The operation-order cases polled a settled flag and the compact spy with
vi.waitFor's 1 s default. Under SQL worker contention the goal or rewind
answers after more than a second, so the poll gave up while the operation
was still on its way (CI: "expected false to be true", then "closed by
quit" from the unhandled result). Await the result itself and a promise the
compact stub resolves.
With a 30 ms SQL reply delay injected locally plus CPU load, 3 repeats: the
old file failed "releases a startup goal" (expected false to be true) and
"answers a goal" (compact called 0 times); the awaited version passed all.
The contact-regained resync fired when the files.watch subscription was accepted, before the
restarted host reported its watcher ready, so a file created in that gap was neither in the
re-read listing nor reported by the watcher. The managed-orcad explorer recovery spec now waits
for that resync before writing its probe file.
The session-list summary publishes after an async journal projection read that
neither flushStreamedEvents nor the strip's batch covers, so asserting it right
after either raced the SQL worker.
Subscribers queue the opening snapshot behind an asynchronous SQL work
read, so agentSession.subscribe can reply before the snapshot frame; the
queued-image wire contract depends on that ordering. The at-rest case
read frames only up to the reply and lost the race under CI load.
With a 50 ms opening delay injected locally: old assertion 3/3 failed
(expected undefined), new assertion 3/3 passed.
The file-local busyChat answered turn/start, so main's automatic mail
steering (#41476) handed each queued mail card to the accepted turn about
80 ms after send. Cases that wait for a visible card then timed out (or
found it gone), and teardown logged the closed SQL reader. Reuse the
custody fixture's busyChat and settleTurn, which keep admission
unanswered until the scenario settles the turn.
Bun: 4/7 failed before; 35/35 passed across 5 runs after. Node: passes
with the custody file (18/18).
The journal SQL writer and reader entries run on worker threads. Their
dependencies are grandfathered in the SQLite baseline as worker-only, the
same way existing worker dependencies are; none run SQL on Electron main.
Prune baseline rows the branch no longer needs.
Carry the terminal identity worker alongside chat SQL workers and adopt provider aliases at the committed SQL cache boundary. Keep worker release and automation consumers on their relocated owners, preserving asynchronous journal reads and authority checks.
Retain main test deletions; none of the 47 deleted tests had branch-owned changes. Port incoming ACP fixtures to the asynchronous resume contract.
Validation: the standard merge hook, whole-merge lint, tc:node, e2e typecheck ratchet and changed-quality passed in gate825. All 120 tests in 14 owning files passed on Node and configured Bun. O1 diagnostics are isolated on their separate local branch and absent from this merge.
A workspace a worker start created gets the 'orchestration-worker' reason once every dispatch on it released its terminal and its work landed in the default branch, a merged review or the coordinator's branch. Commits the coordinator's branch already holds no longer count as unpushed.
Carry retained Codex input intent, admission safety, account attribution and
idle confirmation through the SQL journal owners. Preserve main relocations
and deletions and the SQL queue, history and custody assertions.
Suppress publication of unchanged SQL command acknowledgments so empty queue
claims cannot renew a chat's idle clock. This SQL mismatch predates this sync;
main's new idle-retirement coverage exposed it. Mail custody fixtures now hold
native admission and use real edit leases without altering automatic delivery.
Validation: direct Node through tc-gate; merge hook, basic lint, tc:node,
e2e typecheck and pinned-main changed quality pass. All 148 owning tests in
25 files pass on both Node and configured Bun. O1 diagnostics remain excluded.
The fetch queue checked each queued-refresh flag once per loop, in a fixed
order. A forced refresh queued after its flag was checked stayed set when the
loop ended, so nothing ran it: after two quick account switches during a
refresh the meter stayed on fetching with no numbers, and the switch never
read the new account. One drain loop now re-reads every flag after each cycle.
* fix(terminal): draw the hardware cursor in remounted panes before first focus
xterm withholds the cursor until its textarea gets a focus event or a
keystroke. A remounted pane (reload, reattach) keeps DOM focus, so no
event fires and TUIs that use the hardware cursor, like agy, show no
cursor until the next keypress. Set showCursorImmediately so DECTCEM
alone decides visibility, matching the mobile fix in #11387.
