* fix(agent-resume): record a background agent launch's recipe so resume keeps its flags
* test: narrow the reveal's notifier so the test needs no cast
* refactor(agent-resume): one recipe registration path; skip adopted panes
* test: add the launch-recipe listener to the remaining window mocks
* fix(codex): resume a thread with the permissions it was last given, not Orca's launch flag
Codex restores a resumed thread's saved approval/sandbox settings unless the
launch passes a permission flag. Orca replayed its launch-time recipe
(--dangerously-bypass-approvals-and-sandbox, --approve-for-me, or the Ask
flags) on every resume, so a session switched to "Approve for me" came back
as Full Access after a restart, and that override was saved to the thread.
Fixes#10886
Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>
* test(mobile): Codex AI Vault resume no longer replays Orca's permission flag
The mobile AI Vault resume builds its command through the shared resume plan,
so it now omits --dangerously-bypass-approvals-and-sandbox like desktop does.
Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>
---------
Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>
Adds cloud/packages/connector-contract: the shapes the desktop and the cloud connector service exchange (hello, held poll, received/done acks, events with per-hello seq, replies), limits, error codes and the contract version. Nothing calls it yet.
* fix(agent-resume): resume Claude sessions at their own effort level
* fix(agent-resume): keep effort through persistence and /clear; simplify ensure shaping
* fix(agent-status): keep Codex's hidden title-thread prompt off the sidebar heading
Codex titles a new thread in a hidden ephemeral thread. When managed config pins hooks on,
that thread's SessionStart (source startup) took the pane and its prompt became the row heading.
Drop its prompt as a foreign ephemeral thread and keep the row's prompt across rollout-less starts.
Fixes#30049
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): hold a rollout-less Codex start until its prompt shows what it is
The hidden title thread's SessionStart no longer swaps the row's state, session or tool snapshot.
A held start is dropped with the title prompt, or replayed as SessionStart on a new conversation's
first prompt so relayed desktops still let it take the pane. Covers a main Stop arriving first.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): also hold Codex's hidden recap thread and clear the old completion stamp on takeover
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(remote): a desktop ignores its own workspaces echoed back by a server it serves (#33424)
When two desktops pair to each other, each server republishes the tabs it
mirrors from its own servers. Desktop A then received B's mirror of A's own
workspace under the real workspace id and grafted it onto its local copy as
B-hosted tabs, so opening those files asked B (selector_not_found) and closing
them closed B's tabs.
A session-tabs frame from a paired server no longer writes a workspace this
app lists as its own (a stamped local or direct SSH row) unless that server
also lists a copy. Other servers' workspaces stay open to every runtime.
* fix(remote): retire echoes already taken and replay frames a twin's late row releases
An echo fenced out of this app's own workspace now applies as that server's
tombstone, so rows it left before the fence (restored sessions, or frames that
arrived before this app's own row listed) are retired without closing anything.
A held frame replays once the server's own copy of the workspace lists, so a
same-id twin that publishes before its row loads still mirrors. The e2e waits
on a later frame from the same stream instead of a fixed delay.
* fix(remote): serve a desktop's tabs on its servers' files only to its phone, not to other runtimes
Redesign of the #33424 fix at the source. A desktop publishes every editor tab in
its window, including ones on files of its paired servers; its phone uses those
through the desktop's relay. Served to another runtime, such a tab routes the file
to the desktop, and in a pairing cycle it is that runtime's own workspace coming
back as the desktop's tab: file reads fail with selector_not_found and closing it
closes the desktop's real tab.
Publishers now stamp those rows with hostRuntimeEnvironmentId (window, layout-owner
main projection and the windowless projection alike). projectSessionTabsForClient
strips the stamp for every caller and drops the stamped rows for runtime-scope
callers, keeping groups, layout and the active tab consistent. Phones and local
callers see what they saw before. The receiver-side fence is removed.
* refactor(remote): keep the file-host stamp helper outside the old-client boundary; test an all-server snapshot
History lists every managed OpenCode account's sessions since #33658, but
resume still launched with the active account's XDG_DATA_HOME, so OpenCode
looked in the wrong database and reported "Session not found".
