- git-binary-compatibility: give the docker image runs of the ref-pairing case
a 90 s budget; each Git call is a docker exec and the case normally takes
22-25 s of the 30 s default.
- claude-transcript-catch-up: fire the 5 ms catch-up deadline with fake timers
only after the fallback lookup has started, instead of racing a real timer.
* fix(source-control): read the Kimi answer from stream-json
Kimi Code's text mode prefixes thinking and hook output with a bullet, so the
commit message arrived mixed with narration. The recipe now asks for
--output-format stream-json and the answer is taken from the last assistant
record, which is the commit message (#33556).
A record that requests a tool is narration rather than an answer, so it clears
the candidate: a stream that ends on a tool call yields no answer, which
finalizeFromAgentOutput already treats as a failed run. Only a body whose every
non-empty line is a record counts as stream output, so a plain answer that
happens to contain a JSON line is left alone.
* fix(source-control): decode Kimi output only for the selected protocol
* fix(source-control): satisfy generation hook checks
* Preserve Kimi generation failures and normalize options linearly
* Fix Kimi argument failure messages
* Bound Kimi option failure recognition
* Fix Kimi generation test fixture types
---------
Co-authored-by: beduldul <alkaysan07@gmail.com>
* fix(wsl): refuse Windows drive folders on a WSL host and offer to add them on this computer
A /mnt/<drive> project on a WSL host shows false line-ending changes, misses
edits made from Windows, and searches slowly. Add Project refuses typed,
picked and dropped Windows drive folders for a WSL host and shows the refusal
inline with Add on this computer, which switches the open dialog to this
computer. The WSL-host orcad re-checks by /proc/self/mountinfo (after
resolving symlinks) in repo.add, repo.create, repo.clone, explicit
folderWorkspace.create and the nested scan/import, answering with the
existing runtime_error code plus optional data, so older clients still show a
readable message. Everything is behind the WSL hosts gate; SSH is untouched.
* test(wsl): hold the e2e's this-computer add instead of racing its failure
On the Linux CI host the switched local add of a Windows path fails its nested
scan and hands off to the Open as Folder modal, closing Add Project before the
test looked. The refusal itself already came before any scan. The e2e now
records the local add at its scan step and asserts it went to this computer
with the Windows path; a unit test pins that a refused pick never reaches the
host path step.
* test(wsl): type the e2e's held-scan window hooks instead of Reflect
* fix(plugins): reject locale ids Intl cannot parse
`pluginLocaleIdSchema` checks the shape of a locale id but not its grammar,
and the shape check is looser than BCP 47 in one direction: `en-US-US`
(duplicate region) and `en-aaa` (a subtag that is neither region nor script)
both match it. A pack declaring one installs, loads, and translates every
string — and then `Intl.DateTimeFormat` throws inside `getIntlLocale()`, which
swallows the error and falls back to English. Nothing is logged, so the pack
author sees a working pack with English dates and no way to tell why.
Delegate the grammar to `Intl.getCanonicalLocales` in a `.refine`, so the tag
is rejected at install where the author can still act on it. The bundled
`pt-BR` pack and every other well-formed tag are unaffected.
* Condense this branch's comments to one line
AGENTS.md asks for one-line comments that say why, and main's comment
cleanup (#33249) applied that across the repository. This brings the
comments this branch adds in line with it. No code changes.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(wsl): internal distro allowlist for WSL execs on shared test boxes
ORCA_INTERNAL_WSL_DISTRO_ALLOWLIST (comma-separated distro names) keeps every
wsl.exe call out of distros not on the list: process-host's resolveSpawn,
the main and daemon node-pty spawns, and the two codex-accounts calls that
bypass process-host. Pure list/status/version calls stay allowed; any other
form must name an allowlisted distro, and --shutdown or a default-distro exec
is refused. A malformed value refuses every distro and logs once. Unset, the
check reads the variable and returns, so behavior is identical to today.
* fix(wsl): cover every direct wsl.exe exec with the internal distro allowlist
- Restore #34525's worktree-create payload and captured-host test, reverted by
accident in the first commit.
- Check the allowlist in execFileCapture, the choke point for WSL Git, gh and
worker-thread captures, and before the WSL git-read probe, the Codex hook
path canonicalization and the CLI login spawn. The WSL watcher now spawns
through process-host.
- Stop scanning wsl.exe argv at the first positional argument, which wsl.exe
runs in the default distro.
- check-process-host-imports fails on any direct wsl.exe exec outside
process-host that does not call assertWslDistroAllowed.
* fix(wsl): check the distro allowlist where resolveCommand produces the wsl.exe form
Every Git, gh and glab path into a distro resolves through resolveCommand, so
gitExecFileSync, gitSpawn, git stream reads and wslAwareSpawn are covered too;
the execFileCapture check is now redundant and removed. The import check also
treats buildWslExecArgs as a wsl.exe exec and accepts resolveCommand as covered.
