Complete Jira Cloud discovery and token pagination, reject incomplete pages, and classify presets by status while retaining strict CLI reads.
Co-authored-by: ggbdpq <ggbdpq@gmail.com>
Support scoped Jira Cloud API tokens through the configured gateway while keeping self-hosted routing, redirects, diagnostics, and selected-host capabilities bounded.
Co-authored-by: Jerome Würf <oss@scharom.de>
Use one token-based task search implementation on desktop and mobile. Preserve explicit issue/PR qualifiers, distinguish quoted search text, and follow shared reexports in mounted mobile recordings.
Refs #10950 and #11121.
Co-authored-by: MumuTW <42820974+MumuTW@users.noreply.github.com>
Expose host-owned verified Jira reads and single-attempt writes through the CLI. Preserve site ambiguity checks, old-host capability refusal, atomic label changes, and uncertainty after failed writes.
Refs #11986 and #26055.
Co-authored-by: Dan Cieslak <dcieslak19973@users.noreply.github.com>
Co-authored-by: kokbee <kok2209@gmail.com>
Preserve safe ADF hyperlinks and rich-text marks through the existing Markdown renderer, with escaping and punctuation regressions.
Refs #13604.
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Adapt Jira rows and sort headers to their panel width so titles remain readable in narrow side panels.
Refs #16627.
Co-authored-by: Leopold Tripot <leopold.tripot@gmail.com>
Any press on a <webview> guest moves Chromium focus into it, so an agent click
took the user's terminal focus (#20595). Main now asks the hosting pane to guard
focus for each agent press (Orca's click/mouse down and the CDP proxy) and the
pane puts it back inside the webview's focus event, and again when the press
ends. Offscreen pages keep their native focus.
* test(native-chat): replay recorded Linux Sogou commits into the chat composer
Guards #26722: keyup-only pinyin, plain Space/digit selector picks (GTK IM
and XIM shapes), Process/229 phrase picks, and a client-preedit commit all
land in the composer. The recorded fcitx4 shapes do not reproduce the issue.
* test(native-chat): read the composer event log through a typed dataset value
* Recover orphan browser processes and clarify blocked updates
* Use isolated Electron launch flags for sidecar lifetime tests
* Keep update retries fenced while describing blockers
* Keep update translations and context clock valid on current main
* Use the option context clock restored on main
* fix(updater): address status guidance and test launch reviews
* Require exact-commit PR checks before agent merges
* Give full PR checks a unique required status context
* Validate required context ownership on every pull request
The connection pool replaced any connection that was not fully up
(reconnecting, failed, closed by a census) with a fresh one, and the
teardown wiped the in-memory password, so background dials after a drop
or sleep/wake prompted again. The pool now keeps the sign-in the host
accepted and hands it to the replacement for the same endpoint. A
password the host refused or re-asked for is never handed on, an edited
endpoint asks again, and an explicit disconnect forgets it.
Co-authored-by: m4air <m4air@Mac.localdomain>
A first connect onto a host whose managed server another Orca version
started deferred the update (its terminal count needs pairing) and failed
the connect. Pair with the running build as it is, before uploading
anything, then let the linked update check ask it for its terminals.
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(runtime): save a windowless host's chat tabs in its layout
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab on the index's hidden notice, which every close reaches
Claude-Session: p2-headless
* fix(runtime): a chat whose record is gone loses its saved tab at startup
Claude-Session: p2-headless
* test: run the windowless chat-layout host test in the Node runtime project
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab from whichever partition still holds it
Claude-Session: p2-headless
* refactor(runtime): list saved chat tabs across partitions in the layout module
Claude-Session: p2-headless
* refactor(runtime): read saved chat tabs straight from the store's partitions
Claude-Session: p2-headless
* fix(chat-tabs): save a windowless chat tab under its own tab id
Review pass: the saved tab reuses the id status and attention address, the close
checks for a window before scanning partitions, and the host tests seed readable
records with unreadable, other-host and no-index cases.
Claude-Session: p2-headless
* test(chat-tabs): a window opening a windowless-saved chat reuses its tab
Claude-Session: p2-headless
* test(chat-tabs): check the saved tab with the lookup a window reuses
The window's existing-tab lookup moves to the shared projection so the
windowless-layout test exercises it without importing the renderer.
