* fix(git): stop sweeping unattributed per-ref locks during maintenance
An old packed-refs.orca-owner marker with a dead pid does not prove ownership of empty refs/**/*.lock files. A live git update-ref transaction can hold an empty lock, so deleting it let competing writers change the ref mid-transaction. Remove the sweep; keep packed-refs marker recovery.
* test(git): drop ref-lock tests made redundant by sweep removal
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
isFullGitObjectId only matched 40-hex IDs, so a saved 64-hex commit base in a SHA-256 repo was treated as missing, triggering an unneeded origin fetch and a fallback to the default branch.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Buffered gitExecFileAsync reads now always fence login-shell rc output, and
non-zero exits de-fence error.stdout. The per-call captureWslLoginShellOutput
opt-in is removed since it is no longer meaningful.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(source-control): hide discard for present submodule gitlinks
Parent git restore --worktree without --recurse-submodules leaves a dirty or moved submodule untouched, so Discard reported success while the row stayed. Hide row/section discard for present gitlinks and submodule children; deleted submodule dirs and staged gitlink discard (which unstages) keep working.
* fix(source-control): keep submodule discard when submodule.recurse is on
Plain git restore recurses into active submodules when submodule.recurse=true, so status now stamps restoreRecurses on gitlink entries and the shared discard guards keep those rows discardable.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Route resolveLocalGitUsernameDetailed's config lookups through createGitConfigSnapshotRunner so one resolution runs a single 'git config --list -z' instead of up to five 'config --get' children.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Read .gitmodules with config -z so a submodule name or path containing a
space (the default when 'git submodule add' targets a spaced path) keeps
its real path instead of being split at the first space.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
for-each-ref %(refname:short) prefixes a branch with heads/ when a same-named tag exists, so the mobile branch picker sent heads/<name> to checkout and detached HEAD. Use %(refname:lstrip=2) to return the branch name itself.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The fallback patch-equivalence proof only reads each line's leading +/- marker,
so the subjects printed by `git cherry -v` were unused output.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(git): resolve current branches without tag ambiguity
* fix(git): share tag-safe current branch reader with push-target setup and trim real-git proof matrix
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
git show :<path> and git show HEAD:<path> treat a missing blob spec as a
pathspec, exit 0, and print the HEAD commit when the path contains [, *
or ?. Orca then showed the commit header as the original side of new
files such as app/[id]/page.tsx. Read index and tree blobs with
git cat-file blob, and on older Git that only reports 'Not a valid
object name' prove absence with an empty literal ls-files/ls-tree probe.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(wsl): user clicks on cwd-less gh may start the stopped default distro
#35709 stopped background gh/glab from booting a stopped default distro,
which also refused explicit clicks for users whose gh lives only in WSL.
Starring Orca, the auth diagnosis, the project picker, opening a work
item and board edits now run as a user act on the distro the fallback
uses; the board table reload, which also runs unprompted, stays gated.
The GitHub and GitLab rate-limit cards keep their last snapshot on the
not-running refusal instead of flipping to unavailable.
* fix(wsl): only an explicit click may start the stopped distro for project gh calls
Wrapping the project-view and auth-diagnosis IPC handlers as user acts
also let mount effects (useProjectViewTable listing a restored board's
views, GhAuthErrorHelp's diagnosis) start a stopped default distro. The
handlers now wake only when the renderer passes wakeWslDistro, which the
picker browse/select, opening an item and every edit set; mount effects
leave it unset, and the auth diagnosis never wakes.
