* Preserve open overlays when focusing the chat composer
* Fix chat composer focus after launch menus close
* Fix chat composer focus handoff after overlays close
* Fix composer focus after custom overlays close
* Prevent chat composer from stealing overlay focus
Scope recovery overlays to their own pane and let menus dismiss before
returning focus to the composer. This keeps the quick launcher open
when delayed chat actions complete.
* Fix composer focus across nested overlays
Track focus ownership through portaled overlays so the launch prompt can
regain focus while its model list is open. Close the context menu before
inserting a quote so the caret lands after it.
* Fix overlay focus CI regressions
* Complete overlay focus ownership for inline and retained surfaces
* Declare public overlay focus hook return type
* fix(relay): exit promptly on SIGTERM instead of waiting out docker's stop timeout
On SIGTERM the relay drained sessions and called server.close(), which waits
for every open socket. A TCP connection that never sends a byte (or sends
partial headers) is not idle, and server.close() also stops the header-timeout
checks, so nothing ever closed it. The process stayed alive until docker's
--stop-timeout 300 SIGKILLed it: about five minutes of every cell VM
replacement during a same-cap roll.
Shutdown now tracks accepted sockets (including upgraded WebSockets), keeps
the existing drain order, destroys sockets still open after a 5 s grace, waits
(bounded) for queued pool clients, closes the database and exits 0. An unref'd
10 s backstop exits even if the database close hangs. SIGTERM/SIGINT use
process.on behind a shutting-down guard so a repeated signal no longer kills
the process with 143.
The new blackbox test fails on the previous index.ts (silent TCP and
partial-headers peers keep it alive past the test bound) and passes now.
* style(relay): satisfy changed-lines lint gate in SIGTERM exit change
* feat(updater): let users delay updates until a release has been public for N days
Adds an Update Delay setting (None/1/3/7/14/30 days) for supply-chain safety (#5259).
Release age comes from GitHub's Atom feed timestamps and fails closed when unknown.
Settings shows the held release with a countdown, a one-off Skip Delay Once, and
the updater wakes when a held release clears instead of waiting a day.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(updater): satisfy cast, progress-restyle and wall-clock test gates
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(updater): simplify delay UI and enforce release age across checks
* fix(updater): retain ready updates and recheck changed delay settings
---------
Co-authored-by: Claude <noreply@anthropic.com>
Launch seeds and terminal status rows carry the session without a hook source, so the next hook recorded the Bash tool's folder and dropped the effort.
Refs #31545
* Keep opened GitHub work items bound to their exact repository
* Bind GitHub work item ownership through consumers and dispatch
* Keep empty mention lists from consuming selection keys
* Preserve GitHub action and consumer ownership across resource changes
* Exercise repository account updates through their production store action
* Exercise account publication and cache settlement through GitHub consumers
* Simplify fork PR contract verification
* Make contract verification imports and clocks deterministic
* Correct mobile task test fixtures and model types
* Correct task recording fixtures and CI types
* Correct task fixture types and static checks
* Consolidate replay test RPC imports
* Separate GitHub metadata imports from Linear hooks
* Scope mobile PR sidebar reads to the selected resource
* Separate desktop GitHub changes from phone updates
* Fix relay authority probe census across topology cases
* Repair repository owner proof fixtures and compiler allocation
* Preserve repository row observation in host lookup
* Seed metadata fixture before server-side store acquisition
* Preserve nullable fixture settings and discover mixed test types
* Preserve GitHub detail argument types and optional capabilities
* Let keyed details queries own pending read replacement
* Repair GitHub RPC and relay test fixture boundaries
* Verify expected GitHub account at repository execution capture
* Preserve captured GitHub account expectations through client dispatch
* Retain observed runtime status after switching environments
* Fix account contract fixture types and RPC setup timing
* Restore the negative-capability switch probe assertion
* Align account fixtures with runtime identity and configured origin
* Consolidate details test imports
* Drop duplicate fork pull request identity tests
* fix(orchestration): reach a terminal that still coordinates another Run through its worker Dispatch
A terminal can stay bound to an older Run while it works a Dispatch in another.
send --to <terminal> --run <its Dispatch's Run> was refused with
recipient_run_mismatch, and run-current never mentioned the Dispatch.
* fix(orchestration): say which terminal can safely take an older Run
* Run the picked Claude model for text generation
Claude text generation used plan mode to stay read-only, and in plan mode
the Claude CLI runs Sonnet for the haiku alias. Turn tools off and set
the dontAsk permission mode instead, so every alias runs the picked model
while text generation still cannot edit files or run tools. Tracked in
STA-13412.
* Keep file reads and old Claude CLIs working for text generation
Text generation now gets Read, Grep and Glob under dontAsk instead of no
tools, so saved prompts that read repo files keep working. Claude CLIs
older than 2.0.43 refuse dontAsk; Orca retries once with the older
syntax (default mode plus a fixed deny list of the other built-ins those
versions have), never plan mode. The managed-MCP retry denies MCP tools,
matching the strict attempt, which loads none.
* Let Claude text generation read files outside the checkout
dontAsk refuses Read outside the working directory unless the tools are
also granted, so current CLIs now get --allowedTools Read,Grep,Glob
beside --tools. The older-CLI retry grants the same tools as root-path
rules (Read(//**) and so on); a bare grant there would override a user's
path-specific ask rule.
* Pass spawnAgent in the old-CLI text generation test and type its fakes
A repo id on two hosts makes canUseRepoWideTrust refuse the repo-wide entry, and ticking Always trust saved nothing else, so the prompt came back on every create. Save the shown script's hash too, on desktop and mobile. A changed script still prompts on such repos.
