* Improve built-in browser downloads
Implements docs/browser-normal-download-behavior.md with automatic OS Downloads saving, collision-safe destinations, and renderer download controls.
* Clean up browser downloads on tab closure and guest destruction
- Cancel and drop pending download records when webview guests are destroyed or closed to prevent memory leaks and dangling state.
- Purge tracking entries for cancelled downloads lacking an active tab.
- Document filename normalization and reservation assumptions in download builder.
- Translate "Copy Terminal ID" context menu action in Spanish and Chinese locales.
* Add test file for workspace delete bug
Co-authored-by: Orca <help@stably.ai>
* Fix Windows workspace deletion runtime resolution
Resolve project-created workspace deletion through the selected project runtime so Windows paths are listed strictly without falsely tripping the unregistered worktree guard.
Design doc: docs/delete-workspace-windows-unregistered.md
---------
Co-authored-by: Orca <help@stably.ai>
* Add Cmd-J tab session search
References docs/cmd-j-tab-session-search.md for the design.
* Support searching and activating all editor-family tab types
- Index and search editor, diff, conflict-review, and check-details tabs when their backing files are open.
- Deduplicate tab activation logic to ensure exact unified tab IDs are targeted correctly.
- Update palette placeholder texts and localized labels to use "tab title" and "agent prompt" instead of "page title" and "emulator".
- Localize missing tab error strings in Spanish, Japanese, Korean, and Chinese locales.
- Ensure cross-platform path compatibility in search tests using path.join.
* Add floating workspace contextual tour
Co-authored-by: Orca <help@stably.ai>
* Clarify floating workspace tour intro copy
Co-authored-by: Orca <help@stably.ai>
* Differentiate floating workspace tour steps instead of repeating examples
Co-authored-by: Orca <help@stably.ai>
* Lead floating workspace tour with the user benefit
Co-authored-by: Orca <help@stably.ai>
* Pitch floating workspace tour around cross-repo agents
Co-authored-by: Orca <help@stably.ai>
* Refine floating workspace tour step 1 copy
Co-authored-by: Orca <help@stably.ai>
* Anchor floating workspace tour step 2 on the minimize control
Co-authored-by: Orca <help@stably.ai>
* Restore floating workspace tour step 2
Co-authored-by: Orca <help@stably.ai>
* Anchor floating workspace tour steps on New Terminal and New Markdown Note
Co-authored-by: Orca <help@stably.ai>
* Retitle floating workspace tour step 2 as scratchpad
Co-authored-by: Orca <help@stably.ai>
* Add why-comments for tour selector fallback and placement flipping
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(windows): stop main-thread PowerShell storm on env-store reads
Two changes fix the v1.4.52+ Windows performance regression (#4901 regression
against #4840) where 49 powershell.exe processes were spawned in 27 seconds
during load, saturating the Electron main thread and causing black terminals
and runtimeEnvironments:call timeouts.
Root cause: `readEnvironmentStore` calls `hardenExistingSecureFile` on every
read. The env-store parent directory's mtime churns constantly (every secure
write updates it), so the mtime-keyed idempotency cache never matched →
`bestEffortRestrictWindowsPath` (powershell, ~1-1.5s synchronous) fired on
every call. After #4901, the remote-runtime tab-sync loop reads the store
~2×/s, turning sporadic mtime misses into a continuous main-thread storm.
Fix 1 – path-cached directory hardening: add `hardenedDirectoryPathsThisProcess
(Set<string>)` that caches directory hardening by PATH for the process lifetime.
A directory's required ACL does not change when its mtime changes; only file
hardening retains the metadata-keyed cache so post-rename inode changes are
detected correctly.
Fix 2 – async ACL application: replace `execFileSync(powershell.exe, ...)` with
`execFile` (fire-and-forget). PowerShell cold-start is ~1-1.5s; the function is
already named `bestEffortRestrictWindowsPath` so async/optimistic caching is
correct. `applySecurePathRestriction` returns `true` optimistically on win32 so
the cache entry is written before the background process completes.
Tests: new regression tests verify the directory is hardened exactly once even
when its mtime changes between calls, that unchanged files are not re-hardened,
and that ACL application goes through async execFile (not execFileSync).
* fix(windows): apply credential-file ACL synchronously on write path
Follow-up rigor on the env-store PowerShell ACL storm fix (#5006). The
read-path storm fix (path-cached async directory hardening + async file
re-harden) is retained, but switching ALL ACL application to async opened a
narrow Windows-only security window: because writeFileSync({mode}) is a no-op
on Windows, writeSecureFile returned with the credential file still carrying
the parent directory's inherited (broader) ACL for the ~1-1.5s PowerShell
cold-start, affecting the e2ee keypair, device registry, and runtime env auth
store.
Fix: apply the credential FILE's ACL synchronously (execFileSync) on the
infrequent write path, before the atomic rename publishes it, and cache the
path as hardened only on confirmed success so a failed apply retries. Keep the
DIRECTORY hardening async + path-cached for the process lifetime (that is what
killed the #4901/#5006 main-thread storm). The read path's existing-file
re-harden stays async + metadata-cached (fires at most once per file, no storm).
Also:
- Document the dir-path cache process-lifetime known limitation (deleted+
recreated dir not re-hardened until restart).
- Remove the redundant double dir-cache write in writeSecureFile.
- Add docs/windows-secure-file-acl-hardening.md describing the sync-file/
async-dir model and a manual Windows e2e test plan (the cross-platform
Playwright harness runs on Linux and cannot reach the PowerShell path).
Tests (src/shared/secure-file.test.ts, 13 passing): credential file hardened
synchronously while dir stays async (no async file-ACL window); failed sync
file-ACL apply is not cached and retries; dir hardened exactly once across many
writes despite mtime churn; no PowerShell spawned on non-win32.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: keep POSIX secure directory hardening metadata-aware
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Detect generated Orca Unix launcher files as stale CLI registrations and replace them during install, while keeping arbitrary regular files protected as conflicts. This removes the stale /usr/local/bin/orca blocker found during memory profiling.
github-actions[bot]
Jinjing
Jinwoo HongandOrca
Siddiqui Qamar
OrcaWinandNeil
Brennan BensonandOrca