* feat(source-control): resolve conflicts with one host operation shared by desktop and mobile
* feat(mobile): resolve merge conflicts and complete merges from Source Control
* test(mobile): pin Complete merge refusals and the older-desktop message
* fix(source-control): only resolve paths Git still reports as conflicted
* fix(source-control): refuse to keep a missing file and serialize conflict resolution per worktree
* fix(source-control): resolve only the exact conflicted path
* fix(source-control): match conflicted paths in Git's separator form on Windows and WSL
* fix(source-control): accept only the resolutions the live conflict offers
* fix(source-control): refuse to keep a both-modified file that is gone from disk
* feat(mobile): translate the merge conflict actions
* test(runtime): keep the mobile allowlist test under its line cap
* fix(mobile): let VoiceOver reach conflict action buttons
* fix(source-control): resolve delete/modify conflicts and complete merges from the panel
* fix(source-control): address review findings on conflict resolution
* fix(source-control): save every view of the file before marking a conflict resolved
* fix(source-control): match unsaved conflict views by physical file only
* test(source-control): prove completeMerge refuses with a commit template set
* refactor(source-control): reuse autosave view matching and refresh only after a completed merge
* fix(source-control): drop the untranslated Complete merge fallback text
* fix(source-control): refuse Keep file when the file is gone and re-read unsaved views on retry
* fix(source-control): let Keep file stage conflicted symlinks with missing targets
* fix(source-control): run one conflict resolution per file at a time
Hosted-review eligibility (baseRefExistsOnRemote) and PR remote-base probes
spawned one `show-ref --verify` per configured remote. Eligibility re-runs on
every source-control state change (commit, ahead/behind, dirty toggle, worktree
switch), so a repo with many remotes bursts dozens of git children each time.
Add probeExactRefsViaForEachRef: one stdin-free `for-each-ref -- <refs>` child,
keeping only exact matches (descendants do not count), with fallback to the
existing per-ref probes on any failure. On a 77-remote repo: 77 children /
~570ms -> 1 child / ~40ms, identical present/absent results.
Exact probes are now case-sensitive on every filesystem (for-each-ref matches
refnames byte-for-byte, unlike loose-ref show-ref on macOS/Windows), which
matches packed-ref and hosting-provider semantics.
Refs STA-8433, STA-6289
* fix(wsl): every local Git call follows its project's runtime unless it says why not (D1c-6)
* fix(wsl): rebuild Git routes on the store's own writes, never on a timer, and route a new worktree by its link
* fix(wsl): route WSL-made worktree links, aliased checkouts and sync Git; host Git only where marked; no wsl.exe storms
* fix(wsl): map WSL-made worktree links through each project distro's automount root
* fix(wsl): arm the missing-distro cache only with the Git router on, and feed it spawn failures
* fix(wsl): keep synchronous Git host-only, read the setup runner's path from the link, and keep the sync launch under the ratchet
* chore(wsl): move the sync Git runner's process-host import allowance with it
* fix(wsl): read only per-worktree git paths from the link, and only from a git dir that still exists
* fix(wsl): name which Git ran on stream and spawn spans too, so status shows its route
* test(wsl): setup runner lookups declare host Git; cover the link read with the router on and off
The hooks tests expected the setup runner's `rev-parse --git-path` call to
carry `wslDistro: 'Ubuntu'` for a WSL-runtime project. On main that field
never reached Git: main's gitExecFileSync options have no wslDistro and it
calls resolveCommand('git', args, cwd) with no distro override, so the
lookup ran host Git (WSL only when the cwd itself is a WSL path). The tests
pinned call arguments, not what ran. The sync runner now states that with
`hostGit: true` and resolves exactly as main did, so the tests assert that.
New worktree-runner-script-link tests cover the router-gated link read:
router on reads the link; router on with no usable link falls back to host
Git and converts its Linux path; router off makes main's host Git call and
never reads the link.
* test(git): read src/main once in the host-Git routing guard, so it holds under load
* test(wsl): pin the setup runner's sync Git spawn to main's exact launch on POSIX
The setup runner's path lookup now passes hostGit: true where it passed a
wslDistro that gitExecFileSync never read, so the binary, args, cwd and env
it spawns are unchanged. Update the call-shape assertions and pin the POSIX
execFileSync call itself.
(cherry picked from commit 6aae6d4d090e13b75c1d9ad2734f2f717dde7570)
* fix(wsl): await WSL Git admission in spawns only when there is one
With the Git router off admitWslGit returns null; awaiting it anyway added a
microtask to every spawn's admission path that main doesn't have.
(cherry picked from commit 883aaeb90bc23e89cafb039708a565ab3d72620e)
* fix(wsl): keep main's Git scheduling when the D1c Git router is off
The remote-identity sweep moved every user's probes to the background
admission tier, which only the router reads; it now keeps its tier unless the
router is on. Admission wrapping and the spawn stderr tail also step aside
without the router, so those calls run exactly as on main.