Fixes#37484
`worktree set` read --comment through getOptionalStringFlag, which turns
an empty value into undefined, so `--comment ""` and `--comment=` sent no
comment field and the stored comment survived while the command reported
ok:true. Keep an explicit empty value for this flag only; the shared
helper and the RPC schema are unchanged.
Fixes#37464
Image and diagram viewer dialogs are portaled outside every pane, so the
zoom bridge never offered them the command unless an editor tab was
active. Over chat, terminal and other tabs the shortcut changed and saved
the app's UI Zoom instead. Where the command would otherwise change UI
Zoom, offer it first to a viewer in the frontmost open dialog.
Fixes#37489
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The placeholder float had margin-right:-100% and no width, so it could
reach 200% of the paragraph before wrapping and overflowed in French and
German. width:100% wraps it at the paragraph, and its margin box stays
zero-wide so the caret line does not move.
* Stop listing a worker as retained after its follow-up took its terminal
* Read handed-on terminal history only for the listed workers
* Detect a handed-on terminal from follow-up lineage instead of owner history
* Count a terminal as handed on only when the follow-up runs in the same process
* fix(orchestration): steer mail notices into a busy native chat's running turn
A native-chat coordinator's mail notice always queued as a card until the whole turn ended, so a
coordinator busy in a long command never saw its workers' reports. Agents that take a message
mid-turn (Claude, Codex, Pi) now get the notice at once; agents that would cancel their turn for
it (ACP) still queue it.
* fix(orchestration): drain mail that arrives while a notice is pending
* fix(orchestration): native chats get each orchestration message whole instead of a check pointer
Each mail message is sent to a native-chat agent as its own chat message,
with the sender, type, subject, body, payload and exact reply command, and
is marked read once the chat accepts it. Heartbeats are marked read, never
sent. Mail an unacknowledged check batch holds stays with that batch.
* fix(orchestration): keep the at-most-once gate's mail-lane assertions, exhaustive sender switch
* Preserve native mail compatibility and drain delivery backlogs
* Drain native mail with a finite ordered pass and scoped operation ownership
* Bound mail formatting and honor accepted queue handoffs
* Run the native mail tests that open SQLite in the Node runtime project
* Preserve live mailbox ownership and recover full reports by id
* Use a typed runtime client in inbox compatibility test
* Preserve historical mail evidence and scope the test clock
* Map historical structured-send evidence to the current test command
* fix(orchestration): settle mail handoffs per message and recover interrupted consumers
* Hold native chat mail until the chat is idle, as terminal mail waits
A mail send admitted into a running turn cancels that turn for agents that
cannot take a message mid-turn (ACP: Grok, OpenCode, OMP, Antigravity): the
second of two reports cancelled the first before the agent saw it, and the
first report cut off the turn carrying the person's answer. Mail now waits
while the chat is working or a prompt waits on the person, for every agent,
and goes out at the idle edge, one message per turn, oldest first.
* test: cover idle orchestration report turns
* fix: preserve independent mail authorization through grouped delivery
* fix: preserve routed mail identity and private inbox state
* test: bound mailbox query work on repeated delivery
* fix(orchestration): consolidate terminal mail imports
* Validate mailbox query rows and type delivery fixtures
* Keep host forwarders typed and inline single-use mail evidence reader
* Declare the mail handoff store method boundary
* Preserve mailbox contracts across typed boundaries
* Retain existing main cleanup row boundaries
* Fix mailbox handoff fixtures and helper mail transfer
* Name the mailbox fixture constructor type
* test: complete mailbox dialog pane identity
* Keep structured mail ordering and ownership current at claim
* Bound mailbox preparation and immutable cohort selection
* Consolidate structured mail contract fixtures
* Consolidate duplicate mailbox imports
* Fix mail handoff type contracts and deterministic test fixtures
* Repair journal forwarding and align mail contract fixtures
* Fix mailbox corpus message type inference
* Correct personal provenance in ACP backlog fixtures
* Correct ACP mail contract measurement and epoch wake fixtures
* Retain full ACP contract diagnostic arguments
* Restore reliability gate coverage and consolidate mail fixtures
* Preserve unknown alias release coverage
* Route native reports through the durable chat queue
* Preserve exact legacy mail holds in queue lineage proof
* Use ordinary queued messages for worker reports
* Use semantic queue and check completion for report delivery
* Record bounded queue recovery work and request cleanup proofs
* Preserve report creation evidence and bounded source wakes
* Preserve report source work and check ownership
* Use ordinary report acceptance and incremental original history
* Retire completed mail opportunities with their current owner
* Retire routed source debt and complete joined mail contracts
* Exercise Run typed peek through the command transport
* Require the queued report submission in creator coverage
* Restore database callback API and align queue contract fixtures
* Fix empty legacy tab selection in restart fixtures
* Keep relation heading assertions scoped to each report
* Native chats receive each orchestration message whole, through the chat's own queue
Each orchestration message to a chat session becomes one ordinary chat message carrying the whole
message, sent with the chat's queue like a person's message: it waits behind running work or a
question and the agent is handed one per turn. A per-message record keeps the send's operation id,
so a restart finds the card instead of sending twice; the message is marked read once the agent is
handed it, and a check that takes it first deletes the waiting card. A message too large for one
chat message keeps today's pointer to check. Terminals are unchanged.
* Test that chats get each message whole, queued like a person's message
* Repeat a report the agent may not have taken only after a later turn or /clear
A send the agent rejected or left unanswered stays unread for check and is handed over again only once
a later turn ran or a /clear replaced its context, so edges alone never restart an agent that fails on
every start. A send whose record a rewind dropped is sent again, and a send that throws is retried on
the session's next journal edge. Tests follow chats getting each message whole.