* test(terminal): drop xterm-behavior cases and casts from cursor init test
* feat(workspace-cleanup): classify finished automation run workspaces
A new-per-run automation leaves one workspace behind per run. Cleanup
scans now tag such a workspace 'automation-run' once its run is final
and the automation has released the run's terminal, so the
automationRuns rule can remove it behind the usual safety blockers.
* refactor(workspace-cleanup): keep the scan file under its line cap
* Give every Settings pane the same card structure
Settings cards that hold rows were built several ways (the non-grouped
SettingsSection px-7 card, shadcn Card, the Appearance accordion, one-off
bordered boxes), each with its own side padding and row inset. Every one
now goes through SettingsGroup: one 20px inset, rules between rows, title
outside the card. SettingsGroup gains an id, a collapse prop for the
Appearance groups, SettingsGroupSubsection, SettingsGroupNestedRows and
SettingsGroupDisclosure (the old Appearance advanced disclosure), plus
shared bleed classes for rows that span the card. The non-grouped
SettingsSection body is removed.
* Fix settings card typecheck errors
* Keep collapsible group headings valid and restore notification row padding
* Keep Chat names anchor on its group, toggle Appearance groups from the whole header, and steady the Machines row padding
* Show Appearance groups as plain cards and even the Computer Use card's top inset
* Restore the SettingsGroup subsection exports dropped with the collapse mode
* Scope workspace deletion shortcuts to selected sidebar rows
* Complete shortcut event typing and web bridge cleanup
* Use stable fixture rows and typed input elements
* Align sidebar deletion and navigation with eligible focused rows
* Pass explicit absent repo for selected row host lookup
* Describe selected options in keyboard test fixture
* Bound sidebar selection and deletion work and preserve host ownership
* Keep navigation imports within the file size limit
* Separate navigation type imports consistently
* Match selected workspace repositories by explicit host
* feat(computer): type into a named text field without focusing it on Linux and macOS
* fix(computer): report unconfirmed Linux text readback and cover element typing
* test(computer): send an element with benchmark text only for targeted typing
* test(computer): pick gedit's editor, not its hidden overview map, in Linux e2e
* docs(computer): confirm focus before the unindexed type-text fallback
* fix(computer): report unreadable element text readback as readback_unsupported
* fix(native-chat): preview GitHub PR links in chats without a GitHub repo
A chat whose workspace has no GitHub repo (a plain folder) sent every
GitHub link to the anonymous web page fetch. Private repos answer that
with a 404, so the card said "No preview for this page." Route the
lookup through another registered repo on the chat's host whose remote
is on the link's GitHub host; main already lets a preview read any repo
on such a host with that sign-in.
* fix(native-chat): prefer exact clones and repair attachment test import
* fix(native-chat): retain direct SSH ownership for GitHub previews
* fix(native-chat): invalidate routed previews when repo accounts change
* fix(native-chat): resolve current preview routes before cache reuse
* fix(native-chat): preserve preview authority across async lookups
* fix(native-chat): retain valid preview lookups across catalog updates
* Avoid coalescing retired preview requests
* Give terminal agents a lasting Orca Agent ID
Terminal agents now get an Orca ID (orca_session_id:<agent>_<uuid>) derived
from their own conversation id on the host that runs them, so it stays the
same across worktree sleep/wake, app restart and a hand-run resume in any
pane. The terminal pane menu gets Copy Agent ID beside Copy Session ID, and
worktree ps --json agent rows carry orcaSessionId. Messaging a terminal
agent by that ID is refused with a message naming its pane until terminal
delivery lands.
* Name terminal agents at row admission and fix review round 1
- Perf: a row's Agent ID is resolved once, when its provider key changes at
admission (legacy rows via the status adapter's prepareRow hook, tmux rows at
canonical commit) and carried on the row as runtime-only agentIdentity.
