mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 17:17:38 +00:00
bbb7f2d695bdf8614ecc35c06dcfca219cd809ee
95
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Neil
|
045f8c8266 |
feat(files): show images and PDFs from the byte-range preview path, local and remote (#35165)
* feat(files): show images and PDFs from the byte-range preview path, local and remote ImageViewer and PdfViewer read an orca-media:// URL instead of base64 when the editor opens a file: images load by URL, and pdf.js reads PDFs by range, so a large PDF no longer arrives whole through files.readPreview or pages into memory first. The grant mints only for the editor's viewers; diffs, git blobs, markdown images and the paired web client keep base64. - Minting an image checks its header with the base64 path's rule, so an image proven too large to decode safely never reaches the decoder. - orca-media gains fetch and CORS privileges, and range responses expose Accept-Ranges and Content-Range, so pdf.js can read by range. - Grants report the file size the viewer used to estimate from base64. * fix(files): read PDFs by real range, check served images, keep old hosts' previews - pdf.js fetches ranges only over http(s), so an orca-media URL was read whole; a small range transport now hands it bytes=a-b reads from the grant, and a failed range fails the preview instead of hanging it. - A file can change after mint, so the raster header is checked again on the bytes each image request serves (the same handle locally). - A paired host without files.readChunk falls back to files.readPreview for images and PDFs, as before; only audio and video need the update. * fix(files): mint no local document grant for a renderer gone mid-mint The local image/PDF mint is async now (authorize, open, header check), so a renderer that closed meanwhile could leave a grant no teardown drops. It binds the renderer lifetime first and refuses to mint once it's gone, as the remote mint does. * fix(files): keep the 50 MB cap for URL images, and probe remote headers incrementally An <img> decodes the whole file, so image grants keep the base64 path's 50 MB cap; PDFs, now read by range, don't need one. A remote header probe reads only each wider step's new bytes instead of re-reading from the start. A replaced image of a different size resets its zoom. * fix(files): tear down a PDF load whose range failed, and read 256 KiB ranges A failed range only showed the error and left the pdf.js task, its worker and pages alive; it now destroys that load first. pdf.js asks for one readChunk-sized range at a time instead of 64 KiB, and a Range preflight gets its CORS answer instead of 405. * fix(files): read PDF ranges over IPC so orca-media needs no fetch or CORS orca-media had gained supportFetchAPI and corsEnabled, and its responses sent Access-Control-Allow-Origin: *, so pdf.js could fetch ranges. That let any default-session frame holding a token read the bytes. pdf.js now reads a PDF grant's ranges through fs:readPreviewRange, which main answers only for the renderer that minted the token. The scheme is back to element-load privileges (standard, secure, stream), responses carry no CORS headers, and preflights get 405. Grant bookkeeping moves to preview-grant-registry.ts. An e2e spec proves an orca-media URL can't be fetched from the app page or read from another session. * ci(e2e): route the byte-range preview sources to the viewer specs that exercise them Changes to the orca-media grant path, the image/PDF viewers and the PDF range transport now run the PDF reload, rebuild and find specs, the remote large-file open, media playback and the partition-isolation spec. * fix(files): stop PDF range reads on abort, abort remote reads with the window, fix the CI route - A closed or reloaded viewer schedules no further pieces of a merged range, and a remote range read stops when its window goes away. - A URL without a size is an error rather than a fetch the scheme refuses. - The PR guard job's sparse checkout and its admission test include the new route module, and the route now also covers the mint handler, preload bridge, editor surfaces, scheme registration and read client. * fix(files): classify linked previews by their target, keep range reads off stopped WSL distros A local image or PDF reached through a link is classified by the file it resolves to, at mint and on every read, and a re-mint after the link is retargeted gets a fresh grant of the new type. A paired host's document whose first bytes are another kind defers to files.readPreview, which classifies the target there. Lazy local reads go through the non-waking WSL guard, as fs:readFile and fs:readFileChunk do. |
||
|
Neil
|
f59bd43c46 |
fix(wsl-host): Remove keeps a WSL host's server that another Orca on this computer shares (R39) (#34699)
* fix(wsl-host): Remove keeps a WSL host's server that another Orca on this computer shares A WSL host's server lives in the Linux login's ~/.orca, so two Orca installs on one Windows account (stable and dev), or a desktop reaching the distro over SSH, share one server. Remove used to close every terminal there and decommission it, ending the other desktop's sessions and agents. The server now answers host.peerDesktops (capability orcad.peer-desktops.v1): the other desktops paired with it, whether each is connected now, and when each was last seen. Before tearing anything down, Remove asks. If another desktop is connected or was seen in the last 30 days, it only closes this desktop's bridge and reports the server kept. If the server can't answer, the teardown is refused. An older server without the capability gets today's teardown, plus a warning. * fix(wsl-host): a shared Remove releases this Orca from the host, and says the host keeps running - On a shared server, Remove now revokes this desktop's own device (and its phones) on the host, through the new host.releaseDesktop, before letting go. Otherwise its recent row would make a peer's later Remove keep the server forever. Peers also skip rows of the caller's own installation (same caller fingerprint), such as an enrollment from before a re-add. - The renderer says when a removal kept the host for another Orca, and the Remove confirmation no longer promises to end terminals unconditionally. - Remove-path files now route CI to the fake transport e2e spec, which exercises Remove. * i18n(wsl-host): Russian and Traditional Chinese for the shared-host Remove copy * fix(wsl-host): tell desktops apart by device key, and release this Orca on every Remove - Peers are no longer hidden by caller fingerprint. Every device-key fork of one pairing token row inherits that row's fingerprint, so two installations that paired through one code hid each other, and one's Remove could tear the server down under the other. Only a shared device public key now marks the same installation, as with a re-add under a new token. - This desktop's own device is released as the last call over the bridge on every Remove that proceeds (no terminals left), not only a shared one. A later Add then Remove never meets a stale row of ours. - When the release fails on a shared Remove, the toast says the host may keep running for a while. The Russian confirmation copy is corrected. * fix(wsl-host): move undo refuses a removed host whose server another Orca kept A Remove that kept a WSL host's server for another Orca (R39) now records that. Before, undo of a move onto that host read the missing environment as "its terminals and automations stopped with