* Hand a chat orchestration mail only while it is still owed
A queued mail card now runs only while its message is unread in its mailbox and that mailbox still belongs to
the chat: the queue asks at handover and drops a stale card without a turn (abandoned or settled Dispatch,
Run taken over by another chat, mail a check or reset took). Cleanup after check, moves, run-use, abandon,
reset and worker release deletes those cards visibly and never holds the action up; mail still owed goes to
the mailbox's current owner, and Orca's own deletion is never read as the person's.
A send that may have reached the agent is never sent again; check keeps it. A send the agent proved it never
got is sent once more, under a new id, only after a later turn or /clear ordered after that failure. A send
recorded but never admitted is admitted under its own id. Each outstanding send is read by key, never by
scanning the chat's history.
A refusal no longer loses its retry when an edge arrives mid-send, and a coordinator refused for queue room
gets its mail when the queue frees room. A chat worker's follow-up now takes its short Task first and then
each moved message whole, with no check needed. The guide says a working worker gets mail when its turn ends.
* Let the chat's host answer what became of each mail send, and let the person's cards pass mail Orca cannot decide on
The chat's host now answers for each send by its id: the card first, then the send itself, then a gone card's handoff found by key, and only then the admission receipt, which alone can prove nothing was admitted. A receipt whose journal detail is gone is in doubt however old its id, so a renewed id can no longer send the same message twice. A rejected send is repeated once only after a different turn was actually handed over and accepted, or a /clear was made, after the rejection; the queue's admission cursor no longer stands in for that. No answer walks the conversation's history.
The mailbox reserves each send and stamps the message delivered in one write before the host call, so a crash after admission never leaves it selectable again. A refusal before admission releases that exact reservation; every retirement and release is checked against the current attempt, and a record an older build saved without a stamp is repaired as it retires. A person's Delete consumes an oversized pointer's mail too.
Who holds a mailbox is read from durable facts: a Run moved to a terminal, a released worker, another host or an ended chat makes a waiting card stale, so it is withdrawn without a turn and its mail released for the real owner. Only a fact that cannot be read holds a card; the person's own cards behind it go on, later mail stays behind it, and selection and the handover check use the same rule. When the owner can be read again the queue is woken. A Task or a person's edited card never opens the mail database. An explicit Send of such a card now says what happened.
Parked mail is indexed by chat, wakes only that chat's mail, ignores streamed tokens, and drops the chat's journal watch with its last mailbox. Canonical session identity is reused per session store revision instead of rebuilt from every record on each check. Main's account-switch worker test now reads "unread and still owed".
* Let the queue alone decide which card goes next, and wake a terminal given back its mail
The queue now owns one rule for what can be handed over next, installed once on each chat's queue and read by the drain, the final handover check, queue publication and scheduling alike. Mail whose owner cannot be read keeps its place; the first of the person's own cards behind it goes instead. Held cards stay held, a returned, paused or edited card behind it still stops the queue, and later mail, from any mailbox, stays behind it. The rule walks only the queue's live cards, never its history. When nothing can be handed over nothing is published as next, so the chat reads as idle and /clear works; when the owner becomes readable again the queue is published and looked at again. Choosing and publishing the next card only reads custody; settling a stale card stays with the handover.
Mail a chat gives back after its Run or worker moved goes through the runtime's own delivery, so a terminal owner is pointed at it. A chat's journal watch now lasts as long as it has mail parked, through its own redrives, so a publication that changes nothing the mail waits on starts no pass. Session identity is cached until a record joins, leaves or is cleared, not rebuilt after every admission. An explicit Send of mail whose owner cannot be read says Orca couldn't read the chat's saved state rather than that it restarted.
* Find the person's next card past undecidable mail by walking only as far as it must, and ask mail authority only once nothing else stops a send
* Say plainly when Orca can't confirm queued mail is still this chat's, and that the person can try again
* Let parked mail's own watch be the only journal subscription for mail, and stop saving a send fence nothing reads
* Count the queue's order reads with plain index getters instead of a reflected proxy
* Read saved mail sends column by column, and build test fixtures as the types they stand for
* Keep main's words for every other refused queued Send; only undecidable mail says its message wasn't sent
* Let replay read the queue's handoff links, keep the host's last mail answer where the type can see it, and drop the removed test from the send gate
* Keep the queue's possible next cards in order as each one changes, reuse the last pick until the queue moves, and look up a send by its id
* Ask whether one chat's tab closed instead of listing every open tab to find it
* Settle a mailbox's earlier mail only when something it waits on moved, republish a chat once per pass, clean up only the mail a check, abandon or move touched, and act on a chat's status only when it changes
* Date the scaling test's extra tabs by the coordinator's recorded lease instead of the wall clock
* Keep nothing in memory for a mailbox a cleanup finds with no owner and no send left, unless a pass on it is still running
* Ask about a report whose send threw before handing over newer mail, under the id it was reserved with
* Show Claude compaction activity before the message echo
* Own a Claude send's turn from the moment Orca hands it over
A Claude chat now shows "Compacting the conversation" (and any other root
activity) as soon as Claude starts working on a message, including on CLIs
that send no command-lifecycle receipts. The send's turn is opened when
Orca hands the input to Claude, the echo confirms delivery into that same
turn, a follow-up handed over while it runs joins it, the previous cycle's
late idle or result no longer closes the new turn, and an input Claude
proves it never ran retracts its unworked turn instead of ending it.
Tracked in STA-9923.
