

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>

* Fix source control compare base ambiguity (#5127)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.59-rc.1 [rc-slot:2026-06-10-15]

* release: v1.4.59

* Default-driven create-project flow: name-first form with sensible defaults (#5115)

Co-authored-by: Orca <help@stably.ai>

* Redesign Connect integrations (#4531)

Co-authored-by: Orca <help@stably.ai>

* Expose E2E store via build mode

* File search match counts (#5085)

* Add matchCount to SearchFileResult for accurate per-file hit counts

Co-authored-by: Orca <help@stably.ai>

* Add file search match count design

* rm design doc

---------

Co-authored-by: Orca <help@stably.ai>

* fix: address review findings (#5139)

* perf(windows): avoid blocking daemon pid checks (#5137)

* release: v1.4.60-rc.0

* release: v1.4.60

* Preserve core workflow terms in English and apply CJK spacing (#5141)

* Preserve core workflow and product terms in English across locales

Update translation policy to prevent localization of key terms such as
"Agent", "Commit", "Markdown", and "Terminal". This ensures consistent
jargon and product branding.

Introduce CJK-Latin term spacing to keep these Latin terms legible
when combined with CJK text, while adjusting Korean particle spacing.
Also add overrides to prevent network proxy settings from being
mistranslated as "Agent".

* Preserve repo terminology in English and localize source control labels

Treat "repo" and "repos" (and their capitalized forms) as brand terms
that should remain in English/Latin across CJK and Spanish locales.
Update translation files and policies to replace translated words like
"repositorio" or "リポジトリ" with "repo"/"repos", and fix an issue where
latin brand terms could be incorrectly matched as substrings in larger
words during cleanup.

Additionally, externalize and localize the "Staged Changes", "Changes",
and "Untracked Files" section labels in the source control sidebar.

* UX (#5143)

* UX/copy tweaks (#5142)

* UX/copy tweaks

* UX/copy tweaks

* Fix missed star UI translations (#5148)

* fix: make windows ssh relay deploy survive session teardown (#5136)

* Add option to remove child projects when deleting repo groups (#4702)

Co-authored-by: Orca <help@stably.ai>

* fix: remove checks panel response badge (#5147)

* Add read-only `orca linear` CLI with trusted launch-prompt pointer (V1) (#5126)

Co-authored-by: Orca <help@stably.ai>

* Add AI Vault session history

## Summary
- add AI Vault session scanning and resume command construction
- add the Agents sidebar panel with filtering, grouping, copy/open actions, and local resume launch
- support dragging saved sessions onto terminal split panes

## Validation
- pnpm run lint
- pnpm run typecheck
- pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/register-core-handlers.test.ts src/main/ai-vault/session-scanner.test.ts src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts src/renderer/src/lib/ai-vault-session-drag.test.ts src/renderer/src/lib/launch-ai-vault-session.test.ts

* Default agent launches to yolo permissions mode (#5145)

* Default agent launches to yolo mode

* test: update launch default validations

* Fix Claude usage refresh error copy (#5155)

Co-authored-by: Orca <help@stably.ai>

* Move workspace board to sidebar bottom toolbar (#5146)

Co-authored-by: Orca <help@stably.ai>

* Rebuild contextual tour positioning on floating-ui; fix hosted dialog placement and arrow seam (#5154)

Co-authored-by: Orca <help@stably.ai>

* Fix missing spaces in cross-repo switch dialog (#5158)

* Fix Ctrl+Tab switcher selection on release (#5116)

* Fix additional i18n spacing regressions from #4995 (#5159)

* Refine add project selection styling (#5160)

Co-authored-by: Orca <help@stably.ai>

* improve chinese localization (#5162)

* Fix floating workspace needing two clicks after app switch (macOS) (#5128)

* Autofocus feedback textarea when Send Feedback dialog opens (#5164)

* fix: address pr-bug-scan validated finding from #4683 (#5151)

Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces

Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>

* fix: enable claude agent teams by default (#5168)

* Refresh Jira and Linear status after credential errors (#5169)

* fix: address pr-bug-scan validated finding from #4683

Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces

* Refresh Jira and Linear status to clear stale credential errors

Ensure stale credential decryption errors are cleared from the store
status once a successful API read completes. By updating the check in
shouldRefreshStatusAfterRead to trigger when a credentialError is
currently set, successful issue or list fetches will trigger a status
check and remove stale error flags.