Snapshots, publications and internal notifications only copy it; no key
serialization, cache lookup or database access per walk. Drops the pane FIFO
cache.
- Refusal: the identity service keeps a reverse index id -> rows, kept exact by
the adapter's rowChanged hook; a terminal refusal reads only matching panes
and names only confirmed running ones (no resume seeds, exited or
unconfirmed restored rows).
- Retry: a read-only identity file is lookup-only and never mints; any store
failure backs off all SQLite work for 30 s; a Copy click retries once.
- Menu: Copy Agent ID shows for a live pane only when its host stamped an ID,
and for a sleeping pane only when this app owns it on macOS/Linux.
- SSH: a sleeping record keeps its connection; a foreign (non-WSL) one resolves
no ID.
- Renderer keeps an existing ID only for the same agent, owner and provider key
including the Pi transcript locator.
- tmux-selected terminal rows carry their ID at every snapshot seam and in Copy
resolution; structured chat rows stay excluded.
* Keep Agent ID work out of notifications and reach Copy wherever a host can answer
- Internal status/provider notifications walk rows without Agent ID work:
canonical (tmux-selected) rows are decorated only for outputs that carry
the id (snapshots, live emit, ps, Copy). The tmux publish body is now
publishTmuxSelectedStatus so tests drive the production path.
- A row this host can name but has not yet (failed or pending link) is
published with orcaSessionId: null; older hosts omit the field. The
renderer offers Copy Agent ID on a live row whenever the field is present,
and the click retries through terminal.agentId.
- Hosts advertise terminal.agent-id.v1. A sleeping pane offers Copy Agent ID
when its owner is this app on macOS/Linux, or a remote owner that advertises
the capability on a known non-Windows platform, and its record names no
foreign connection.
- "Running in pane" places require that this runtime observed the row; a
saved status, Done included, is history.
* Guard the pane menu subscription and stop offering Copy where it can never succeed
- A settled read-only miss (no link in a newer build's identity file) no
longer publishes orcaSessionId; only a resolved id or a pending failed link
does, so Copy Agent ID is offered only where a click can succeed.
- Render contract for the per-pane menu selection: another pane's or host's
status change re-renders no unaffected pane; a pane's own stamp flips its
availability.
* Move terminal agent identity SQL into a worker thread
Main's blocking-SQLite ratchet forbids the synchronous identity store, so
(per the decider ruling) agent-identities.db is now owned by one lazy
worker-thread entry per hook-server owner, desktop and orcad alike.
- The schema, open/version handling, mint/link transaction and read-only
behaviour move unchanged into agent-identity-worker-entry.ts; main keeps
only the key type, path and an async client over WorkerThreadRequestQueue.
- Admission stays synchronous: a new key is published pending (null), one
request per exact key is shared by every row and click, and the committed
answer re-stamps the current rows still pending on that key (legacy and
tmux-selected) as identity-only replays. Replies are fenced by store
generation, key and current subscription; failures back off 30 s and a
Copy click retries once.
- terminal.agentId and the terminal-ID refusal are async: Copy waits for the
pending lookup and revalidates the pane; send/task routing resolves the
terminal recipient (awaiting the store's has() on an index miss) before
any synchronous routing or effects.
- The renderer treats the host's row naming a conversation as authoritative
for its id, so a settled miss clears a pending null, while ID-less local
updates keep it.
- Packaged for desktop and orcad; registered as a worker entry, no baseline
growth.
* Own identity demand per key, publish settled ids as projections, recheck authority
Implements the second decider ruling for the identity worker:
- One owner-level demand table replaces the per-key promise backlog and the
settled-row scan: each exact key a current row or caller needs has one
record (identity, places, waiters); the pump sends the worker one operation
at a time, only for keys still needed, so a healthy burst completes and
detached keys are never sent. Operation deadlines start at dispatch; a
caller's wait expiring never drops a row's demand.
- One failure gate for lookups and membership: after a failure nothing is
sent for 30 s except one coalesced Copy attempt; a single owner wake
retries while rows still wait, and cancels with the last demand or close.