it", and would have restored the project here while the host's copies kept running, duplicating its agents and automations. Undo now reads such a host as unreachable and refuses, as it does for any host it can't reach. A later Remove that proves the server stopped clears the record. If the record can't be saved, the host stays listed as pending instead. * i18n(wsl-host): Turkish for the shared-host Remove copy * fix(wsl-host): each WSL desktop splits off its own row from orcad's startup pairing orcad publishes one startup pairing offer and never rotates it, so every desktop that enrolled through it shared one token row and device id. Stable and dev Orca on one distro were invisible to each other as peers, and releasing that shared row broke the next re-add and pairing repair. - New host.forkDesktop (same orcad.peer-desktops.v1 capability). A runtime device on a shared desktop token mints its own token row, forked from it and named by the caller. Forks share the device-key fork cap, and a released fork frees its slot. - The WSL desktop forks right after enrolling through the startup offer, or after a repair lands back on it, and keeps the forked pairing (named after its userData folder, e.g. Orca or Orca Dev). On an older orcad, or if the fork fails, it keeps the shared pairing and warns. - A token row that desktops forked from counts as a peer only while something is connected on it. One that nobody forked from keeps the last-seen rule. * fix(wsl-host): keep host.forkDesktop to the startup offer's holder, over E2EE, with a clean label host.forkDesktop mints a credential, so: - only the holder of the desktop pairing offer this server advertised last (orcad's startup offer) may fork; an older offer, a fork, a phone or any other row is refused; - the fork takes exactly the caller's grants and reach; params are just a label (strict, so a grant request is refused); - it runs only on an authenticated E2EE socket; the token goes back only in that reply and is never logged; - the label is display-only: control, zero-width and bidi characters stripped, whitespace collapsed, at most 64 characters; an empty result is refused. * refactor(wsl-host): count only Orcas connected right now as WSL host peers; drop fork and release Review found the token fork and self-release add more identity state than R39 warrants: orphan forks, a desktop left on the shared token releasing it, and a changed caller fingerprint. So this drops host.forkDesktop, host.releaseDesktop and the 30-day last-seen rule, and restores the restart test. A peer is now another Orca installation with a control socket open on the server right now. The desktop declares its installation (a hash of its userData path) with host.declareClient on its shared-control socket after every ready, including reconnects. The server tags that socket and drops the tag when it closes. host.peerDesktops takes the caller's installation id, so its own other sockets (multiplex, one-shot) never count, and two desktops sharing one startup token stay distinct. Undeclared sockets, phones and browser sessions are ignored. Peer names go through sanitizeDeviceLabel, and a startup-offer "CLI <date>" name shows as "another Orca". An older orcad lacks the method: nothing is declared, and Remove keeps today's teardown with a warning. Limit: an Orca that's closed while its terminals keep running isn't protected. * fix(wsl-host): keep a reconnecting Orca as a WSL host peer for 60 seconds Lost contact isn't proof an Orca left. When an installation's last declared control socket closes (a bridge exit, an orcad restart, resume from sleep, reconnect backoff), the server keeps counting it as a peer for 60 seconds, or until it re-declares. A Remove inside that gap no longer tears down its terminals. * fix(wsl-host): say an open Orca keeps the host, and name each peer once - The Remove confirmation now reads "Unless another Orca that's open on this computer is using it", since only a connected Orca keeps the server. Updated in all 10 locales. - The kept-host toast dedupes peer names, so several unnamed peers read "another Orca" once. * test(wsl-host): pin the reconnect grace to the last socket's close, and to the server's own forget - The unit test advances the clock between the two closes and checks that the peer still counts when the first close's grace would have run out. - The integration test waits until the server has dropped the closed socket before reading peers, so it fails without the grace (checked by setting the grace to zero). * fix(wsl-host): sweep expired reconnect graces on every close, on a monotonic clock Expired graces are dropped at the start of forget() as well as peers(), so the map stays bounded even when nobody asks for peers. The default clock is performance.now(), so a wall-clock jump can't stretch or cut the grace. * i18n(wsl-host): German for the shared-host Remove copy |
||
|
Neil
|
eb7f4d9c31 |
test(wsl-host): native chat on a WSL host through the fake transport, including a stopped distro (#34573)
* test(wsl-host): native chat on a WSL host through the fake transport, including a stopped distro * test(wsl-host): type the chat spec's focus host id * test(wsl-host): harden the WSL host chat spec and re-run fake-connector specs on change * test(wsl-host): scope the chat reply check to the transcript and test the fake's route Find the prompt only in the transcript so the composer can't stand in for it, re-check the boot-free stop window after unfocusing, right before the focus, give the fake's distros.json temp file its own name so it can't collide with the spec's, and test that the fake connector routes to both WSL host specs. |
||
  hwantageandNeil
|
483573f0b9 |
fix(browser): focus newly opened image tabs (#34127)
* fix(browser): focus newly opened image tabs Focus the window before the webview so Command+W closes the new image tab instead of the original tab after a plain image click. Add tests for focus order, image loading, and close-shortcut forwarding. Fixes #34114 * test(browser): verify image tab focus with native keyboard input * refactor(ci): keep browser E2E routes within registry size limit * fix(ci): enable background launch for native browser regression * test(ci): include browser routes in isolated detector fixture --------- Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
ccedfe312e |
fix(ssh): move enabled SSH automations to the host's Orca server (#34044)
* fix(ssh): move enabled SSH automations to the host's Orca server
Connecting an SSH host moves its saved state to the host's managed Orca
server. An enabled SSH automation refused that move on every Connect
("automations (1), automation runs (4)"), leaving the host unconnectable;
Move anyway connected it but stranded the automation on the desktop, where
it no longer ran.
An enabled automation whose runs have all finished now moves with its run
history. The manifest still carries it disabled, which every server version
accepts; once the move commits the desktop disables its retained copy and
turns the server's copy back on through automation.update, re-sending its
start time so the next run is the next future occurrence. A server that
can't is noted in Settings; an unreachable one is retried on the next
Connect. While a move fences the host, the desktop scheduler, Run now and
the launch re-check write nothing for its automations, so a tick can no
longer break the fenced export; releasing the fence resumes them. A run
still in flight keeps blocking and the refusal now says to wait for it.
