Top-level agent rows had no press, so a tap opened the workspace's active
tab; and a session the host list opens in-page read the pane only from
the shell route, which never has it.
Fixes#34235
* test: remove 25 low-value checks and six complete suites
* Remove deleted startup benchmark from plugin CI routes
* Remove CI route for deleted pet layout smoke suite
* test: repair retained E2E labels and collision lifetimes
* test: remove synthetic activation collision scaffolding
* fix: activate folders opened on the selected runtime
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(wsl-hosts): a stopped distro still lists all its projects after a restart
The desktop now keeps each WSL host's last project list (from the repo.list
answers the window already receives) and seeds those rows at startup before any
live host catalog is requested. The first live list replaces them, so projects
deleted on the host disappear on that fetch. Loading the saved list is a desktop
read only: no wsl.exe, no host RPC, no \\wsl.localhost access. The saved list is
cleared when the host is removed.
* fix(wsl-hosts): pin saved project list writes, removal, WSL gate and seed races
- Exempt HostRepoCatalogSnapshotPersistence.environmentId from the id-only
store write ratchet like the paired-server layout snapshot (the id names the host).
- A live list applied before the startup seed now skips that host's seed, and
a live answer requested before the seed may still drop seeded rows.
- Tests now count saves, cover remove then re-add, check paired servers in
storage and in the listing, and cover both seed/live-list orderings.
* WSL hosts: penguin mark for WSL host rows, and on the stopped-distro notice
Sidebar project headers and workspace rows that named a WSL host with a
text badge ("orca-demo (WSL)") now show a small penguin icon instead,
labelled and tooltipped "Runs on WSL: orca-demo (Linux)". The same mark
replaces the host chip in the jump palette. The "<distro> is stopped"
notice leads with the same penguin.
* Wait on the tooltip instead of sleeping in the WSL mark tests
* Redraw the WSL penguin as the classic mascot; focusable tooltip mark; muted token on the stopped notice icon
* Use the classic Linux mascot silhouette for the WSL penguin
* Tolerate unloaded runtime environments in the WSL host mark selector
* fix(wsl-hosts): keep the e2e fake WSL connector out of release builds
The fake WSL host connector was compiled into every build and honored
whenever ORCA_E2E_FAKE_WSL_HOSTS was set. Gate main and preload on
import.meta.env.MODE === 'e2e' (the mode every e2e build already uses),
so other builds fold the branch away and drop the module, and mark its
module-level schemas pure so none of it is retained.
* fix(wsl-hosts): build the e2e fake's zod schemas lazily so release builds drop them
Eager module-level zod chains survived tree-shaking even with a PURE
annotation on the outer call, so the fake's schema construction still
shipped in out/main/index.js.
wsl-host-paired-phone asserted the pre-#36771 'isn't running' copy; it now
asserts the stable remote_runtime_unavailable code and '<distro> is stopped'.
wsl-move-dialog's gate-closed case seeds a saved host, which since #34683 puts
the app in serve-only: the WSL hosts section still lists the host. Assert
instead that Add is hidden and the host row's menu has no move entry.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(wsl-hosts): remove a freshly installed orcad that fails its start check
A WSL connect that uploaded an orcad build whose candidate then failed its
preflight or readiness check left the complete install in place, so every
later connect reused the same broken bytes. deployOrcad now reports whether
it uploaded the slot and whether the candidate's own start check failed, and
the WSL deploy removes that slot under the same pins, liveness probe and GC
claim the version GC uses (active, rollback target, the serving daemon's
build, journaled transactions), so the next connect re-uploads it.
* fix(wsl-hosts): fence the failed-install removal and keep a slot any process runs from
Review follow-up. The pin check and the delete now run under the
activation fence (a held fence keeps the copy), so a concurrent connect
cannot preflight or launch the slot between them; it waits, finds the
slot gone and re-uploads. Liveness now also scans the process table and
the daemon pid files for anything running from the slot, because a
candidate's stop ends only its server, not a terminal daemon it spawned
there.
* fix(wsl-hosts): match the resolved slot path in the slot process probe
Node realpaths its entry, so a daemon behind a symlinked home or data
root names the resolved slot. The probe now also matches
$(cd slot && pwd -P)/ and answers UNKNOWN (keep) when it cannot resolve.
* test(wsl-hosts): wait for sibling slots to run before proving this slot idle
Replaces a fixed 100 ms sleep (flagged by test-no-real-time-wait) with an
expect.poll until each sibling's own slot probes LIVE, so the DEAD answer
for this slot is meaningful.
* fix(github): prefer the open PR when a branch has several
The branch lookup asked GitHub for one PR across all states. GitHub sorts
a branch's PRs newest first, so a closed PR opened after the live one
shadowed it and got linked to the worktree on every checkout.
Fetch a page of the branch's PRs, REST and the `gh pr list` fallback alike,
and take the open one; with none open, keep the newest as before.
* refactor(github): keep branch lookup casts on their own lines
---------
Co-authored-by: agustin2606 <agustinvarela2606@gmail.com>
* fix(claude): Full access approves Claude's own permission asks in chats
A Claude chat in Full access still showed Allow/Deny cards whenever Claude Code
forwarded an ask it keeps under bypass mode (ask rules, ask-answering hooks,
built-in shell safety checks). Approve those at once while the chat runs with
Full access, read per request; questions and plan approval still go to the user.
* fix(claude): Full access grant comes from the launch; Claude's mode reports restrict it in wire order
Only a process Orca launched with Full access can auto-approve Claude's own
asks; Own settings never does, whatever Claude reports. Claude's init/status
mode reports, read from stdout before the SDK sees them, can suspend and
restore that grant, and each permission request keeps the mode in effect at
its own position in the stream, so a paused journal consumer or a read-ahead
chunk cannot apply a report late or early. Questions, plan approval and
requests Claude flags as needing the person's answer keep their card.