Derive the owning account from the row's store path and request it via a
spawn env key; the host validates it against registered accounts and falls
back to the active one when the owner was removed.
Refs #28790, #33658
* fix(program-status): keep a Pi row working while a pi-subagents child outlives the parent's done
OSC 7501 projected the root record's done straight onto the row even when
live child records remained, so a Pi parent showed Done/IDLE while an async
pi-subagents worker kept running. Fold child liveness with the existing
foldMainAgentWithRowChildWork; mainAgent keeps the lead's own verdict so the
row settles to done once the last child ends.
Fixes#33657
* fix(program-status): announce a held turn's done on time and keep hook verdicts authoritative
- Stamp turnCompletedAt on the child-held row and its all-clear so the lead's
done is announced once, when it happens, as hook rows do.
- Hold only a finished (non-boundary) turn, only for working/waiting children;
in-turn rows and failed/idle children keep the root's state.
- A settled hook row is never reopened by a program's child-held working row,
so the 2-minute silence fallback cannot flip done -> working -> done.
* fix(program-status): lapse an unrefreshed child hold to the lead's done
Children report only changes, so a pi-subagents that dies or hangs inside a
live Pi would hold the row working until decay. The lease timer now settles a
child-held row no report refreshed within AGENT_STATUS_STALE_AFTER_MS minus one
renewal interval (20-30 min) to the lead's done, keeping turnCompletedAt so it
is not announced again.
Setup on Windows Server 2012 R2 and on Windows hosts with neither
System32\tar.exe nor Expand-Archive ended in the generic "Orca couldn't
start its server on this host. Try connecting again.", which no retry
fixes. The runtime probe that already runs before staging now also reads
the Windows build and checks for an extractor, read-only, and refuses
before anything is staged or uploaded. The refusal travels the existing
orcad_unavailable reason plumbing to the host card and the ssh:connect
error, and is rechecked on every connect like a noexec home.
Fixes#33574
Reported-by: HKLHaoBin
* Keep the permission pill inside the Arguments box
* Share the Settings permission menu and commit Arguments on field exit
* Honor changed permission choices and acknowledged host picks in reset notices
* Show acknowledged permission resets with scoped Undo
* Consume removed permission recipes in the Arguments draft
* Keep reset notices separate from the inline permission field
* Show reset choices and Undo after a global permission pick
* Use Textarea variant for composite arguments field
* Fix permission test query typing and sync English runtime catalog
* Keep permission reset Undo beside the toast title
* Add permission reset localization base keys
* Complete host settings bookkeeping transport mock
* Flow arguments beneath the permission chip
* Keep composite argument typography in Textarea variant
* Share native scrolling between permission chip and arguments
* Place all-agents permission menu beside its label
* Preserve permission menu width while settings load
* Keep explicit agent permissions when changing the global default
* Use acknowledged settings for local permission notice actions
* Apply local permission notice actions at the settings owner
* test: give settings runtime mock a portable type
* test: place settings fixtures in the recognized fixture directory
* fix: update populated permission notices without dismissal
* Toast says agents still use their own permission setting
* fix(native-chat): a Claude chat saved as Approve for me keeps it when Orca can't read its model list
A chat's auto mode dropped to Ask whenever the saved model list was missing
or couldn't name the chat's model (another account home, first start in a
folder, an unlisted model id), so a resumed chat launched asking for approval.
Auto now drops to Ask only when the list shows the model without it; Claude
itself starts a model that can't run auto in its default mode.
Tracked in STA-10953.
* fix(native-chat): a model list from a CLI older than auto mode still reads as Ask
A CLI that marks no model with auto support predates the auto value (2.1.71)
and would refuse --permission-mode auto, so its listing is evidence, not a gap.
Tracked in STA-10953.
* docs(chat): correct auto support reporting version
* test(chat): type saved launch option cases
* Honor requested chat permissions across model changes
* Match outgrown child fixture to journal null contract
* fix(native-chat): preserve admitted input and current mail choices
* perf(native-chat): derive wake debt and held sends once per retirement decision
The retirement check derived wake debt (a child-work projection and a scan
for the newest turn) before asking whether open work had already decided
the outcome, and its admitted-input fallback rebuilt the provider's held-send
set once per unanswered submission, O(S x W) per decision.