(cherry picked from commit 151a3091307c03078d0c0b98487bbe3bf467ec27)
* test(wsl): point the distro allowlist test at the sync runner's new home, as host Git
Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit 255e85fc93deba83addc4370f889c1b721180188)
* test(wsl): installing the Git router with the gate closed or off Windows leaves none installed
Co-Authored-By: Claude <noreply@anthropic.com>
* perf(wsl): skip the span-only Git resolution on every spawn while the Git router is off
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): read a distro's automount root only from a running list probed after its stop settled, so it never boots a terminated distro
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
A timed-out worktree add surfaced only "git timed out.". Rewrite the
GitCommandTimeoutError message on the add path to state the limit used and
point to ORCA_WORKTREE_ADD_TIMEOUT_MS, set where Git runs (the remote host
for SSH or orca serve workspaces). The advice is dropped once the limit is
already at its maximum. The error's class and timeout field are preserved.
Fixes#35174
Cwd-less gh/glab calls whose host CLI is missing fell back to the default
WSL distro with no running check, so background work (rate limits, auth
status, Settings, task-source probes) booted a stopped distro. The
fallback now asks the background exec gate first: stopped or
unverifiable refuses with the distro-stopped error, running and user
acts fall back as before.
* Support explicit remote branch reuse across workspaces
- Preserve selected branch identity, tracking, and busy-branch handling
- Add explicit branch-off intent with v2 runtime capability gating
* Style existing workspace action in branch reuse UI
* Preserve explicit branch reuse with versioned host support
- Gate strict reuse on a new request capability while retaining legacy behavior
- Warn when a reused remote branch cannot be configured as the push upstream
* Clarify selected branch checkout options
* Offer existing or new branch choices for worktrees
* Preserve new-branch intent when reusing a branch name
* Adapt branch composer tests and catalog after rebase
* Refresh mobile RPC recordings for branch intent capabilities
* Remove retired Russian localization entries
* Remove retired German and Turkish localization entries
* Add branch selection translations for existing workspaces
* Localize mobile worktree branch selection
* fix(wsl): anchor the guest kill's stop read after the guest ran; re-check before each heal batch
A 'stopped' answer skips the guest kill as proof the group ended, so it must come from a probe
started after the guest reported its group. The Codex index heal re-checks the distro right before
each batch spawns its guest codex, closing the window during the inter-batch delay.
* fix(wsl): the Codex heal also stops on an explicit may-have-stopped note
A hook-relay or watcher exit notes the distro may have stopped before any running list sees it;
shouldStop now hears those notes too, not only the running-list diff.
Git refuses `git worktree remove` without --force for any checkout with
submodules, even when nothing is dirty. Orca's dirty check passed such a
clean checkout, so the delete was accepted, its terminals were stopped, and
Git's refusal arrived later in the background, where the CLI and
automation never saw it.
The dirty check now applies Git's own test (submodule repositories under
the worktree's admin directory, or a gitlink checked out with its .git),
which the native Windows path already used, and refuses a clean checkout
that fails it with a message that keeps Git's wording, so every app
version still offers Force Delete with the submodule warning. The same
test now decides when a dirty refusal names submodules. Force is not
applied automatically: it would also delete submodule commits, branches
and stashes that were never pushed.
Refs #35135
L1: the orcad liveness supervisor's heartbeat/verify reads, its recovery gate, the no-boot
reconnect check and the connector's passive probe now take a settled read of their own distro, so
a list probed while the distro is still stopping cannot admit a holder spawn, identity read or
reconnect that would boot it again.
L2: a Git cancel/timeout's guest kill, the WSL move's process table and each step of the Codex
session bridge chain check the distro first. A confirmed stop counts as the group gone / an empty
table / the end of the chain; an unanswered read proves nothing and spawns nothing.
* feat(wsl): run Git for Windows for a WSL project on a Windows drive
A project on C:\ whose runtime is WSL ran every Orca Git command through wsl.exe on
/mnt/c: ~300x slower than Windows Git, and blind to Windows-side edits. The project's
WSL runtime preference gains an optional `git: 'windows-host'`. With it, Orca's Git
(and where new worktrees go) is Windows; terminals, agents, accounts and hooks still
resolve to WSL, so nothing else changes. Older builds drop the field and go back to WSL
Git.
