- Specs with their own CI jobs were also being assigned to general E2E shards, so they could run twice or in the wrong job.
- planE2e now drops dedicated specs before balancing and fails if no general specs remain, instead of producing an empty plan.
- The mobile subscribe spec builds a paired runtime connection from the pairing offer before sending requests, matching the updated remote runtime helper signatures.
* fix(settings): show a Keychain unlock on its own instead of leaving the locked notice up
The server already recovers on its next status read, but Settings read Linear
and Jira status once, so the locked notice stayed until the user pressed Test.
While the notice is up it now re-reads its provider's status every 10 seconds.
* fix(settings): wait for each Keychain status read before the next
A newer status read discards an older one, so an interval could keep
discarding every slow read and never show the recovery.
* fix(settings): poll the Keychain status with an in-flight guard
* fix(wsl-cli): keep the WSL CLI status check from timing out on a cold or slow-profile distro (#29497)
* fix(wsl-cli): run install/remove without the login PATH; a PATH-check timeout reports PATH unknown
* Finish structured agent readiness before delivering held work
* Adapt permission fixtures to startup lifecycle
* Keep model discovery for chats before their first start
* Use one host readiness promise for provider operations
* Await provider opening in the execution host
* Await Claude initialization in host-owned open
* Observe Claude readiness through the host status
* Keep optional readback behind host readiness
* Recheck launch permission after host readiness
* Preserve the awaited child during permission revalidation
* Record failed owned opening before the first message
* Abort a matching provider open when its child exits
* Cover provider exit during an unanswered host open
* Cover explicit failure facts on a host-stopped child
* Keep startup waits cancellable and preserve operation order
* Keep live choices and delivery order while agents start
* Apply startup picks and let parked messages release operations [skip ci]
* Save a waiting startup pick after Stop ends its opening [skip ci]
* Save choices when startup ends or a replacement is still opening
* Check saved choices separately from Claude startup reports
* Align startup fixtures and preserve observed Claude exits
* Order startup picks before later messages and retain flow regressions
* Keep reviewed lifecycle contracts while pruning duplicate tests
* Save picks after a proven exit without requiring a child
* Type the startup reply fixture against the Claude control contract
* Honor the before-input callback in the startup reply fixture
* Keep startup option menus independent and show the saved choice
* Exercise startup picks across real menus and the runtime
* Keep saved effort visible when picking a model during startup
* Include the running-turn scope in repeated Stop fixture
* Use the current attach contract in import fixtures
* Align carried-message fixture with startup event contract
* Keep launch-only permission picks usable while prior writes wait
* ci: rerun on main with the locale fix
* Preserve goal retries and chat launch selections
* Give launch regression its request identity
* test(native-chat): type the provisional-launch hook's session prop
* fix(projects): refuse a folder-to-Git type change that would hide folder workspaces (STA-10638)
A folder project's extra workspaces exist only as metadata rows that the folder listing shows. Changing the project to Git switches it to `git worktree list`, so those workspaces drop out of the next refresh and their saved tabs are purged as if they had been deleted. Only the automatic upgrade checked for this; `orca project setup-update --kind git`, repo updates and clone-into-folder did not.
The check now lives in the one repo write every type change goes through, so any caller gets the same refusal and nothing is written. The automatic upgrade and both clone paths use the same check and keep the project as a folder project.
* test(repos): give the repo handler store mock the metadata read the clone path now uses
* test: run repo catalog request coordination in Bun
* fix: remove redundant chat callback alias to restore lint
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(relay): destroy a pooled client whose session the server ended, and mark work that never ran
pg keeps calling a client queryable until its socket's end arrives, so a client released after
57P01 (pg_terminate_backend, shutdown) or a dropped socket went back to the pool and failed the
next caller's statement with 'Connection terminated unexpectedly'. Such clients are now released
with the error, so pg-pool discards them.
Also marks failures where no statement of the operation reached the server (acquire, a failed
BEGIN, a client dead at checkout) so a caller can tell work safe to re-run.
* fix(relay): skip ROLLBACK on an ended session, drop unused nothing-ran marking
Adds 57P04/57P05 to the session-ended codes and covers 08xxx, a dropped
socket, an ordinary 23505, and a real pg_terminate_backend.
Claude-Session: f2fe8cb5
* Ask Claude for a resting chat's / menu instead of rebuilding it from folders
A Claude chat whose Claude isn't running (a new chat, or any chat after a
restart) offered only clear/compact plus folder commands and skills, so
Claude's own built-ins like /goal, /init and /review were missing until the
first message started Claude.