Open work is now read first and wake debt only where it picks the outcome or
the refusal reason. Current work gains one batch query that reads the held
set and the handover set once, sharing the single holds rule with the
per-send reader. Outcomes and refusal reasons are unchanged.
Adds N/10N operation-count contracts on the real Claude host rig: two
retirement checks per ordinary send, each one pass over history, with a
control that the second sees a sign-out reported between them; no wake debt
mid-turn; one held-set read per refusal in a queued model-change burst.
* Keep active Claude input on its turn choices
* Fix chat admission type imports and cover turn-scan costs
* Preserve root lifecycle delivery under journal pressure
* test: construct Codex mail fixture with its source
* test: expect root retention metadata in Claude turn timing
* test: cover captured Claude full-ID Auto launch
* test(native-chat): explain queued-send test timeout
* test: supply explicit mailbox working policy
* Guard managed server restarts with host work reservations
* Protect legacy server update requests with host admission
* Reserve chat-safe restarts in SSH and WSL server updates
* Keep activation host fixtures within the module line limit
* fix(orcad): preserve session queue timing during admission
* Explain chat-safe update deferrals and superseded restarts
* Clarify managed server Force upgrades and retry instructions
* Separate chat entry delegates from conversation creation
* Report child work through main's child evidence in the restart drain test
* Drive main's snapshot-room tests through the restart reservation
Main's room tests deployed over a serving incumbent with a census that has no
chat work count and no restart admission, so the update deferred before the
room probe ran. Give them the same idle census and slot admission as the other
activation tests, and pin the probe before the reservation instead of before the
recount it replaced.
* fix(native-chat): an update keeps waiting on a chat start after its conversation is closed
The restart check counted a start only while its conversation stayed open,
so an idle close during a stalled start let a managed update through.
Every tracked attach, create, start and open now counts as restart work
in the same tracker that counts the session queue.
* fix(native-chat): keep the structured session view within its line limit once formatted
Main's copy sat at 400 lines only because one line was left unformatted; the
merge's formatter pushed it to 401. Inlining the one-use question list keeps it
at 400 with identical behavior.
* fix(orcad): a recovery stop request stops the server; only an older client's empty request waits for idle
Stopping a slot and restarting it for an older client's update were both an empty
.orcad-stop-request file, so routing that file through restart admission let a
crash recovery, stranded-setup release or rejected-candidate rollback leave the
server running. New clients now write "stop-now" into the request (renamed in
whole), which stops at once as before; an empty or unrecognized request takes the
chat-safe restart, and a deferred restart logs why. Also gives the restart
admission activation fixtures the now-required recount.
* docs(orcad): say a directory at the stop-request path is refused, not restarted
* docs(orcad): the plain stop request's comment states both of its meanings
* style: format the restart admission files for the format check
* test(wsl): count the incumbent's recount bridge after the reservation's
* fix(orcad): a Windows stop request retries its rename while antivirus holds the new file
Renaming the just-written stop-now request can briefly fail with EPERM, EACCES
or EBUSY on Windows; the stop now retries those with the same bounded delays as
record-publish instead of answering SIGNAL_FAILED and leaving the server up.
* test(orcad): a real Windows host stops on the slot's stop-now request and relaunches
* test(orcad): recovery stops a real server whose restart admission refuses
* test(orcad): the recovery-stop cell tunnels over the cell's SSH connection
* test(orcad): the recovery-stop cell names itself in the CI log
* fix(settings): a deferred WSL update shows its full reason below the row
* test(orcad): fixtures pass releaseIncumbentAdmission; the census test calls its own method
* test(orcad): the capable-server census in the fence test reports idle chat work
* Record server chat restart offers and desktop creation history
* Offer interrupted chat recovery per managed runtime
* Ship the remote chat resume action labels in the runtime catalog
* Update removal contracts for desktop chat history cleanup
* Scope remote chat recovery to each server occurrence
* Preserve recovery choices and uncertain continuation outcomes
* fix: preserve uncertain restart action outcomes
* Fix restart recovery CI imports and fixtures
* test: align resume assertions with unconfirmed outcomes
* test: bound restart recovery work across scaled populations
* fix(native-chat): title the remote resume dialog with the restart
The dialog can appear out of nowhere when another desktop updates a shared
server, so its title now says what happened: "<machine> restarted".
