* refactor: separate execution route and child exit owners
* refactor: move browser data into defining feature owners
* refactor: give runtime RPC entry its shutdown implementation
* refactor: use defining process types and colocate host telemetry test
* docs(process-host): point piped child contract to Node owner
* docs(process-host): clarify both piped contract owners
* Start OpenCode 2 with a picked model through its launch config
OpenCode 2's root command has no --model, so launches that carried one
exited with 'Unrecognized flag'. On supported 2.x releases the PTY launch
hook now moves a literal root --model into OPENCODE_CONFIG_CONTENT and
starts a private server so the TUI reads it. Anything it can't apply is
left as typed.
* Point the sync-fs ratchet baseline at the moved agent-hooks files
#39969 moved the agent-hooks installer files after #39930 wrote the
baseline, so the ratchet saw every moved file as new and failed lint.
Same counts, new paths; installer-utils' 20 split into its two new owners.
* Rewrite only one plain OpenCode command with a real --standalone
A --prompt or --session value spelled --standalone no longer counts as
the option, the cut starts at the previous token's end so its escaped
trailing characters stay, and a newline or shell operator leaves the
command as typed.
* Leave a command with an operator outside quotes as typed
A token that only starts with a quote, such as '--auto'&&echo, could hide
a shell operator; scan each token outside its quotes instead.
* Leave comments and explicit servers as typed
A word starting with # comments out the rest of the line, and --server
means another server that never reads this launch's config.
* Scan for shell operators with each shell's own quoting
cmd quotes only with double quotes and PowerShell escapes with a backtick,
so a posix-only scan could miss an operator they would split on.
* Rewrite only the command shape Orca itself emits
Replace the shell scanners with one check: every argument after the
executable must be exactly quoteStartupArg's output or a bare flag the
builders append, and the prompt must match the body Orca put in the env.
cmd also rejects any divergent token or raw newline. Anything else stays
as typed.
* Test that the launch hook hands the prompt body to the model rewrite
* refactor(main): organize SSH transport and managed server owners
* Remove orphan deploy readiness fixture and shrink test baselines
* refactor(wsl): import lock records from their defining owner
* refactor(wsl): use the canonical deferred update contract
* chore(lint): bump oxlint to 1.91, add perf lint rules and perf audits
* fix(lint): await promises returned inside try/catch/finally for return-await
Prepare typescript/return-await with error-handling-correctness-only: await
returns whose catch or finally was meant to cover them, and suppress the eight
sites where the catch must not re-handle the returned promise.
* chore(lint): enable return-await (error-handling-correctness-only); exempt secondary-scan directives in the changed gate
* refactor(mobile): move file preview discard modal into its own module
Keeps MobileFilePreviewScreen under the 400-line limit after merging main.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* refactor(main): organize runtime implementation owners
* test: retire wall-clock CLI title recovery case
* refactor: route new folder mutation to runtime store owner
* test: import folder mutation store contract from its owner
* Preserve native model choice when restoring ACP chats
* Forward startup observations through the OpenCode connection
* Use fixed time in the connection regression fixture
* Complete the model-command fixture session identity
* Stop retrying final native agent startup refusals
* Retire startup opens after exit and keep final answers across exit orders
- A start flight cancels its outstanding provider open on every ended path; a direct attach keeps the child-bound abort.
- The post-exit answer join is bounded by the remaining startup ceiling.
- An elapsed initialize deadline keeps its words when the exit wins the race.
- Codex cloud config temporary declarations retry on thread/resume as on thread/start.
- A Claude exit before acquisition publishes waits briefly for initialize's answer, so a rejected initialize stays final.
- The Claude startup stdout observer parses only failed root results, within the shared line budget, and detaches once it has one.
* Keep saving the last turn when a Claude process exits after startup
The exit path skipped saving the resume cursor whenever Orca had not
dispatched a message, but turns can settle without an Orca dispatch and an
already-started idle session still owns its exit save. Only a start that
died before initialize answered and before any turn now skips the save and
gets the short cleanup bound. A failed result captured before the first send
counts as a startup failure only when no turn ran in that process.
* Merge duplicate test imports
* Bound resumed Claude starts that exit during catch-up and keep untyped refusals final
Exit-time cursor writes and the short close bound now key on the host-awaited
open actually returning, so a resume that exits while transcript catch-up is
pending publishes ended at once instead of waiting on a cursor write. The
startup observer no longer reads an answer from an oversized line's prefix.