- The retirement barrier outlives a client: a replaced worker must exit
before another starts; a different store path is a different authority.
- Settlement re-stamps the stored row and publishes a projection only: window
readers get the row without its hook event (no agent-state record) and
session.tabs is woken by a row touch; no enriched subscriber, plugin event
or freshness heartbeat runs again.
- Copy and terminal membership check the owner generation after their waits.
A known chat is decided by the chat store alone; send, peer mail, reply and
assignee admission resolve the terminal recipient before reading the facts
they act on, recheck the sender after the wait, and group send reselects
its audience and mailboxes after each wait before writing.
* Scope identity answers to their store authority, expire Copy grants with callers, index provider aliases
- One synchronized authority token before Copy/reverse fast paths, compared after their awaits;
answers carry their authority and an ended store turns rows, tmux subjects and the reverse
index pending together. Status path changes sync the authority outside admission.
- A failed operation reschedules the pump so a queued click gets its attempt; grants belong to
live waiters and a click joining a running attempt earns none.
- Provider-native ids resolve through a commit-maintained alias index at the record store.
- Group fan-out no longer classifies authoritative candidates; @idle rereads statuses with
current candidates before the final synchronous selection.
- Hook-server unit fixtures use an in-memory identity client; a real worker load/stop failure
check covers the worker boundary.
* Pick a shared provider alias's owner among its owners only
The alias index keeps the store's listing order (readable, then unreadable) as derived ranks, updated from the draft's appended keys on commit, so a duplicate alias no longer walks the history per lookup.
* Ask a remote pane's host for its Agent ID by the host's own pane key
Copy Agent ID on a web-terminal surface sent the client's mirrored pane key, which the execution host does not know, so it answered null.
* Keep focus where the user moved, recover a missed identity re-stamp, ack peer-mail replays first
Copy Agent ID refocuses its pane only when focus is unclaimed or still in the pane; a carried pending row takes its key's settled answer; an already-delivered peer-mail retry is acknowledged before recipient preparation.
* fix(tab-group): track divider drags by pointer and keep guests click-through
When a divider drag's first move lands on a browser page, the guest's
process takes that event and every later one, so pointer capture never
activates and the divider stays stuck in is-dragging. Hold webview drag
passthrough for the whole gesture, as the pane-divider, tab and DevTools
dock drags already do.
Linux Chromium can report hasPointerCapture() false while moves still
arrive (#34287), so own the gesture by pointerId with window-level
listeners, and end it on a buttonless move when the release was missed.
Drawn from #35919 by alpenshtokk.
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* fix(tab-group): keep split dividers grabbable beside a narrow browser group
A squeezed browser toolbar overflowed its overlay slot and sat on top of the
divider to its right, so presses in the toolbar row never reached the handle.
Clip the overlay slot to its group like other retained pane hosts.
Adds a real-mouse e2e for a narrow terminal | browser | terminal row: the
divider must be uncovered along its whole height, follow a drag whose first
move lands on the page, and accept the next drag afterwards.
* fix(tab-group): end a lost divider drag on blur, hide or re-press
A release outside the window could be missed with no buttonless move to end
the gesture, leaving guest passthrough held and letting a later pressed move
resume the old drag. End the gesture when the window blurs or is hidden, and
let a new press of the same pointer replace a gesture whose release was missed.
Covers release outside the window, Linux false capture, multiple guest
surfaces and unmount mid-drag.
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* fix(tab-group): end a lost divider drag on the next press anywhere
Divider moves are tracked on window, but the same-pointer recovery only ran
when the next press landed on the stale handle itself. A press on another
divider or on pane content let later pressed moves resume the old drag, and
with two dividers both followed the new gesture. Listen for the active
pointer's next pointerdown on window in the capture phase and end the stale
gesture before anything handles the press.
* fix(browser): clip the narrow browser toolbar without making it scrollable
overflow-hidden still made the browser overlay slot a scroll container, so
tabbing to a toolbar control clipped in a narrow group scrolled the toolbar
and page sideways with no way back. overflow-clip clips the same way without
a scroll position.
