* fix(browser): stop failing goto when a redirect or download aborts the load
Electron's loadURL rejects with ERR_ABORTED (-3) when the initial
navigation is superseded — a client-side/meta redirect (common in SSO
flows) or a download-triggered load. Since #9633 drives goto through
wc.loadURL directly, that rejection surfaced as a spurious
'Failed to navigate' browser_error even though the page landed fine.
Treat ERR_ABORTED like offscreen-browser-backend already does: resolve
with the page's actual URL/title. Every other loadURL failure still
fails closed.
* fix(browser): settle replacement navigation after abort
* fix(browser): clean up aborted navigation destruction race
* fix(dashboard-popout): zoom the pop-out window, not the main window behind it
The View menu's zoom handlers always sent terminal:zoom to the main
window, so zooming while the dashboard pop-out was focused zoomed the
window behind it. The pop-out also never applied the persisted
uiZoomLevel, so it always rendered at 100% in a zoomed app.
The pop-out now applies uiZoomLevel on dom-ready and follows app-zoom
changes while open (main-window zoom, settings control, mobile ui.set).
Menu zoom routes to the pop-out when it is the focused window, stepping
its own webContents zoom, and a narrow before-input-event handler
resolves the zoom.in/out/reset chords (honoring keybinding overrides)
since the pop-out has no renderer-side shortcut plumbing. The step/clamp
constants move to shared/ui-zoom-level.ts so main and renderer share one
definition.
* fix(dashboard-popout): isolate window zoom
* fix(dashboard-popout): deny unused permissions
* docs(dashboard-popout): clarify wheel zoom path
* fix(dashboard-popout): wire terminal copy/paste in the popped-out window
The Edit menu's Paste is a custom item that routes Cmd/Ctrl+V to the
focused window as ui:appMenuPaste, and only the main window's React root
listens for it — the popout dropped it, so paste silently did nothing.
The copy chord similarly resolves in the main window's before-input-event
handler, which the popout window never registers; the menu's role:'copy'
no-ops on xterm's empty hidden textarea.
AgentTerminalPreview now subscribes to onAppMenuPaste (guarded on focus
inside the preview) and pastes via terminal.paste(), which xterm flags as
user input so the existing preview->PTY routing and main-process input
limits apply. A custom key handler honors the terminal.copySelection and
terminal.paste keybindings, skipping plain Mod+V since the menu
accelerator owns that chord (handling it twice would paste double). The
popout bootstrap fetches keybinding overrides so custom bindings apply.
* fix(dashboard-popout): harden terminal clipboard routing
* fix(dashboard-popout): authorize terminal clipboard text
* test(dashboard-popout): harden terminal paste coverage
* fix(terminal): normalize streamed paste newlines
* fix(dashboard-popout): forward macOS IME native-text commits in the preview terminal (#9771)
* fix(dashboard-popout): forward macOS IME native-text commits in the preview terminal
The preview terminal enables xterm's kitty keyboard protocol (via
buildDefaultTerminalOptions), whose encoder can encode and cancel a
printable keydown before Chromium commits the real IME/native text —
silently dropping macOS input-source commits and synthetic Unicode
injection. Main-window panes guard this with the IME native-text
forwarder; the pop-out preview never installed it.
Install the composition tracker + forwarder (macOS-only, mirroring
TerminalPane) and claim native-text key events at the top of the
preview's custom key handler so the committed glyph reaches the PTY via
terminal.input() and the existing user-input routing.
* fix(dashboard-popout): prewarm IME input source
* fix(skills): preserve released history across new tags (#9778)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(skills): record latest Linear release history (#9777)
---------
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
---------
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(settings): stop mislabeling a WSL default shell as PowerShell
The Terminal settings shell toggle coerced a stored `wsl.exe` default to
`powershell.exe` for display, so a WSL default (set in onboarding) showed
"PowerShell" selected and wrongly surfaced the PowerShell-version options.
Drop the coercion and surface WSL as a disabled, already-selected segment
when it's the active default, so the control reflects the real shell. WSL
stays non-selectable here because choosing it needs a companion distro that
only the onboarding step configures; wiring a full WSL picker into Settings
is left for a deliberate design pass against the per-project runtime model.