* ci: move secondary, scheduled and contract workflows to GitHub-hosted runners
Public-repo standard hosted runners are free under Enterprise. Release, build,
benchmark, e2e and unit workflows stay on Blacksmith. ci-xterm-cache seeds both
cache stores since its PR consumer's pool is undecided.
* test(pi): resolve the smoke bundle's external packages from the repo
#34148 pulled zod into the commit-message planner graph; the bundle in the
OS temp dir could not resolve it on any runner.
* ci(unit): use four workers on the hosted four-core x64 runner
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(cli): hide unsupported profile-state flags
* fix(cli): derive --page and remote-selector help from what each command takes
--page is now a property the browser spec modules set for commands that act on
one page, rather than offered to every command group not on a deny-list, so
serve, environment, agent, connector, host, vm and profile commands stop
advertising and accepting it. Local-only commands offer only --help and --json
plus a selector they take as their own argument, and a test ties their help to
the same local-only list dispatch uses.
Co-authored-by: William Poisel <53629276+epoisel@users.noreply.github.com>
---------
Co-authored-by: William Poisel <53629276+epoisel@users.noreply.github.com>
Hourly and daily builds publish unvetted dev channels on a schedule, so their
latency is not user-facing. Move the macOS build to hosted macos-15, the
Windows build to hosted windows-2022 (the release path), template
qualification to hosted lanes, and the small routing/publish jobs to
ubuntu-latest. Adhoc and release builds stay on Blacksmith.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
* test(wsl-host): native chat on a WSL host through the fake transport, including a stopped distro
* test(wsl-host): type the chat spec's focus host id
* test(wsl-host): harden the WSL host chat spec and re-run fake-connector specs on change
* test(wsl-host): scope the chat reply check to the transcript and test the fake's route
Find the prompt only in the transcript so the composer can't stand in for it,
re-check the boot-free stop window after unfocusing, right before the focus,
give the fake's distros.json temp file its own name so it can't collide with the
spec's, and test that the fake connector routes to both WSL host specs.
* test(wsl): find the chat lane's claude on the guest PATH, with a Windows-side decoy
* test(wsl): prove the Windows decoy is reachable before asserting it never ran; record probe errors
* ci: warm hosted runner caches and drop the serve-switch installer cache
* ci: seed only restored caches from hosted warm legs
* docs(ci): hosted dev builds and no larger runners
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Make context and tab menus compact and native-style
Shared menu primitives get 13px/24px rows, inset separators, full-size
shortcuts, frosted translucency with solid fallbacks, and submenus that
level with their trigger. Tab menus keep only meaningful icons and align
the rest on one text column via inset.
* Keep launch menus and shortcut chips consistent with row text size
* Use the primitive label style in worktree menus
Keep preflight and the unit-test matrix (the PR critical path) on Blacksmith; move routing, aggregation, contract, packaging and mobile checks to hosted standard runners, which are free for public repos under Enterprise concurrency.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
decode() collected payload chunks even when no payload was expected, and with
expected = 0 every data event ran Buffer.concat over all chunks so far. The
128 MB desktop-reads-slowly flood therefore copied quadratically: ~9 s idle under
bun, over 30 s under node or a loaded CI runner, timing the test out.
Collection now lives in received(), used only by the tests that check a payload.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(editor): VS Code markdown highlighting and sticky headings in source mode
* fix(editor): address review on markdown TextMate highlighting
- resolve fence grammars from the first word of the info string
- give fence grammars the cold-compile retry budget
- fall back to Monarch markdown when TextMate fails to load
- bound heading-scan line length
* feat(wsl): note why an idle distro stays held, and fail the holder's scan closed
When user work keeps the holder from releasing, it writes the first few process names (at
most 5) to ~/.orca/wsl-holder-blocked, replaced whole and cleared on release, for the desktop
to read later. A /proc without the holder's own entry, or a status file it cannot parse, now
keeps the hold instead of reading as idle.
* fix(wsl): count an unreadable /proc entry only when it is the user's own
Review of #34534: under hidepid=noaccess root's status files are unreadable, so each read as
this user's work and the distro never released. An unreadable entry now counts only when its
directory belongs to this user. The holder also clears a half-written note on start and
rewrites the note only when it changed.
* Stop unrelated host status publications rebuilding sidebar workspace state
* Follow sidebar selector lint conventions
* Scope sidebar status reads to mounted consumers
* Cover each unrelated sidebar status publication
* Fix sidebar isolation lint and formatting
* Type the composed sidebar header fixture without assertions
* Remove unused React imports from sidebar contract tests
* Reuse folder record selector and prune stale focus allowance
* Add native chat hand-off menu on main
* Fix saved chat hand-off observations and RPC exports
* Reuse indexed chat tabs for hand-off subscriptions
* Match saved-chat clear fixture to current journal API
A desktop-scheduled automation whose project lives on a managed Orca server
sent its dispatch token to the server, which never minted it and rejected every
run with "Invalid automation provenance request". The token now goes only to
this desktop's own create.