The at-rest catalog now sends Claude one initialize control request in the
chat's launch folder, through the same sessionless path the model list uses
(same binary, env, account pin and supervised runner), and shows the list
Claude answers. Hooks and MCP servers are off for that one process. Results
are cached per workspace and account for 5 minutes, and at most two probes
run at once. If Claude can't answer, the folder scan is used as before.
* fix(claude): keep Claude's own / list when a later refresh fails
* fix(claude): preserve CLI commands across overlapping fallback scans
* fix(claude): keep overlapping command refreshes eligible
* test(claude): await fallback settlement in overlap case
* test(pty): pin where the two spawn lanes build a daemon spawn's host env differently
Characterization on main's code before the host-env step merges: which failed env builds sweep
per-PTY state (minted ids only, both lanes), the empty-id split, the host-only WSL Pi/OMP guest
readiness wait, and that a host create operation still waits on a managed Codex login.
* refactor(pty): one host-env step for both terminal spawn lanes
The window (pty:spawn) and host (runtime controller) lanes each carried a copy of Codex resume,
Codex home selection, the managed-auth wait, backfill recovery and the daemon host-env build.
Both now call resolvePtySpawnHostEnv. Lane differences are explicit inputs: two TEMPORARY ones
(the host-only WSL Pi/OMP guest readiness wait; the host skipping host env for an empty id) and
three that mean the same in both lanes. The resume step's launchEnv was never read and is gone.
* test(pty): pin that both lanes hand Codex resume prep the request's CODEX_HOME
orca serve (#29209) skips resume prep for a launch whose env names a client-sent CODEX_HOME.
* test(pty): type the new lane-pin requests instead of asserting them
* test: pin selected Codex home on terminal restart
* test(launch): pin what a paired agent session spawns today
Characterization on main's code before createAgentSession moves onto the
host planner: plain launch, short/long/multi-line prompts on macOS, a
stdin-prompt agent starting clean, Windows PowerShell and cmd quoting, and
the identity-required refusal when no launch can be built.
* refactor(runtime): plan paired agent sessions with the host planner
terminal.createAgentSession built its own launch command beside the planner
every other host launch uses, and the two had drifted. It now hands the
request to createTerminal as a startupAgent, so one planner builds it.
The planner gains a draft delivery input, and one TEMPORARY input
(startupPromptCarry: 'force-line') keeps what createAgentSession did: the
prompt always rides the typed line, and an agent that reads its prompt
after start launches clean. The later change that delivers uncarried
prompts after start removes it. A launch that can't be built still refuses
with agent_session_identity_required.
* test(accounts): pin that the selected account wins over Settings agent env
A paired agent session now layers the host-selected account env the way
every other host launch does.
* fix(runtime): report prompt carry truthfully on the planner's direct path
Review round 1: a stdin-prompt agent's text never rides its launch line, a
draft comment that overstated the carry rule, the error class's name, and
formatting the cherry-picked commit skipped.
* docs(runtime): scope the account-order and draft comments accurately
Review round 2.
* test(launch): drop paired-session parity rows that pin nothing new
The no-prompt and short-prompt rows plan the same with or without
force-line, and the Windows cmd row repeats the OpenCode-model Windows
row's createAgentSession runtime and cmd quoting. The long-prompt,
aider, PowerShell, refusal and account-env pins keep the coverage.
* docs(runtime): label the draft's carry-rule exemption temporary
Skipping the typed-line carry rule for drafts is createAgentSession
parity, not design: a draft on the line has the same hazards as a
submitted prompt. The one prompt/draft delivery policy removes it with
force-line.
* fix(runtime): keep main's error name for an unbuildable agent launch
Overriding the name made every other planner caller's stringified
error read 'AgentLaunchUnbuildableError: ...' instead of main's
'Error: ...', which renderer code that strips an 'Error:' prefix
would show raw. createAgentSession matches by instanceof, so the
override bought nothing.
CI's Mobile verify timed the 'finishes' case out at 5s: it hashed and base64-encoded
twelve real 384 KiB windows under fake timers. The link now costs a fixed 17s of
fake time per window over a 1 KiB grid, so the test runs in ~20ms and still fails
on the per-read timeout without the #29751 fix.