* test(settings): cover persisted WSL shell display
* fix(codex): count per-account homes in usage and state removal blast radius
- usage scanner now includes codex-accounts/*/home/sessions so multi-account
usage is no longer silently undercounted (audit F2)
- account-removal dialog copy now states that session history and MCP logins
are permanently deleted with the managed home (audit F1 mitigation)
* fix(codex): harden account usage discovery
* feat(linear): add MCP-style save issue
* fix(linear): harden save issue parity
* fix(linear): close save issue contract gaps
* docs(linear): bundle project discovery with save issue
* feat(settings): link Linear capabilities pane to Integrations settings
The Agent capabilities -> Linear pane installs the orca-linear skill but
gave no path to where the connection itself lives. Add a link to the
Integrations settings pane, where connected Linear workspaces and API
keys are managed.
* refactor(settings): move Integrations link to bottom of Linear pane
* refactor(settings): drop icon from Linear Integrations link
* feat(status-bar): add tooltips explaining Detailed vs Compact usage modes
The Detailed/Compact density picker in the usage popover named both modes
but didn't explain what they change. Add hover tooltips via a new optional
`tooltip` field on SettingsSegmentedControl's options (no behavior change
for existing segmented controls).
* reword usage tooltips + add zh/ko/ja/es translations
Detailed: drop 'in the status bar'. Compact: 'Condensed usage: only the
tightest window'. Translate both keys into all locales via the repo's
translate+repair policy.
* test(status-bar): wrap UsageRosterPanel renders in TooltipProvider
The new segment tooltips use Radix Tooltip, which requires an ancestor
TooltipProvider (present in the real app at App root). Wrap the test
renders to match, fixing 3 failures.
* i18n(usage-tooltips): fix zh/ja mistranslations of 'full usage'
The zh/ja 'Detailed' tooltips read as an imperative ('make full use of
bars/labels/percentages') instead of the intended noun ('full usage
shown with ...'). Correct to the usage-status noun, align ja Compact to
使用状況 (not 使用法/how-to), and drop a stray trailing period in es.
* chore(skills): regenerate skill bundle manifest for release-tag drift
New release tags cut since the manifest was last committed appended
orca-cli snapshots (releaseRevision 33→35). Append-only regen — released
history is preserved; only unblocks the verify:skill-bundle-manifest gate.
* i18n(usage-tooltips): polish zh Compact tooltip wording
The zh Compact tooltip read like an instruction ('only use the tightest
window'). Reword to a descriptive summary parallel to Detailed. Keep the
'tightest = highest-usage window' meaning (getTightestUsageSection picks
max usedPercent) rather than CodeRabbit's '最短/shortest', which would
misdescribe it as the shortest-duration window.
* fix(source-control): keep commit generation entry point visible
* fix(source-control): translate and clarify generate button visibility
Translate Chinese-language comments to English and improve clarity
around the showGenerate logic: config errors surface in the generation
dialog, and the Create PR flow owns generation state to prevent stacking
spinners.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Fix Linear skill-install modal CTA hierarchy
Remove the redundant 'Not now' button from the Linear agent-skill
install modal and make Install the filled primary action, matching the
other setup surfaces (filled primary + muted dismiss).
'Not now' was doing exactly what the dialog's × already does (session
snooze via onOpenChange), but styled as an outline button in the
footer-right CTA slot it read as the primary action over Install —
which itself was only an outline button buried in the panel body. Users
reflexively clicked the dismiss.
- Drop 'Not now' + its unused onSnoozeForSession prop / i18n key (all locales)
- Add opt-in installVariant to AgentSkillSetupPanel (defaults 'outline';
settings surfaces unchanged) and pass 'default' from the Linear modal
- Update tests to drive the session snooze via the dialog ×
* Keep 'Not now' as the safe dismiss; demote 'Don't show again' to a muted link
This modal auto-opens unsolicited (first activation of a Linear-linked
worktree with the skill missing), so the reflexive dismiss must be
non-destructive. Removing 'Not now' left the permanent 'Don't show again'
as the only labeled footer button — the reflexive target — which would
nuke a useful prompt forever.
Restore 'Not now' (session snooze) as a quiet ghost — the easy, safe
dismiss, matching Neil's original ask ('not now is fine, just not the
CTA'). Demote 'Don't show again' to a muted text link so permanent
suppression takes intent. Install stays the filled primary.
Restores onSnoozeForSession wiring + notNow i18n key (all locales);
tests exercise the Not now snooze path again.
* Remove 'Not now' from Linear skill-install modal; × handles session dismiss
Per product call: the modal is typically reached by clicking 'Set up' on
the reminder toast (an opt-in), and the dialog's × already dismisses for
the session. Drop the redundant 'Not now' button. Footer keeps only the
quiet muted 'Don't show again' (permanent opt-out); Install stays the
filled primary.