The conversion checks first, then the caller saves the returned preference through the
normal project update:
- Git for Windows must exist.
- New worktrees must not be set to go inside the distro.
- No linked worktree may have a Linux-path link. WSL Git made those; Windows Git sees
them as prunable, and Orca's prune after a worktree removal would delete their
metadata.
- Optionally writes core.autocrlf=true into the repo when Windows Git uses it, so WSL
Git in the project's terminals stops seeing CRLF changes. Never core.checkStat.
IPC is refused off Windows and with the internal WSL hosts gate closed.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl): mock the drive-project IPC in the core handler registration test
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl): pin WSL Git for a drive project that never chose Windows Git, and record which Git ran
* fix(wsl): base-ref lookups and the remote-identity sweep run Git where the project's runtime does
* fix(wsl): route base-ref and remote-identity reads by runtime only with WSL hosts on
These reads ran host Git on main. Routing them into a WSL-runtime project's
distro is part of D1c, so with the WSL hosts gate closed they run host Git
exactly as before.
(cherry picked from commit 2ed82987dc5b82c3a86ea7e03ce05e9efc3e77fb)
* refactor(ipc): register the filesystem handlers in one call, keeping core registration under its line cap
The optional commit-message resolvers pass straight through, so the call is the same with or
without them. #34059 left this file at the 300-line cap and the WSL drive-project wiring adds to it.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): skip folder repos in the Windows Git check, and read worktree links with the prune guard's reader
Folder repos run no Git, so rev-parse on them always failed the preview. The link reader and
the WSL-authored test now come from worktree-prune-guard.ts; the copy's startsWith('/') wrongly
refused //wsl.localhost links, which Windows Git writes itself.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): the remote-identity sweep checks the distro a drive project's Git runs in, so it never boots a stopped one
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
When git status failed (e.g. a corrupted index), the read returned an empty
result and Source Control said the workspace was clean. getStatus now carries
Git's error as an optional readError; the store keeps the last known entries
and conflicts while it is set, and the panel shows a status-read banner with
Git's message and Retry instead of the clean empty state. The Retry logic is
shared with the too-many-changes banner, and the per-worktree error is cleaned
up on teardown and migrated on worktree rename.
Fixes#28033
Co-authored-by: Neil <neil@stably.ai>
* feat(media): read remote media ranges through the paired runtime
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(media): stream remote media through orca-media grants
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(editor): play video and audio from remote runtime workspaces
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(media): surface update-required for remote media and cancel in-flight chunks
Probe files.readChunk once per environment and pairing revision before minting a
grant so older servers show the update message. Closing a media stream now aborts
the in-flight remote chunk. Also validate the IPC address, fix extension-only
names, and tighten the preview return type.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(files): one classifier decides which viewer opens a file
Local reads, files.readPreview on hosts, git blob previews and the desktop's
remote binary handling each kept their own image/PDF extension table, and
media had another. file-preview-kind.ts is now the one table: image, PDF,
audio or video, with the MIME type. AVIF, which only local reads knew,
previews on hosts and in git diffs too.
* perf(runtime): give byte-range reads their own small call lane
files.readChunk (media streams, paged files, downloads) now runs in a
two-call lane per environment, so a playing video or a download never holds
the slots terminal input and workspace calls use.
* feat(files): stream previews from paired runtimes by byte range
Generalises the remote media grant into one byte-range preview path: an
orca-media:// grant keyed by environment, worktree, path and pairing
revision, streamed over files.stat/readChunk. Audio and video use it now;
the shared classifier decides which viewers do.
- One files.stat at mint replaces the readChunk probe: it proves the host
serves range reads and that the path is a file, so an old host or a
missing file fails in the tab, not as a silent player error.
- A burst of range requests shares one stat (reused for 1s), so seeking
costs one round trip less on a slow link; later requests re-stat, so a
growing recording keeps playing.
- Removing a paired runtime revokes its grants; a re-paired one answers
410 and drops the grant.