* fix(claude): Full access keeps every request's own wire position and restores after an approved plan
A permission request Orca never saw on stdout no longer inherits a later
mode: each request keeps the first snapshot for its id until the SDK hands
it over, including after a cancel and past any number of unread requests,
and requests resent in initialize's reply are recorded where that reply
arrived. Approving a plan in a Full access chat now reads Claude's mode in
wire order, so the restore is sent even while the chat's presentation still
lags behind the plan report.
* test(claude): narrow contract-pin frames to permission requests with a type guard
* test(claude): count the policy's stdout search work instead of timing it
* test(claude): type the contract-pin frame guard with the fixture frame union
* refactor(claude): let the launch permissions wrap the exit handler, keeping acquisition under its line limit
* fix(native-chat): show a terminal's unsent input in the chat composer and replace it on send
Switching a pane to chat view now seeds the composer with the text left unsent in Claude Code's or Codex's input box, and a chat send clears every line of it instead of one Ctrl+U. The clear is confirmed with the same typed-only read and kept under the 64-byte chunk Claude Code reads as a paste.
* test(native-chat): drop the removed screen-text clear check from the background-rows test
* fix(native-chat): clear a seeded multi-line draft before typing a Codex command from chat
* test(native-chat): expect the typed command's clear argument in composer tests
* fix(native-chat): confirm a seeded draft is cleared before typing a Codex command
* fix(native-chat): find Claude's closing frame past dim suggestion rows
A typed-only read stopped at the suggestion row, so a draft under Claude's hidden caret never reached chat.
On a Nothing A065 (Adreno 730) the transparent pixels of these two
scroll layers turn black while a selection handle is dragged. Fill each
with the colour already behind it so the layer has nothing to drop.
Refs #36553
* fix(mobile): back from a session lands on its host's session list
A session opened from Home's "Jump back in" or a notification replaced the
host list it had just mounted, so Back went to Home. It is now pushed over
that list.
A session opened from the host list lives inside the list's own page, and
the stack holding it has one screen, so the iOS edge swipe belonged to the
parent screen and popped the whole host to Home. While the page claims Back
the parent's swipe is turned off too, and a left-edge pan on the shell view
sends Back to the page.
* fix(mobile): keep the host swipe off until its last page claim ends
Count claims per parent screen instead of guessing whether a shell is its
stack's root, and measure the back edge from the shell's own left edge so
a landscape safe area does not hide it.
* refactor(mobile): share the session route name and write the host swipe once per claim run
* test(mobile): give the catch-all screen mock a parent navigator
* fix(native-chat): an open chat moves to the account you switch to before its next message
A running chat's agent read its account only when it started, and nothing compared it with the
account a start would use now, so open chats kept answering on the old account after a switch.
The agent a chat runs now records the account its launch used, and the host's replace-before-the-
next-send check replaces an idle one whose account is no longer what a start would use. A chat
mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the
account they were created on are never compared.
A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer
writes its new account's list under its first account (STA-11281).
Tracked in STA-11211.
* fix(native-chat): declare the launch-account read for the runtime layer that wires the host
* fix(claude): find custom chat history before managed-account resume
* test(claude): assign the complete custom account home
* feat(native-chat): offer account switching and hand-off at usage limits
* fix: track the provider in account-list reload effects
* fix(native-chat): target recovery actions at the chat host and transcript
* fix(native-chat): verify account recovery for each chat on its host
* refactor(native-chat): retain the existing image-support result
* fix(native-chat): withdraw account recovery after failed eligibility reads
* fix(native-chat): leave unavailable recovery facts absent
* Align Japanese usage-limit recovery copy with catalog convention
* Preserve complete chat context through usage-limit recovery
* Keep Continue callback focus optional
* Keep recovery fixtures and account effects type safe
* Keep chat recovery on native sources and native accounts
* Validate native recovery files after path admission
* Use the optional cursor shape in recovery fixture
* fix(native-chat): exclude source CLI family from limit handoff
* Resolve recovery context in the owning workspace directory
* Add the continue-at-usage-limit-reset setting and its chat row lines
* Continue chats automatically after usage limits reset
* Fix automatic continuation fairness, lifecycle and host settings
* fix: bind automatic continuation withdrawal to accepted actions
* fix: withdraw source auto continuation after handoff starts
* Read unopened chats with the saved-record reader for usage-limit continue
Unopened chats were read through the raw-row replay, which no longer sees
chats saved as keyed records, so a usage-limited chat that was not open
was never continued after its reset. Read them the way the rest of the app
reads a chat without opening it. Also use the shared visible-tab check,
keep the ordinary rewind result without a sequence as main does, and adapt
two tests to the current queued-message and saved-status behavior.
* Keep a usage-limited turn idle after any rewind restores it
Rewind completion read the resulting conversation through the raw-row
replay, which no longer sees chats saved as keyed records, and a forked
rewind wrote its completion before the new history's records. So a
limited turn that a rewind brought back was continued automatically
after its reset. The completion now reads the saved result the way the
app reopens a chat, and the forked rewind writes its completion after
the new history in the same transaction.
* Type the usage-limit auto-continue test mock without an assertion
* Fix type errors from main's settings, failure-wording and refusal changes
* Keep ordinary settings replies when the paired host changes mid-call, and list the cancel method in wire contracts
Settings reads and writes that don't carry the automatic-continue choice go
through the common runtime call again, so a reply that completes after the
paired host is removed still merges, as before this change. Only a write of
that choice stays pinned to the host it was made for. The structured method
count and the cross-version method manifest now include the cancel method.