Claude-Session: p2-headless
* test(chat-tabs): assert the reused tab's identity directly
Drops the shared lookup added for the test; two functions already carry that name.
Claude-Session: p2-headless
* fix(chat-tabs): leave an unstamped chat tab in an SSH partition to that host
Claude-Session: p2-headless
* fix(chat-tabs): count an unstamped chat tab as this host's only in the local partition
A desktop mirrors a remote server's chats into that server's runtime partition
without a host stamp; the startup sweep must not delete them.
Claude-Session: p2-headless
* refactor(chat-tabs): one chat tab writer, one startup match, local partition only
Chats run only on local hosts, so their saved tabs live in the local partition:
the cross-partition listing and its writer go. Open and close share one layout
load, the startup fill and sweep become one function beside the index seed, and
the tab filter is the existing savedSessionId.
Claude-Session: p2-headless
* fix(chat-tabs): restore and sweep saved Claude chat tabs like any structured chat
The Claude skip predates Claude structured chats (#18519, #18560); an id the host
has no record of is already dropped by the readable restorer.
Claude-Session: p2-headless
Main-session CDP key and text input on a <webview> guest is routed by the window's
focus, so it landed in the user's terminal (#20595). Embedded guests now get
widget key/char events; child-frame focus and untypeable text keep the CDP path
after focusing the guest.
* feat(wsl-mover): the terminal gate a WSL move passes before it pauses anything (D1b-5b)
* feat(wsl-mover): capture each paused pane's last folder for the host's restore (D1b-5b)
* feat(wsl-mover): prove a moved workspace has no live terminal before commit (D1b-5b)
* fix(wsl-mover): a permission prompt blocks the move; the exit proof also checks recorded pane sessions (D1b-5b)
* fix(wsl-mover): any agent waiting on a person blocks; the exit proof refuses an incomplete census (D1b-5b)
With kitty event reporting (flag 2) on, every keyup xterm saw became a release
report. IME-consumed keys produce keyups whose press xterm never encoded: fcitx4
Sogou letters arrive as keyups only, Hangul presses are Process/229 with real-key
keyups, and a key held across a focus change releases without a press. Track the
physical codes whose keydown actually reached xterm's encoder and keep any other
keyup away from it while report-event-types is active.
With a Hangul syllable still composing, macOS reports Ctrl+2 as key 'Process', so
tab.selectByIndex (and every other chord) matched nothing and the press only
committed the syllable. A Cmd/Ctrl chord (or Alt off macOS, minus AltGr) is never
IME text, so fall back to the physical code for 'Process' the way '' and
'Unidentified' already do.
Fixes#28159
Adds an oxlint plugin rule that reports Enter-key handlers on raw input,
textarea, and contentEditable elements (and keydown listeners on text-field
receivers) unless the handler reaches the shared IME guard. Also routes the
automation run history window listener through isImeOwnedKeyboardEvent, whose
previous nativeEvent check never fired for native events.
* Carry a person's stopped messages to the agent with their next send
A message a person sent and then stopped before the agent started on it was kept
on screen as "Stopped manually" but never reached the agent. The delivery loop
now derives the stopped messages the agent is still owed, names them on the next
ordinary send's handover row, and each agent receives them in that same write as
framed context (Claude and Pi: framed text and images in the prompt; ACP: leading
blocks; Codex: turn/start additionalContext, or framed input items for images
and steers). Codex withdrawals that may have reached the agent are marked so they
are never carried.
* Let a queued card's hand-off carry stopped history; test the exactly-once outcomes
A card's hand-off records no sender, so carrier eligibility also accepts a
queued card whose body names no other agent. Tests cover every row of the
exactly-once table against the real host, each agent's rendering, the journal
fold, and that nothing a client parses changes.
* Keep a send that carried stopped history out of fingerprint reconciliation
After a host crash, restart reconciliation matches an unsettled send to the
agent's transcript by fingerprint. A carrier's transcript copy leads with its
stopped history, so it could never match and would read as never delivered,
which would also release its history again. Like a send with an attachment,
it now stays unconfirmed.