---------

Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>

* Hide internal context from AI Vault titles (#5175)

* Fix detached HEAD publish actions (#5173)

* Keep freshly split terminal pane mounted if newborn PTY exits early (#5171)

Prevent a newly split pane from collapsing immediately if its PTY exits
during initial setup before any output is received or input is sent.
This ensures a failed startup session remains visible to the user.

* Route task PR queries by upstream source (#5176)

* Route task PR queries by upstream source

Implements the routing described in docs/tasks-pr-upstream-source.md so task PR and issue queries stay scoped to the selected source.

* rm design doc

* Prevent stale PR refreshes from restoring unlinked review state (#5180)

- Pass `worktreeId` to `fetchPRForBranch` to track active worktree context
- Ignore inflight or queued PR fetches if the worktree has been unlinked
- Include linked PR/MR metadata in the checks panel snapshot key to trigger updates immediately on link/unlink events

* Fix Claude agents management status detection (#5179)

Co-authored-by: Orca <help@stably.ai>

* fix: address review findings (#5177)

* Allow resolving selected review comments with AI (#5184)

* Allow resolving selected PR/MR review comments with AI

Users can now select specific unresolved review comments or threads in
the Checks panel sidebar, queue them, and trigger an AI agent to address
them, marking resolved threads on the host upon agent launch.

- Adds checkboxes and action/send buttons to select and queue comments.
- Builds a structured, robust prompt with sanitized comment metadata.
- Optimistically marks threads resolved on launch with rollback on error.
- Supports both GitHub PRs and GitLab MRs.

* Consolidate PR comment selection state and eliminate effects

Combine independent selection states and context-tracking into a single
state object. Derive active selection data and prune ineligible comments
during render using useMemo instead of relying on asynchronous
useEffect synchronization hooks.

* Improve source control action dialog layout and recipe saving UX (#5153)

* Improve source control agent action dialog layout and recipe UX

- Constrain dialog and scroll area heights to prevent viewport overflow.
- Add variable chips to easily insert the base prompt with tooltip previews.
- Keep the recipe save controls visible when a recipe is already saved, showing informational status text instead of hiding them.
- Update localized copy across multiple languages and reduce textarea rows.
- Add unit tests for the variable chip preview and save target visibility.

* Fix recipe-saved check in source control action dialog

* Evaluate only the selected save target instead of checking all available targets, as the action only writes to the selected target.
* Update daemon PTY adapter test fake PID to prevent collision with real host OS processes during runtime directory lookups.

* fix: remove unsupported agent launch defaults (#5185)

* Update Chinese and Japanese translations for worktrees and fixes (#5187)

- Correct awkward Chinese translation of "fix" ("使固定") to "修复" and "基本的" to "主工作树" (main worktree).
- Improve Japanese translation of "fix" from physical repair ("修理") to software correction ("修正").

* Embed hosted review creation composer directly in Checks panel (#5140)

* Embed hosted review creation composer directly in the Checks panel

- Replaces the modal pull request/merge request creation dialog with an
  inline composer embedded in the empty state of the Checks sidebar.
- Extracts and moves pull request generation state to a dedicated store
  slice so AI-generated details are persisted across sidebar unmounts.

* Fix hosted review composer feedback

* Combine file search and file explorer right sidebar tabs (#5182)

Unifies file discovery and tree navigation under a single Explorer domain, simplifying the right sidebar activity bar and reducing tab clutter.