Fixes#34433
* fix(tasks): derive preset highlights from the applied query
Reuse the parsed query and already loaded viewer login for personal preset matching. Keep the stored preset field for resume and task-kind behavior.
Co-authored-by: 0668000615 <wen.xiaosong@xydigit.com>
* fix(tasks): limit preset identity matching to known sources
* fix(tasks): wait for source identity before matching viewer aliases
* fix(tasks): match preset highlights to query tokens
Require the effective open state and recognize personal presets by their @me query tokens. Remove viewer identity matching while preserving existing preset persistence and task-kind behavior.
Co-authored-by: 0668000615 <wen.xiaosong@xydigit.com>
---------
Co-authored-by: 0668000615 <wen.xiaosong@xydigit.com>
* fix(gitlab): retain successful hosts from partial auth failures
Read rejected auth-status output without treating failed host headings or
API error advice as successful logins. Publish positive results through
the existing context-owned cache; keep backoff when no login succeeds.
Co-authored-by: David Anderson <cantspamdave@gmail.com>
* fix(gitlab): preserve discovery retries with partial host evidence
* fix(gitlab): escape auth marker for ASCII server bundle
---------
Co-authored-by: David Anderson <cantspamdave@gmail.com>
* Correct GitLab MR check status for failed and manual pipelines
Use the same single-MR read for linked and branch-discovered reviews so a
list summary cannot hide a failed pipeline. Preserve lookup failures for
strict callers and keep detail reads within the existing branch cache.
Set mergeable manual pipelines to neutral without claiming an unrun stage
passed; keep blocking manual pipelines pending.
Co-authored-by: Son of Odin <2700975-son-of-odin@users.noreply.gitlab.com>
Co-authored-by: Emily <hadikcze@gmail.com>
* test: cover GitLab MR check status consumers
* test: type GitLab MR fixtures from mapper input
* chore: document GitLab MR boundary assertion exceptions
* test: share GitLab MR producer and consumer fixtures
---------
Co-authored-by: Son of Odin <2700975-son-of-odin@users.noreply.gitlab.com>
Co-authored-by: Emily <hadikcze@gmail.com>
* fix(tasks): make Linear list section headers collapsible
* test(tasks): cover Linear section collapse and keyboard activation
* test(tasks): bound Linear section toggle work at scale
* fix(tasks): compose Linear section surface with standard button
* fix(tasks): keep section keyboard focus inside the row
---------
Co-authored-by: Isaac Mello <dzordinetwork@gmail.com>
* fix(gitlab): keep paging merge requests when GitLab omits the totals
When total headers are absent, a full response advertises another page to probe and a short response ends pagination. Keep the existing header precedence and unknown total count.
Tracked in #33800
* test(gitlab): cover MR pagination exhaustion and header precedence
* test(gitlab): verify unknown-total metadata across list consumers
* test(gitlab): cover remaining screen consumers of list metadata
* test: use checked GitLab RPC runtime fixtures
---------
Co-authored-by: Hotragn <103170876+Hotragn@users.noreply.github.com>
* fix(ssh): prove a recycled server PID exited on hosts without ps
On slim Linux images that ship no ps, the managed server's liveness probe
could not read the recorded PID's argv, so after a reboot a PID that now
named another process read as LIVE (same user) or UNKNOWN (root). The wake
then refused to start the stopped server, the update deferred on the
terminal census, and the host stayed unreachable. Read argv and the
zombie state from /proc when ps is missing.
Fixes#34149
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ssh): name argv-less PIDs from /proc stat; annotate e2e timeout
Kernel threads and zombies have an empty cmdline, so a recycled PID owned
by one stayed UNKNOWN on hosts without ps. Quote the stat pattern so the
probe also parses inside command substitution on older bash.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ssh): fall back to the stat line only after cmdline was read
A failed tr must stay unproven rather than make a live server's PID look
recycled.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(codex): keep the Codex app's bundled plugins in Orca-managed homes
Codex only loads the openai-bundled marketplace when its source sits under
the active CODEX_HOME. The config mirror copied ~/.codex's source verbatim,
so managed homes silently dropped bundled plugins such as visualize.
Link ~/.codex/.tmp/bundled-marketplaces into managed homes and rebase the
mirrored source onto it.
* fix(codex): rebase bundled marketplace onto the canonical managed home
Codex canonicalizes CODEX_HOME before comparing the bundled marketplace
source, so a managed home reached through a symlink (symlinked userData,
/tmp on macOS) was still rejected.
Neil
Brennan Bensonandbeduldul
EvgeniiandOrcaWin
Jinjing
Jinwoo Hong
Kelvin Amoaba