* Owe a stopped message only on proof it never reached the agent; carry Codex history as input
- Codex: every stopped message rides as leading framed input on turn/start and
turn/steer (an older Codex silently ignores additionalContext and would read as
delivered); add a Codex fit check against its 1,048,576-character input limit.
- Flip the marker: a withdrawal is owed only with `neverReachedAgent`, written where
Orca proves it (host-held Stop, ACP held steer, Claude queue clear, a start the
Stop ended). Old journals and Codex withdrawals read as not owed.
- A carrier releases its history only for Orca's own pre-write refusals or a marked
withdrawal; provider refusals and not-signed-in are doubt.
- If the history does not fit, try once without its images, then send alone.
- Re-read the turn scope after selection; owed excludes typed slash commands;
dropped-history fallbacks log through the host logger.
* Owe stopped messages only where Orca held them; list only the history actually written
- Claude's queue clear (lifecycle and interrupt sweep) and a start ended by
Stop write plain `cancelled` again, as on main: Claude may already hold a
swept send, and the child-exit site proved nothing for leftover rows. The
proof sites are the host-held Stop withdrawal and ACP held steers.
- An adapter that leaves the history out after it fit calls the host's new
`historyLeftOut` before writing; the host rewrites the pending row without
`carries`, so those messages stay owed.
- History is chosen oldest first: each message with its images if it fits,
else without them, else skipped this time without holding back later ones.
- Session History titles and previews skip `<stopped-message>` blocks through
the existing hidden-block list.
* Build the swept-send test's marked fact with the shared builder
* Keep a person's own words when a rewind rebuilds their message
A rewind rebuilt each kept message from the provider's copy. Codex's copy of a
send that carried stopped history starts with the framed history, so that
bubble showed it. Keep Orca's body for a person's own message, as the live
fold already does; other senders keep the provider's body with their sender.
* Require the logger on the handover context
* Write a plain Claude send as soon as before when no stopped history rides
Wrapping the content build in an async function added microtask ticks before
every Claude write, even with no history, which a turn-timing test caught.
Return the same promise when nothing rides.
* Keep stopped messages and their carriers' coverage through a rewind
A rewind rebuilt history from the provider's items, which hold none of the
host's send facts, so a stopped message the agent never received lost its
bubble and its submission, and a surviving send that carried it lost its
coverage. The rebuild now restates those sends with the submission and
dispatch rows that first recorded them, in both the epoch and the post-clear
paths. A carrier the rewind removed is simply absent, so what it carried is
owed again with the next send.
* Test that a rewind keeps stopped messages owed or covered
Drives the real host, store and journal through a Codex-shaped rewind:
before and after the carrier, after a /clear, across a host restart, for a
stopped message nothing carried, and for a rewind that crashed after its
history committed. Each checks what the desktop and the phone draw and what
the next send carries.
* Owe stopped history again when a carrier provably never reached the agent
A Pi prompt refused for sign-in after its retries, and an ACP prompt line the
encoder refused before writing a byte, now settle with neverReachedAgent. The
owed derivation treats any carrier rejection carrying that proof as refused
before write, so its history rides with the next send instead of being lost.
Pi checks sign-in before it records a prompt from 0.84.0 (Orca's floor).
* Share the Pi adapter test harness with other Pi tests
Moves the scripted connection and setup out of the adapter test, unchanged, so
a stopped-history test can drive the real adapter without growing that file.
* Prepare each send once with the stopped history that fits, in one batch frame
Stopped messages now reach the agent in one frame ahead of the next send: a
header saying they are earlier, stopped history, one tagged element each with
its images numbered in the order sent, then a 'User message:' label. Only a
'<' that would open or close the frame's own tags is escaped.
Each adapter prepares the send once (prepareDispatch): images are read once,
each message's cost is weighed once against that agent's real limits, and the
result is the exact payload plus the ordered ids inside it. The host lists
those ids on the pending row and dispatch writes that same payload, so what a
row says it carried is what the agent got. A message that does not fit goes
without its images, then shortened with a marker; only when not even that fits
does it wait, and the frame says how many were left out. A plain send with
nothing owed is prepared and written exactly as before.