* Keep each Claude run tied to the inputs and provider cycle that are really its own
A Claude turn opened when Orca hands a message over now tracks every
message handed over while it runs and which provider cycle each one ran
in. A turn Claude started and then cancelled ends on its own idle; a
refused message only removes itself, keeping the turn for any message that
joined it; a follow-up's echo with a new uuid stays in the turn it joined;
a finished turn's unechoed message never owns later work; an earlier
cycle's result no longer completes a newly handed-over turn; and
withdrawing an unrun message no longer announces the previous reply again.
Tracked in STA-9923.
* Retire a Claude input on its own endpoint wherever it is owed
A follow-up whose own result arrives after the turn it joined ended can
no longer anchor the next message's turn: every endpoint Claude reports
for an input (its named result, a terminal receipt, a refusal, or the end
of the run it ran in) now retires it in one step, wherever it is waiting.
Inputs are looked up by the ids Claude names them with instead of
scanning every message a long turn has folded in, so a turn with many
follow-ups stays cheap.
Tracked in STA-9923.
* Revert "Retire a Claude input on its own endpoint wherever it is owed"
This reverts commit bcc7dd5aba.
* Revert "Keep each Claude run tied to the inputs and provider cycle that are really its own"
This reverts commit 43df8fce90.
* Revert "Own a Claude send's turn from the moment Orca hands it over"
This reverts commit 211a0b75e3.
* Cover compaction before the echo and background-wake ownership on the started-send boundary
Precompaction: the previous turn's completed/idle tail, 14 s and zero-length
compaction, the receipt-less Working expectation, a follow-up released during
compaction with exact and reminted opener echoes across an intervening init,
both Stop forms with the published turn id, and started -> compacting ->
cancelled -> idle without an echo.
Background wake: captured CLI wake frames stay provider-owned whether the
follow-up was handed over before the first result (with or without a queued
receipt) or after the first turn ended; the follow-up's own echo opens its
turn. A follow-up settled by its own named result cannot own the next send.
* Keep review note changes on their captured workspace owner
* Keep review note actions on the copy whose notes are shown
Review notes now read their owner and their notes together, so an action
always changes the copy the user is looking at:
- A paired SSH copy saves through its server even when its row does not
name the server, instead of saving on this computer.
- The Markdown preview shows and edits the selected copy's notes, not the
first copy listed with the same workspace id.
- While the selected copy is not listed yet, no other copy's notes are
shown; a note started then saves to that copy once it lists.
- A listing that stamps the same copy's host no longer looks like a new
copy: a pending Send stays held and unsaved note edits are kept.
- Clear all / Clear file confirmations stay on the copy they opened on
when the selected host changes.
- A copy removed since the user acted reports the existing save or clear
failure once instead of failing silently.
- Mounted note views skip ownership work on store updates that cannot
change it, and do not re-render for another copy's changes.
* Keep review notes on the exact workspace copy each surface shows
Notes, their owner and every note action now come from one copy identity.
Previews and editors of a server's copy read and save that copy, paired
SSH copies keep working through their server, an SSH draft never lands on
a local row, and controls stay disabled instead of claiming "All notes
sent" while a copy's notes are unknown. Open Clear confirmations share the
cached read, so unrelated store writes do no row work.
* Resolve review-note copies through the shared workspace ownership rules
Every listed row now gets its copy from the same rules the app routes
writes with, including server provenance from detected listings and the
SSH place behind a paired server for older rows without host stamps.
Previews, editors and diffs read notes from their own tab's provenance
instead of the selected copy, folders honor their source's host, and a
note composer's shortcut captures the copy its surface shows when it
opens.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Keep folder review notes on the folder copy their source names
A folder's notes now come from the same source rules as worktree notes,
so a file from this app never shows or saves to a server's folder with
the same id. Queued folder saves and rollbacks check the captured folder
copy the same way reads do, and resolving copies no longer rescans the
project list for every row.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Read review-note copies through the shared id indexes
Folder and worktree note views now read only their own workspace's
catalog entries from the shared indexes, and readers of one folder
share its qualification, so listing updates cost work proportional to
what is shown rather than catalog size times readers. Also fixes the
type errors and the end-to-end note seeds, which now pass the owner of
the worktree they seed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Share review-note copy resolution across rows and readers
Rows of one workspace on the same host now share a single ownership
answer per catalog snapshot, so duplicate listings of an SSH worktree
no longer make every note view rescan its peers. Folders that are not
listed return one shared answer instead of leaving cache entries behind.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Name the catalog snapshots review-note ownership results are shared under
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Save renamed-file drafts under the new path and encode restored SSH targets
A diff note draft opened before its file was renamed in place now saves
under the file's current path, still on the copy it was opened on. A
restored SSH file whose target id needs encoding now shows and saves its
own copy's notes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Update the diff note path ref after render instead of during it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Preserve provider failures from manual compaction
* Keep compact self-failures command-owned; attribute quota only to this attempt
An ACP /compact error now uses the ordinary failure row only when the merged
evidence carries a typed usage-limit or sign-in cause; other errors keep the
command's Compaction failed row with the agent's detail, as before.
Claude /compact replies stay hidden but feed their typed provider errors to the
usage-limit evidence, with a sign-in failure as an explicit other cause. Account
rejections count for a failed manual compact only when received during that
command; older ones still supply the window and reset.
* Select compact failures in the command composer; attempt-owned Claude rejections
ACP: the compact composer merges the settlement into the retained evidence and
asks the ordinary failure owner's classification; established provider evidence
(quota, sign-in, or OpenCode's structured provider error names) writes the
ordinary row with a thread-only join, otherwise the command keeps its own
compactionFailed row. The ordinary owner no longer touches compaction state.