Removes onSnoozeForSession wiring + notNow i18n key (all locales); tests
exercise the × (Close) session-snooze path.
* Move permanent opt-out to an EyeOff icon next to the × (matches SetupGuideModal)
Replaces the footer 'Don't show again' link with a quiet EyeOff icon
button beside the dialog ×, matching the house pattern for hiding a
setup/teaching surface (SetupGuideModal, StatusBarUsageEmptyCta,
SetupGuideSidebarEntry). The footer is gone entirely, so Install is the
only labeled action; the two 'make it go away' controls (× = for now,
EyeOff = never) sit together and neither is a tempting text button.
- Rendered last in the branch so initial dialog focus lands on Install,
not the hide button (Enter-on-open must not permanently dismiss).
- Wrapped in a local TooltipProvider so it works outside the app's global
provider (isolated tests/mounts).
- Reuses the existing dontShowAgain i18n key for aria-label + tooltip.
- Tests locate the control by aria-label now that it has no text.
* Align EyeOff hide icon with the × (top-3 not top-3.5)
The icon-xs button is 24px tall vs the bare 16px × close, so its centered
icon sat 2px low. top-3 lines the two icon centers up (measured pixel-exact
in the running app).
The card column-move uses the View Transitions API, whose snapshot
pseudo-elements render in the browser top layer — above any z-index,
including the terminal dialog's z-50 Radix portal. So a card morphing
columns briefly flickered over the open terminal.
Skip the view transition while the terminal dialog is open; the card
just settles into its new column under the dialog (which covers the
board anyway) instead of animating on top.
Pin the large-QR grid track to a shared size token so long under-QR copy
(relay-degraded notice) cannot max-content the auto column and collapse
the pairing step to one glyph per line. Constrain the QR stack for wrap
and lock the layout contract in tests.
* fix(rate-limits): unstick Claude "Limited" usage and feed live usage from session statuslines
The OAuth usage endpoint's 429 Retry-After (~50 min) was ignored, so the
30s-15min automated retry lanes kept landing inside the throttle window and
the status bar stayed on a bare "Limited" indefinitely while Claude itself
worked fine.
- Respect Retry-After on 429: carry it through usageMetadata.retryAtMs and
gate automated refetches (activation lane, poll cycles) until it expires;
user-directed refreshes still bypass.
- Keep the last-known usage snapshot visible through rate-limited windows
(24h) instead of dropping it after the generic 30-minute stale threshold.
- Add a managed Claude statusLine command that forwards each session's
rate_limits (Claude Code >=2.1.80) to a new /statusline/claude loopback
route, feeding live usage windows with zero usage-endpoint calls; OAuth
polling pauses while the live feed is fresh. User-owned statusLine
settings are never overwritten.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(rate-limits): keep last-known window when a statusline post carries only one
Statusline payloads may report five_hour and seven_day independently; a
partial post must not wipe the other bar to null. Also document the
seconds-vs-ms epoch heuristic.
Addresses CodeRabbit review on #9617.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(rate-limits): unstick Claude usage with live statusline feed
The OAuth polling endpoint is rate-limited; Claude's status often shows
"Limited" until the next poll cycle, even when quota remains. Live posts
from the statusline command update usage within 100ms, eliminating false
"Limited" displays during active sessions.
Manages install lifecycle via marker to respect user deletions. Handles
Windows payload buffering and guards before curl spawn. Protects against
live-post/OAuth-fetch races and cross-attribution during account switches.
Gracefully tolerates schema drift in statusline parsing.
* test(rate-limits): assert stale outgoing post doesn't affect incoming
Capture usedPercent before ingesting and assert it remains unchanged,
rather than checking for a specific value. This is more precise and less
brittle when testing session switch isolation.
---------
Co-authored-by: Dzmitry Bachko <dbachko@users.noreply.github.com>
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(editor): fail safe when rich-markdown reconcile throws
commitRichMarkdownSerialization called reconcileSerializedMarkdown with no
guard. Its three callers all assumed the only failure was editor teardown —
which commit already handles internally (didSerialize:false) — so their empty
`catch {}` (debounced onUpdate, flush) and missing catch (Cmd+S shortcut)
actually only ever swallowed, or crashed on, a genuine reconcile throw.
When reconcile threw, the Cmd+S path crashed uncaught, and the debounced/flush
paths dropped the draft update silently — leaving editorDrafts stale and
stalling auto-save with no UI signal (the auto-save half of #9158/STA-2027,
diagnosed by @klay7w).