- Only readers that render bytes mint a stream; baseline checks don't.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* fix(files): prove chunk reads at mint, and let a reload report the new size
Hosts from v1.4.5 answer files.stat but only v1.4.111 and later answer
files.readChunk, and no capability names it, so minting reads one byte,
cached per pairing, and an older host fails in the tab with the update
message. A re-mint seeds the grant with its fresh stat, so a reload never
reuses an older size. A renderer gone mid-mint mints nothing. Preview
chunks time out after 20s so a stalled one frees its lane sooner.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* fix(files): resolve preview hosts in the pairing registry's own directory
The remote preview reader looked environments up under the canonical
user-data path, while the pairing IPC writes the registry under
app.getPath('userData'), which can differ in casing on case-sensitive
installs. Both now use one getter. A chunk-read verdict is cached only
when a pairing revision pins it, so it can't outlive a re-pair.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* fix(files): read the pairing registry from one directory everywhere
Doc previews resolved paired servers under the canonical user-data path,
the same casing mismatch the media reader had. They and every other main
caller that names the registry directory inline now use
getRuntimeEnvironmentRegistryRoot(), so it has one source.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* fix(files): pin an unpinned preview grant to the pairing it was minted on
A renderer that hadn't loaded the environment's pairing revision yet sent
none, and every later chunk read went unguarded, so a re-pair under the
same environment id would let the old URL read from the new host. Main now
pins the registered revision at mint.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* refactor(files): route the remaining pairing-registry readers through the one getter
AI-vault host scans, the settings runtime-environment preference, skill
capability checks and the mobile relay host list named the registry
directory inline. They now use getRuntimeEnvironmentRegistryRoot() too;
callers that also use the directory for other storage keep their own path.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
* refactor(files): write new pairings through the same registry root
The ephemeral VM pairing writer named the registry directory inline; it now
uses getRuntimeEnvironmentRegistryRoot() like every reader.
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
---------
Co-authored-by: Sahil Sharma <128581847+SahilSharma0810@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Follow-ups from the large-file audit (E7):
- files.search had no byte budget: a result past the remote reply cap failed outright with
reply_too_large. It now keeps the whole files that fit and marks the result truncated, as
files.listAll and searchPaths already do. Local callers stay uncapped.
- A diff side past the 10 MiB read cap came back as binary, so the diff said "Binary file
changed" for a large text file. Blob reads mark it `tooLarge`, the binary diff result carries an
optional `tooLarge`, and both diff views say "File too large to diff". Older clients ignore the
field and keep the binary view. buildDiffResult builds its binary sides without a cast.
- The real-WSL lane pages a 100 MB file over the plain distro's shared control socket in the
editor's 384 KiB chunks and records the time, chunk count and orcad's VmHWM. Record-only: it
asserts nothing, and a failure is recorded in the receipt.
Fold every forge SSH host alias (ssh.github.com, altssh.gitlab.com,
ssh.bitbucket.org) through one shared normalizeForgeWebHost so main-process
provider detection and renderer manual review links agree. Remotes on
ssh.bitbucket.org now open bitbucket.org pull request forms instead of
ssh.bitbucket.org URLs, and Gitea no longer claims the host.
Co-authored-by: Eric Junker <4758+ejunker@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix: bound local iteration checks and show live progress
* fix: harden check lifecycles and cached test evidence
* fix: preserve process instrumentation and fixture lifecycles
* fix: give fixture unref spy a portable function type
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(github): count gh pr and issue commands against the GraphQL rate limit
gh serves pr/issue/repo view-style subcommands over GraphQL, but the breaker
filed every non-api command under core and only matched REST's
"API rate limit exceeded" wording, so GraphQL exhaustion never tripped it.
Map those subcommands to the graphql bucket, match GraphQL's
"API rate limit already exceeded", and guard project-view issue close/reopen
against the GraphQL quota.
Fixes#28767
* test(github): drop redundant Date.now() args in graphql breaker test
Keeps the flaky-test-pattern ratchet at its baseline.