Fixes #29083
* test(ssh): mock the server automation enabler in the delta-move handler test
* test(e2e): keep the Move anyway specs refusing now that enabled automations move
The inline Move anyway spec seeded an enabled automation to force a
refusal, which this branch now moves instead. It seeds one pinned to an
earlier registration of the host, which still stays behind. The relay
bridge spec's Move anyway lookup also matched the refusal toast's
button since #34041; it now takes the pane's own.
|
||
|
Neil
|
ae55694d27 |
fix(ssh): show Move anyway on a host card whose move saved state refuses (#33961)
A host whose move to its Orca server was refused over saved state (an enabled SSH automation and its runs, stale workspace details, unsupported saved tabs) stayed in error on every Connect. Move anyway, which connects it and leaves those items on this computer, was only in the card's overflow menu, so the host looked stuck. The card now offers Move anyway next to its refusal, as it already does for Recover server. Refs #29083. |
||
 
|
1d0d3f5e94 |
fix(ssh): expand %d, ${NAME} and other tokens in ssh -G IdentityFile paths (#33981)
* fix(ssh): expand %d and other tokens in ssh -G IdentityFile paths OpenSSH prints IdentityFile values from `ssh -G` with their percent tokens unexpanded (it expands them only at connect time), so a config line like `IdentityFile %d/keys/work.pem` reached Orca as a literal relative path. The key was silently skipped and the connection fell back to a password prompt even though plain `ssh <alias>` worked. Expand the tokens OpenSSH supports for IdentityFile that can be derived locally or from the ssh -G output (%%, %d, %u, %i, %l, %L, %h, %n, %p, %r). Paths with tokens that need OpenSSH internals (%C, %j, %k) are left unchanged. A configured, non-default identity file that does not exist is now named in the auth error instead of being skipped silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(ssh): reproduce #33849 end to end and keep tests off the real ~/.ssh Adds a Docker e2e: a host from ~/.ssh/config whose IdentityFile uses %r and %p connects with that key. It fails on v1.4.241 and passes with the token expansion. Drops a unit assertion that read the real ~/.ssh/id_xmss. * fix(ssh): expand ${NAME} in ssh -G IdentityFile paths too ssh -G also prints IdentityFile's ${NAME} environment references unexpanded, so a key at ${KEYS}/work.pem fell back to a password prompt in the same way as #33849's %d. Expand the braced form first, and keep the raw path when the variable is unset, as OpenSSH refuses it. --------- Co-authored-by: william <wanglv93@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Neil
|
899d2aad96 |
fix(ssh): say why SSH failed when Connect never reaches the host (#33928)
When the SSH session itself could not open (key rejected, port refused, host not answering, host key not trusted), Connect on a host Orca had not set up yet said "Orca couldn't start its server on this host" and offered a plain SSH terminal that could not work either. Errors from opening the SSH session are now marked where they are dialed, and a setup that fails on one ends the connect with SSH's own reason. A held move keeps its status. The connect-failure toast also drops Electron's IPC prefix. |
||
|
NeilandClaude
|
f5b2cc5a79 |
fix(native-chat): say why Claude refused to start a chat, including Full access as root (#33812)
* fix(native-chat): say why Claude refused to start a chat, including Full access as root Claude Code exits before initialize when Full access (--dangerously-skip-permissions) meets a root uid, which is common on SSH hosts. Orca reported only that Claude stopped before it finished starting, and retried four times. Classify that refusal as fullAccessAsRoot with a next step, and show the CLI's own startup words behind Details on the failure row and on the unsent message. Co-Authored-By: Claude <noreply@anthropic.com> * fix(native-chat): keep message Details to start failures; cover the exit path Route the exit-error module and delivery notices to the managed e2e, explain its timeout, and drop the exec non-null assertion. Match the zh Full access label. Co-Authored-By: Claude <noreply@anthropic.com> * test(native-chat): type the refused fixture so the web typecheck passes Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
 Jinwoo Hong
|
28de913868 |
test(connectors): drive a connector conversation end to end on a headless serve host (#33613)
Adds an end-to-end test that boots an isolated headless serve host and drives the orca connector CLI against a scripted Claude. Runs in the existing PR e2e job only when connector code changes. |
||
 NeilandMohith S
|
92fd257bd9 |
fix(projects): refuse project setup on a paired server's SSH host with a clear reason (#33284)
* Refuse unsupported SSH project setup before local API dispatch * fix(projects): keep the desktop's SSH refusal copy and drop a re-export The desktop's own project-setup IPC is not an Orca server, so it keeps saying the SSH connection is not connected; the renderer now refuses SSH setup before reaching it. Callers import the shared refusal message directly instead of through the controller. Adds a headless paired e2e that sets up a project on the server's SSH host from a web client. Refs #33124 * fix(projects): give the server refusal only for a paired server's SSH host A desktop's own SSH host keeps its 'not connected' copy; the server refusal shows on a web client, or for a target only a paired server lists. Refs #33124 * test(e2e): read the added SSH target from the RPC result * test(e2e): pass a typed SSH execution host id * test(e2e): give the paired SSH project-setup timeout bump its reason --------- Co-authored-by: Mohith S <smohith58@gmail.com> |
||
  OrcaWinandOrcaWin
|
7d6603aa17 |
[comment audit] Complete repository-wide comment cleanup (#33249)
* [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
NeilandClaude Opus 5.5
|
8e9f86b119 |
feat(managed-server): Update and Update anyway for a managed SSH server, keeping its running terminals (#33397)