* Replaces the standalone 'search' activity bar tab with a nested 'search' subview inside the File Explorer tab
* Introduces 'rightSidebarExplorerView' ('files' | 'search') state to manage the active subview inside the Explorer
* Adds a search button to the File Explorer toolbar and a back button to the search subview for seamless transition
* Exposes 'showRightSidebarFiles' and 'showRightSidebarSearch' store actions to route and seed search queries/include patterns
* Adapts file explorer keybindings, git status polling, and external workspace watchers to respect the active subview
* Maps legacy persisted search tab state to the new explorer search view for backward compatibility

* release: v1.4.61-rc.1

* Add multi-repo folder workspaces (v1) (#5172)

Co-authored-by: Orca <help@stably.ai>

* release: v1.4.61-rc.2

* Hide unavailable project hosts in worktree composer

Co-authored-by: Orca <help@stably.ai>

* Remove inline project host setup from composer

Co-authored-by: Orca <help@stably.ai>

* Mark imported project host setup methods

Co-authored-by: Orca <help@stably.ai>

* Fix rebase merge fallout

Co-authored-by: Orca <help@stably.ai>

* Disable unavailable Add Project hosts

Co-authored-by: Orca <help@stably.ai>

* Compact Add Project host selector

Co-authored-by: Orca <help@stably.ai>

* Hide redundant SSH target chooser

Co-authored-by: Orca <help@stably.ai>

* Browse SSH clone destinations

Co-authored-by: Orca <help@stably.ai>

* Avoid local clone defaults for SSH hosts

Co-authored-by: Orca <help@stably.ai>

* Polish host-aware Add Project flows

Co-authored-by: Orca <help@stably.ai>

* Polish remote host add project flows

Co-authored-by: Orca <help@stably.ai>

* Remove redundant host kind chips

Co-authored-by: Orca <help@stably.ai>

* Fix remote project setup UX gaps

Co-authored-by: Orca <help@stably.ai>

* Fix multihost workspace composer project identity

Co-authored-by: Orca <help@stably.ai>

* Finish host context merge repair

Co-authored-by: Orca <help@stably.ai>

* Continue host context checklist implementation

Co-authored-by: Orca <help@stably.ai>

* Route Linear and Jira tasks by source context

Co-authored-by: Orca <help@stably.ai>

* Preserve Linear task source context in history

Co-authored-by: Orca <help@stably.ai>

* Scope task retry state by source context

Co-authored-by: Orca <help@stably.ai>

* Route GitHub drawer reads by source context

Co-authored-by: Orca <help@stably.ai>

* Guard GitLab selectors with repo context

Co-authored-by: Orca <help@stably.ai>

* Guard GitHub metadata selectors

Co-authored-by: Orca <help@stably.ai>

* Route GitHub task row actions by source context

Co-authored-by: Orca <help@stably.ai>

* Update GitHub source-context checklist status

Co-authored-by: Orca <help@stably.ai>

* Show host ownership for CLI provider accounts

Co-authored-by: Orca <help@stably.ai>

* Persist GitLab task detail source context

Co-authored-by: Orca <help@stably.ai>

* Show host scope for provider API budgets

Co-authored-by: Orca <help@stably.ai>

* Preserve Jira task source context

Co-authored-by: Orca <help@stably.ai>

* Scope Jira optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Resolve task PR bases on run host

Co-authored-by: Orca <help@stably.ai>

* Record Jira task workspace usage

Co-authored-by: Orca <help@stably.ai>

* Scope Linear optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Scope GitHub optimistic task patches