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(wsl): background repo probes, PR refresh and worktree scans never start a stopped distro (E9)
Any Windows touch of a \\wsl.localhost path, or Git/gh run for it, boots a
stopped distro. These background paths ran without asking the stopped-distro
gate: the worktree scan refresh (Git-admin fingerprint reads plus git worktree
list), the remote-identity and username enrichment sweeps, the startup
upstream backfill, the quiet-period ref maintenance, and queued PR refreshes.
Each now asks blockedWslDistroForPath first and skips, keeping known data,
until the distro runs; a host path never asks the gate.
* fix(wsl): a user act's wake allowance ends with the act
The allowance lived in an AsyncLocalStorage store, so any timer, listener or
queue created during a user act (opening a workspace, a wake read, the first
git status) kept it forever and could start the distro later, after a
terminate. The scope now carries an active flag cleared when the act settles.
* fix(wsl): skill discovery and automatic refreshPRNow never start a stopped distro (E9)
- Skill discovery (mounted by passive UI) leaves out roots on a stopped or
unverifiable distro, and skips plugin discovery for such a cwd, instead of
reading \\wsl.localhost; they are not reported missing, so the next scan
picks them up.
- refreshPRNow skips automatic reasons (visible, active, post-push) on a
blocked distro like the drainer does; only a manual refresh may start it.
- Ref maintenance's opt-out probe takes the same sync wslDistroForPath
early-out as the other paths.
- Tests: stopped-with-no-cache worktree scans answer from stored rows, and
'unverifiable' is treated as blocked.
* fix(wsl): skill discovery for a WSL target never starts a stopped distro (E9)
Passive UI discovers skills for projects whose agents run in WSL. The target
resolution probed the distro home (wsl.exe) and the scan ran in the distro,
so either booted a stopped one. Discovery now refuses a stopped or
unverifiable WSL target before the home probe and answers no skills and no
sources, so nothing reads as missing and the next scan retries. Delete and
share keep resolving without the gate.
* fix(wsl): a settled user act marks its distro woken; host skill scans never await the gate
- runAsWslUserAct (the gate's wrapper) notes the distro woken inside the act
when it settles, success or throw, so a follow-up is never answered by a
'stopped' read taken before the act.
- Skill discovery takes sync early-outs: a host-only root set and a host cwd
never await the WSL gate.
* fix(wsl): Share discovers as a user act; a stopped distro's skills read as unknown, not absent
- skills:prepareShare (and the skills.share RPC) discover as a user act on the
target's distro, so an explicit Share on a stopped distro finds its skills.
- A blocked WSL target answers an 'unavailable' source per requested kind, and
roots (or a workspace plugin folder) on a stopped distro are reported
'unavailable' instead of dropped, so the installed-skill verdict says the
status may be incomplete rather than offering Install.
* test(wsl): use a fixed fetchedAt in the stopped-distro PR refresh test
* fix(wsl): Share scans stopped distros' skill folders, with or without a target
The desktop Share dialog sends no target, so the user-act scope had no distro
and the gated scan reported a stopped distro's repo folders unavailable; Share
then failed with skill-share-source-not-found. discoverSkills takes
gateStoppedWslDistros: false for both share paths (IPC and RPC), skipping the
stopped-root split and the plugin-cwd check; passive discovery keeps the gate.
Gated and ungated scans of one target no longer share a coalesced answer.
* feat(wsl): internal distro allowlist for WSL execs on shared test boxes
ORCA_INTERNAL_WSL_DISTRO_ALLOWLIST (comma-separated distro names) keeps every
wsl.exe call out of distros not on the list: process-host's resolveSpawn,
the main and daemon node-pty spawns, and the two codex-accounts calls that
bypass process-host. Pure list/status/version calls stay allowed; any other
form must name an allowlisted distro, and --shutdown or a default-distro exec
is refused. A malformed value refuses every distro and logs once. Unset, the
check reads the variable and returns, so behavior is identical to today.
* fix(wsl): cover every direct wsl.exe exec with the internal distro allowlist
- Restore #34525's worktree-create payload and captured-host test, reverted by
accident in the first commit.
- Check the allowlist in execFileCapture, the choke point for WSL Git, gh and
worker-thread captures, and before the WSL git-read probe, the Codex hook
path canonicalization and the CLI login spawn. The WSL watcher now spawns
through process-host.