* feat(managed-server): offer Update and Update anyway on a managed SSH server's row A managed SSH server only updated on connect, and every connect deferred while a terminal ran there. Its row now offers Update when this desktop bundles a newer build than the Orca that runs the host. When running terminals defer it, Update anyway restarts the server past them; the terminal daemon carries them across the restart. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(managed-server): Update anyway passes only counted live terminals and keeps Update's version admission Update anyway now sends the incumbent build it confirmed over; under the host fence it is refused if another desktop activated a build since, keeps the newer-host downgrade refusal, and never passes an uncounted terminal census. The offer also covers hosts activated before the Orca version was recorded, for the build this desktop already deferred there. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(managed-server): Update anyway also confirms a menu Update the row does not advertise Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(managed-server): the row shows one confirmation at a time Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * ci(e2e): route managed-server update sources to the Update anyway Docker spec Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
 NeilandSahilZ0810
|
0c27fd5f91 |
fix(ssh): move a managed tunnel off an unbindable saved local port (#33271)
* fix(ssh): move a managed tunnel off an unbindable saved local port When the saved local port of a managed SSH server's tunnel can no longer be bound (EADDRINUSE from another listener, or EACCES from a Windows excluded port range), pick a free port, save it with the pairing and the deployment link together, and build the tunnel again. The pairing, server identity, remote port and projects are unchanged. A move interrupted between its sidecar and store writes reads the moved port from the stored endpoint, so the deployment link is never dropped. Fixes #33182 Co-authored-by: SahilZ0810 <sahil@zamp.ai> * test(e2e): drop squatter connections so teardown never waits on them * fix(ssh): move the tunnel port before pairing repair and retire old transports Move outside buildWithPairingRepair so a refusal on the moved port is repaired against the revision the move saved, and retire transports and status owners still dialing the old port, as a repair does. * fix(ssh): refresh maintenance pairings on the current tunnel port Update, rollback and restart reread the deployment's local port when they save the new pairing, since the census before them may have moved it. * fix(ssh): let concurrent tunnel builds follow a port another caller moved --------- Co-authored-by: SahilZ0810 <sahil@zamp.ai> |
||
|
Neil
|
758b9c2b71 |
ci: avoid slow Ubuntu mirrors during WebKit setup (#32205)
* ci: reuse bounded Ubuntu mirror setup for WebKit * ci: preserve Ubuntu setup for dispatched older refs |
||
|
Jinwoo HongandClaude
|
41661e3312 |
feat(sidebar): main runs workspace sleep; the window follows (P3b) (#31564)
* fix(sidebar): land flip-a's switch-on fixes on main, still dark (no flip) The fixes found while the sidebar ran from main's feed, without turning that on: ORCA_SIDEBAR_INPUTS_IS_MAIN stays false, and none of flip-a's stop-gaps come along. - Main stops counting a closed tab's terminal once it was asked to stop and no pane shows it; a failed or refused stop takes the request back, and a host out of contact stays unverifiable. - Main fetches a paired server's rows with the transport's normal bound, so a server slower than 5 s still lists. - A deferred unread raise flips the folder row it was decided for, and a read while the owner check is out cancels it. - Phone: no worktree.ps flash before the feed; a host's last installed feed stands in while a fresh read is out; it highlights its own last-opened workspace and a fold never scrolls; projects file under their project group with the desktop's indent; the collapse spinner shows only after 500 ms; "Reopen to update" keeps the rows on screen. - e2e helpers and journeys for the switch-on suite. * fix(sidebar): keep an owed relay stop marked, clear a thrown stop, and prune pending unread raises - A stop-and-wait that throws takes its stop request back, like one that fails. - A final stop the legacy relay still owes stays marked, since the relay retries it. - Pending unread raises are tracked only while one waits, so the map no longer grows. - The paired-server fallback poll test gives its third fetch a reply and asserts live. * feat(sidebar): main publishes cached snapshots and announces its own stores; detected, view and live-content domains (inert) * fix(sidebar): keep links confirmed only by a new git run, no rescan on metadata writes, no phone wait on detected checkouts * fix(sidebar): rescan the workspace rows when the Windows runtime default changes * feat(sidebar): one lifecycle queue per workspace in main, with in-progress hints (switch-gated) Create, delete, terminal.closeAll, terminal.sleep and worktree.sleep now run through one first-in, first-out queue per host-qualified workspace: strict order, no merging, delete cancels what has not started and waits for what has, an unconfirmed outcome pauses until the host's own answer. Hints publish in a new inProgress feed domain (no reader yet); the creations domain is its projection. A finished create or delete keeps its hint until a scan started after it applies, in the same revision. Adds the paired-server metadata serializer (saving domain, no caller yet). Replaces the creation registry. * fix(sidebar): a create never queues behind the previous occupant's delete * feat(sidebar): main runs sleep; the window follows (P3b) * fix(sidebar): keep electron out of the headless server's sleep path The desktop registers how sleep reaches paired servers; a headless serve has none. Co-Authored-By: Claude <noreply@anthropic.com> * test(sidebar): type-check the sleep e2e specs; drop the removed VM suspend stub Co-Authored-By: Claude <noreply@anthropic.com> * fix(sidebar): resume a paused workspace by re-observing, never replaying - A command issued while paused waits behind the pause; when the owner answers again main re-reads terminal liveness and the listing, then carries on. A forced delete runs past it. - Commands keep their arrival order across a workspace lookup; deletes by name key by the resolved id, so they wait for that workspace's running sleep. - A second delete with different options is refused as already in progress. - Close and delete read lost contact as sleep does. - A create always frees its own queue entry, even after a retry took over its id. - Drops the unused opId, and the paired-server write serializer and its feed section, which land with their first caller. Co-Authored-By: Claude <noreply@anthropic.com> * fix(sidebar): main is the only writer of a sleep's wake records; sleep classifies only lost contact as unconfirmed - The window no longer captures wake records for a sleep main runs; it takes main's records from main's answer, which its wake and tab-open resume then read. - A workspace reopened during its sleep keeps its VM running (the window and a phone's activation tell main). - Only lost contact pauses: a definite chat-stop failure or a server's still-live answer is a plain failure with today's toast. - A paired server's chats are asked with the