* Seed WSL Codex runtime config through the fresh-mirror preparation
The WSL runtime home seed copied config.toml verbatim, so relative
path-valued settings (model_instructions_file etc.) resolved against the
runtime home inside the distro and aborted Codex config load with
'os error 2' -- the same failure class #7157 fixed for host runtime and
managed account homes. Seed now applies the shared fresh-mirror
preparation (deprecated codex_hooks normalization + relative-path rewrite
anchored to the Linux-side source home + system hook-trust strip).
Also fixes CRLF configs skipping deprecated codex_hooks normalization:
the feature-section header regexes did not tolerate the trailing \r.
Co-authored-by: Orca <help@stably.ai>
* Extract prepareWslRuntimeSeedConfig and pin UNC->Linux anchor in tests
The e2e seed test's mocked WSL home is a plain local path, so the
parseWslUncPath linuxPath branch was never exercised. Extract the seed
preparation as a pure exported function and cover both UNC spellings
(wsl.localhost and wsl$) with hardcoded literals.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
The SSH reconnect dialog was auto-opened at render time for any active/restored
worktree whose SSH target was disconnected, blocking the entire UI even when the
user was working elsewhere. On app restart the previously-active worktree is
restored without a click, so the modal stole focus app-wide over unrelated work.
The disconnected state is now surfaced only through the non-blocking affordances
that already existed — the worktree card chip, the status-bar Connect action, and
the pane-scoped terminal reconnect overlay. The blocking dialog opens only on
deliberate focus (clicking the worktree card), and even then it is suppressed when
the active view is a terminal, since that pane already shows the in-context
reconnect overlay and a second prompt would just duplicate it.
Fixes#7314
Refines 291 Simplified Chinese (zh-CN) strings for terminology consistency and clarity. Rebased onto main with full en/es/ja/ko key + interpolation parity; fixed placeholder parity on 4 keys and 9 reviewed translation-quality issues.
Co-authored-by: linyunlong <yunlonglin1995@gmail.com>
* perf: overlap sidebar-scope loads with worktree scan at startup (#7225)
Continues the renderer-chain parallelization proposed in #7225 (proposal 2),
on top of the merged #7266:
- Run project-groups → folder-workspaces concurrently with the per-repo
`git worktree list` fan-out. Neither reads the repos store nor worktrees,
so a slow remote host's 15s scope RPCs no longer queue ahead of the scan.
- Raise worktree refresh concurrency 5 → 8 so multi-core machines run fewer
sequential scan batches, still bounded so one moment can't launch every
git probe at once.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Test overlapping sidebar scope loads and worktree hydration at startup
Verify that sidebar scope loads and worktree hydration operations run
concurrently before session hydration. This protects against regressions
in startup performance under the perf/startup-lag optimization.
Additionally, document the rationale for the worktree refresh
concurrency limit in the worktrees slice.
* Clarify worktree refresh concurrency comment
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Resolve terminal CWD and worktree paths to their canonical form using
realpath before validating containment. This blocks symlink escape
routes for local terminal spawns, returning the default workspace
directory if a requested path attempts to escape the worktree.
- Local terminal paths are canonicalized using native realpath logic
- WSL UNC paths and SSH/remote terminals skip canonicalization
- Floating terminal startup directories bypass containment checks
- Missing or unresolvable workspace directories default safely
* fix(automations): start scheduler in headless serve mode
* Trigger initial catch-up check for headless scheduled automations
Headless serve never receives a renderer-ready IPC, which previously
prevented the initial catch-up pass of due scheduled automations from
running on startup. Checking for the presence of a headless dispatcher
allows starting the evaluation pass immediately.
Additionally, refactor the corresponding test to use fake timers for
better reliability and deterministic assertions.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Creating a workspace hard-failed with "Could not refresh base ref …"
whenever the pre-create git fetch of a remote-tracking base (e.g.
origin/main) failed — offline, transient, or (common on Linux GUI) the
Electron process lacking SSH_AUTH_SOCK so `ssh -o BatchMode=yes` cannot
auth. This blocked creation even when a perfectly usable local
origin/main already existed and `git worktree add` from it would succeed.
Regression introduced by #2310 (5c93579e40), which replaced the prior
best-effort fetch + post-create reconcile with a hard network gate.
Fix: at all three create sites (local runtime, local IPC, SSH), only
throw when the refresh failed AND no usable local base ref exists;
otherwise create from the local ref (a possibly stale but valid base).
Also: move the SSH local-ref probe after session.registerRoot so relays
that gate generic git.exec don't false-negative and defeat the fallback.
Co-authored-by: Orca <help@stably.ai>
* fix: address pr-bug-scan validated finding from #6952
throwNodeNotFound() now re-raises AbortError when the shared signal is aborted, so a signal-cancelled node probe no longer launders into 'Node.js not found'; sequential fallback runs.