* Keep a stopped turn's automatic continue withdrawn when its usage limit arrives later
A person could Stop a running Codex turn, have the turn then end with a
usage-limit failure, and still get an automatic "Continue where you left
off." after the reset, because Stop had nothing to cancel yet. The journal
write that first reveals a limited turn the latest personal Stop owns now
saves the same exact cancellation in that transaction, and a Stop accepted
just after the limit landed withdraws it too. Resume, deleting a queued card
and restarting keep it withdrawn; manual Continue and later turns are
unaffected.
* Bound the automatic-continue sweep and keep notice rows from re-rendering
The 10-second sweep now does nothing while the setting is off, republishes
only chats with a scheduled continuation, reads at most three unopened chats
per pass, and keeps going when one chat's saved history can't be read (that
chat is retried after the others instead of stopping every chat on the host).
Settings writes republish only when the switch changes. Working out the
usage-limit cut no longer indexes the whole conversation on every streamed
row. The chat's notice rows no longer re-render for status changes they
don't show. Adds operation-count and render-count tests for these bounds.
* Test that streamed journal commits after a Stop scan no history and build no command index
Drives real Codex rows through the host at 20 and 200 history rows: each streamed commit runs the Stop's commit hook and the status projection's cut reader with no newest-turn scan, no render and no full command index; the next turn end scans once and renders nothing.
* Leave a usage limit manual once its reset passed more than a day ago
Turning automatic continue on later no longer sends into chats whose limit reset days ago. Eligibility, which the row's summary, the sweep and the pre-send recheck all read, now requires the reset to be within the last 24 hours; older limits show the usual manual actions and are never continued unasked.
* Show only manual actions for a usage limit Orca can never continue
A limit more than a day past its reset is never continued, but its row still showed the setting link, inviting people to turn on a switch that could not help that chat. One shared check now decides whether a cut can ever be scheduled; the status summary and the sweep's eligibility both use it, so past the bound the row keeps only Continue Now, Hand Off and Add Account. A row already on screen when the day passes drops the line on the shared minute clock; the host alone decides sends.
* List every journal row kind in the Stop cut filter
The type-aware lint requires exhaustive switches; epoch, tombstone, submission and queue rows still cannot reveal a cut.
* Type the status-subscription mock instead of casting its handler
The changed-code casting gate rejects type assertions; the mock now carries the real subscription signature, so the recorded handler is typed.
* Open store-less conversations without the Stop withdrawal hook
Acquisition-only opens have no record store, so a person's Stop followed by a limited turn end made the journal commit throw and drop the turn end. Install the withdrawal only when a store exists; without one there is no continuation to withdraw. Also narrow the status summary before reading it and type the sweep test's send mock.
* Show the open orchestration panel as a floating card
The open panel now floats in the closed tab's corner as a card as tall as
its rows. In chats it stops above the composer (the transcript frame
already ends there); in terminals it keeps the bottom quarter clear for
the CLI's prompt and recent output. Past that it scrolls inside.
* Keep the orchestration card's collapse button reachable in tiny panes
A terminal split can be 50px high, leaving the card no room under the 75%
limit, so its header and collapse button were clipped away. The card is
now never shorter than its header.
* Keep the orchestration card's collapse button inside narrow cards
In a narrow split the card is 20px narrower than the pane and its title
didn't truncate, so the collapse button was pushed past the card's edge.
The title now truncates and the header's side padding gives way before
the button, down to the 50px pane minimum.
* Launch an agent with a first prompt from its setup panel
The agent setup panel in the new-tab menu gets an optional prompt box above
its Launch buttons. It is the chat composer in a compact launch layout: one
line that grows to six, Attach as its only control, / listing the launch
workspace's skills and commands and @ finding its files. Enter launches the
panel's default way, either Launch button sends the prompt its own way, and
with nothing typed both launch exactly as before. The prompt rides the
existing launch prompt field and is kept in memory only until the launch.
* Preserve launch prompt input across submission and refusal
* Retain scoped composer submissions through launch ownership
* Keep launch prompt tests deterministic during collection and persistence checks
* Retire launch source drafts at committed qualified removals
* Retain workspace launch setup through ordinary rich drafts
* Preserve rich draft authority through accepted setup handoffs
* Keep setup prompt moves within current rich draft memory
* Create setup drafts on first input instead of on row render
Rendering an agent row in the launch menu or search no longer creates a
setup record. The row derives its scope from its workspace, host and
agent without touching session state; the record is created by the first
typed prompt, option change or pending attachment, matching main, which
kept only authored setups. Catalog applies, readoptions and renames now
visit authored setups only.
Option listeners use the existing per-scope draft listeners and subscribe
only while the setup popover is open. Also return the runtime-status
files to main, which only carried leftovers from a removed hook.
* Return group-delete draft revocation to main and repair launch tests
Deleting a project group no longer retires in-flight setup submissions
for its folders: folder keys are never derived again, so it changed
nothing users could see. The group mutation, its removal state and the
prompt-delivery type widening go back to main's content, with the test
that exercised the revocation.
Test fixtures catch up with the setup prompt composer: the TabBar window
stubs gain event listeners, the picker inventory's mock store gains agent
status, create-rejection handbacks expect inComposer, and the folder
removal test expects a same-ID survivor's chip to stay, as on main.
* Keep each search preset's setup options in its own slot
Opening a search result's setup no longer writes its preset over the
workspace's setup. As on main, each preset keeps its own options slot,
now inside the workspace/host/agent setup, keyed by what the search
parsed rather than by defaults; the plain row keeps its own slot. Only a
real change saves, into that entry's slot, and creates the setup then.
The typed prompt stays one per workspace, host and agent.
* Fix the moved agent profiles import and merge duplicate imports
Main moved the native chat agent profiles module under shared/native-chat,
so the setup prompt composer imports it from there. Files that imported
one module twice now import it once; nothing else changes.