ACP measures every prompt's whole line, text included, and refuses a text-only
message too long for one line before writing it. Titles, previews and copied
first prompts hide the whole frame and its label, however long.
* Keep a stopped or restarted queue paused through a rewind after a /clear
After a /clear the rewind rebuilds in place, so a restated accepted carrier
reads as a turn after the person's Stop (or a restart's pause) and released
the cards it held. Restate those pauses above it, as a new epoch does.
* Restate a rewind's stopped messages in the order they were sent
Owed history follows the restated rows' order, so write them in their old
send order within each anchor rather than the order they were refused.
* Fit the rewind tests to the prepared-dispatch frame
* Cap carried history at 64k characters and degrade only the oldest stopped message
* Owe stopped history again when ACP or Claude refused its carrier before writing it
* Strip a carried-history frame before capping a Grok preview
* Leave a title that opens like a frame but never closes it unchanged
* Drop the image labels Codex writes for carried history images from titles and copied prompts
* Read a stopped message's images one by one so a refused image leaves the readable ones riding
* Settle a Pi prompt still waiting out a sign-in refusal as never reaching Pi when the session ends
* Name the journal rewind module after the rows it builds
* Type Pi's rejection helper with the facts that can reject a message
* Hide everything ahead of a carried-history frame within a bounded lookahead, and cap carried images at 20
* Fit Pi's stopped history beside the line it is written, and settle an encoder-refused prompt as never reaching Pi
Preparation measured the prompt without the streamingBehavior field PiRpcTurns adds, so a nearly full
carrier could exceed the line limit; the encoder then refused it and the write settled as unknown,
covering the carried history forever. Both now measure the frame from the same builder, and an
encoder refusal settles as writeFailed with neverReachedAgent, leaving the history owed.
* Record stopped messages appended to the agent's own log in the journal
A host-only mark on an id no item takes, written before the append and
cleared by a later proven refusal, so an older host reads past it and
clients never see it.
* Derive owed stopped messages from append records as well as ACP and Pi carriers
* Append owed stopped messages to the agent's own log at the next handover
The record is written first and covers them; only a proven refusal owes
them again. A failed or unknown append is logged and never holds the
send. Agents that cannot append keep carrying them in the send.
* Write Claude's stopped messages as shouldQuery:false frames that run no turn
Each message is its content and then Claude's own block-form
"[Request interrupted by user]". The append settles when Claude names
every frame in a result, and its zero-turn commands are claimed by uuid
so they open no turn, show no Working and write no row. The prepared
carrier send and the startup-failure never-reached mark are gone.
* Inject Codex's stopped messages with its own turn_aborted record while idle
One thread/inject_items holds each message and the default-mode
user-role marker. Only "method not found" proves a refusal; any other
error may have recorded them, so they are never injected again. The
prepared carrier send is gone.
* Carry stopped messages for ACP and Pi as plain text, whole messages only
Each rides as its words and Claude's interruption line ahead of the
send's own words, oldest first, while it fits the agent's own limits;
the first that does not fit waits with the rest. The frame, numbering,
labels, shortening and history caps are gone.
* Drop the stopped-history frame stripping from Session History scanners
Nothing writes the frame any more. Claude's and Codex's own interruption
records were already never read as a title or first prompt.
* Keep stopped messages and their append records through a Codex rewind
Only stopped sends are restated, each with the record that covers it, so
a kept message is never injected twice. Carrier coverage on rewind is
gone: Claude and Codex no longer carry, and ACP and Pi never rewind.
* Keep an append record through a Codex rewind only where Codex keeps its pair
A turn can come between a Stop and the send that appends the stopped message (another
agent's mail, a slash command, a busy Codex). A rewind to before that turn kept the
bubble and its append record, while Codex dropped the injected pair, so the message
read as covered when the agent no longer had it.
The reducer now keeps each record's row position. A rewind restates a record only when
that row precedes the rewound turn, and writes it back after the row it followed, so a
later rewind compares the same way; the same-epoch rebuild after a /clear takes back
every record after the floor first. A stopped send is restated with its submission and
rejection rows only: the queued withdrawal never wrote a handover row.