Co-authored-by: Orca <help@stably.ai>

* Clean host copy in onboarding flows

Co-authored-by: Orca <help@stably.ai>

* Preserve automation CLI run context

Co-authored-by: Orca <help@stably.ai>

* Add automation CLI source context selector

Co-authored-by: Orca <help@stably.ai>

* Clarify unavailable task source hosts

Co-authored-by: Orca <help@stably.ai>

* Surface host model runtime capability skew

Co-authored-by: Orca <help@stably.ai>

* Use SSH host copy in reconnect dialog

Co-authored-by: Orca <help@stably.ai>

* Show host context in task source picker

Co-authored-by: Orca <help@stably.ai>

* Mark task source display complete

Co-authored-by: Orca <help@stably.ai>

* Clarify provider account host selection

Co-authored-by: Orca <help@stably.ai>

* Guard task source switching boundary

Co-authored-by: Orca <help@stably.ai>

* Mark task source diagnostics persisted

Co-authored-by: Orca <help@stably.ai>

* Mark base resolution host boundary

Co-authored-by: Orca <help@stably.ai>

* Clarify external automation source states

Co-authored-by: Orca <help@stably.ai>

* Harden project host compatibility projection

Co-authored-by: Orca <help@stably.ai>

* Finish host copy audit

Co-authored-by: Orca <help@stably.ai>

* Add provider host scope controls

Co-authored-by: Orca <help@stably.ai>

* Show task source account labels

Co-authored-by: Orca <help@stably.ai>

* Show automation run context in CLI

Co-authored-by: Orca <help@stably.ai>

* Scope Jira task cache lookups by source

Co-authored-by: Orca <help@stably.ai>

* Seed workspace creation from task source context

Co-authored-by: Orca <help@stably.ai>

* Explain disabled external automation actions

Co-authored-by: Orca <help@stably.ai>

* Surface task source runtime capability gaps

Co-authored-by: Orca <help@stably.ai>

* Persist automation run context from UI saves

Co-authored-by: Orca <help@stably.ai>

* Require workspace run capability for setup hosts

Co-authored-by: Orca <help@stably.ai>

* Disable automation runs for stale host setup

Co-authored-by: Orca <help@stably.ai>

* Route GitHub drawer metadata by source host

Co-authored-by: Orca <help@stably.ai>

* Guard runtime project setup mutations by host model

Co-authored-by: Orca <help@stably.ai>

* Route PR page metadata by repo host

Co-authored-by: Orca <help@stably.ai>

* Route PR mention metadata by repo host

Co-authored-by: Orca <help@stably.ai>

* Route GitHub Project edits by view source

Co-authored-by: Orca <help@stably.ai>

* Clarify runtime automation disabled states

Co-authored-by: Orca <help@stably.ai>

* Guard runtime automation backend dispatch

Co-authored-by: Orca <help@stably.ai>

* Preserve GitLab task source identity

Co-authored-by: Orca <help@stably.ai>

* Remove redundant SSH target row in add project

Co-authored-by: Orca <help@stably.ai>

* Add task source provider availability reasons

Co-authored-by: Orca <help@stably.ai>

* Surface task provider preflight availability

Co-authored-by: Orca <help@stably.ai>

* Record local GitHub task source verification

Co-authored-by: Orca <help@stably.ai>

* Record Linear task source verification

Co-authored-by: Orca <help@stably.ai>

* Show automation source context in details

Co-authored-by: Orca <help@stably.ai>

* Record remote capability negotiation coverage

Co-authored-by: Orca <help@stably.ai>

* Record local add project create verification

Co-authored-by: Orca <help@stably.ai>

* Scope Linear cached task reads by source

Co-authored-by: Orca <help@stably.ai>

* Preserve PR generation host ownership

Co-authored-by: Orca <help@stably.ai>

* Route git operations by owner host

Co-authored-by: Orca <help@stably.ai>

* Route delete warnings by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route editor drops by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route agent draft paste by tab owner

Co-authored-by: Orca <help@stably.ai>

* Route file explorer requests by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Document remaining host context gaps