* fix(ssh): make session-limited (MaxSessions=1) relay deploys actually succeed
Review of #7180 verified the parent fallback end-to-end against a real
MaxSessions=1 sshd and found the connect still failed. Four gaps, in order
of discovery:
- isSshSessionLimitError missed stock OpenSSH, which refuses session
channels over MaxSessions with SSH2_OPEN_CONNECT_FAILED (2) and 'open
failed' — reason 4 never matched, so the fallback never triggered.
- execCommand settled aborted commands before the channel finished
closing, so the sequential fallback reissued execs while sshd still
counted the old session.
- SshConnection.waitForSshCallback rejected aborts mid-channel-open
immediately, leaking a confirmed-late channel that held the only
session slot; it now settles after the late channel closes (bounded)
and drains its streams so ssh2 emits 'close'.
- Session channel opens now retry transient session-limit refusals
(sshd frees the slot only after processing our close-ack, which the
next open can beat by microseconds), and the remote orca CLI shim
install is non-fatal like the managed-hook install — after the relay
bridge occupies the sole session slot, raw-connection extras must
degrade instead of failing the connection.
Verified live against Docker sshd (OpenSSH 9.2, MaxSessions=1): fresh
deploy (upload + native deps + launch), reconnect cycles, and a PTY
round-trip all succeed; unrestricted-sshd regression run also passes.
Co-authored-by: Orca <help@stably.ai>
* Handle ssh execution aborts immediately during retry backoff or hangs
- Cancel the session-limit retry delay immediately if the operation is
aborted during backoff.
- Limit the wait time to a 5-second grace period when aborted during a
channel open that is hung and never invokes its callback, rather than
waiting for the full connection timeout.
---------
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
The release-blocking `terminal rendering golden mac` job was failing ~40%
of Cut Release runs with `Expected e2e repo to be loaded`, leaving the RC
stuck as a draft (publish-release depends on this job).
Root cause: the sharedPage fixture did a single-shot fetchRepos() + find()
+ throw. window.api.repos.add() fires a repos:changed echo that triggers a
concurrent fetchRepos() in the renderer; the store's reposFetchGeneration
guard then drops the fixture's own awaited fetch result, leaving `repos`
briefly stale, so find() returns undefined and throws. The repo lands a few
ms later (the failure screenshot's sidebar actually shows it).
Wrap the repo load in expect.poll (matching the seeded-worktree poll right
below it) so it retries fetchRepos until the repo lands, then runs the
idempotent updateRepo. Also harden the single-shot hasWebgl/cursorHidden
diagnostics reads in the golden spec: WebGL reattaches asynchronously after
a worktree switch, so poll those eventually-consistent fields until they
settle before the golden asserts. Regression detection is preserved: a real
WebGL/cursor regression times out the poll and still fails the test; the
geometry/wrap/overpaint golden checks stay single-shot.
- Prevent the "Stage All" button from being enabled when only nested
submodule worktree changes are present.
- Remove the disabled stage button on submodule worktree-only rows,
replacing it with an explanatory tooltip.
- Fix WSL terminal environment assertion in daemon PTY tests to allow
inherited agent-hook environment variables.
* Fix notes send targets for manual agents
* Split agent title merging into manual and launch-agent paths
Separate the merging logic for terminal titles depending on whether the
tab has a launch agent or is a manually started CLI.
- Launch-agent tabs carry an owner bit, allowing their live titles to
promote a stale status row on the same pane.
- Manually started agents have no owner bit, so they only ever add a
row and must not override existing status evidence.
- Remove the temporary TitleHintAgentTarget type and the need to strip
metadata when pushing targets.
Quality pass on main-process/build PRs merged 2026-07-03:
- ios-emulator-backend: resolve the serve-sim executable via a lazily-cached getter
instead of eagerly in the constructor. The bridge is built before the main window
is shown, so the one-time recursive copy + xattr subprocess (first launch after each
version bump) no longer blocks macOS startup for a feature that may go unused (#7174).
- index: collapse the two near-identical `{webContentsId, until}` reload flags
(expectedRendererReload / recoveryReloadInFlight) into one `createWebContentsTimedFlag`
primitive; behavior preserved, including consume-on-read for the recovery reload (#7290).
- check-reliability-gates: coerce gate.commands/testFiles/platforms/providers with an
`asArray` helper before `.includes`, so a hand-edited manifest with a missing/mistyped
field reports a validation failure instead of throwing an uncaught TypeError; extract
`hasCompleteRedGreenEvidence` for the duplicated status check (#7295).