Sleep mark, and again without it when an older server refuses the field, instead of reading an unprobed status. - A phone's worktree.sleep is answered on acceptance and its activation no longer waits on a queued wake, so neither can outlast the phone's request timeout. The web client passes markChatsAsleep and keeps the receipts. - One desktop adapter, passed where the desktop builds the runtime, replaces the two module slots; a headless server gets none. Co-Authored-By: Claude <noreply@anthropic.com> * chore(sidebar): share worktree.sleep's params with the RPC catalog; lint fixes Co-Authored-By: Claude <noreply@anthropic.com> * test(sidebar): test the paired-server sleep where main runs it; drop the window's copies The window no longer sleeps a paired server's terminals, so its convergence and order tests for that path move to main (remote-workspace-terminal-sleep.test.ts) or follow main's answer. Co-Authored-By: Claude <noreply@anthropic.com> * test(sidebar): retry the sleep spec's liveness read while terminals stop Co-Authored-By: Claude <noreply@anthropic.com> * fix(sleep): main resumes every workspace-sleep wake; the window only attaches - Main claims and starts each slept pane through its windowless resume path, with or without a window: the "window present" check is gone. - A phone's open queues main's wake, which finishes only once the resumes have started, and always notes the reopen so a running sleep leaves the VM up. - The window no longer relaunches a workspace sleep's records in fresh tabs; opening a slept pane asks main to resume it and the pane's spawn attaches to main's terminal. - A window save cannot overwrite main's workspace-sleep records. - A VM that would not suspend no longer reads as "kept open": the terminals slept, and the toast says the machine is still running. * test(e2e): main resumes a slept pane once, in place, and keeps its record * chore(i18n): add the VM-still-running sleep message * fix(sleep): a phone's or the CLI's failed sleep shows the desktop toast again * fix: restore main's final P2 test fixes a merge reverted * fix(sleep): window saves never write or clear main's sleep records; headless wake report counts only real sleeps * test: a same-id twin's grace follows the rows' change, not the removed catalog hook * fix(sleep): drop the 1 s settle wait after an observed exit, and wake a slept workspace's mounted agents on phone open A workspace sleep stopped each terminal through main's stop-and-verify, which polled for a further second after the exit it had already seen. And a phone opening a slept workspace no longer reached the window's mounted panes of agents that had finished before the sleep, so they stayed asleep until the window opened their tab. * test: give the workspace-sleep wake record its prompt field * refactor: match slept-agent records to the workspace with worktreeIdsEqual * chore(sleep): one import from sleep-record-pane-claim * test(sleep): route the disconnected-sleep SSH spec, declare the desktop sleep adapter, and open the workspace after its sleep starts * test(sleep): delete a workspace the spec creates, not the seeded one later specs share --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Neil
|
c149395c20 |
fix(remote-terminal): repaint an idle full-screen program when a reconnect can't image its pane (#31482)
* fix(remote-terminal): repaint an idle program when a reconnect can't image its pane After an SSH reconnect the pane is repainted from the host's screen snapshot. When the host cannot give one (too large for the replay limit, no buffer, unanswered, overflowed), the pane only printed a loss banner and an idle full-screen program that writes diffs kept its pre-disconnect frame until the user resized. The two places a remote pane declares it has no host image now ask the program to repaint through one choke point: a one-row viewport claim and back, which every TUI honours (Node's tty ignores a same-size SIGWINCH). It respects a phone or another desktop holding the size, skips hidden panes, and puts the row back even if the pane unmounts mid-nudge. Fixes #26887 * test(e2e): idle full-screen program frame after a managed SSH outage * test(e2e): wait for the pane before typing in the idle-frame spec * fix(remote-terminal): pick the redraw height on the host's clamped grid * fix(remote-terminal): wait for the host's grid before putting the redraw row back * test: give transport mocks a connection status for the redraw gate * test(e2e): keep the orcad idle-frame proxy typed for the e2e ratchet * fix(remote-terminal): let a new PTY's redraw supersede a swapped-out nudge * test: keep new transport-mock lines free of type assertions * ci(e2e): route the managed-SSH idle-frame spec to its sources |
||
 Jinwoo HongandE2E Test
|
893c4e24a4 |
fix(ssh): an old SSH host moves to its managed server while a relay shell named only on its tab still runs (#31093)
* fix(ssh): an old SSH host converts while a relay shell named only on its tab still runs The conversion check counted legacy pane-key aliases as terminals waiting to reconnect. An alias only routes hook events to a pane whose terminal the lease check, the bridge or the terminal gate already accounts for, so it no longer blocks the move. * Tighten the alias census comment * Register the tab-only relay spec: typed deployment lookup, relay fence baseline, PR route --------- Co-authored-by: E2E Test <e2e@test.local> |
||
|
Neil
|
ba6599eabb |
fix(ssh): pair again over SSH when a managed server drops this desktop, instead of reconnecting forever (#30775)
* fix(ssh): say the host dropped this desktop's pairing, not that another Orca holds the port * fix(ssh): pair again over SSH when our own managed server refuses this desktop's token * fix(ssh): key re-pairs by the refused revision, cap attempts, retry on explicit connect * fix(ssh): keep a newer pairing stored mid-repair, count only completed reads, and offer Connect, not an access link, for managed servers * fix(ssh): judge a re-pair only against the pairing still stored; Check connection retries a managed server's pairing * fix(ssh): a pane whose managed server refuses this desktop says why and offers Reconnect, instead of spinning * test(e2e): live failure path for a refused managed pairing * fix(ssh): a Connect that re-paired answers from the new pairing, not the retired one * fix(ssh): only an explicit Connect lifts a managed re-pair's hold and cap; say SSH access can pair again Startup restore reaches ssh:connect with automatic: true and went through the same ensureTunnel that cleared the hold, so repeated automatic reconnects could bypass the three-attempt cap. The reset now lives in connectTarget's explicit branch. The Shared Server Access footnote now