---------
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* Chat UI settings: install an agent's chat runtime from its row
* Keep the install line while Orca installs over an external copy or can't read status
* Keep Removing… visible in the Chat UI install line
* Chat UI and new chats: show Antigravity sign-in as the next step after install
* Record NativeChatStructuredSession's cleared React Compiler bailout
* Keep the Chat UI row install-only; open sign-in on the chat's host and skip chats on the host's agy
* fix(settings): drop nested cards from Worktree hooks
The orca.yaml status, its parse-error callout and the local-scripts notice drew bordered panels inside the Worktree hooks card. Render them as flat rows; code blocks and inputs keep their borders.
* fix(settings): show healthy orca.yaml status as a collapsed row
Loaded and missing orca.yaml now render as a disclosure row under Command source instead of a tinted card inside the Worktree hooks card; the script preview or template is collapsed by default. Parse-error and update-available keep their warning card. Advanced content is indented to line up with its label. Restores the local-scripts notice card from main.
* chore(i18n): drop orca.yaml status strings the new row no longer uses
* fix(settings): keep orca.yaml row inside design-system lint rules
* fix(automations): follow-ups to the automation detail redesign
- Show the latest occurrence as a folded skipped run's last-run time. The
detail health band, list rows with loaded history, and the projected list
summary all read the retained run's first-occurrence timestamps, so a host
that kept refusing runs looked like it last ran days ago.
- Translate the new detail strings (Repeats, Missed-run grace, Execution,
Not run yet, the usage detail, and the prompt copy labels) in every
supported locale, reusing existing localized wording, and give the usage
detail CLDR plural forms again.
- Assert the prompt preview's eight-line boundary by behavior in the e2e
spec instead of the line-clamp CSS value.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(automations): zh copy-prompt wording
Use 提示词 in the new zh copy-prompt label so it matches the panel heading.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
It streams like Nemotron 3.5, so text shows as you speak, and scored
2.8% WER streamed (2.35% as one decode) on the 73 LibriSpeech bench
clips, against 3.7% for Parakeet v3. It sits ahead of Parakeet v2,
which measures the same, so one-click setup favouring accuracy picks it
for English.
* feat(native-chat): run Kimi Code in Chat over its ACP server
Kimi chats launch `kimi acp` with Kimi's own sign-in and KIMI_CODE_HOME.
Orca sets Kimi's own permission mode at every start: Ask is Kimi's
default, Approve for me is its Ask When Needed mode, and Full access is
its Never Ask mode. Without that, a default_permission_mode in Kimi's
config.toml would apply while the session reports default.
A Kimi dialect reads Bash results as output and exit code, drops the
streamed arguments a running call shows as text, names the command or
path on approval cards, and takes questions as forms so every question
reaches the chat.
* fix(native-chat): import Kimi session history helpers from their new home
* fix(computer-use): scroll, expand and set sliders on Windows without raising the window
* fix(computer-use): wait for Windows scroll and slider writes to settle before verifying
* fix(computer-use): reject NaN for Windows slider set-value
* test(computer-use): wait on the Windows fixture state with vi.waitFor and a schema
* test(computer-use): check activation per action against a holder window in the Windows fixture
* test(computer-use): log fixture window events for activation failures
* fix(computer-use): report foreground when a Windows app raises itself for a UI Automation action
WPF activates its own window for Scroll, ExpandCollapse, RangeValue and SelectionItem calls from any UIA client, so the runtime now compares the foreground window before and after a pattern action instead of assuming background. The Windows e2e checks delivery against the fixture's own activation count, with a holder window in another process.
* test(computer-use): skip an unstarted holder when closing the Windows fixture
* fix(computer-use): bound Windows pattern scroll paging and tighten slider read-back
* fix(computer-use): cap Windows slider read-back tolerance and run the UIA e2e only on CI
Brennan Benson
Kelvin Amoaba
OrcaWinandOrcaWin
Neil
buf0-bot[bot]
Jinjing