Co-authored-by: Orca <help@stably.ai>

* Check runtime task source provider auth

Co-authored-by: Orca <help@stably.ai>

* Validate automation source availability

Co-authored-by: Orca <help@stably.ai>

* Route remaining UI requests by owner host

Co-authored-by: Orca <help@stably.ai>

* Route quick open file listing by worktree owner

Co-authored-by: Orca <help@stably.ai>

* Route typed GitHub lookups by source host

Co-authored-by: Orca <help@stably.ai>

* Centralize automation run identity fallback

Co-authored-by: Orca <help@stably.ai>

* Surface unsupported task source providers

Co-authored-by: Orca <help@stably.ai>

* Document automation legacy repo compatibility

Co-authored-by: Orca <help@stably.ai>

* Record live host model verification

Co-authored-by: Orca <help@stably.ai>

* Quiet disconnected SSH polling

Co-authored-by: Orca <help@stably.ai>

* Verify task drawer source boundaries

Co-authored-by: Orca <help@stably.ai>

* Verify GitLab repo source selectors

Co-authored-by: Orca <help@stably.ai>

* Route automations through owning host

Co-authored-by: Orca <help@stably.ai>

* Update host context verification checklist

Co-authored-by: Orca <help@stably.ai>

* Run remote automations headlessly in serve mode

Co-authored-by: Orca <help@stably.ai>

* Keep setup guide entry stable during refresh

Co-authored-by: Orca <help@stably.ai>

* Keep setup script prompt stable during host switches

Co-authored-by: Orca <help@stably.ai>

* Deduplicate Tasks project picker sources

Co-authored-by: Orca <help@stably.ai>

* Use project identity for Tasks picker dedupe

Co-authored-by: Orca <help@stably.ai>

* Add Tasks source host switcher

Co-authored-by: Orca <help@stably.ai>

* Refine Tasks source picker disclosure

Co-authored-by: Orca <help@stably.ai>

* Polish Tasks source picker hover

Co-authored-by: Orca <help@stably.ai>

* Open Tasks source menu on hover

Co-authored-by: Orca <help@stably.ai>

* Match Tasks source submenu hover behavior

Co-authored-by: Orca <help@stably.ai>

* Open Tasks source submenu from project row hover

Co-authored-by: Orca <help@stably.ai>

* Group automation project hosts

Co-authored-by: Orca <help@stably.ai>

* Tighten automation project picker density

Co-authored-by: Orca <help@stably.ai>

* Show selected host in Tasks project picker

Co-authored-by: Orca <help@stably.ai>

* Hide host labels for single-host project pickers

Co-authored-by: Orca <help@stably.ai>

* Use saved remote server names in host pickers

Co-authored-by: Orca <help@stably.ai>

* Use standard add project start for remote servers

Co-authored-by: Orca <help@stably.ai>

* Use saved host labels in workspace surfaces

Co-authored-by: Orca <help@stably.ai>

* Route remote browser tabs through runtime hosts

Co-authored-by: Orca <help@stably.ai>

* Keep sidebar project-first across grouping modes

Co-authored-by: Orca <help@stably.ai>

* Polish multi-host remote runtime UX

Co-authored-by: Orca <help@stably.ai>

* Fix CI lint and remove design notes

Co-authored-by: Orca <help@stably.ai>

* Fix CI test failures

Co-authored-by: Orca <help@stably.ai>

* Fix Windows CLI path expectation

Co-authored-by: Orca <help@stably.ai>

* Fix CI renderer test expectations

Co-authored-by: Orca <help@stably.ai>

* Fix remaining verify test failures

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Bryant Ung <bryant.ung@outlook.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Borja <3930245+BorjaLL@users.noreply.github.com>
Co-authored-by: Parker Rex <me@parkerrex.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Trevin Chow <trevin@trevinchow.com>
Co-authored-by: buf0-bot[bot] <252831055+buf0-bot[bot]@users.noreply.github.com>
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
 2026-06-13 18:53:01 -07:00
Brennan BensonandOrca 5424582b51 Suggest enabling local-main freshness when a new workspace finds it stale (#4888) 
* Suggest enabling local-main freshness when a new workspace finds it stale

Adds a "Keep Local Main Up to Date" suggestion path: when the setting is
off and a new workspace's local base branch is behind its remote, Orca
surfaces a one-time, dismissible toast nudging the user to enable it. The
toast is sticky (no auto-expire) so it can't be missed, with explicit
Turn On / Dismiss actions; dismissing (button, close X, or swipe) persists
localBaseRefSuggestionDismissed so the nudge — and its backend probe —
never runs again.