* Check, bound and settle each stopped-message append once
Each session now gives one answer for how its agent takes stopped messages (append,
carry or none), instead of a per-session check beside a router that always offered
the append.
Right before writing, both agents check again that the child, connection and fence are
the same and that no turn runs, by the agent's account or Orca's journal; a failed
check is refused, so the message stays owed. Reading a stopped message's images has its
own 2 s limit and the write and its settlement another 2 s, so a send or Stop queued
behind a stalled append waits about 4 s at most; work abandoned on a timeout never
writes later. A message with nothing left to read is logged as such, not as unknown.
Claude: the append keeps only a uuid observer. Its own lifecycle, echo and result
settle it and stay out of turn tracking, even late; its running, init and idle frames
are left alone. It holds the child from rest only while unsettled, and a child that
ends settles it from what the writes prove, so frames it never took are refused.
Codex: every inject error is unknown. A Codex without the method answers an error Orca
cannot tell from a failed write, so it is never asked again, as before appends existed.
Remote image URLs are left out: Codex refuses them before recording anything.
* Give ACP's carried stopped messages a text block of their own
The carried words were folded into the send's first text block. With an image-only
send its own images came before the interrupted text and read as part of the stopped
request. The prompt is now the carried images, one text block with the carried words,
then the send's own blocks unchanged. Pi keeps text and images apart, so it cannot
interleave them, and stays as it was.
* Hide Codex's own <turn_aborted> record in Session History
Codex writes a user-role <turn_aborted> message for its own Stop. After a first message
holding only an image, that marker became the session's title, its copyable first
prompt and a preview row, in natively interrupted sessions as in appended ones. It is
now hidden like the other harness blocks in titles and previews, and never seeds the
first prompt.
* Give carried stopped-message preparation one time limit, so a stalled image never holds the send or Stop
* Read Codex's stopped images within Orca's attachment limit, not Claude's
* Append only while the agent is idle by its own account, and record nothing while it is busy
* Find a Codex rewind's cut in one place for kept rows and kept append records
* Drop the rewind send-order sort, share the interruption marker, and return untouched files to main
* Test the append end to end through the router, and a late append echo with the next send's words
* Leave out a stopped image whose read stalls, and never read that file again while it is stuck
* Inject Codex's stopped images only into a Codex that resizes injected images, read from its handshake
* Skip and log a kept append record no rebuilt row precedes, instead of anchoring it at the end
* Restate a rewound stopped send's rejection through the one dispatch-row builder
* Keep a stopped image unread until every abandoned read of it settles, not just the first
* Read stopped-history transcripts through the one projection every client now shares
Main removed the rejectedInPlace option: the desktop and the phone now draw a recorded-then-rejected
send the same way, so the tests read one transcript instead of comparing two.
* Deliver stopped messages with the next send: Codex by injection, every other agent inline
Claude no longer writes stopped messages as separate shouldQuery:false appends with
their own frame-claiming, idle gate and settlement. Like ACP agents and Pi, it now gets
them at the front of the person's next words-only send, followed by the
"[Request interrupted by user]" record. Codex keeps thread/inject_items right before the
send, idle only, at most once; a Codex without the method is refused and its sends carry
them instead.
One selection serves both: words only, the newest that fit a 1 MiB encoded bound, in the
order sent, older ones left out and covered. A send with attachments carries nothing, so
history can never push a send past an agent's limits; the per-agent prepare and fit
modules, stopped-image reads and Codex version plumbing go. The injection record is
renamed for what it is. Rewind restatement is split out: a rewind drops stopped
messages with their bubbles, as before, and nothing is injected twice.
* Bound stopped history by one send's size beyond the newest, counting its marker, and keep scanning older messages
* Keep a whole stopped-history delivery within one send, counting either transport's framing
* Budget stopped history by the agent's remaining context beside the send, and carry none when none fits
* Bound stopped history by one send again, not the agent's context: each would have reached the agent unstopped
* Bound stopped history together with the send it rides with
The delivered stopped messages and the send's own words never exceed one send's size, so the agent is never handed more than a send the person could make. If the newest doesn't fit, they all stay owed for a later send.