* Fix the web typecheck for the setup prompt changes
The catalog continuity test no longer imports the main process's SSH
target reassignment, which pulled the whole main graph into the web
program; it builds the reassigned folder inline. Test fixtures and spies
now match current types, the edit-session tests pass a composer ref as
production does, and the setup panel again accepts callers that return
no launch answer. The pending-chip owner filter drops an unused name.
No shipped behavior changes.
* Show the setup prompt's skill and file lists above the setup panel
In the agent setup popover, the / and @ lists opened underneath the
panel, so they could not be seen or clicked. A list opened inside a
popover now takes the menu layer that selects and dropdowns already use
above popovers; an ordinary chat's lists keep their container and layer.
The prompt placeholder is translated in every locale, and folder draft
continuity takes the fetched catalog itself instead of reading its
folder list field.
* Fit the setup prompt box to a placeholder that wraps
With a longer translation, the empty setup prompt's placeholder wrapped
to a second line that the one-line box cut off. The empty launch prompt
now lets its placeholder's wrapped height count, so the box fits it;
English still fits one line, and an ordinary chat's box is unchanged.
* Type the submit test's pending sends as the boolean main now returns
* Show the dictation button in the agent setup prompt
* Update draft test handle for agent references
* feat(settings): import Kitty configs through a shared terminal config import pipeline
* fix(settings): harden Kitty include and value parsing
* fix(settings): match Kitty globs linearly, skip read-only system configs, report non-family font selectors
* refactor(settings): read current settings through a typed map when diffing imports
* style: format Ghostty importer
* fix(settings): type the import hook stub and let dialog primitives own their typography
- Box (ui.catalog 4, since 1.4.248): direction, gap/padding/paddingX/
paddingY/margin on the gap scale, align, justify, wrap, grow, shrink,
width/height/min/max (px up to 4096 or whole percents), columns,
scroll, border (true or a tone), radius, background (theme surfaces or
tone tints). Strict props: hex colours, CSS lengths and unknown props
are dropped with a warning like other components.
- Renderer maps props to theme tokens through data attributes; sizes
reach inline style only as validated px or percents.
- Typings, docs, skill references, gallery Layout tab; orca/testing
finds Boxes and summarizes danger or warning Boxes.
* Add scoped terminal identity acquisition and preserve crew source wakes
* Share raw crew identity inputs through scoped production readers
* Exercise crew generation retirement through actual source owners
* Retire crew inputs on consumed ownership and visibility writes
* Use typed crew mutation and fixture access
* fix: use owned crew styles and committed render counters
* Repair crew fixture and RPC type contracts
* Align crew fixtures with pane and mention contracts
* Count crew consumer render attempts in the fixture
* Localize crew panel labels and details
* Align crew integration fixtures and RPC parameter contracts
* Keep mention contracts within their compiler boundaries
* Encapsulate terminal identity mutations and captured reader contracts
* Seed terminal identity fixtures through canonical mutations
* Complete crew panel English catalog entries
* Fix terminal identity fixture return type
* Cover terminal identity lifecycle schedules
* Align terminal fixtures with canonical identity sources
* Repair runtime fixture source contracts
* Use checked database fixtures for federation contracts
* Update crew source inventories and exit fixtures
* Preserve crew setup outcomes at existing subscription owners
* Match managed restore fixture to its nullable async return type
* Keep absent setup observations distinct from undefined failures
* Drive pending Crew questions from existing metadata
* Preserve nested pairing repair outcomes for shared callers
* Route attached workers to explicit local recipients
* Type Crew pending-question measurement receipts
* Match SSH repair fixture target absence to store contract
* Repair composer fixture and consolidate crew English catalog
* Add finite crew subscription boundary candidates
* Isolate crew portal in terminal file drop fixture
* test: use checked property access for crew owner assertions
* Consolidate web runtime auth type imports
* test: type crew API legacy arguments and pending results
* Bound cold terminal layout construction and finite pane acquisition
* test: use public runtime identity in pane acquisition fixture
* Follow image reference module relocation in mention serializer
* Avoid repeated searches in cold workspace layout loading
* Verify cold loader fault identity and hook claimant effects
* Revert "Route attached workers to explicit local recipients"
This reverts commit f1335d1c06.
Keep attached workers on the existing Run-home routing path for this change.
* Omit crew peer addresses outside the active home route
* Align crew disclosure and availability with shared UI
* Keep crew retries on the verified runtime session
* Bound cold layout retirement and recorded-key construction
* Verify original cold layout failure identity
* fix: preserve surviving layout split references
* test: use typed retirement instrumentation properties
* Keep crew overlay inside narrow panes
* Resume Crew streams on verified runtime sessions
* test: preserve pane and retirement fixture contracts with checked types
* Prepare Crew record admission and wake identity changes
* Derive Crew recipient actions from current target owners
* Keep nested Crew process facts within selected acquisition
* Defer Crew legacy facts to consumers and complete raw coverage on success
* Use deterministic time in Crew command fixtures
* Restore pane-local Crew menu dismissal focus
* Document schema-owned Dispatch row assertions
* test: align Crew authority fixtures with typed project boundaries
* Cover menu agent mentions through production insertion paths
* test: place Crew CLI integration in cross-surface project
* Type retained identity test meters with canonical source maps
* test: adapt mounted Crew fixture to Run unbind contract
* Document suffix Dispatch row boundary and preserve fixture unbinding
* Close crew menus when their terminal pane hides
* Remove unused structured activity component
* test: migrate Crew authority arguments and mailbox observations
* Forward native pane visibility to crew menus
* Keep rich draft offsets aligned with agent references
* Preserve later explicit pane selection after Mention delivery
* test: check the complete overlay focus host fixture
* test: use the DOM containment contract for menu focus
* Fix pointer dismissal enrollment and modal permission
* Remove shared menu primitive patches
* Reuse message avatars in the crew panel
* Focus the captured input when Mention is pressed
* Test the exact Mention all worker selection
* Derive Crew attention and actions from complete recipient authority
* test: repair Crew avatar store fixture and operation accounting
* Keep selected references structural during paste projection
* Fix Crew public-command fixture type contracts
* Align Crew fixtures with runtime reader and routing contracts
* Keep shared message avatar glyphs at their declared size
* fix: preserve existing native mention separators
* Narrow receiving fixture calls to unary RPC methods
* test: load crew Open sender before test execution
* test: consolidate pasted text value imports
* test: supply crew avatar panel mention contract
* Age pending question fixtures from every actual answer timestamp
* test: give mounted mention fixture a portable return type
* Complete Crew public-command workspace fixture result
* Test delegated helper follow-up through Crew advertised address
* Qualify Crew follow-up addresses through shared command admission
* Complete finite follow-up authority and lifetime evidence
* Assert exact remote authority acquisition error identity
* Consolidate Crew SQL test fixture imports
* Trim Crew panel tests to the high-impact set
Keep one mounted test per panel flow, the review-found regressions (avatar glyph size and attribution, stable labels, unavailable sending, hidden-pane menus, navigation remedies), the real producer-to-hook contract, cross-version refusal and recovery, and one N vs 10N contract per scaling piece. Remove permutation matrices, focus-timing proofs, and the duplicated web API and attempt suites.