Grok's -32003 RPC code now reads as a rate limit.
Claude: rejection types seen while a command runs belong to that attempt and
must still be rejecting; a hidden sign-in reply selects the ordinary sign-in
notice, written once at result time.
* Assert compact failure rows by their encoded item ids
* Keep a compact's 403 access denial in Claude's words, not as sign-in guidance
* Pin the clock in the compact failure tests instead of reading it
* Parse the recorded sign-in fixture instead of casting it
* Allow profile repair to replace damaged automation history metadata
* Keep verified automation history when repairing its placeholder
* Test structural profile open and repair output for kept automation history
Schema verification no longer reads automation history metadata, so the
read-concurrency tests now assert that open succeeds without reading it and
that ordinary reads still keep snapshots consistent and refuse corrupt
metadata. Add output coverage for the recovery-required message, the
startup failure text (English and a translation) and the bundled CLI
recovery route printing kept and backup-restored sections.
* fix(review): reconcile hosted reviews after failed writes
* fix(review): reconcile PR page, phone and Checks after failed writes
- PR page: merge, auto-merge, close/reopen and reviewer changes reread details after every attempted write, and the page's displayed state follows a freshly read details state so buttons reflect what landed.
- Phone: the PR actions engine and title save reread once per attempted write after busy clears; a failed reread never replaces the write's outcome or turns a successful write into an error.
- Checks: a failed merge's error stays visible when the reread shows the review merged; a GitLab reread that settles after the panel switched reviews no longer commits details for the other context.
* fix(review): reconcile GitHub and GitLab item dialogs after failed writes
- GitHub item dialog: merge, auto-merge, close/reopen and reviewer changes reread details after every attempted write, after pending clears and after the close/reopen revert. Success toasts and patches stay success-only.
- GitLab MR dialog: merge, close, reopen, details save and reviewer changes run the dialog's existing refresh after every attempted write. The write's error toast and the user's drafts stay.
* fix(review): keep shown review data and ownership across write rereads
- Phone: a write's follow-up read that fails keeps the PR already shown and the write's own error instead of replacing the panel with a load error. Manual Recheck, Retry and HEAD refreshes still show a failed read.
- Phone: a load started for an earlier branch can no longer claim the current one, and a title write that settles after the view moved to another PR stays silent and skips its reread.
- Phone: an older title Save that finishes late no longer closes a newer edit or hides its failure.
- Checks: the GitLab details read after a write lands only on the review the panel currently shows; an old or fallback MR can no longer take over a replacement MR's checks and comments.
* fix(review): keep loaded item details on screen through rereads
- GitHub item dialog and PR page: when a write's reread (or any other invalidation) drops the cached details, the same item keeps showing its last loaded details while exactly one fresh read runs and if it fails, so the comment composer and its unsent draft stay mounted. A cold first load, a retry with no data and switching items still show loading and errors.
- GitLab MR dialog: the state badge and Merge/Close/Reopen follow the item's freshly read details, falling back to the list row; the Reviewers section stays visible while a reread runs; the load-error banner shows only when there is nothing loaded; switching items drops the previous MR's details before paint.
* fix(review): keep loaded details at their cache and scope GitLab details to the full target
- GitHub item dialog and PR page: invalidation keeps the loaded details in the cache entry, retires its pending read and owes exactly one fresh read, so Viewed, description, reviewer and checks updates keep landing on what is shown, even while that read runs or after it fails. A failed read, an empty result or an optimistic comment does not start another read. Removes the separate retained-details hook.
- GitLab MR dialog: details, reviewer/label options and drafts belong to the full target (task source, GitLab project, item and repo); switching source or instance with the same item id drops the previous target's reviewers and state, and a late result for the old target is ignored.
* fix(review): keep owed and running detail rereads through local field updates
Each GitHub details cache (item dialog and PR page) gets one payload-only patch operation that copies the entry's read ownership (an owed reread and the running read) by construction. Viewed, description, reviewer, checks and the optimistic comment all go through it; read start, settlement and invalidation stay separate. A comment that lands with a write's invalidation no longer cancels the owed reread, and a comment during a running reread no longer lets an unrelated invalidation discard that read. A comment alone still starts no read.
* fix(mobile): reread the PR after every attempted write on main's PR tab
Rebuilds this PR's mobile behavior on main's restructured PR tab:
- Engine and title/description edits reread after every attempted
write once busy/saving clears; the write's outcome is the only
feedback and a failed reread is contained.
- The controller gives writes a dedicated reread entry that a poll
can't skip, keeps the shown PR when the read fails, and retires a
details read started before the write.
- A reread whose checks read failed still shows the PR's new state
(merged/closed), keeping prior checks only for the same review.
- Details carry, dedup and completion key on repo + number, so the
same PR number in another repo doesn't inherit details.
- An older Save can't close a newer edit; a write that settles after
the view moved to another PR shows no error and rereads nothing.
* test: repair CI for the reread tests
- Use a fixed fetchedAt for the unrelated cache entry in the details
hook tests instead of reading the wall clock.
- Mock platform haptics in the mobile controller probe and text action
tests so they don't load react-native, and give the act callbacks
that awaited a load result a Promise<void> body.
* fix(mobile): publish PR details against the latest queued state
Phase-two details spread the last rendered PR data, so when they settled
before phase one rendered (a fast read, or a closed client failing at
once) they restored the PR state the reread had just replaced: a Close
or Merge the host applied still showed open. Details now patch only
their field through a functional update whose identity, sequence and
same-review checks run against the state React applies them to.