A typed acquisition refusal without a dedicated failure kind keeps its
refusal marker, so an exit-only start stays final.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: pin the fake clock in the resumed-exit start test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: bound startup answer parsing by candidates at N and 10N records
Drive the startup observer through the shared framer at 100 and 1000
irrelevant hook and assistant records, and assert that only the failed
root result is parsed, one capture happens, the data listener retires,
and no parse follows capture or finish, with identical counts at both
populations.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: shape startup fixtures like the real providers
Held opens in the launch test now reject when their child exits, as a
real connection does, and the temporary open failures use the provider's
actual overload envelope. Also fixes the test-only type errors CI found.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: use the real Codex canonical-filename refusal wire capture
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): align merged startup tests with answer-wins and final generic results
An exit with no stderr leaves the start to Claude's buffered result, so that result is the start's one failure. A generic startup failure result is final after one start; only an unanswered exit retries, and the recovery case now recovers from such an exit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(claude): let a final initialize answer outrank a physical exit reported fault-first
The connection reports one physical root exit through onFault and then
onExit. It now marks that error as an observed exit before either
callback, and acquisition's onFault leaves a proven exit to onExit's
bounded initialize join, so a final initialize rejection that arrives
just after the exit owns the start instead of a retryable bare exit.
Typed refusals, live-root faults and processless spawn faults still end
the start at once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): await a macrotask instead of real time in the exit-answer start test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): replace casts in the exit-answer start test with an annotation and guard
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let each adapter decide a failed start, and give the start one owner
A start that the agent refused could still be replayed: the host joined a
child's exit with its open's error and rebuilt the meaning from provider error
classes, and an answer written just before exit could lose to the exit itself.
Each adapter now answers its own acquire, open and required startup reads with
one typed result (final, or safe to run once more), keeping a final answer
beneath the exit proofs cleanup adds. Transports keep reading answers already
written after the agent stops reading or exits, within the existing one-second
drain, and only a drained exit of the agent's own process counts as unanswered.
The child's open is the single owner of the start's outcome: it awaits the
adapter's result and required settlement, records the verdict once, writes a
direct attach's failure row, and stops the child. The start flight reads that
verdict instead of joining exit and open. A start whose adapter gives no outcome
within five seconds of its own process exit fails through a timer that no
bookkeeping can hold, and the original start deadline stays in force until the
start is decided.
Tracked in STA-12982.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): bound a failed start's lifetime and keep Orca's own refusals final
- A start's ending is kept only while its owner can read it: admitted when the
acquisition starts, retired when the owner finishes, the acquisition fails, or
the session is released or closed. An exit after ready records nothing.
- Codex takes its own exit as the start's wake from the moment the process is
seen, before spawn bookkeeping, and a failed acquire keeps that exit as cause.
- Once the handle or rewind write began, an unanswered death no longer decides
the start: the write's refusal stays final, and the exit grace bounds the wait.
- Stop, the deadline and the exit grace release the start's callers at once; the
failure row is queued first but never awaited by them.
- An ACP connection Orca closed before the exit keeps that cause, so cleanup's
exit is not read as the agent ending unanswered.
- A request deadline keeps its words when an exit is seen around it.
- A direct attach whose exit settled first keeps the exit's words.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let a start's owner, not its live route, keep and retire its ending
Exit acknowledgment drops a session's route while the start's owner may
still be reading how its acquisition ended, so the router now reaches the
adapters by exact generation for both the read and the retirement. Claude
admits its acquisition before publication can observe an exit.
An ACP start Orca refused before the agent exited now fails with that
original refusal as the adapter's final verdict, through every cleanup
wrapper, instead of a generic closed-while-starting error.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(agent-session): give the worker retry fake the Codex adapter's typed start verdict
The host now reads only the adapter's verdict on a failed start, so the
fake open rejects with the verdict the Codex adapter returns for its
declared overload instead of the raw request error.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let Claude's own exit record decide a start the SDK reports as exited
A Claude CLI missing from the launch PATH makes the supervisor exit 127 with the spawn error on
stderr. The SDK rejects initialize with only "process exited with code 127", and the start took
that report as its cause, so the missing CLI was lost: the chat said Claude stopped before it
finished starting and the start was retried as an unanswered exit. The SDK's exit report is no
answer; the start now reads Orca's own record of that exit, which carries the missing CLI.
Also brings two ACP tests in line with the typed start verdict (a signed-out open rejects with
the adapter's notSignedIn verdict) and the bounded drain after the agent stops reading.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(agent-session): stop parsing Claude's startup output once its failure is captured, and pin start and drain work at N and 10N
A failed root result captured mid-chunk still let the rest of that chunk be framed and parsed;
nothing reads those records once the start has its answer. The observer now accepts no further
line once it has captured the failure, and drops what that chunk left in its framing state.