* Trim Crew Mention tests to the high-impact set
Keep the native and terminal Mention flows, the review-found regressions (send and Goal serialization, label collisions, offsets and handback, Mention-all membership, press-time focus, late write responses, the native double space), the provider delivery contract, and the serializer N vs 10N bound. Remove menu and boundary permutation matrices, panel duplicates, recall and paste cases covered elsewhere, and the retained-group selection fixture. Panel-test cuts mirror the lower PR's so the stack merges cleanly.
* Trim Crew read-model tests to the high-impact set
Keep the real CLI/RPC/database command paths, one regression per review-found bug, the cross-version contracts and one N vs 10N operation contract per scaling piece. Drop permutation matrices, equivalence oracles, near-duplicate scenarios and diagnostic output, and return the SSH, managed-server and WSL test files to main, since their production changes were reverted earlier in this PR.
* Drop diagnostic output and a duplicate error case from Crew tests
Remove two leftover console.log diagnostics, an unused 2x2 sample matrix and unused return fields in the follow-up cost contract, and the subscription AbortError serialization case that the subscription identity and preload tests already cover.
* Pass the recorded-leaf reader in main's check-details loader test
* Build the approved orchestration panel design
Closed tab: panel icon, lineage icon with the worker count, then agents
grouped by status (needs you, working, idle, failed) with the sidebar's
status icon, up to three overlapping agent icons and +n. Rows are one
card with the task, the latest message or question, the relative time
and Details, Open, More. Rows sort by latest message. The open panel
reaches the pane top under the title strip. No user-visible 'crew'
text; counts use plurals. One store subscription resolves every row's
live sender state so the tab and the rows agree.
* Keep pane title buttons above the orchestration panel; tick row times
The open panel now sits just below the pane title strip in stacking
order and starts at the pane top in every host, so the strip's buttons
draw over its top band and no chat or terminal text shows above it. An
open panel lifts its pane's drag strip above it. Row times re-render on
the sidebar's shared 30s clock. Each status group keeps one fixed icon,
and the panel's needs-you count has its own plural.
* Move the orchestration row into its own file
* List every status case in the orchestration icon switches
* Name the orchestration row 'Mention <agent>:' while keeping its status, task and message
* Use the outline xs Button as is for Mention all
* Subscribe the memoized orchestration row to language changes; type the listener count
* Fit the orchestration tab and avatar stack to main's Button and key lint rules
* Ship the orchestration panel's plural counts in the runtime English catalog
* Subscribe the memoized crew row to language changes; read the nullable listener count
* Ship the orchestration panel's plural labels in the boot catalog
* End the chat's orchestration panel above the composer
The panel overlaid the whole chat body, so with it open the composer's
send button sat underneath it. The frame now wraps only the transcript;
the queued drafts, prompt cards and composer stay where main puts them.
* Skip escalations when choosing a crew row's latest message
Orca writes its failure notices (a worker stopped without reporting, a
chat agent error, a terminal exit) as the worker's own escalation, with
terminal, task and dispatch IDs and CLI syntax meant for the coordinator
agent. The panel showed that text as the row's second line. Only the
panel reads this query, so escalations are skipped there and the row
shows the agent's last real message. An agent's own Blocked escalation
is skipped too; it still reaches the coordinator's inbox.
* Point Mention's tests at the modules main moved
Main moved the composer command, send mutation and Claude dispatch
content modules; two of this PR's test files still imported the old
paths and failed to load. Also drop a mock of a module main removed.
* Say why a crew row's agent can't be opened
Opening a row whose agent is gone showed "This agent is no longer
available." Use the existing reasons instead: the chat is no longer on
this host, or the terminal has exited.
* End the panel above the composer in terminal-hosted chats too
A terminal's chat view still mounted the orchestration panel over the
whole chat, so it covered that view's composer and send button. Both
chat hosts now wrap their transcript in the same frame, which takes the
panel's props.
* Show only an agent's own words as a crew row's latest message
Besides failure notices, the latest line could pick up an empty setup
receipt (a blank line that also moved the row) or a lifecycle message
Orca rewrote to "Orca rejected this worker_done: ...". The panel's
query now admits only conversational types with a body and without the
lifecycle rejection marker, before choosing each peer's latest.