* fix(terminal): give the window and main's copy the daemon's ConPTY resize rule
Every PTY a Windows machine owns is ConPTY, WSL shells included, and ConPTY
repaints its own grid after a resize. The window applied xterm's ConPTY
model only to native (non-WSL) panes, and main's copy for reveals and phones
never did, so growing either pulled history into ConPTY's grid. Decide
windowsPty from the PTY's owner backend everywhere, keeping the native-only
cursor, CJK and keyboard workarounds behind isLocalNativeWindowsConpty.
* fix(terminal): keep main's copy of an SSH relay PTY off the ConPTY model before its record exists
Main's copy is built on the first byte, and a restored or adopted relay PTY
can stream before its record carries a connection id.
Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52.
* Chat renames are saved as the chat's name, so Session History shows them after the tab closes
Renaming a native chat tab only changed that window's tab. Session History, phones and other windows read the host's saved name, so the rename vanished from History once the tab closed or Orca restarted.
A rename now goes to the host that owns the chat (agentSession.rename) and is saved as the chat's one name, the field History, tabs, sidebars and phones already read. The record remembers that the user chose it, so automatic naming never replaces it. A window's pre-upgrade tab rename is uploaded once and only fills a name Orca chose. Hosts without the new capability keep the old tab-only rename. Every native agent's History row now shows the chat's name once it has one.
* Keep saved chat names consistent across readers and reconnects
* Carry qualified chat names into cached readers
* Reuse the history recorder context across platforms
* Use recorded chat ownership for legacy name transfer
* Transfer legacy chat names only from known catalog ownership
* Correct recorder path matching and History subscription order
* Require complete evidence for bridged parity exclusions
* Preserve sparse array lengths in complete recording comparisons
* Initialize History observation before loading workspace context
* Integrate measured History recordings and scoped parity evidence
* fix chat naming retries and certify both replay modes
* fix ambiguous chat rename labels after navigation
* preserve chat rename intent across tab updates
* type dashboard snapshot fixtures without assertions
* fix: align chat name observation with store contracts
* test: update chat name consumer fixtures
* test: distinguish sender naming metadata from status
* Preserve saved Activity chat names across tab focus
* Clarify Activity tab projection identity
* Remove package-manager lockfile churn from main merge
* fix(runtime): validate tab property edits before saving chat names
* fix: refresh History ownership after conversation clear
* fix: commit History request identity before refresh effects
* Fix History scan scope typing and integration test placement
* test: cover saved chat name reader contracts
* test: make chat naming fixtures deterministic
Kiro's V3 engine (default from Kiro CLI 3.0) now reports status in Orca: Orca installs a global hooks file under KIRO_HOME/hooks (covering the built-in default agent, local and remote, never overwriting user files) and recognizes V3's PascalCase hook events.
Fixes#31577
Supersedes #24937
Co-authored-by: Dongho Lee <126236161+LDH1103@users.noreply.github.com>
Orca CLI commands inside a sandbox that blocks chmod (e.g. Claude Code's Bash sandbox) no longer fail with a misleading "file is invalid": the pre-read hardening of existing secure files ignores EPERM/EACCES/EROFS; writers still create files 0600.
Fixes#20937
* feat(agents): store each agent's permission itself instead of typing flags into Arguments
Terminals and new chats read one stored choice per agent (Use the agent's own
settings, Ask for approval, Accept edits, Approve for me, Full access). Orca adds
the flag at launch; Arguments hold only the user's own text. A one-time move
lifts Orca's flags out of saved Arguments. Older clients still see and write
the flag as part of Arguments; the host translates.