Also refactors the refresh logic so the advisory and mutating paths share
one fast-forward-safety evaluator, adds an SSH relay RPC for the ref
mutation, and fixes remote-tracking base parsing for fully-qualified refs.

Co-authored-by: Orca <help@stably.ai>

* fix: restore update-ref fast-forward for un-checked-out local base ref

The refactor that split refresh into evaluate + mutate dropped the
non-owner case: a local base branch checked out in no worktree was left
stale (return undefined) instead of fast-forwarded. Restore it across all
three layers — local evaluator/mutator, SSH evaluator, and relay handler
(which also removes the dead duplicated throw) — using the expected-old-OID
compare-and-swap form of update-ref so a concurrent ref move is a no-op.
The suggestion toast now also fires for this case.

Co-authored-by: Orca <help@stably.ai>

* refactor: restore resultBase spread in local-base-ref mutators

The evaluate/mutate split spelled out { baseRef, localBranch, status }
literally in the mutating paths; main used a resultBase spread. Restore
that pattern in both the local and SSH mutators — behavior-preserving,
collapses two identical skipped_error returns.

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>
 2026-06-08 13:19:45 -07:00
Neil 8ba451e8dd fix: preserve newline worktree paths 
Use porcelain-z worktree parsing with fallback line parsing so newline-containing worktree paths survive local and relay operations. Risk: low.
 2026-05-31 01:50:16 -07:00
Neil 6c9332004e fix: allow dot-dot-prefixed relay diff paths 2026-05-31 01:49:29 -07:00
Neil 760f5c34ec perf: classify relay bulk discard paths safely (#3770) 2026-05-30 09:37:17 -07:00
buf0-bot[bot]orca-bug-scan-botNeil
 		1844a992e8 fix: pr-bug-scan validated finding from #2947 (#2965) 
* fix: address pr-bug-scan validated finding from #2947

Prepended `:(literal)` pathspec magic to each path passed to `git clean -ffdx --` in both `cleanUntrackedPaths` call sites, so untracked filenames containing pathspec glob magic (`*`, `?`, `[`, `]`) a

* fix: literalize discard git pathspecs

---------

Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
 2026-05-30 01:25:41 -07:00
NeilOrcaJinwoo-H
 		386fc42564 Add Source Control fast-forward action (#3364) 
* Add source control fast-forward action

* Fix fast-forward overwrite error wording

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
 2026-05-30 02:06:12 -04:00
Jinjing 47dffe5308 fix: address review findings (#3014) 2026-05-28 16:13:45 -07:00
Jinwoo HongandOrca d917240499 Guard untracked discard against symlink escapes (#2947) 
Co-authored-by: Orca <help@stably.ai>
 2026-05-27 19:48:27 -07:00
Leynier Gutiérrez GonzálezOrcabrennanb2025
 		659fe79226 feat: add source control action to abort merge (#2092) 
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: brennanb2025 <brennankbenson@gmail.com>
 2026-05-27 14:59:23 -07:00
Trevin Chowandbrennanb2025 a65f7b4216 feat: auto-rename workspace branch from the first prompt (#2888) 
Co-authored-by: brennanb2025 <brennankbenson@gmail.com>
 2026-05-27 14:09:43 -07:00
Prethish KumarOrcaPrethish-Complyancebrennanb2025
 		3c59c019fc fix(worktree): add SSH preflight check for dirty worktree before archive hooks (#2912) 
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Prethish-Complyance <prethish@complyance.io>
Co-authored-by: brennanb2025 <brennankbenson@gmail.com>
 2026-05-27 13:32:52 -07:00