* fix: type the reread test fixtures and commit identity refs after render
- Replace type assertions in this PR's tests with typed fixtures; the
GitLab primary-actions test keeps one partial dialog-state cast with a
SAFETY note, as neighbouring hook tests do.
- Assign the mobile controller and text-action identity refs and the
GitLab dialog owner ref in a layout effect, so a render React discards
can't leave an identity that never committed for a late result to
check against.
* fix(github): route the saved-body patch through the details payload helper
Main's issue-body rule (a saved description supersedes a read already
running) now goes through the one field-patch helper, which keeps an
owed reread and copies the running read for every other patch.
* fix(github): replace a read retired by a saved issue description
A saved issue description drops the details read already running so it
can't restore the older body. When that read was an ordinary one (such
as the reread after a write), the dialog now owes one replacement read,
so the new conversation still arrives with the saved body. A Refresh
read keeps relying on its own loop, which already retries a superseded
attempt. Starting the replacement consumes the obligation, and a failed
replacement owes no retry.
* test: fix typecheck errors in the dialog and checks-panel reread tests
* fix(gitlab): keep a late write on the previous MR from touching the next one
A save, reviewer change, close/reopen/merge or comment that settled after
the dialog moved to another MR still reread and cleared busy state for
whatever was shown, restarting the new MR's first read and discarding its
answer. Those finalizers now reread and clear busy only while their own
MR is still shown, as pipeline retry already did, and switching MRs
resets the save, action and comment busy flags so the next MR is never
left busy.
* test(gitlab): give the pipeline tab test a details owner after the main merge
* Add standalone chat right-click session actions
* Update fork draft fixtures for source focus callbacks
* Read chat menu data only while the menu is open
Quick Commands and the provider Copy Session ID now read their data from
components that mount only inside the open chat menu, so closed menus in
retained chats do no work on repo, project or agent-status writes. The
add-command editor reuses the terminal's editor dialog and outlives the menu.
Chat menus also stop showing the Insert hint, since they run every quick
command in a new tab the way the tab bar's Quick Commands menu does.
* fix(agent-status): let Claude's own hook record its process when the pane's owner has none
An owner recorded without a process (Claude's trust prompt seen before any hook, or a hook that couldn't capture one) refused every later process the agent's own hooks proved, so live Claude terminals stayed unproven and the next Claude in the pane inherited the same owner. The agent's first non-exit hook that proves a process in the same session (or when the owner names none) now claims it; nested agents run another session and stay refused.
Tracked in STA-13222.
* fix(agent-status): a terminal observation doesn't name the pane owner's session
The trust prompt's row carries the pane's previous session (a forked resume's source, an earlier Claude), so the owner it recorded didn't match the session Claude then reported and its process was still refused.
Tracked in STA-13222.
* feat(agent-status): classify a hook's process against its pane from one process table
A hook process is the pane's root when no agent runs above it inside its
terminal session and it holds the foreground (or the foreground has no
agent); an agent above it makes it nested, a foreground agent makes a
background job competing, and anything missing or unreadable is unknown.
The reader validates PID and start identity with the existing probe before
reading the shared budgeted process table, and coalesces concurrent reads.
* fix(agent-status): only an agent's own evidence names a pane's owner; its root process acquires an unproven pane
Terminal, title and process-name reports and Orca's own restatements
(inferred settles, timer and poll republishes) now publish status but keep
the recorded association as it is, suspended and retired ones included, and
never create one. A genuine hook from an agent without process capture still
names its own session. An admitted exit is now an explicit result, so a
retired record carried on the next agent's terminal report never re-clears
it or refreshes the exit.
When a Claude hook carrying its process reaches a pane whose row has no
proven live owner (a trust prompt seen first, a launch seed's source session,
a hook owner that never sent its process, another agent's leftover record or
a retired one), the execution host classifies the sender before provider
folds run, in the shared hook preflight on both the desktop and the relay
(HTTP and spool). A root acquires agent, process and session together;
nested and competing background processes are refused; unknown evidence is
applied as a hook without a process and retried on the next hook. A late hook
from the retired process is refused before folds. Hooks matching a proven
owner never read the process table, and proven-owner rules are unchanged.
* test(agent-status): pin root acquisition gates, unreadable evidence and retired-process folds
Covers a mid-turn record left by another agent (the identity gate must not
refuse the proven root), an unreadable acquisition over a trust prompt (no
guessed process), and a late hook from the retired process being refused
before provider folds.
* test(agent-status): drop the terminal-first presence test the root acquisition contract now covers
* fix(agent-status): answer a hook's root read within the hook's own timeout
A busy Linux process table can take over a second; the hook's curl gives up
at 1.5s and spools its event. Each hook now waits at most 500ms, reads as
unknown past that, and the next hook joins the still-running read.
* fix(agent-status): prove a hook's process belongs to its pane's own job
The first rebuild judged a hook's process against the sender's own terminal, so a shell
wrapper named claude read as a nested agent (every hook refused), a Claude in another
terminal that inherited the pane key could take a Codex pane, a real nested `claude -p`
(run by Claude's Bash tool in a new session with no terminal) read as unknown, and a slow
whole-host process table made every blocking hook wait without ever healing.