* Keep worker launch stages out of crew rows and Details
A row with no message fell back to the worker's internal launch stage
("input accepted", "worker report queued") as its second line, and
Details repeated it as Progress. The row now has no second line until
the agent says something, and Details drops Progress; the status icon
already shows the state.
* Fit both chat hosts under the line limit after the frame merge
Name each host's existing Mention availability once and pass it in the
frame's one-line crew props.
* Mention each agent once per chat draft
Mention all after a row Mention added a second chip for the same agent.
Inserting references now skips agents already in the draft or repeated
in the list; a repeat row click just focuses the composer. Terminal
Mention types text and is unchanged.
* Test a row Mention followed by Mention all
The QA sequence is two separate inserts; cover the draft scan that keeps
the first agent from being added again.
* Give the recipient-authority test's history message a body
The panel no longer admits empty-body messages as a row's latest; the
test's history message now carries the words a peer would send.
* Clip the chat's orchestration panel to its transcript
In a short split or under a tall composer, the transcript can be shorter
than the panel's header, which then painted over the composer. The chat
frame now clips the panel to the transcript; terminals are unchanged.
* Check a terminal's readiness when Mention is pressed
The panel read the terminal's connection once while rendering. A
restored pane connects later without a re-render, so its rows and
Mention all stayed disabled. Mention is now available whenever the pane
has a terminal, and the pane and connection are captured and checked
when the user presses it.
* Keep a row's status at full strength when it can't be mentioned
A row that couldn't be mentioned dimmed everything on it, including
another agent's "Waiting for you" line. Its content now stays as is;
only the hover highlight and pointer cursor go away.
* Translate the crew row Open failure toasts
The crew's Open failures were English literals. They now go through
translation, and a gone or outdated chat uses main's existing texts.
* Translate the crew row Open fallback for agents without a target
* Put the Orchestration panel behind an experimental setting, default off
Settings > Experimental > Orchestration panel (experimentalOrchestrationPanel).
Off mounts nothing: the chat frame, the terminal-hosted chat's identity lookup
and the terminal pane portals all gate where they mount, and toggling applies
live without remounting the transcript.
* Give the terminal-hosted chat's panel its own module
* Leave the setting-off path exactly as on main
The message card's avatar and its single-sender hook are back to main's code;
the panel keeps its own list hook. The panel's code now loads only when it
first mounts, behind the setting.
* Leave /goal and ordinary sends exactly as on main
A typed multi-line /goal is prose again, as on main; only Mention's own
routing lines after a one-line /goal join its objective. A draft with no
agent reference skips the reference serializer, so its send text is projected
once, as before. The routing line format now lives with the other reference
formats.
* Keep main's abort reason and send-failure handling for every web subscription
* Build the panel tests' settings from defaults instead of a cast
* Load the panel with plain lazy so a failed load never retries or reloads the app
* Keep main's /goal parser and put a goal's Mention notes on its one line
The shared command parser is main's code again, so any typed or pasted text
parses as before. A typed /goal or Goal-mode objective with mentions carries
its routing notes on the same line instead.
* Let a failed panel load try again the next time the panel mounts
* Type the queued-edit test's pending send as main's boolean result
* Keep a mention's routing notes in Goal mode on hosts without goals
There /goal goes to the agent as a message, so its notes keep their own lines,
as a typed /goal there already does. A draft with no mention sends main's text.
* Give the lazy panel test the Mention props this branch's panel requires
* feat(settings): preview each font in its own typeface in font pickers
* perf(settings): skip offscreen font rows so opening the picker loads only visible fonts
* fix(settings): keep symbol font names readable in font pickers
* fix(settings): size skipped font rows by their content box
---------
Co-authored-by: Neil <neil@stably.ai>
* feat(settings): delete imported terminal themes from the theme picker
* fix(settings): theme delete reads latest settings, undo keeps later choices, focus stays in picker
* fix(settings): serialize theme deletes and keep later edits on undo
* fix(settings): theme delete button visibility on a wrapper, not a Button restyle
* Nest chat-UI orchestration workers under the agent that started them
Main's lineage projection only walked terminal panes, so workers running
in the chat UI never got a parent link and listed flat in the sidebar.
It now also projects chat workers, keyed by their visible chat row, and
resolves a chat creator or coordinator to that chat's visible row
instead of its handle or private mailbox pane key.
* Fix public worker lineage across assignment and row identities
* Complete terminal lineage provenance and bound active session selection
* Repair lineage test runtime boundaries and SQLite counters
* Provide read-only crew snapshots for each agent
* Batch public lineage verification after exact recency selection
* Derive crew relations once per meaningful host change
* Remove package manager lockfile churn from hook
* Show each pane’s agent crew with open and copy actions
* Use checked runtime values in lineage integration tests
* Preserve host-aware crew navigation remedies
* Document the trusted Dispatch SQL row boundary
* Keep lineage integration imports within their test programs
* Load native lineage fixtures before test execution
* test: complete lineage inputs in runtime and sidebar fixtures
* test: seed benchmark facts from active dispatches
* test: replace partial orchestration DB casts with typed fixtures
* test: complete stale-leaf mailbox fixture session input
* Derive durable crew parents from retained assignment proof
* fix(test): render worker lineage fixture with production list
* fix: preserve crew pane controls and summary identity
* refactor: extract crew row details presentation
* Add scoped terminal identity acquisition and preserve crew source wakes
* Share raw crew identity inputs through scoped production readers
* Exercise crew generation retirement through actual source owners
* Retire crew inputs on consumed ownership and visibility writes
* Use typed crew mutation and fixture access
* fix: use owned crew styles and committed render counters
* Repair crew fixture and RPC type contracts
* Count crew consumer render attempts in the fixture
* Localize crew panel labels and details
* Align crew integration fixtures and RPC parameter contracts
* Encapsulate terminal identity mutations and captured reader contracts
* Seed terminal identity fixtures through canonical mutations
* Complete crew panel English catalog entries
* Fix terminal identity fixture return type
* Cover terminal identity lifecycle schedules
* Align terminal fixtures with canonical identity sources
* Repair runtime fixture source contracts
* Use checked database fixtures for federation contracts
* Update crew source inventories and exit fixtures
* Preserve crew setup outcomes at existing subscription owners
* Match managed restore fixture to its nullable async return type
* Keep absent setup observations distinct from undefined failures
* Drive pending Crew questions from existing metadata
* Preserve nested pairing repair outcomes for shared callers
* Route attached workers to explicit local recipients
* Type Crew pending-question measurement receipts
* Match SSH repair fixture target absence to store contract
* Add finite crew subscription boundary candidates
* Isolate crew portal in terminal file drop fixture
* test: use checked property access for crew owner assertions
* Consolidate web runtime auth type imports
* test: type crew API legacy arguments and pending results
* Bound cold terminal layout construction and finite pane acquisition
* test: use public runtime identity in pane acquisition fixture
* Avoid repeated searches in cold workspace layout loading
* Verify cold loader fault identity and hook claimant effects
* Revert "Route attached workers to explicit local recipients"
This reverts commit f1335d1c06.