- Stop scanning wsl.exe argv at the first positional argument, which wsl.exe
runs in the default distro.
- check-process-host-imports fails on any direct wsl.exe exec outside
process-host that does not call assertWslDistroAllowed.
* fix(wsl): check the distro allowlist where resolveCommand produces the wsl.exe form
Every Git, gh and glab path into a distro resolves through resolveCommand, so
gitExecFileSync, gitSpawn, git stream reads and wslAwareSpawn are covered too;
the execFileCapture check is now redundant and removed. The import check also
treats buildWslExecArgs as a wsl.exe exec and accepts resolveCommand as covered.
* fix(editor): Copy Remote URL links to the code the workspace is on, with the selected line range
The gutter menu's Copy Remote URL always built the link on the default
branch and dropped any multi-line selection. Prefer the HEAD commit when
origin already has it, then the origin branch the current branch tracks,
then the default branch; carry an optional end line through IPC, RPC and
the git provider so a selection becomes a line range.
* fix: pair remote file links with published repository refs
* fix: prepare exact remote file fallback before publication scan
* test: consolidate remote file URL integration coverage
* test: document real-clock cancellation deadline proof
* test: handle optional cancellation signal in assertion
* test: reuse spawned child fixture across runtimes
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(windows): stop recursive deletes from retry-storming when a file is held open
Node's async recursive rm retries every nested entry separately and orphans
sibling walkers when it rejects, so deleting a workspace holding a live
browser profile multiplied filesystem work per directory level until the
main process hung. Delete Windows host trees with a walker that retries
whole passes from one shared budget and leaves nothing running on failure.
Also bound and log detached worktree removal, and fail a file transaction
whose proper-lockfile lock is compromised instead of throwing from its timer.
* fix(windows): retry a locked delete as whole passes instead of a custom walker
Replace the hand-rolled tree walker with Node's own recursive rm and no
per-entry retries. Async rm gives each nested entry its own retry counter and
never stops siblings, which is what multiplied the work; with retries off each
pass is one bounded walk, and a transient Windows lock repeats the whole pass
from the existing 250/500/1000/2000 ms budget, checking the job's signal
between passes.
A failed delete now names the file another program holds open instead of
Node's EBUSY/EPERM text. Drop the 30-minute background deadline. The lost-lock
error no longer embeds the library's message and says the write may or may not
have been saved.
* test: cover bounded deletion failure and recovery contracts
* test: prune unchanged cleanup coverage
* fix(worktrees): give truthful failed-delete cleanup advice
* test: document fake-clock retry adapter
* fix(windows): preserve checkout ownership until files are removed
* fix: preserve worktree ownership checks across metadata aliases
* test: make checkout retry clock completion explicit
* Keep failed Windows workspace deletions retryable
* test: correct removal fixture imports and path formatting
* fix: retain failed removal until a retry is accepted
* test: identify the mocked backoff clock
* test: preserve failed removal records and recreate marker fixtures
* test(worktrees): preserve exact checkout bytes in refusal contract
* test(worktrees): exercise current native deletion contracts
* test(windows): prove long-path deletion through native checkout removal
* test(windows): preserve real Git runner exports in removal fixture
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(wsl): say why a silent WSL guest command failed
A guest command that exits non-zero with empty stderr was reported as
"WSL <distro>: command failed". When wsl.exe itself fails it writes its
error to stdout, so the real cause was dropped. Report stderr, else
wsl.exe's own error, else the exit code, for the Claude account pointer,
OpenCode reader, WSL CLI install and WSL file operations.
Refs STA-12262 (#33917)
* refactor(wsl): share the wsl.exe host-failure exit check
* test(wsl): type the guest failure fixture instead of asserting it
* fix(wsl): background Git and the roots catalog never start a stopped WSL distro
git status ran on the UNC project root 0.45 s after a terminate, next to the
explorer read; either boots the distro. Background Git (status, conflict
operation, upstream status, branch compare, the upstream-ref watch) now asks the
shared running gate first and refuses for a stopped distro, including host
paths whose Git runs through wsl.exe. The authorized-roots rebuild skips a
stopped distro's repo and leaves it dirty, and the detected-worktree scan fails
as unavailable, so rows are kept and the next scan after the distro runs lists it.