Acquisition now needs proof that the process runs in the pane's own job on the host that
owns the pane: the pane's root comes from its PTY provider's inventory, the sender's
ancestry is walked across detached tool sessions up to that root, shell scripts and npx
layers count as launchers, the pane's terminal and foreground job decide root versus a
competing background or foreign terminal, and tmux panes are tied through the outer pane's
foreground client. Reads are targeted (the sender's lineage and the pane's terminal), one
500 ms answer deadline is shared per attempt, late results are kept, unproven evidence is
retried once per turn, and exits get fresh proof. The pane root's own exit retires the
same agent's unproven record once. Desktop, serve and orcad wire the resolver; the WSL
relay asks the desktop for the pane's guest root and keeps the legacy path when the desktop
or the pane's PTY predates it; a relayed process is pane-root proof only from a relay that
asked this session.
* feat(agent-status): name a WSL pane's guest root from the PTY that owns it
A WSL pane's PTY belongs to Windows, so the guest-side hook relay had no way to know which
guest shell is the pane's root: the Windows PID of wsl.exe means nothing inside the distro,
and an inherited pane key proves nothing.
The WSL bootstrap now prints a one-shot marker with its guest PID and Linux start identity
before it execs the login shell (same PID, every shell, never waiting on anything). The PTY
owner, the daemon session or the in-process provider, watches only the launch output for it
and keeps it as volatile metadata of that PTY incarnation in its inventory. The desktop
answers the relay's pane-root request from that inventory for the relay's own distro, and
marks that link as one whose relay proves pane roots. A PTY started before its owner
recorded roots answers legacy, so the relay keeps its existing path.
* test(agent-status): keep a Claude run under Hermes out of its scoped binding, then let the pane's Claude own it
* test(agent-status): mark the slow-host reader's fake-timer delay as no real wait
CI's flaky-test ratchet flagged the simulated read delay in the owner-presence deadline tests, which fake timers drive; the ignore names that, so the 800/2,000 ms contracts stay as they are.
* fix(agent-status): a pane's first unproven hook keeps main's process; only proof replaces it
Round 3 found four places where pane-root acquisition trusted something that is not proof:
- A WSL relay that merely asked for a pane root was trusted for every pane on its link, so after a relay restart a nested `claude -p` could take a pane on a legacy answer and its exit cleared the parent's row. The desktop now issues a binding only for a returned guest root, per pane and link generation, and accepts a relayed owner as proved only when it echoes that binding for the pane's current PTY.
- An untraceable launch (a spawning shim, screen, an unreadable ps, a missed answer deadline) into an empty pane recorded no process, so its exit no longer ended the row. As on main, that first hook now records its process, tagged as a fallback that a later proved root replaces (saved, so it survives a restart). A Claude in a tmux session the pane can't be shown to display gets its status, session and Done without a process.
- A slow host's late answer was dropped after 10 s and each turn waited again. The answer is kept, each process waits at most once, and a late answer now heals the pane, upgrades or withdraws a fallback, or retires the row on an exit that missed its answer, with no later hook and no replayed prompt.
- A suspended owner let any other process take the pane. Only the pane's own foreground job replaces it now; a nested or unverifiable sender is refused before it changes the prompt.
A hook that challenges the owner no longer erases the owner's proved exit unless it is admitted as the successor, and a pane inventory snapshot taken before a PTY spawned is re-read once instead of answering for it.
* perf(agent-status): cap a host's pane-root reads at four at a time
Each pane's first hook started its own ps reads, so a burst of panes (a restore, many agents starting together) spawned one process-table read per pane at once; on a loaded Linux or Mac host past ~70 panes that alone outran the hook's 500 ms answer. Every subprocess or /proc read the acquisition makes (the sender probe, per-PID and per-terminal ps, Linux start identity, tmux list-clients/display-message) now takes one of four shared slots, released on success, failure or abort, and an attempt past its work budget gives up its queued reads.
* perf(agent-status): share one pane-root request among a WSL pane's concurrent hooks
Hooks of one pane arriving together each asked the desktop for the pane's root; they now share the request in flight.
* fix(agent-status): read no tmux from agent-teams' synthetic TMUX; refuse a pane only shown elsewhere
Orca's agent-teams launch gives its Claudes a synthetic TMUX that names no tmux server, so their hooks sent a tmux hint and an untraceable first hook into an empty pane showed status without recording the process main records. One shared constant now names that synthetic socket for the launcher and the hint parser, which reads no hint from it.
A tmux session attached only in another app's terminal read like a detached one (status only). When no client runs in the pane and every client showing the hinted pane has a fully read lineage outside it, the hook is now refused as foreign; anything unverifiable stays status-only.
* fix(agent-status): a late root heals what its next hook would; a stopped fallback resumes as itself
A late answer only reached the pane if the row still had the association the read started against, so the status-only record a hinted first hook minted into an empty pane while its read was pending kept the root out until the next hook. A late root now acquires over any record a root outranks on the hook path (none, an unproven one, a fallback); a stopped or retired owner must still be the one the read started against, and an owed exit retires only the record that exit saw. The hand-off to the host follows whether a hook actually went on without the answer, not a second reading of the clock, since a hook's timer can fire before it.
A Ctrl-Z'd fallback owner's own hooks after fg were refused as a would-be replacement. Suspension now blocks only another process; the owner's own hook resumes it with its process, session and fallback tag, and a late upgrade of its own fallback keeps it suspended.
* test(agent-status): read a tmux pane shown only in another terminal through the real bridge reader
* fix(agent-status): point the moved local-PTY modules at the shared WSL root marker
main moved the local-PTY modules into src/main/providers/local-pty/; the merge carried this PR's two imports of the WSL guest root marker into them at the old depth, which broke the build.
* test(agent-status): type the pane-root reader test's process mocks
* test(agent-status): type the reader test's platform without an assertion
* perf(agent-status): give a spool drain one acquisition answer deadline
Startup replay ran each unproven pane's acquisition in series, so every pane
added up to 500 ms before the listener bound or live hooks were answered. The
drain now owns one deadline on desktop, serve and the WSL relay; every record's
attempt, joins included, is capped by it and hands a later answer to the host.