* fix(agents): say the all-agents switch resets agents set separately; keep primitives unstyled
* test(agents): the one-time move returns every launch-profile field
* Fix permission carrier ownership and surface-specific defaults
* Preserve uncertain permission operands and name the option inventory
* Check env entries without indexing typed agent maps
* Combine Chat permission capability imports
* Use folder execution-host platform for permission environment
* Preserve launch map replacement and acknowledge permission saves
* Keep permission feedback fallbacks statically discoverable
* Provide preload platform to Agents settings render tests
* Preserve Gemini approval arguments under Full access
* fix(settings): retain complete environment edits through save outcomes
* fix(settings): narrow local failure scope and preserve host messages
* fix(settings): retire argument drafts after acknowledged saves
* fix(settings): keep Goose environment editable after reset
* fix(settings): show resolved arguments for legacy hosts
* Preserve pending environment resets and bound launch settings work
* Use agent permission choices for new chats
* Let Claude resolve chat permissions from its own settings
* Keep optional settings fallback in repository metadata reads
* Consolidate permission report imports
* Update permission choice contracts for own settings
* Read repository visibility defaults through the raw settings fixtures
* Match existing translated Agents settings labels
* Update readback and legacy host test expectations
* Align Chat behavior tests with host permission capability
* Fix permission compatibility and host-owned descriptions
* Prepare whole Environment edits and retire unchanged drafts
* Handle null explicitly in permission report decoder
* Keep Environment settings transitions in an acyclic module
* Update raw settings reader test fixtures
* Place test fixture safety notes on assertion starts
* test: pin permission settings work and recovery contracts
* test: type permission settings work fixtures
* test: cover migrated permission inputs and captured CLI grammar
* Publish permission reports and reuse host capability state
* Combine mobile option state React imports
* Honor mobile status feed capability for permission reports
* test: preserve typed permissions in WSL Claude restarts
* Correct permission report child and fixture type contracts
* Delegate older-host chats to explicitly selected own settings
* Avoid rebuilding live ACP option catalogs
* test(chat): place cross-boundary permission contracts in integration project
* Preserve existing chat capability gates and complete report test fixtures
* fix(chat): preserve newer Claude startup permission reports
* test(chat): clarify startup report fixture provenance
* Show reported permission modes in chat menus
* Keep reported permissions available after chat mode picks
* Remove obsolete guard from concrete permission selection
* Report the installed approval policy for ACP chat menus
* test: keep accepted mobile mutation fixture on current fence
* test: cover installed ACP approval report for own chats
* test: align capability scaling contract with concrete permission menus
* Ship required permission help in English runtime catalog
* Adapt permission persistence test to shared menu
Antigravity automations no longer complete (and close their tab) when an in-process invoke_subagent subagent reports back: once a conversation launches subagents, hooks from other conversations without user input are ignored until the parent's own fully idle Stop; a user-started conversation (carrying lastUserInput) clears the marker so a relaunched agy still gets status.
Fixes#17650
* fix(native-chat): one ownership index with link roles, and a chat refuses to start while a terminal writes its conversation
Each chat link now carries its role (head or earlier) and key; Session History names
the chat continuing a conversation first, duplicate adoption checks only head links in
both the pre-commit check and the store transaction, and terminal resumes stay refused
exactly as before. The terminal-writer check now also runs inside acquireOwner before
the spawn, refusing with the typed pre-spawn reason conversationOpenInTerminal.
* fix(native-chat): hold a terminal start Orca issues until its terminal reports it
An in-memory registry of managed terminal starts per conversation, registered in the
same step as the resume admission (terminal.send with a resume command, createTerminal
with a command), bound to the PTY execution that runs it, and ended only when that
terminal's hooks report the conversation or the execution is gone. A chat's agent
start refuses while an entry may hold its conversation.
* fix(terminal): an automatic pane restore never resumes a conversation an open chat continues
Resume recipes built from a pane's saved facts (cold restore, deferred and late reattach,
sleeping wake, host mobile materialization) carry resumeOrigin 'saved'. The execution host
decides before any command is issued: while an open chat continues the conversation, or a
chat may be writing it, the pane starts its plain shell with the started-fresh notice and
its saved claim is forgotten; with unreadable records only a saved restore is refused and
its record kept. An admitted resume registers its managed start in the same step, so the
chat's agent start refuses until the terminal reports it or exits. Clearing the last saved
record now reaches disk.