* Never owe a stopped message too large to deliver beside any send
Such a message could never fit, so it held every older one back for good.
* Owe a stopped message only if it fits beside a one-letter send
The smallest send that carries history has one letter, so the owed bound reserves that, not an empty send.
* Deliver Codex's stopped messages inline, like every other agent
Codex no longer gets stopped messages through thread/inject_items. Its next
turn-opening send carries them at the front, the same text every other agent
gets, and the carrier's own pending row records what it carries. That removes
the injection module, its host-only journal row and reducer handling, the
adapter and router hooks, the unsupported-method fallback flag, and the
<turn_aborted> hiding in Session History that only injected items needed.
A Codex rewind rebuilds kept messages from Codex's copy, which now leads with
the carried words, so a person's own message keeps the words Orca recorded, as
the live fold already does. The per-message size allowance is now the inline
framing itself.
Measured with real Codex 0.159.0 before building: inline acted on "go ahead"
8/8, never on "ignore", and 0/21 on unrelated follow-ups, matching the injected
pair and a real Stop.
* Owe a Codex send's stopped messages again when Codex declines its turn/start
A request Codex answered with an error recorded nothing, so the rejection now
carries the never-reached proof and any stopped messages that send carried are
owed again instead of covered forever. A timeout or transport failure still
proves nothing.
* refactor(migration): one durable journal-directory store for every source kind
* feat(wsl-mover): a WSL move journal in its own directory, one move in flight per distro (D1b-5a)
* feat(wsl-mover): the WSL move journal fences and hides the rows it names
* fix(wsl-mover): journal records only move forward; a new journal directory is durable
* test(migration): pin the SSH journal's path and bytes across the shared store
* fix(wsl-mover): journal records are detached, unique per id, rooted, kept while in flight, and digest-checked
Accept positive safe-integer line and column flags through the existing file-open path. Reject invalid or incomplete positions before changing the editor. Bind deferred reveals to the requested workspace and tab, including floating panels, and clamp oversized positions without moving another editor or stealing late focus.
Co-authored-by: Nikita Maketryuk <n.maketryuk@lince.studio>
vitest's 30 s default cut the test's 60 s relock waitFor short; it failed
package (windows) 3 times at 30-33 s in ~1,000 runs.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(chat): Resume in New Native Chat for OpenCode terminal conversations
An OpenCode conversation started in the terminal now offers "Resume in New Native Chat" in its
Session History row menu and its tab's right-click menu, as Claude, Codex, Grok and OMP do: a new
OpenCode chat takes it over, showing its history and continuing it. OpenCode 2.x rows
(`opencode2`) and 1.x rows both open an OpenCode chat.
Two pieces kept OpenCode off the shared adoption path. Its account is a locator, not a folder, so
the transcript import now works over the account the chat pins, whatever its kind; the folder
agents wrap their lookups in directoryTranscriptImport, unchanged. Its conversations live in a
database, so the journal import reads the found database with the reader the OpenCode transcript
view already uses. OpenCode refuses to reopen a session from another folder, so the workspace rule
covers it too.
* test(chat): Pi is now the agent with no transcript import
* fix(chat): find an OpenCode 2.x terminal tab's Session History row
The pane reports `opencode` while Session History lists the conversation as `opencode2`, so the pane
header's and tab menu's Resume in New Native Chat found no row. Match by the chat agent that takes the
conversation over.
* Fix OpenCode chat adoption environment and pane eligibility
* test(chat): adapt parent adoption fixtures to account identities
* test: keep only the tests that pin user-visible behavior
* refactor(chat): map a Session History row to its chat agent where the chat starts
Both Resume in New Native Chat callers repeated the row-to-chat agent lookup. The launch now
takes the row agent and maps it once, so the Session History actions file stays unchanged.
A dialect's request() now presents session/request_permission when it claims it,
and full access no longer auto-allows a claimed request. No dialect claims
permission requests yet, so nothing changes today.