says revoking there doesn't stop someone with SSH access to this computer from pairing again. * ci(e2e): route the managed pairing-repair spec with the managed-host remote sources * fix(ssh): the repair gate decides whether a managed tunnel builds, not the build A refused shared-control open rebuilt the tunnel (SSH execs, forward, handshake, wake) before the held failure or the attempt cap was consulted, so reopens on a blocked server rebuilt without limit. buildWithPairingRepair now asks the gate first: a failure stands for the refused pairing revision for 15 s, or through the window once the cap is spent, and every caller gets it without reaching the host. - A connect during an in-flight repair keeps its reset (per-environment reset epoch). - An unpaired answer fails at once; it is not a moved port, so no re-read or wake. - A refusal that only rebuilt the tunnel no longer reports "pairing changed". - WSL and cloud VMs no longer say Orca tried to pair over SSH, and Check connection only re-pairs servers managed over SSH (runtimePairingRepairRoute). - Translate the new strings; route the pane-banner files to the managed-SSH e2e lane. * fix(ssh): fence a status re-pair follow-up to the same server, and hold a refused repair under its own revision - getRuntimeEnvironmentStatus followed any pairing change mid-probe, past a caller's expectedEnvironmentPairingRevision fence. It now follows only for an unpinned caller and only a new pairing of the same SSH-managed server under its pinned host key. - recordRefusedAfterRepair stood under whatever revision was stored now, so a newer pairing stored mid-refusal was blocked untried; it stands under the repaired revision. - The WSL restart test expects the refused-pairing classification main's WSL path now reaches. * fix(ssh): a re-pair hands its callers the new credentials, and a failed one judges only the pairing it tried - ensureOrcadManagedTunnel returns the environment as stored once the tunnel stands. The terminal census and a deploy's already-current result use it, so after a re-pair they no longer authenticate with the refused token, which read as an unverifiable census and refused restarts, updates and stops. - The shared-control refusal handler blocks the status owner only while the failure stands for the pairing stored now (managedOrcadPairingFailureStands). A newer pairing stored meanwhile keeps its owner and retries. * fix(ssh): migrations commit with the pairing the tunnel stands on, and a Connect mid-handshake stays reset - Conversion binds the environment ensureOrcadManagedTunnel returns, so the destination, the server project reads and the result use the re-paired credentials (the migration mark is kept). - A delta move gets its destination only from connectDestination, which opens the tunnel and builds the destination from what it returns; a pre-ensure destination can no longer exist. A tunnel that cannot open keeps the delta journaled and the host marked for the next move. - buildWithPairingRepair takes the reset epoch when it starts, so a refusal after the re-pair cannot reinstate a failure that a Connect pressed during the handshake cleared. * refactor(ssh): one module owns a shared control socket's environment policy, keeping request-connections under its line limit |
||
|
Neil
|
e278bc9a17 |
feat(orcad-migration): unsaved drafts stay on this desktop and are renamed to the server on commit (#30894)
* feat(orcad-migration): unsaved drafts stay on this desktop and are renamed to the server on commit * fix(orcad-migration): refuse clashing drafts from the rename's own collection; stricter live spec * fix(orcad-migration): stamp renamed drafts with the server, rename at startup after a cut-off commit, keep draft refusals * fix(orcad-migration): retain only after a startup rename is durable; startup survives an unreadable journal * fix(orcad-migration): a cut-off commit is renamed and retained at startup, so the rename runs once * fix(orcad-migration): one retain per migration at a time; no rollback that could drop newer edits * test(e2e): check the visible draft in whichever editor a large file opens in * fix(orcad-migration): startup retains only migrations of hosts this profile owns * ci(e2e): route the editor-drafts migration spec to the sources it covers |
||
|
Neil
|
28d9f959de |
Run selected SSH tests instead of the whole suite on PRs (#30928)
* fix(ci): run only selected managed SSH specs on pull requests * fix(ci): retain full SSH coverage for routed shared helpers |
||
|
Neil
|
d4813638d2 |
fix(orcad): orca open-url opens the page on the paired desktop (#30782)
* wip: orcad client-hosted browser pages * wip: tests and renderer placement * wip: engine-free client tab queries; keep paired server intent * wip: one logical tab list for orcad engine tabs and desktop-hosted pages * wip: one selection rule for engine tabs beside desktop-hosted pages * refactor: one owner per mode for orcad tab selection; hide reopen-on-server without a server browser * fix: an engine tab create or switch takes workspace selection from desktop-hosted pages * refactor: one logical tab list and one selection rule for orcad engine tabs and desktop-hosted pages * fix: keep the engine's per-workspace current tab beside desktop-hosted pages * fix: an unscoped current tab matches unscoped automation routing * fix: retained desktop-hosted pages stay listable and closable after their desktop leaves |
||
|
Jinwoo HongandClaude
|
36913fd4f5 |
test(e2e): a phone lists the desktop's managed SSH workspace as the desktop sidebar does (switch on) (#30718)
* test(e2e): a phone lists the desktop's managed SSH workspace as the desktop sidebar does (switch on) * fix(sidebar): key folder workspace rows by host in the shared builder so the phone matches the desktop Co-Authored-By: Claude <noreply@anthropic.com> * test(sidebar): pin the SSH folder row key encoding Co-Authored-By: Claude <noreply@anthropic.com> * test(e2e): route the SSH phone feed list spec from its sources Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
NeilandClaude
|
6328a104bd |
refactor(ssh): split ssh-connection-utils into concretely named modules (#30488)
* refactor(ssh): split ssh-connection-utils into concretely named modules - classifiers -> ssh-reconnect-error-classification.ts - retry/timeout constants and sleep -> connection/ssh-connection-timing.ts - buildConnectConfig -> connection/ssh-connect-config.ts - credential callbacks -> connection/ssh-connection-callbacks.ts - exec options and abort error -> connection/ssh-exec-options.ts - wrapRemoteCommandForPosixShell -> ssh-posix-command-wrapper.ts - shellEscape and shared/wsl-login-shell-command quotePosixShell (identical) -> shared/shell-argument-quoting.ts quotePosixShell No re-exports are left behind. Co-Authored-By: Claude <noreply@anthropic.com> * fix: point the WSL git benchmark and the WSL lane route at shell-argument-quoting Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