* Fix saved terminal resume ownership and effective launch results
* Preserve conversation case and clear refused cold restore identity
* fix: publish effective terminal launch results on attachment
* fix: preserve terminal launch callback and candidate ownership
* fix: keep existing terminal attachments observational
* fix: consolidate terminal launch imports
* test: document snapshot runtime fixture boundary
* fix: preserve terminal launch identity types
* fix: accept reattach payload policy sessions
* fix: preserve terminal result validation contracts
* refactor: separate terminal create contract
* test: document partial terminal runtime fixtures
* test: align sleeping resume store fixture
* Fix terminal create type contracts
* fix: return the terminal main started to its waiting view
* fix: register reattached terminals before publishing their handles
* Check unavailable-resume test fixture types
* Complete sidebar resume test store fixture
* test: bound saved resume ownership and refusal work
* Settle refused saved resume claims from actual launch results
* Fix saved resume test type contracts
* test(e2e): capture exact terminal parking diagnostics
* test: verify parked terminal with fresh host inventory
* Consolidate agent session imports in remote terminal transport
* Clarify terminal conversation refusal guidance
* Admit note-only saved conversations without hiding live writers
* Retain terminal writer proofs through final admission
Builds the macOS terminal host's Node 24.22.1 from pinned source with a libuv patch: idle threadpool workers recheck for queued work every 30 s instead of waiting forever, so a lost Darwin condition-variable wake-up (libuv #5280) no longer strands terminal I/O. Bumps the daemon protocol to v52 so new terminals start on the patched runtime right after an update; older daemons stay attachable. Adds stalled/recovered daemon async-I/O telemetry, and lets release workflows rebuild older refs that predate the source build.
Fixes STA-11709, #31926.
* Refuse unsupported SSH project setup before local API dispatch
* fix(projects): keep the desktop's SSH refusal copy and drop a re-export
The desktop's own project-setup IPC is not an Orca server, so it keeps
saying the SSH connection is not connected; the renderer now refuses SSH
setup before reaching it. Callers import the shared refusal message
directly instead of through the controller. Adds a headless paired e2e
that sets up a project on the server's SSH host from a web client.
Refs #33124
* fix(projects): give the server refusal only for a paired server's SSH host
A desktop's own SSH host keeps its 'not connected' copy; the server
refusal shows on a web client, or for a target only a paired server lists.
Refs #33124
* test(e2e): read the added SSH target from the RPC result
* test(e2e): pass a typed SSH execution host id
* test(e2e): give the paired SSH project-setup timeout bump its reason
---------
Co-authored-by: Mohith S <smohith58@gmail.com>
The idle terminal-mode reset (ESC[0 q) is no longer written into the middle of an escape sequence split across output chunks (which made xterm print fragments like `41;41;41m`, e.g. Codex's composer sparkle on Windows): a per-pane tracker holds the reset until the next write that ends cleanly.
Fixes#20596
Supersedes #23733
Hermes workers no longer time out at agent_readiness while the TUI is ready: Orca recognizes Hermes' ready status + composer (including built-in skin prompt symbols) and Hermes started through its own installer launcher (`python -I -c … import hermes_bootstrap`, interpreter -c only).
Fixes#23723
Supersedes #24748
Co-authored-by: Route Smith <2595827+routesmith@users.noreply.github.com>
Panes follow a Claude Code conversation that moves into a background job (agent view ← then Enter, and /clear inside the job): on the presence recheck Orca reads the pane's own transcript `continued-in` record and the job's state.json (UUID-validated, sibling-folder only, overtaken pointers ignored, cwd kept) instead of trusting job hooks, so mobile and native chat stop freezing on the old session.
Refs #24117
Supersedes #26569
Co-authored-by: mtsr404 <10844682+mtsr404@users.noreply.github.com>
Co-authored-by: dimakrest <12894495+dimakrest@users.noreply.github.com>
* feat(native-chat): OpenCode and Grok chats show the turns made outside them
When an OpenCode or Grok chat reopens its conversation, the agent replays its
saved history before it answers. Orca used to drop all of it. Now the turns in
it the chat never saw (made in the agent's own CLI, or anywhere else) are added
once, in the agent's order, after the chat's rows and behind the existing
"Continued outside this chat." divider.