Make the shared choke point degrade to canonical `edited` on any reconcile
throw — the same fallback reconcile already uses internally — so no path can
crash or silently lose content; worst case is a canonical-style save (#6080).
The two remaining catch blocks now log instead of swallowing so an unexpected
serialize failure can't be invisible.
The multi-byte crash that was the known trigger is already fixed (#9642); this
hardens the shared path against any future reconcile failure.
* fix(editor): preserve source EOL on reconcile fallback
* perf(runtime): gate PTY path-candidate extraction on mobile-connected
The 3-regex path extractor ran on every PTY chunk of every session for a mobile-only consumer. Now gated behind a sticky mobile-connected flag; first onReady synchronously backfills candidates from the retained 64KB window per original chunk boundary (lazy safety-net fallback). ~28.5us/chunk (~99.8%) saved on the desktop-only hot path; mobile parity preserved (Tier-1 raw-window read unchanged + backfill before any file RPC). 5-round review converged 2-consecutive-clean; independently verified tsc+902 tests.
Co-authored-by: Orca <help@stably.ai>
* fix(runtime): guard path-candidate activation on the remote runtime proxy
MobileSocketWiring.onReady called this.runtime.activateRecentPtyPathCandidateTracking() unconditionally, throwing on the E2EE/remote proxy (which lacks the method) and breaking the remote runtime connection (CI verify failure). Guarded with optional chaining (runtime-rpc.ts:900) — activation is a local-host concern. Mutation-verified E2EE-proxy regression test. Integration test + 3 typechecks green.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(mobile): route graph-sync snapshot fanout through the notify coalescer
syncWindowGraph no longer unconditionally re-serializes+fans every worktree's mobile snapshot to every client. Serve-hydrate fast path skips the build-then-drop loop when no serve-owned pty exists (desktop case); changed-worktree gating (strict superset of snapshot inputs) routes only real changes through the existing coalescer. No-op syncs 720->0 emits; single-worktree churn 720->120 (~83% fewer bytes to phone). Real changes still propagate. 11-round GPT-5.6-Sol xHIGH review converged 2-consecutive-clean; independently verified tsc+830 tests.
Co-authored-by: Orca <help@stably.ai>
* fix(mobile): bump snapshotVersion on preserved prune frames + carry split-group layout
Pre-merge adversarial review found two stale-phone regressions: (1) preserved-headless snapshots did not bump snapshotVersion, so a pruned-but-serve-preserved worktree change was dropped by clients' same-epoch freshness gate (orca-runtime.ts:22316); (2) serve-only no-op hydrate dropped the phone's split-group layout (orca-runtime.ts:3731). Both fixed + mutation-verified regression tests. 3 typechecks + suites green.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(native-chat): add reconciliation to catch missed transcript updates
Periodic reconciliation catches file changes that fs.watch may miss on
remote filesystems. Event-driven drains use a bounded max-wait timer to
ensure responsiveness. Extracts timer logic into a scheduler module for
testability and maintainability.
* fix(native-chat): add reconciliation to catch missed transcript updates
Detects same-size file rewrites and native watcher failures by reconciling
transcript state even when fs.watch events don't fire. Extracts watcher
binding into a dedicated module that gracefully degrades to
reconciliation-only mode when native watch is unavailable. Adds test
coverage for watcher rebind failures, parent-directory replacements, and
unsubscribe races.
* Document transcript watcher reconciliation contract
Clarify that bind() is best-effort with reconciliation fallback,
invalidate() detaches from stale identities, and the caller's polling
loop owns transcript liveness. Supports resilience on remote filesystems.
* fix(github): prevent unscoped work item queries
* fix(review): translate non-English rationale comment to English (client.ts:1151)
Restores the English '// Why:' convention and re-states the allSettled partial-results rationale that was dropped when the comment was replaced. Flagged by Ce-code-review (maintainability/previous-comments) and a prior PR reviewer. No behavior change.
Co-authored-by: Orca <help@stably.ai>
* fix(tasks): surface repos with no resolvable GitHub source
Since #9660 an unresolvable GitHub source returns an empty null-source
envelope instead of an unscoped search. That empty was indistinguishable
from a genuine zero-result query — no log, no telemetry, no UI signal.
Surface it in the Tasks list: a per-repo info row with Retry for each
fetched repo that resolved neither an issue nor a PR source (told apart
from genuine-zero and not-yet-fetched purely via the cached `sources`).
Renderer-only — the signal was already threaded through the envelope.