NeilandClaude
|
139bac88b6 |
refactor(ssh): move the ssh-connection and ssh-target cluster into ssh/connection/ and ssh/targets/ (#30479)
* refactor(ssh): move the ssh-connection and ssh-target cluster into ssh/connection/ and ssh/targets/ Pure git mv plus import and path-literal rewrites. ssh-connection-utils stays put; the next PR splits it. Co-Authored-By: Claude <noreply@anthropic.com> * test(e2e): keep the release-checkout import at the v1.4.218 path Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Neil
|
1938bd055a |
refactor(ipc): group SSH and runtime-environment IPC handlers into ipc/ssh/ and ipc/runtime-environments/ (#30362)
git mv plus import, vi.mock and path-literal rewrites; e2e route regexes and the Windows host lane filter follow the moved handlers. |
||
|
Neil
|
658953dc23 |
refactor(ssh): group system-ssh transport, ssh config and remote exec into ssh/{system-transport,config,remote-exec}/ (#30355)
git mv plus import, vi.mock and path-literal rewrites; one e2e route regex follows the moved dynamic-forward process. |
||
|
Neil
|
506aa03195 |
refactor(managed-server): move the managed server's lifecycle into src/main/managed-server/lifecycle/ (#30343)
orcad-managed-*, orcad-runtime-*, orcad-stdio-bridge-*, orcad-decommission-* and orcad-rollback-* leave src/main/ssh. git mv plus import and path-literal rewrites; two e2e route regexes learn the new folder. orcad-runtime-maintenance stays for now because open #29834 edits it. |
||
|
Neil
|
d38299290d |
refactor(managed-server): move the managed server's install and deploy code into src/main/managed-server/install/ (#30335)
orcad-remote-*, remote-install-*, remote-node-runtime-store-*, remote-versioned-install and remote-deploy-timing leave src/main/ssh. git mv plus import and path-literal rewrites; one e2e route regex learns the new folder. orcad-remote-deploy and orcad-remote-node-runtime-report stay for now because open PRs #29834 and #29829 edit them. |
||
|
Neil
|
2d1ec53533 |
refactor(ssh): fence the legacy relay in ssh/legacy-relay/ and drop the relay name from live deploy primitives (#30292)
Moves legacy-relay-bridge/ plus the relay-only census and endpoint files into ssh/legacy-relay/, so the 2027-01-15 retirement deletes one folder. Live install, exec and framing modules that only carried the relay name become remote-*. git mv plus import, path-literal, routing and workflow path-filter rewrites only; no remote file name or path changes. |
||
|
Neil
|
1e4d65ea51 |
ci: path-literal check scans live gate references; historical gate commands move to currentCommand (#30252)
Gate evidence prose and evidence runs record what ran then, so the check reads only each gate's commands and test files (baseline 53 -> 14). Four evidence-pinned historical commands that named deleted tests are removed from their gates' commands and their runs point at the successor via currentCommand, the manifest's existing mechanism. One live command drops a deleted updater test. The managed-SSH catch-all route is renamed remote-sources and its test joins the route contracts. |
||
|
Neil
|
262a61703a |
ci(e2e): start the managed-SSH lane for every helper only its specs import (#30233)
* ci(e2e): route every helper only managed-SSH specs import to their lane, by import graph * ci(e2e): normalize import-closure paths to / on Windows |
||
|
Neil
|
1e29bd1907 | ci(e2e): route remote product sources without a hand-kept route to the managed-SSH lane (#30210) | ||
|
Neil
|
1b3113de8e |
fix(ssh): a tab closed while a managed host is disconnected stays closed; deflake the shared-home spec (#30146)
* fix(ssh): a tab closed while a managed host is disconnected stays closed after Connect #30130 made a user's Disconnect mark the host's managed server manually disconnected, so the desktop now answers its calls itself with runtime_manually_disconnected. The tab close path read that as the host's answer and dropped the close instead of holding it for replay, so the tab came back on reconnect. Treat it as an undelivered close, and route the Disconnect sources to the managed-orcad Docker lane. * test(e2e): close the disconnected host's tab the way a user does The journey called the store's bare closeTab, which sends only terminal.close and holds nothing; it passed only because the disconnected host used to be redialed in the background, which #30130 stopped. Click the tab's X instead, the path that holds and replays an undelivered close. * test(e2e): the shared-home spec tells a host's own server from a PID that only collides Each Docker host has its own PID namespace, so the PID host A records in the login-home slot can belong to an unrelated live process on host B; kill -0 alone then read it as B running from A's slot. Count a recorded PID only when its process runs from that slot. |
||
|
Neil
|
d3cafe234d |
test(e2e): stage the WSL inline-image payload in a file (#29633)
* test(e2e): stage the WSL inline-image payload in a file instead of a 25 KB typed line * ci: run the real WSL lane when its inline-image spec changes |
||
|
Neil
|
db22421ae7 |
fix(ssh): agents on a managed SSH host can drive the desktop Orca browser again, behind the per-host switch (#29384)
* fix(ssh): an opted-in desktop serves its browser to a managed SSH host's orca CLI again * fix(ssh): scope bridged pages through the renderer, render them as desktop pages, and route the e2e * fix(ssh): bridge refuses file URLs and clipboard reads, revokes on disconnect, closes desktop tabs * fix(ssh): judge bridged paste chords as the page sees them; accept long workspace ids * fix(ssh): bridged clipboard denial follows popups; revoked commands never leave the browser queue * fix(ssh): refuse option-like host values bound for agent-browser argv; report undeliverable results * fix(ssh): bound bridged error results and fall back when the host refuses one * fix(ssh): bridge only routed host tabs, and bound bridged page scripts by a deadline and revocation * fix(ssh): cap waiting bridged commands below the desktop socket's result capacity * fix(ssh): bridge revokes on routing changes, checks each page's route at run time, and cancels host-driven downloads * fix(ssh): name the bridge registry's owner type * fix(ssh): bridge refuses pages showing a local document, and never starts a command past orcad's deadline * fix(ssh): bridged commands may leave Chromium error pages, and stop starting before orcad's deadline * fix(ssh): ask for a fresh opt-in to host CLI control saved before it drove the desktop browser * test(ssh): type the bridge registry deadline test |