- claude-pty: derive FABLE_WEEKLY_LABEL_RE from WEEKLY_RE.source so a future weekly-
wording change stays in one place and can't reopen the parsing gap it just closed.
- macos-tcc-login-shell: trim the 30-line flag-by-flag JSDoc to the two non-obvious whys
(TCC identity, env(1) SHELL re-assertion) per the repo comment guidance (#7003).
Typecheck, oxlint, oxfmt, `check:reliability-gates`, and touched unit suites all pass.
Quality pass on renderer/shared PRs merged 2026-07-03:
- WorktreeTitleInlineRename: skip the truncation measure + ResizeObserver in `wrapTitle`
mode, where wrapped titles never truncate — it could only churn unused state (#7307).
- editor slice: reuse the `removeEditorStateForReplacedPreview` helper this PR added
instead of a hand-rolled copy of the same six-field eviction (drops ~50 lines) (#6476).
- useFileExplorerTree: extract `readWorktreeDirectory` so the connectionId/settings
assembly for `readRuntimeDirectory` lives in one place, not three (#6321).
- comment-markdown-github-attachment-media: extract a shared `AttachmentFallbackLink`
for the image/video error-fallback link (#6759).
- repository-icon-github: fold the two near-identical live resolvers into one
parameterized `resolveRepositoryIdentityLive`; trim a 3-line comment to 2 (#6507).
- resource-usage-open-slices: delete the `shouldReadPopoverSlices` identity wrapper and
inline `open` at the four call sites (#7275).
- BrowserPane: drop the pointerEvents assignment already applied inside
`ensureBrowserPageWebview` for the reused-webview path (#6958).
- github slice: fix two garbled "…a commit main confirmed…" comments (#7277).
- runtime-file-client: trim the binary-file fallback comment to its whys (#6606).
- composer-branch-selection: drop the inline comment that restated the JSDoc (#6748).
- TabBarQuickCommandsButton: correct the stale "+ Command" comment (button shows no +).
No behavior change (the editor-helper reuse is behavior-equivalent, only more
conservative on an edge case); typecheck, oxlint, react-doctor, oxfmt, and touched
unit suites all pass.
Quality pass on terminal PRs merged 2026-07-03:
- pane-split-close: extract a shared `teardownManagedPane` so `closeManagedPane` and
`detachManagedPaneForExternalMove` can't drift apart on future edits (#7215).
- terminal-link-activation: reuse the existing `isMacPlatform()` instead of a second
inline `navigator.userAgent` copy, keeping one source of truth for Mac detection.
- pty-connection: gate the shadow-cursor moves on empty CSI params so parameterized/
modified cursor keys (e.g. Ctrl+Left word-jump, `ESC[1;5D`) reset command tracking
instead of silently desyncing the buffer used to infer a typed agent name; relocate
the `getAuthoritativePaneAgent` JSDoc to the function it documents (#6954).
No behavior change except the cursor-tracking hardening; all touched unit suites pass.
This reverts commit a94d692cd5, restoring the
shorter "Command" label and the Play icon on the quick command entry
(PRs #5528 and #5674).
Co-authored-by: Orca <help@stably.ai>
sherpa-onnx cannot load model files or hotword lists from Windows
paths containing non-ASCII characters.
- Resolve speech model and hotwords paths to ASCII-safe alternatives
like ProgramData when the default userData path contains non-ASCII
- Migrate existing downloaded models from the legacy non-ASCII cache
- Ensure deleted models are removed from the legacy source folder to
prevent them from being re-migrated on subsequent launches
Fixes the PTY fallback path so Claude Fable usage carries a concrete reset timestamp and the existing status tooltip renders the Fable reset countdown.
* fix: stop Claude account loading after denial
* fix(claude-accounts): tear down whole login tree on OAuth denial
Use killChild() (not child.kill) on the denial path so the detached
POSIX process group and Windows child tree are killed, matching the
timeout/abort paths and honoring the detached-spawn comment. Strengthen
the regression test to assert the process-group teardown.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Neil <charlie-eng@stably.ai>
Co-authored-by: Orca <help@stably.ai>
* feat: allow custom worktree branch names
* refactor(ui): render custom branch name field unconditionally under advanced container
* fix(composer): hide manual branch field when a work-item source drives the branch
A tracked PR/issue/MR/Linear source derives the branch itself, and a linked
GitHub PR re-resolves the branch name at submit — so an override typed in the
Advanced branch field was silently ignored. Only render the field for the
typed-name and base-branch flows, where the manual override is honored.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
NeilandOrca
Loongandlinyunlong
Rod BoevandJinjing
github-actions[bot]
Jinwoo Hong
slashdevcorpseandJinwoo Hong
Brennan BensonandOrca
andrewroxby
PPandping