Turns are matched by the agent's own ids: Grok's prompt id (Orca's own turns
carry the id Orca sent) and OpenCode's saved message ids, plus the rows of a
transcript the chat was adopted from. A send of the chat's own that failed
before any reply is matched by its text between the turns proven around it,
because OpenCode never tells a client the id it gives a person's message.
The import is translated by the same translator and assembler as a live turn
into an in-memory overlay, then written as one settlement: a stale or failed
import writes nothing, and it never fails the open. A turn imported part-way
gets the rest of what the agent saved on a later open.
* fix(native-chat): type the ACP catch-up staging and origin reads
* refactor(native-chat): share the catch-up open runner across agents
The Codex catch-up's agent-neutral parts move to one module: the open-time
envelope (its own deadline and cancellation, never gating the open), the
bounded staged batch, the single settlement commit that re-checks the
journal before writing, and the "Continued outside this chat." divider.
Codex keeps only how it reads its saved turns and what the chat already
holds. No behavior change; the other agents' catch-up builds on this
instead of copying it.
* fix(acp): bound final catch-up journal barrier
* chore: remove unrelated pnpm executable metadata
* refactor(native-chat): the catch-up runner reads the chat's view only when the agent asks
* refactor(acp): catch up through the shared history runner
The open envelope, budget, divider and one checked commit now come from the
shared catch-up runner; ACP keeps only how it reads the reopen replay and what
the chat already holds. The final-barrier deadline test moves with the barrier
to the runner.
* chore: remove regenerated pnpm executable metadata
* fix(native-chat): the catch-up deadline also bounds waiting for its commit to be written
A journal write barrier that never settled after the import was admitted held
the provider's open past the catch-up deadline. The wait now ends with the
deadline or the open's cancellation, like every other step.
* test: type the history catch-up sink fixture without assertions
* fix(acp): reconcile imported history snapshots without claiming live work
* fix(native-chat): bound and revoke history preparation
* feat(native-chat): validate expected saved items during history catch-up
* fix(acp): preserve user boundaries and visible catch-up dividers
* fix(acp): replay ordered messages within provider executions
* fix(acp): report replay overflow and refresh journal test reads
* test(rpc): explain partial runtime fixture boundary
* Bound ACP history reconciliation and rejected-copy projection work
* test: use typed calls for history scaling instrumentation
* test: account for history views and exit provenance work
* fix: type history scaling test fixtures explicitly
* test: route history probes to Node and bind replay sink before open
* test(acp): explain journal scaling timeouts
* fix(terminal): keep restored history when ConPTY repaints after a resize
The Windows daemon's emulator grew rows the way a Unix terminal does,
pulling scrollback back into the screen. ConPTY then repaints the grid
it owns from the top and overwrote those rows, so a relaunched window's
first fit lost about a screen of restored history and printed the new
shell's prompt onto the restored prompt's row. Give ConPTY-backed daemon
sessions (WSL shells included) xterm's windowsPty resize model, as the
window already does for native Windows panes.
* test(terminal): model ConPTY's repaint at the height it was resized to
ConPTY's screen holds only what the shell wrote at its current height, so a
shrink drops the rows above the cursor and each resize repaints that screen.
Assert every restored and shell row appears once, in order, across shrink,
shrink-then-grow and grow-past-original heights.
* test(terminal): show the Unix grow model loses restored history under ConPTY
A pane's owning agent takes the pane back from a nested/background child on its next hook when the hook matches the owner's recorded session (agent type and session id), instead of staying hijacked until the child finishes; stale owners and nested same-type children with new sessions stay rejected. No recorded session (older hosts/relays) keeps main's behavior.
Fixes#30589
Refs #13341
Jinwoo Hong
Neilandmys
OrcaWinandOrcaWin
Brennan Benson
Jinjing
Kelvin Amoaba