||
|
c023d35cd1 |
fix(browser): managed SSH terminal links open in the Orca Browser again (#29215)
* fix(browser): managed SSH terminal links open in the Orca Browser again A managed server reached over SSH has no browser backend of its own, so links from its panes were offered only the system browser. They now open in a desktop tab whose page egresses through the SSH host, the same route new browser tabs in that workspace already use. Fixes #29077, #27349 * test(e2e): keep the managed workspace host selected for the Cmd/Ctrl-click step * refactor(browser): keep owner-route checks private; split tab presentation instead Moving the owner predicates to their own module made their callers count as new focus reads. Keep them in workspace-browser-tab-open and move the title/error presentation helpers out to stay under the line limit. The SSH deployment check also reads the workspace's owner route instead of the focus-falling-back host lookup. * test(e2e): assert the managed SSH link page renders in the visible browser tab * fix(browser): keep a desktop-hosted link tab owned by its runtime workspace --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Neil <neil@stably.ai> |
||
  Žan MlakarandOrca Worker
|
88bd5db42e |
fix(windows): copy a file to the clipboard without a visible PowerShell window (#28781)
* Run clipboard file copy and TLS openssl through process-host * refactor(clipboard): inject runProcess, pass the Windows path as data, add an e2e - clipboard-file-copy builds the process spec itself, so the stdio policy sits next to the wl-copy/xclip knowledge it exists for; the IPC handler passes process-host's runProcess straight through and keeps no wrapper. - A helper's exit is read as data (clean exit or not) instead of being turned into a throw and caught again. - Windows runs a constant Set-Clipboard script and reads the path from the environment, so no path is ever parsed as PowerShell. - Drop the dead tls-certificate rewrite; nothing in the app imports it. - e2e: right-click Copy on Windows, then a real shell paste of the file. * ci(e2e): run the Windows explorer file-copy spec on the Windows runner Route it from the clipboard sources, keep it out of the Linux lanes, and run it in the existing Windows e2e job beside the other Windows-only specs. * refactor(clipboard): tighten the helper seam, tests and e2e after review - runClipboardHelper takes runProcess and a plain ProcessSpec. - One handler test pins the process-host wiring on every host; spec details stay in the unit tests, which now also pin the inherited environment. - e2e: native realpath so an 8.3 runner temp path still matches, paste via process-host, and no toast check that could never fail. - Route the renderer caller to the e2e too. --------- Co-authored-by: Orca Worker <orca-worker@localhost> |
||
|
efd7e50e0a |
fix(ssh): start a managed server that stopped, on every connect path (#28996)
A connect that found its own build already active launched nothing, so a server killed or stopped by a reboot failed on its stale record (#27284). A stopped server whose recorded port another runtime took failed the tunnel's identity check before any serving check could start it (#28013). Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: yuzhichang <153784+yuzhichang@users.noreply.github.com> |
||
|
Neil
|
6607c54984 |
perf(ci): cut redundant tests and reuse expensive setup (#28669)
* perf(ci): reduce test overhead and reuse expensive build work * test(ci): keep worker startup outside failure-case deadlines * test: isolate push fixture advisory locks * test(ci): preserve fixed drain retry allowance * Align CI contracts with current triggers and guide content * Stabilize consolidated reveal scenarios and retain behavioral CI contracts * Fix upstream lint blockers while retaining behavior and assertions * Classify global Jira preferences in the WSL migration inventory * Align Jira test fixtures with startup and build safety checks * Include package-test routing dependency in CI checkouts and fixtures * Keep native stream classes intact in transcript dependency tests |
||
|
Neil
|
b84d371a9f | refactor(runtime): compose typed browser command owners (#27576) | ||
|
OrcaWinandm4air
|
5763792718 |
refactor(renderer): remove the runtime-file-client barrel (#27975)
Co-authored-by: m4air <m4air@Mac.localdomain> |
||
|
OrcaWinandm4air
|
f8daed0d98 |
refactor(renderer): remove the web-session-tabs-sync barrel (#27969)
Co-authored-by: m4air <m4air@Mac.localdomain> |
||
|
OrcaWinandm4air
|
bce860fec8 |
refactor(renderer): remove the web-runtime-session barrel (#27967)
Co-authored-by: m4air <m4air@Mac.localdomain> |
||
|
OrcaWinandm4air
|
822bd9f972 |
fix(ssh): keep 1.4.224's running terminals working after the upgrade (legacy relay bridge) (#27787)
* wip: legacy relay bridge client
* Revert "fix(ssh): end an older Orca's relay terminals from the connect refusal (STA-10166) (#27748)"
This reverts commit
|
||
|
OrcaWinandm4air
|
e2b31cbc59 |
ci(e2e): one managed-SSH lane and routing regex; no relay build in e2e setup (#27640)
Co-authored-by: m4air <m4air@Mac.localdomain> |
||
|
Jinwoo Hong
|
29dca8c031 |
ci: the layout oracle gates merges (#27600)
* ci: the layout oracle gates merges An oracle-only job joins verify's needs. It runs only the two layout oracle specs through the existing e2e workflow, routed by layout writer paths; a PR outside the route skips it and verify treats the skip as a pass. The route is widened to the terminal store, terminal pane, graph sync, frozen mirror and compatibility folders while the layout-holder stack is open. The oracle specs leave the advisory e2e job so a PR does not run them twice. * ci: the layout oracle tests the merge commit and routes its harness and stack writers Review fixes: run on the merge commit so a stale-base PR cannot pass on an old main; route the oracle's own e2e harness and runtime client (a change there broke main's oracle without running it), and the window-side layout writers the stack edits; move the route into its own module. * ci: route the remaining layout writers the stack edits to the layout oracle |
||
|
Neil
|
c180ba6338 | [CI] Narrow daemon fixture checks and advance coordinator test clocks (#27592) | ||
|
OrcaWinandm4air
|
c9a9ad33b8 |
test(e2e): one managed-host setup path and skip gate for the ssh-orcad specs (#27465)
Co-authored-by: m4air <m4air@Mac.localdomain> |
||
|
OrcaWinandm4air
|
bdc0921718 |
test(e2e): one posixShellQuote; docker-ssh-host fixture names (Phase 3.99 0.11b) (#27449)
* test(e2e): one posixShellQuote; docker-ssh-host fixture names * test(e2e): leave the main-failing stall-recovery spec untouched --------- Co-authored-by: m4air <m4air@Mac.localdomain> |