* fix(orcad): install the pane-root reader before startup replay
orcad started its hook server, and so replayed the spool, before installing
the pane-root reader; replayed hooks took the legacy path and recorded their
processes as proven owners. The reader is now in place before the server
starts, so replay reads the same evidence as live hooks.
* fix(agent-status): record a WSL guest root printed before its session subscribed
Output a PTY prints before its session subscribes is replayed while the
session is constructed. If that output held the guest-root marker, the
callback read the session before it existed and the WSL session failed to
start. The root is now held until construction finishes, then recorded.
* fix(native-chat): let createSupport ask whether another terminal runs a resumed conversation
A resume's createSupport can now carry resumeFrom (behind
agent-session.structured.resume-writer-admission.v1, since older hosts'
strict params reject it). The host runs the same writer check create runs,
leaving out the panes the client will close first (matched by key or by
the PTY they resolve to; a shared tmux/OpenCode server is never left out),
and probes the candidates together so a bounded client wait is not spent
on one probe after another. The host's English refusal says "another chat"
only when it names one. The resume params move to their own module to keep
the params file under its line limit.
Tracked in STA-13440.
* fix(native-chat): refuse a resume before anything closes or opens when another terminal runs it
Continue in Chat UI asks the host before closing the terminal, naming the
panes the close takes; when another terminal runs the conversation it says
so in one toast and leaves the terminal open with no chat. Session History's
Resume in New Chat (and any other resume launch) asks through the launch
admission and, on that refusal, opens no placeholder tab: its caller's one
toast is the only notice. A local admission that times out still never
leads to a close. Older hosts without the capability keep today's flow.
The launch admission's toasts move to their own module to keep that file
under its line limit.
Tracked in STA-13440.
* fix(native-chat): say why a resumed chat failed when a terminal holds it or its history is missing
A failed start refused because a terminal's agent still runs the
conversation (no chat named as holder) now reads the existing "already
running this conversation in another terminal" words instead of a bare
"Chat could not be started.". A transcript the host could not find yet gets
the same history words an unreadable one already had. This covers the
create-time backstop: a terminal started between the pre-check and create,
or an older host without the pre-check.
Tracked in STA-13440.
* fix(native-chat): keep exporting ResumeSource from the session params module
* fix(native-chat): keep a terminal open when its host's resume check could not be confirmed
A failed capability read was taken as an older host, so the resume question
was left out, the host admitted, and the terminal closed before create refused
the conversation another terminal runs. An unread capability now leaves the
resume unanswered; a host that reports an older capability list keeps its path.
* fix(native-chat): say "another terminal" only where the refusal's owner is still known
The write failure drops the refusal's owner, so a chat-owned conflict on a
send, mutation or phone notice read as a terminal. Only the failed start,
which keeps the raw refusal, now records that no chat was named; everywhere
else keeps the generic wording.
* perf(native-chat): resolve panes in the writer check only when some are left out
Every create, resume and acquire check resolved each matching row's pane to
its PTY, even with no panes to leave out, and each unresolved key scanned
every terminal. With nothing to leave out no pane is resolved now; with some,
one identity read context serves every key.
* test(native-chat): pin createSupport's resume refusal to create's, and History's one notice
Runs the real createSupport handler on a runtime whose status store proves
another terminal live: leaving out the source pane admits, otherwise it refuses
with create's code and details. The Session History replacement keeps its chat
and toasts once when the host refuses before anything opens.
* fix(native-chat): translate the "another terminal runs this conversation" toast
It is now the only notice when Continue in Chat is refused before the terminal
closes, and only English carried it, so every other language showed English.
* fix(native-chat): withhold an unread resume capability only where a terminal closes next
Reading an unknown capability as unreachable refused Session History and
/resume launches on a paired host that main admits and create completes. The
host question now asks the plain question on an unread capability and says so
on its answer; only Continue in Chat, which closes the terminal next, treats
that answer as not admitted, from the same read that chose the request.
* test(native-chat): count the writer check's terminal reads with a typed map
The perf contract counted iteration through a proxy, which the type-aware lint
rejects. It now counts record reads on a Map subclass; a scan of every
terminal per row still shows up as rows times terminals.
* test(native-chat): read the writer-check fixtures without type assertions
The changed-code gate rejects casts. The perf contract builds real terminal
records through the identity fixture, and the createSupport parity test reads
create's refusal through the shared refusal parser.
* fix(native-chat): declare the refusal holder that failed-start cause words read
The failed chat's notice passes its launch failure, with the holder its
refusal named, through the cause parts to the words that tell a chat from a
terminal. Those functions now declare that field instead of carrying it
undeclared, which the typecheck rejected for a literal in the test.
* perf(native-chat): probe a conversation's writers a few at a time and stop at a holder
The writer check started a process probe for every matching row at once and
kept them all running after the first live holder refused. It now picks the
rows in one synchronous pass, probes at most eight at a time through the
shared bounded pool, and starts no probe once a holder refused.
* test(native-chat): pin the writer check's single terminal look on the real runtime
The scale contract built its own resolver, so a host that made an identity
read per pane, or passed none, still passed. It now runs the runtime's own
writer check over recorded terminals and counts read contexts and per-key
terminal scans: one context and no scans with panes to leave out, none
without.
Jinjing
Neil
Kelvin Amoaba
OrcaWin
Brennan Benson
Max Hsu
김보경andClaude Opus 5.5
Jinwoo Hong