Keep attached workers on the existing Run-home routing path for this change.
* Omit crew peer addresses outside the active home route
* Align crew disclosure and availability with shared UI
* Keep crew retries on the verified runtime session
* Bound cold layout retirement and recorded-key construction
* Verify original cold layout failure identity
* fix: preserve surviving layout split references
* test: use typed retirement instrumentation properties
* Keep crew overlay inside narrow panes
* Resume Crew streams on verified runtime sessions
* test: preserve pane and retirement fixture contracts with checked types
* Prepare Crew record admission and wake identity changes
* Derive Crew recipient actions from current target owners
* Keep nested Crew process facts within selected acquisition
* Defer Crew legacy facts to consumers and complete raw coverage on success
* Use deterministic time in Crew command fixtures
* Restore pane-local Crew menu dismissal focus
* Document schema-owned Dispatch row assertions
* test: align Crew authority fixtures with typed project boundaries
* test: place Crew CLI integration in cross-surface project
* Type retained identity test meters with canonical source maps
* test: adapt mounted Crew fixture to Run unbind contract
* Document suffix Dispatch row boundary and preserve fixture unbinding
* Close crew menus when their terminal pane hides
* Remove unused structured activity component
* test: migrate Crew authority arguments and mailbox observations
* Forward native pane visibility to crew menus
* Fix pointer dismissal enrollment and modal permission
* Remove shared menu primitive patches
* Reuse message avatars in the crew panel
* Derive Crew attention and actions from complete recipient authority
* test: repair Crew avatar store fixture and operation accounting
* Fix Crew public-command fixture type contracts
* Align Crew fixtures with runtime reader and routing contracts
* Keep shared message avatar glyphs at their declared size
* Narrow receiving fixture calls to unary RPC methods
* Age pending question fixtures from every actual answer timestamp
* Complete Crew public-command workspace fixture result
* Test delegated helper follow-up through Crew advertised address
* Qualify Crew follow-up addresses through shared command admission
* Complete finite follow-up authority and lifetime evidence
* Assert exact remote authority acquisition error identity
* Consolidate Crew SQL test fixture imports
* Trim Crew panel tests to the high-impact set
Keep one mounted test per panel flow, the review-found regressions (avatar glyph size and attribution, stable labels, unavailable sending, hidden-pane menus, navigation remedies), the real producer-to-hook contract, cross-version refusal and recovery, and one N vs 10N contract per scaling piece. Remove permutation matrices, focus-timing proofs, and the duplicated web API and attempt suites.
* Trim Crew read-model tests to the high-impact set
Keep the real CLI/RPC/database command paths, one regression per review-found bug, the cross-version contracts and one N vs 10N operation contract per scaling piece. Drop permutation matrices, equivalence oracles, near-duplicate scenarios and diagnostic output, and return the SSH, managed-server and WSL test files to main, since their production changes were reverted earlier in this PR.
* Drop diagnostic output and a duplicate error case from Crew tests
Remove two leftover console.log diagnostics, an unused 2x2 sample matrix and unused return fields in the follow-up cost contract, and the subscription AbortError serialization case that the subscription identity and preload tests already cover.
* Pass the recorded-leaf reader in main's check-details loader test
* Build the approved orchestration panel design
Closed tab: panel icon, lineage icon with the worker count, then agents
grouped by status (needs you, working, idle, failed) with the sidebar's
status icon, up to three overlapping agent icons and +n. Rows are one
card with the task, the latest message or question, the relative time
and Details, Open, More. Rows sort by latest message. The open panel
reaches the pane top under the title strip. No user-visible 'crew'
text; counts use plurals. One store subscription resolves every row's
live sender state so the tab and the rows agree.
* Keep pane title buttons above the orchestration panel; tick row times
The open panel now sits just below the pane title strip in stacking
order and starts at the pane top in every host, so the strip's buttons
draw over its top band and no chat or terminal text shows above it. An
open panel lifts its pane's drag strip above it. Row times re-render on
the sidebar's shared 30s clock. Each status group keeps one fixed icon,
and the panel's needs-you count has its own plural.
* Move the orchestration row into its own file
* List every status case in the orchestration icon switches
* Fit the orchestration tab and avatar stack to main's Button and key lint rules
* Subscribe the memoized crew row to language changes; read the nullable listener count
* Ship the orchestration panel's plural labels in the boot catalog
* End the chat's orchestration panel above the composer
The panel overlaid the whole chat body, so with it open the composer's
send button sat underneath it. The frame now wraps only the transcript;
the queued drafts, prompt cards and composer stay where main puts them.