* fix(orcad): stamp the build commit so orca skills install works on SSH and headless hosts
#27603 pins 'orca skills install|update' to the commit the CLI was built from,
read from the CLI's out/package.json. The desktop CLI build stamps it, but the
server bundle (the 'orca' in SSH-host and 'orca serve' terminals) wrote that file
without a commit, so the command always failed there with 'Could not read the
commit this Orca CLI was built from'. Stamp it the same way.
* test: verify built orcad CLI skill source in artifact preflight
* fix(i18n): drop the setup-only keys #28543 removed from en.json
Main's localization catalog check fails on these three stale keys in es/fr/ja/ko/zh.
* test(runtime): give the default-tab agent fixture a store
#28543 reads settings before creating default tabs (setup-only skips them), so a storeless runtime now fails provisioning with runtime_unavailable.
* fix(native-chat): restore the option write's clock both crossing fixes removed
#28543 and #28599 each dropped one of the duplicate now keys, leaving none.
* fix(browser): preserve unnamed OAuth login popups
* fix(browser): preserve form and blank popup sessions
* Preserve native request context for Shift popup navigation
* Validate route popups with production policy attachment order
* Fix browser background modifier request continuation
* Route opener-less OAuth popups to Orca tabs and fix menu targets in nati
- Plain links and Cmd/Ctrl+Shift-clicks open OAuth URLs as Orca tabs instead of native windows. Those popups have no opener, so they lose nothing by reloading the URL.
- Scripted popups that have an opener keep the existing origin-bar window, so their window.opener link still works.
- Discard pending popup contents with a navigation veto before closing, so a link's first request cannot reach the server.
- A POST with no page to hand over is still blocked, because reloading it by URL would drop its body.
- Edit, Help, and paste menu actions now target the main Orca window when a native browser popup has focus. The popup has no Orca renderer to receive those IPC messages.
* Cover opener-less OAuth popups and popup request provenance in tests
- Add Electron tests showing opener-less OAuth links open as local tabs without loading the discarded page, and that modifier-opened POSTs are never replayed.
- Add a test that a remote foreground modifier click keeps the native cross-site request context (cookies, referrer, fetch site).
- Add a test that the first adopted link request is blocked when route preparation fails during popup creation.
- Launch the CDP fixture through resolveElectronProbeLaunch so Linux runs use the display-aware launcher instead of a hardcoded xvfb-run.
- Replace `as` casts in the popup tests with typed declarations.
* Route Edit menu actions to native browser popups
Copy, Paste, and Select All from the app menu did nothing when a native
browser popup was focused. The popup has no Orca renderer to receive the
IPC, so the action was dropped. Those actions now go to the focused web
contents, falling back to the popup's own contents, so they reach the page
the user is in.
Also removes the popup request-provenance Electron test, which is no longer
part of this change.
* Fix static analysis failures in browser popup handling
* Handle unavailable permission probe in browser popup fixture
* Admit script-opened native popups and enforce minimum size
Modifier-clicked `window.open` children from page scripts reach Electron after the opener's first task, so the one-shot admission lapsed and they were left unprepared. Their first request then lacked popup context, and the origin title could be hidden by a hostile page title.
- Keep a per-opener pending admission that answers the next native child the opener reports. Unadmitted native children are discarded rather than left as bare windows.
- Route popup children through the contents whose window-open handler answered, since Electron reports script-opened children to that contents.
- Create native popups content-sized with a 360x200 minimum, matching origin-bar popups, so `resizeTo` cannot shrink the origin title out of view. The limits move to `popup-window-minimum-size.ts` so both paths share them.
- Tests: cover scripted admission timing, unadmitted discard, minimum size, and route popup caps. Fixture waits for hidden iframe loads and polls with a longer timeout for CI.
* Prime hidden Linux OOPIF hit testing for all opaque popups
The popup compatibility test clicked a frame gesture target only for the "route" case when the input was opaque. Hidden Linux OOPIFs need that priming click before hit testing works, and the route's root gesture gate depends on it too. Other opaque cases were skipping it and could fail for the same reason.
Apply the priming click to every opaque case and correct the comment to describe the real reason.
Neilandggbdpq
OrcaWinandm4air
Jinwoo Hong
Jinjing