Two contract tests drive the production start owner and transports at N and 10N:
- starts through the host, router and Codex adapter (ready, final refusal, safe replay, deadline
expiry): each start's owner, abort handles, tracked attempt, flight, buffered exits, adapter
receipts, root-exit subscription and deadline timer return to baseline, a waiting start holds
a fixed set, and spawns, opens, router reads and retirements, timers and failure rows grow
exactly linearly;
- ACP, JSON-lines and Codex connections with a pending call, answered at exit or abandoned after
the agent stops reading (with duplicate terminal signals): each call settles once, each output
drain finishes once and leaves no listener or timer;
- an ACP start refused at sign-in keeps its own first cause and leaves no receipt or child.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): decide a failed start once from everything its adapter saw
A failed start was decided from whichever error reached the decision first, so a later or
poorer report could replace the one that explained it: the SDK's exit report hid the missing
CLI Orca's own exit record carried, and an output drain let a load deadline give way to an
unanswered exit. One shared rule now weighs every observation an adapter kept. The start may
run again only if every observation allows it, and the most specific one explains it: what the
user can act on, then a request deadline, then the agent's answer, then Orca's record of its
exit, then an SDK's report of that exit. Claude, Codex and Pi pass their exit records alongside
the operation's error instead of choosing between them.
An ACP agent that exited while its output drained no longer gets a replacement session after
its load fails. JSON-lines output that reports both its end and its close now starts one wait,
so the agent's exit can always cancel it.
Contracts at N and 10N: JSON-lines output ending while its root lives, real Claude and Pi
adapters retiring every start's receipt, and a user Stop whose cleanup is held then released.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(acp): keep a missed saved-session load deadline instead of opening a replacement
A live agent that let session/load run past its deadline fell through to the
takeover path, and the replacement session/new answer then replaced the
deadline the user had to see. The takeover predicate now propagates any
provider request deadline unchanged, read through the existing typed timeout.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Show the native default effort for OpenCode models
* Show the effort OpenCode 1.x actually runs when none is picked
OpenCode 1.x ACP runs a listed default variant, else the first listed
one, so declare that same variant instead of a no-override Default. The
draft and launch default stay as on main; the resting fallback now shows
it too. Shared declared-effort consumers expect no effort for a readback
without that model's menu.
* Name the recorded OpenCode listing test for what it checks
* test: remove 462 low-value test declarations
* Shrink flaky test pattern baseline after audit896 test removal
* Remove two empty hook-only suites after audit896 test removal
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(native-chat): an open chat moves to the account you switch to before its next message
A running chat's agent read its account only when it started, and nothing compared it with the
account a start would use now, so open chats kept answering on the old account after a switch.
The agent a chat runs now records the account its launch used, and the host's replace-before-the-
next-send check replaces an idle one whose account is no longer what a start would use. A chat
mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the
account they were created on are never compared.
A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer
writes its new account's list under its first account (STA-11281).
Tracked in STA-11211.
* fix(native-chat): declare the launch-account read for the runtime layer that wires the host
* fix(claude): find custom chat history before managed-account resume
* test(claude): assign the complete custom account home
* feat(native-chat): offer account switching and hand-off at usage limits
* fix: track the provider in account-list reload effects
* fix(native-chat): target recovery actions at the chat host and transcript
* fix(native-chat): verify account recovery for each chat on its host
* refactor(native-chat): retain the existing image-support result
* fix(native-chat): withdraw account recovery after failed eligibility reads
* fix(native-chat): leave unavailable recovery facts absent
* Align Japanese usage-limit recovery copy with catalog convention
* Preserve complete chat context through usage-limit recovery
* Keep Continue callback focus optional
* Keep recovery fixtures and account effects type safe
* Keep chat recovery on native sources and native accounts
* Validate native recovery files after path admission
* Use the optional cursor shape in recovery fixture
* fix(native-chat): exclude source CLI family from limit handoff
* Resolve recovery context in the owning workspace directory
* Preserve unknown account model facts and legacy option replay
* Clarify terminal account-switch feedback in translated locales
* Offer usage-limit Continue Now only once the limit resets
* Keep usage-limit reset timers current and bounded
* Keep option mutation plans checked against their contract
* Cover unknown model choices across chat consumers
* Keep consumer fixtures aligned with canonical types
* Match the mobile picker label in its consumer test
* fix: clarify terminal scope in translated Claude account settings
* Update integration tests for current session and remote client contracts
* Keep native worker replies on their receiving account
* Preserve receiving accounts across cold starts and nested reports
* Preserve the delivery receiver when reading chat commands
* Clarify native reply matching and consolidate imports
* Resolve catalog scope without re-entering conversation queues
Give owned option mutations and delivery settlement a resolved catalog input while external reads acquire scope once. Preserve account routing, catalog lifetime and current response obligations.
* Align catalog and mobile test fixtures with current contracts
Explain the existing timeout budgets and provide the idle turn identity and truthful model-only picker label in the mobile fixture.