* Skip escalations when choosing a crew row's latest message
Orca writes its failure notices (a worker stopped without reporting, a
chat agent error, a terminal exit) as the worker's own escalation, with
terminal, task and dispatch IDs and CLI syntax meant for the coordinator
agent. The panel showed that text as the row's second line. Only the
panel reads this query, so escalations are skipped there and the row
shows the agent's last real message. An agent's own Blocked escalation
is skipped too; it still reaches the coordinator's inbox.
* Say why a crew row's agent can't be opened
Opening a row whose agent is gone showed "This agent is no longer
available." Use the existing reasons instead: the chat is no longer on
this host, or the terminal has exited.
* End the panel above the composer in terminal-hosted chats too
A terminal's chat view still mounted the orchestration panel over the
whole chat, so it covered that view's composer and send button. Both
chat hosts now wrap their transcript in the same frame, which takes the
panel's props.
* Show only an agent's own words as a crew row's latest message
Besides failure notices, the latest line could pick up an empty setup
receipt (a blank line that also moved the row) or a lifecycle message
Orca rewrote to "Orca rejected this worker_done: ...". The panel's
query now admits only conversational types with a body and without the
lifecycle rejection marker, before choosing each peer's latest.
* Keep worker launch stages out of crew rows and Details
A row with no message fell back to the worker's internal launch stage
("input accepted", "worker report queued") as its second line, and
Details repeated it as Progress. The row now has no second line until
the agent says something, and Details drops Progress; the status icon
already shows the state.
* Give the recipient-authority test's history message a body
The panel no longer admits empty-body messages as a row's latest; the
test's history message now carries the words a peer would send.
* Clip the chat's orchestration panel to its transcript
In a short split or under a tall composer, the transcript can be shorter
than the panel's header, which then painted over the composer. The chat
frame now clips the panel to the transcript; terminals are unchanged.
* Translate the crew row Open failure toasts
The crew's Open failures were English literals. They now go through
translation, and a gone or outdated chat uses main's existing texts.
* Translate the crew row Open fallback for agents without a target
* Put the Orchestration panel behind an experimental setting, default off
Settings > Experimental > Orchestration panel (experimentalOrchestrationPanel).
Off mounts nothing: the chat frame, the terminal-hosted chat's identity lookup
and the terminal pane portals all gate where they mount, and toggling applies
live without remounting the transcript.
* Give the terminal-hosted chat's panel its own module
* Leave the setting-off path exactly as on main
The message card's avatar and its single-sender hook are back to main's code;
the panel keeps its own list hook. The panel's code now loads only when it
first mounts, behind the setting.
* Keep main's abort reason and send-failure handling for every web subscription
* Build the panel tests' settings from defaults instead of a cast
* Load the panel with plain lazy so a failed load never retries or reloads the app
* Let a failed panel load try again the next time the panel mounts
* fix(fonts): enumerate Windows fonts natively instead of through PowerShell
Read the registered font files' name/fvar/STAT tables so a Group Policy
block on PowerShell no longer collapses the picker to five fonts, and say
so in the picker when the OS list is unreadable.
* fix(fonts): harden sfnt parsing and Windows font file discovery
* fix(fonts): follow STAT naming rules and bound Windows font reads
* test(fonts): type platform timeout cases without assertions
* refactor(fonts): list Windows fonts with Chromium's queryLocalFonts instead of a custom sfnt parser
* fix(fonts): scope the local-fonts grant to the main window and keep the web client quiet
* ci: refresh unit shard timings from a 12-shard four-worker run
Replaces the October 25 five-shard eight-worker baseline with run 41403569437,
which includes the November 1 test-time fixes. On an independent run's
measurements the projected per-shard spread falls from 12.0% to 7.4%.
* ci: average unit shard timings over five runs
A single run's per-file noise left this PR's own run 21.8% apart. The importer
now accepts several complete runs and averages each file; held out, the
averaged baseline projects 3.8% against 10.2% for the October 25 baseline.
* fix(repo-icon): round project image icons on desktop to match mobile
Mobile rounds project image icons with a 4px radius, but desktop draws them
with square corners, so the same avatar looks different across clients and
sits awkwardly beside the rounded sidebar controls.
Apply the same 4px radius to the image in RepoIconGlyph so every desktop
surface picks it up. Emoji and lucide icons are unchanged.
Covered by a repo-icon test that failed before the change.
* test: drop repo-icon radius test
---------
Co-authored-by: Rongzheng Liu <tianlrz@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(wsl): offer the existing host when adding a folder from a distro that already runs as one
* fix(wsl): translate the existing-host offer, let a later drop win, keep the offer when the host fails to start
- Translate existingTitle/existingWhy/existingAccept into every locale.
- A drop onto the open dialog after "Add on host" now prefills the dropped path.
- A failed host start keeps the offer so the user can retry or add on this computer.
- Tests run the real saved-host read (flag off gives the run-as-host offer) and the
offer-to-prefill wiring.
* fix(wsl-move): land on the workspace view after a move's window reload
A move or "Use on this computer again" reloads the window from Settings.
Settings cannot restore which page was open, so the reload opened General,
and the saved view kept reopening Settings on later launches. Main now
switches the saved view from Settings to the workspace view right before
that reload.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-move): leave Settings even when the window is gone at reload
The landing view now comes from the write hold whenever a reload is owed,
so a window closed before the reload still relaunches on the workspace view.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-move): keep the reload going if the landing view cannot be saved
Picking the landing view is now best-effort, so a failing store write no
longer strands the write hold or skips the reload. Adds a wiring test that
fails if the landing is not registered.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
OrcaWin
Neil
Kelvin Amoaba
Brennan Benson
Jinjing
Rayyan34andNeil