* fix(wsl): the active workspace's first status and a wake read's roots rebuild may start WSL
- Drive-path projects whose Git runs through WSL had no wake path: the active
workspace's first git:status after it becomes active now passes
wakeWslDistro, so Source Control starts the distro; later polls stay gated.
- A user act runs in an async scope naming its distro; gated work inside it
(the authorized-roots rebuild an authorization miss triggers, the detected
scan, the Git) may start that distro and no other. External worktrees on a
stopped distro no longer fail a wake read with access denied.
- After a user act wakes a distro, background reads stop trusting the older
'stopped' read and probe again.
* fix(wsl): explicit WSL launches refresh the running read; wake only on tab change; gate the home probe
- Any wsl.exe Git/CLI run (commit, push, fetch) or WSL terminal spawn for a
distro last read as stopped records that it started, so background reads probe
again instead of refusing for up to 60 s.
- The active editor tab wakes only when the active tab changes; effect re-runs
driven by git status or overview views read without waking.
- The authorization roots' WSL home probe no longer runs wsl.exe in a stopped
distro when the home is uncached.
- The settle window no longer imports the orcad liveness module (it pulled main
code into the web typecheck); a test pins it to EXIT_SETTLE_MS.
* fix(wsl): deferred work and running-list listeners never inherit a user act
A user act's async scope could leak into work it triggers indirectly: a drain of
deferred tasks it caused, or listeners of a running-list probe started inside
it. Both now run outside the scope, so only the act's own work may start its
distro.
* fix(wsl): keep shared modules free of main-only gate imports
worktree-logic.ts and wsl-running-distro-cache.ts are also compiled by the web
project, which cannot see main-only modules (AsyncLocalStorage, wsl.exe).
getAllowedRoots now injects the gated home lookup into computeWorkspaceRootWithin,
and the background gate's own cache subscriptions run outside the user-act scope
instead of the cache knowing about it.
* fix(windows): stop recursive deletes from retry-storming when a file is held open
Node's async recursive rm retries every nested entry separately and orphans
sibling walkers when it rejects, so deleting a workspace holding a live
browser profile multiplied filesystem work per directory level until the
main process hung. Delete Windows host trees with a walker that retries
whole passes from one shared budget and leaves nothing running on failure.
Also bound and log detached worktree removal, and fail a file transaction
whose proper-lockfile lock is compromised instead of throwing from its timer.
* fix(windows): retry a locked delete as whole passes instead of a custom walker
Replace the hand-rolled tree walker with Node's own recursive rm and no
per-entry retries. Async rm gives each nested entry its own retry counter and
never stops siblings, which is what multiplied the work; with retries off each
pass is one bounded walk, and a transient Windows lock repeats the whole pass
from the existing 250/500/1000/2000 ms budget, checking the job's signal
between passes.
A failed delete now names the file another program holds open instead of
Node's EBUSY/EPERM text. Drop the 30-minute background deadline. The lost-lock
error no longer embeds the library's message and says the write may or may not
have been saved.
* test: cover bounded deletion failure and recovery contracts
* test: prune unchanged cleanup coverage
* fix(worktrees): give truthful failed-delete cleanup advice
* test: document fake-clock retry adapter
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Issue create (including the empty-body fallback and follow-up PATCH),
issue body edits, and issue comments passed the body as
`--raw-field body=...` on argv. Windows caps the command line at
32,767 chars, so bodies with pasted inline images failed with
`spawn ENAMETOOLONG` before reaching GitHub.
These calls now use `gh api -X <METHOD> <endpoint> --input -` with a
JSON payload on stdin. ghExecFileWithScopeAsync also now forwards
`options.stdin` to the child process; it was previously dropped.
Fixes#15832
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
OrcaWinandOrcaWin
Neil
Kelvin Amoaba
Brennan Bensonandyasuhiro nishioka
Jinjing
Samuel VilaandNeil
Žan MlakarandNeil
Sojiro.OandBrennan Benson
Pr1pandBrennan Benson
Wooseong KimandNeil