* Align receiving-account readers and fixtures with typed contracts
* Repair account-switch fixtures and measure receiving work
* Use the checked account-home path in catalog tests
* Restore executed-option recorder context
* Control receiving catalog deadline test clock
* Align unknown-model consumer fixtures with send capture
* Consolidate session host type imports
* Align cross-version catalog fixtures with host read contracts
* test(native-chat): bind Runs through the current start authority in receiving fixtures
Main now resolves a worker start lazily through bindRun with objective and task references, and creating a Run no longer unbinds a coordinator's earlier Runs; run-use does. The receiving fixtures follow the same production owners so every original scenario, input and bound is exercised unchanged. The receiving runtime subclass moves verbatim into its own support module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(native-chat): follow the selected account before its folder exists
A live Claude chat compared its account against the selected one only after that account's folder passed an availability check, so an account still being set up (or whose setup failed) left the chat silently answering on the previous account, and a resting chat refused its start before preparation could run. The retirement comparison and the start pre-read now ask the router for the selected route as identity, through the existing resolver purposes; catalog, create and probe reads keep checking availability. Preparation, typed launch failure and parking are unchanged.
Session History details show the account a chat was last launched under when the host recorded one, else its founding home.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(ai-vault): build the stale acquisition receipt without a type assertion
The History account case now reads the fixture receipt through the typed acquisition reader instead of spreading the record field through a cast; the three assertions and their inputs are unchanged.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(native-chat): narrow the rig acquisition link before relinking it
The account-setup cases spread an optional link, which typed its id as possibly undefined; the rig always links a handle, so a guard that cannot fire narrows it. No assertion or input changes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(native-chat): follow main's chat admission in fixtures and bound the History account projection
Chat admission no longer reads an experimental host setting, so the continuation-context test drops the spy main dropped in its own fixtures. The two History consumers that install a minimal chat host give their fake store the record accessor and host id the real store has, since the projection now reads the acquisition receipt. An operation-count contract holds the production History projection to one roster read and one record lookup per owned row at 10 and 100 rows.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(native-chat): give the declared-effort catalog fake its capture port
The declared-effort fixture builds a catalog service without the capture member the options reader asks every catalog for, which failed its desktop, catalog and phone consumers; it now supplies the inert test operation like the other fakes. The History projection contract also drops an unused map parameter.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Consume main's outcome change feed in the receiving-account index
Main's keyed journal records deliver each change after an epoch's frozen prefix as an
outcome sequence naming touched keys instead of typed rows. The receiving-account index
now re-reads those keys at their current values: queue cards by id, a deleted submission
retires its exact notice, and a deleted item drives the existing recovery rebuild, with
Stop marks still excluded. The in-process read row exposes the already-persisted
queue.cards keys and per-key deletion facts; itemIds and submissionIds keep listing every
touched key. The mobile unknown-consumer test mocks MobileSwitch as main's picker test does.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test: validate historical usage-limit fixture before rendering
* fix: scope handoff choices and share account observation
* fix: align account menu lifetime and local projections
* test: preserve account observation contracts in quality checks
* fix: preserve typed account observation project coverage
* fix: restore handoff feedback for empty host inventory
* test: name exported handoff mocks with public types
* test: follow settings navigation consumption in feature tip adapter
* Keep usage-limit recovery actions beside their lead-in
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* test: remove low-value suites and cases
* test: shrink flaky-pattern counts after case removals
* test: remove empty suite and stale release workflow fixture
* fix(native-chat): a kill that reached the agent ends it, so the next message goes through
After Stop, tab close, idle rest or workspace sleep, Orca force-kills the
agent. It used to accept the old agent as gone only when it saw the exit
report within about a second; otherwise every later message re-ran the kill
and was refused with "Couldn't stop {agent} from before." A kill delivered to
the agent itself now ends it and releases the chat with kill-delivered
evidence; the refusal remains only when the kill could not reach the agent.
When writing the chat's journal fails and the following kill can't be
confirmed, recovery now records the close with its fault instead of silently
returning, so the turn no longer stays Working and later sends retry the stop.
Tracked in STA-12354 and STA-12355.
* Preserve provider kill evidence across cleanup retries
* Exercise ACP setup gate with real managed teardown
* fix: preserve Claude writer termination evidence through settlement
* test: consolidate termination evidence contracts
* fix: restore Pi connection exit listener contract
* test: load actual ACP teardown before timed cases
* fix: correct lifecycle contract typing and test boundaries
* test: make Claude piped fixture mock types portable
* test: expect supervised OpenCode probe teardown
* test: align remaining supervised teardown expectations
* fix: align Stop feedback with terminal writer evidence
* test: remove redundant mocked Codex continuation case
* fix: keep adapter declaration and Stop fixture checks portable
* test: keep Stop fixture clock unchanged
* test: read canonical provider handle when reopening Stop journal
Neil
OrcaWinandOrcaWin
Brennan Benson