* fix(mobile): keep the app download going over a slow link instead of timing out each queued read
Each bundle window read had its own 30s request timeout, but its reply queues
behind the other three reads in flight. On a slow link (Tailscale through a
relay) the fourth reply could not land within 30s, so the download showed
progress and then failed with 'Request timed out: mobileWeb.bundle.range'.
The fetch now fails only when no window reply lands for 30s, and each read's
own deadline is a long backstop.
Fixes#29697
* fix(mobile): bound a stalled bundle fetch's pending reads to the in-flight budget
* test(mobile): re-record bundle-fetch goldens for the per-read backstop option
* chore(i18n): translate new keys to es/fr/ja/ko/zh
Scan 2026-10-15 (window 7244bf3e6f..e2f2277d512): 38 new en keys, 16
removed, 0 changed. All five locales missed the same 18 keys (the other
14 are pinned English-fallback). Translated the 18 x5, fixed badly
translated existing strings, and ran two review rounds.
* rm worklog file
* Add website navigation to the Cmd+J palette
Typing a URL or host such as brex.com or localhost:3000 in Cmd+J now
offers a "Go to <url>" row that opens the site in a new browser tab in
the invoking group. Previously the query only went to search, and the
new tab always opened the default page.
- Classify input with the existing tab-create URL classifiers. Blocked
schemes such as javascript: and file:, oversized queries, and plain
words stay on the normal search path.
- Pass an optional URL through openNewBrowserTabInActiveWorkspace. A
requested URL skips address-bar focus so the page can load directly.
- Rank the website row first unless an exact entity match or an
issue/PR URL should lead. Query-bound actions carry sourceQuery and
are ignored on select if the live input has changed, so a stale row
cannot open the wrong site.
* Open typed websites from Cmd+J in a browser tab
Cmd+J now opens a typed site such as brex.com or localhost:3000 in a new
browser tab. Bare dotted names only count as sites when the suffix is a
listed domain, so file names like App.vue or Cargo.lock still resolve as
files. Browser open failures show a toast instead of an unhandled rejection.
* Fix Cmd+J website action availability
* Leave adopted live terminals' tabs to main's frames in a layout-owner build (dark, build switch off by default)
* Adopt only into a pane main's frames hold for that terminal; test a tab-bar id that differs from its terminal id
* Count only a pane main binds to the adopted terminal; check the pane key's tab
* Read frame-held panes through a small module so window-owned builds keep the frame sync out
* fix(agents): direct work-item and checks-fix launches quote for the execution host
GitHub Project Start, PR checks Fix and the source-control/checks preflights
resolved their launch platform from the client OS whenever the repo had no SSH
connection, so a Windows client starting work on a paired Linux Orca server sent
a PowerShell-quoted --prefill to bash. They now read the execution-host facts
#27259 introduced (server-reported OS, SSH-reported OS, WSL), and the
path-shape resolver is removed so one helper decides.
* fix(agents): resolve direct-launch and preflight platforms from the repo owner
Review follow-up: a WSL worktree on a paired Windows server quotes for Linux,
the owner-row fixture reports its server OS, and the source-control preflights
read the repo owner rather than the focus-defaulted worktree route.
* fix(agents): preflight platform honours a worktree's own host
Review follow-up: a per-worktree host outranks the repo owner, the host-platform
test's mutable client platform is typed, and the source-control panel fixture
carries the host slices.
* fix(agents): a server-projected SSH worktree reads its server's SSH state
Review follow-up: the preflight resolver keeps the runtime owner for nested SSH
worktrees instead of reading this client's own SSH connections.
* fix(agents): cmd.exe pastes a multi-line draft instead of prefilling it
Review follow-up: now that direct launches pass the local Windows shell, a
multi-line --prefill under cmd.exe would submit at its first newline.
* fix(agents): direct launches quote for the shell their tab spawns
A project's Windows runtime can override the terminal setting (WSL setting,
Windows runtime spawns PowerShell), so resolve the tab's effective shell before
quoting. The cmd.exe parity row now expects cmd quoting.
* One pane-commit path for main's splits, a late-mounted split recorded again, and one fresh-pane exit rule (dark, build switch off by default)
* Runtime panes write only touched records in the layout-owner build; main keeps a split the window already recorded
* Admission patch that finds no change writes nothing, as layout.apply
Jinjing
Neil
Brennan Benson
OrcaWinandOrcaWin
Jinwoo Hong
Kelvin Amoaba
Žan MlakarandKelvin Amoaba