Found live on an Orca Cloud rollover (m4air): the persisted-run reader referenced a const declared
below the module-level read, so every restart started with no runs and nothing relaunched. The
relaunch also read orca.yaml before the replacement host served RPCs; it now retries with a bound.
Design-squad sign-off tweaks for DS-15: the action reopens the composer rather
than creating, so it says so; member billing bodies put 'Nothing was created,
and you weren't charged.' before who to ask.
DS-15: no-plan access carries canManageBilling. Members see 'Ask an owner or
admin' instead of Upgrade, and the hint says 'Ask an owner or admin to choose
one.'; at the cap they're told to raise the spend cap. Every billing failure
on the build card offers 'Create on this computer instead' (same prompt,
Local), and Dismiss hands the typed prompt back to the composer.
DS-16: choosing a plan from an Orca Cloud wall leaves an intent. Once paid,
the plans dialog returns to the open composer with Orca Cloud picked, or
retries the refused create. The no-plan card adds Try again, and the Team
page's create action opens on Orca Cloud.
- Port rows get hover/focus buttons: Open in browser, Share… (Orca Cloud), and
More actions for port N, which opens the existing row menu.
- Drop focus:outline-none on the port row group so the focus-ring shows.
- Retry -> Try again; listen failure copy; sentence case for SSH/ports labels.
- Remote desktop notCloud/notInstalled/signedOut render neutral, not red.
- busy/taken -> in use on this computer.
- Expired / Turned off share status keeps full text-muted-foreground.
- New i18n keys for changed defaults; stale keys pruned from all locales.
- Fixtures: share-links portRowFocused / portRowShareFocused / portRowMoreActions.
Settings and Home kept showing the previous team's plan, secrets, keys and
workspaces after a team switch while saves went to the new team, and a
billing read from before the switch could land in local state.
- useOrcaAccountKey() gives `${userId}:${activeOrgId}`; Plan & billing,
Cloud secrets, Cloud environment and Orca API keys remount on it.
- useOrcaBillingStatus re-reads on a switch, clears the old plan, and
drops (and re-reads) an answer whose billing generation moved.
- useCloudWorkspaces keys its read by account, hides another team's list
instead of dimming it; Home resets its filters on a switch.
- Hook tests cover the stale response being dropped and the new team read.
Line items: '{{seats}} x {{price}} per seat, billed yearly' / 'per seat per month'
(plural keys); totals '{{total}} per year' / 'per month'; Worker plan labels
'$50 per seat per month' and '$480 per seat, billed yearly'. Drops /mo, /yr,
/year and /seat/month strings.
Found on a real Orca Cloud VM (m4air): a remote host adopts the run's tab under web-terminal-<id>,
so the run was pruned at once and Stop/status/relaunch lost it; a window reload's empty tab list
pruned local runs too. Pruning now waits for the list to settle (3 s; 15 s after startup).
A one-workspace host (the VM launcher sets ORCA_PORT=3000) keeps its pinned block.
- COPILOT_GITHUB_TOKEN on api.github.com: GET /user and GET /copilot_internal/* only (normalized
paths; dot or encoded segments refused); the Copilot API hosts are unchanged. It resolves like
an env variable (personal beats team): it is one person's GitHub identity.
- Routine summaries for opencode (JSON events), cursor (JSON result) and copilot (--silent) are the
agent's final message, and every summary has the session's secret values replaced before it can
be posted as a comment or PR body.
- Webhook/GitHub context in a routine prompt is capped at 48 KiB (compact, then cut), so a prompt
passed as one argv entry stays under Linux's 128 KiB limit.
- A test fails if an agent credential is neither swapped nor marked 'Stored on workspace'.
- COPILOT_GITHUB_TOKEN: placeholder in the VM, swapped on api.github.com (Bearer or token form, next to
the workspace token's own route) and on the Copilot API hosts (left open for Copilot's own session
token). GOOGLE_API_KEY: swapped on generativelanguage.googleapis.com and aiplatform.googleapis.com
(Vertex express). A credential may now route to several hosts.
- Routines accept claude, codex, opencode, gemini, cursor and copilot; the in-VM runner has a
headless command for each (checked against a local stand-in model: prompts starting with '-' stay
prompts). The editor picks the agent from a list.
- AWS_* keys (SigV4, signed in the VM) and Bedrock API keys can't be swapped: the secrets UI marks
them 'Stored on workspace' with the reason, in the list, the .env preview, the effective view and
the editor.
- Gemini's auth method is seeded for GOOGLE_API_KEY too (vertex-ai with GOOGLE_GENAI_USE_VERTEXAI);
headless Gemini refuses to start without one.
Copilot prefers GH_TOKEN/GITHUB_TOKEN over a stored /login. In Orca Cloud those hold the workspace
GitHub App placeholder, so every Copilot start said 'Resource not accessible by integration' and a
user who signed in could never use it. A wrapper drops the two placeholders for Copilot only, unless
BYOK is configured (no GitHub sign-in needed; gh in Copilot's shell keeps working).
- assertUndoCovers never asks batch-check about a path with a newline (counts as
unsaved), so answers can't shift.
- The workspace-busy probe matches rows by workspace id or worktree realpath and
treats a truncated listing as busy.
- Rewind dialog opens with focus on Cancel; a disabled option reads as disabled.
- Notes: unreadable tracked deletes keep their staged blob; the turn-starting
mark is process-local by design.
- Refuse a restore that would write or delete inside a nested repository, and
verify every on-disk path it touches is in the undo tree first (git add can
skip a path without failing).
- A turn counts as busy from its snapshot until the hand-off; terminal agents
working in the workspace make restores refuse; the preview reports busy and
the dialog disables the files choice.
- W10 copy: statement description, i18n plurals, state-dependent detail line,
option directly under the description, 'The chat was rewound, but…' errors.
- Index restore keeps skip-worktree bits; large-file scan honours the deadline.
- Component fixture for the rewind prompt states.
Neil
Neil