- selectTaskPageUnresolvedSourceRepos selector (+ unit tests)
- per-repo row reusing the existing banner region + handleRetryIssuesFetch
- suppress the generic empty state while those rows show
- assert the null-source envelope contract in client-work-items test
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
The Checks panel polls window.api.pty.getCwd every 4s to follow the active
terminal's cwd. It was gated only on panel visibility (isPanelVisible), not
window visibility — so a hidden or minimized window kept spawning lsof on macOS
every 4s (the 4s cadence exceeds getCwd's 1.5s per-pid cache TTL, so every tick
is a guaranteed miss and a fresh subprocess).
Swap the raw window.setInterval for installWindowVisibilityInterval — the shared
helper every sibling timer already uses — which pauses while the window is hidden
and runs an immediate refresh on becoming visible so a cd made while hidden is
picked up on return. A visible-but-unfocused window (second monitor) keeps
polling, matching prior behavior.
Co-authored-by: Orca <help@stably.ai>
* feat(dashboard): open-worktree dialog control + finished-time parity
Pop-out agent dashboard polish:
- Terminal dialog: replace the footer Close button with the standard top-right
X, rename the primary action from Focus worktree to Open worktree, and prefix
it with an open-in-window icon.
- Card time column: finished agents now read time-since-finish (matching the
left worktree sidebar) instead of time-since-start. Extracts the sidebar's
finished-timestamp logic into a shared helper so the two surfaces cannot
drift, and threads finishedAt through the dashboard snapshot contract.
* fix(dashboard): thread finishedAt through payload validator + test fixture
CI typecheck caught a DashboardCard fixture in dashboard-payload-validation.test.ts
missing the new finishedAt field; also validate finishedAt in the relay guard.
* feat(dashboard): swap pending-question emoji for MessageCircleQuestion icon
The amber pending-question chip used a raw hand emoji (renders differently
per-OS and off the design system); use the lucide chat-with-question icon.
xterm.js has no bold-color theme slot (upstream xtermjs/xterm.js#6032), so the Bold Text override was silently dropped — a false affordance. Makes the Settings copy and the Ghostty importer honest that it isn't applied yet, while preserving any persisted value for a future real implementation. No terminal-rendering change.
Closes#8595
Orca spread its whole process.env into every spawned terminal, so a dev build leaked NODE_ENV=development into integrated terminals (breaking next build, Vitest, etc.). Strips the inherited value at all three PTY-spawn sites (daemon, local provider, relay); a value the user sets themselves still wins.
Supersedes #9058, which patched only the relay path and so missed the reported (local daemon) repro.
Closes#9057
Co-authored-by: John Debay <john@debay.net>
The code editor was hard-wired to the terminal font, so Nerd Font 'Mono' CJK glyphs overlapped in the editor. Adds an opt-in editorFontFamily setting; default is empty so the resolved value is byte-identical to today for every existing user.
Closes#9628
xterm's Linkifier only re-runs providers when the hovered cell changes; window blur fires mouseleave which clears the current link but leaves the cell cache, so on refocus with a stationary pointer the link stays dead until a scroll. Adds the same guarded hover-cache reset the reveal/on-write paths already use, to the window-wake path.
Closes#9116
In compact worktree-card mode, two Radix HoverCard roots shared one open-state boolean, causing an open/close flicker loop when hovering the Live Ports plug. Un-shares the control so each hover owns its own state.
Closes#9304
* fix(sidebar): attribute spinner-only pane titles to the launched agent
A braille-spinner terminal title proves activity but carries no agent
identity, so the title-derived sidebar row resolver dropped it. Agents
without working status hooks — Codex over SSH (#8711) — only ever emit
spinner+cwd titles, so their worktrees showed no agent row at all while
Claude (hook-backed) rows appeared.
Fall back to the tab's launch identity (tab.launchAgent) for
spinner-only titles, mirroring the precedence the hook-row path already
uses. Explicit title identity still wins, Claude-specific prefixes
(✳ / '. ' / '* ') are unaffected, and panes without launch metadata
keep the existing no-row behavior.
* test(sidebar): pin spinner fallback no-launchAgent gate; note split-pane residual
Adds a regression test asserting a spinner-only title with no tab launch
identity produces no row, pinning the `launchAgent ?? null` gate that the two
existing tests do not exercise. Expands the fallback comment to record why it is
spinner-gated (vs the hook path's unconditional launchAgent fallback) and the
split-pane braille-title residual.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
Brennan Benson
github-actions[bot]
OrcaWinandBrennan Benson
fsdwen
余辉andJinjing
NeilandOrca
Cal
