* feat(wsl): stop an idle WSL hook relay so its distro can stop
Once no bridge terminal is left in a distro, the hook relay was the only thing keeping the
distro (and the WSL VM's memory) running, for as long as Orca ran. After 5 minutes with no
bridge terminal and no hook traffic the relay now stops, detached first so recovery never
restarts it, and its config is parked; the next terminal or agent in that distro starts it
again. Nothing new starts a relay, so nothing boots a distro.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): a WSL terminal of unreported distro keeps every hook relay
Review of #35173: a WSL shell whose spawn reported no distro (an older daemon) still uses the
default distro's relay, so it now counts as presence for every distro rather than none.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): a hook relay stays while the daemon still runs a bridge session in its distro
Review of #35173: after a relaunch, a hidden worktree's or headless tab's bridge session is live
in the terminal daemon though no pane in this run noted it, and orchestration, automations or
mobile may wake its agent. Before an idle stop the relay now asks the daemon's own session
inventory; a live session there, or an inventory it can't vouch for, keeps the relay.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(sidebar): switch workspaces on mouse press instead of click
A plain primary mouse press on a sidebar workspace row now activates it; the click that
ends the same press is skipped. The ~80-120 ms a press is held before release hides the
switch, so the new workspace is usually painted before the button comes up.
Modified presses, touch and pen, nested controls, rows inside a multi-selection, kanban
cards and keyboard-forwarded clicks keep click activation.
* test(sidebar): drop wall-clock cache stub from press activation test
* fix(sidebar): keep press activation off drags that wake, resume or close the board
A press-activated switch now keeps focus in the new terminal: the press's native mousedown
no longer moves it to the workspace list. Presses fall back to click activation when the
target would be woken (sleeping workspace or agent session, slept VM, disconnected SSH),
outside the terminal view, on selectable text, and while the workspace board is open, so a
row dragged onto the board no longer closes it. The skip-the-next-click flag now ends with
its gesture instead of surviving a drag-suppressed click.
* fix(sidebar): keep press activation off hosts a focus could boot
Switching workspaces focuses the row's host: a stopped WSL distro boots on focus and a recipe
VM resumes on activation, both before a press is known to be a drag. A press now activates only
on a proven-ready host (local, an SSH target, a WSL host reporting ready, a connected paired
runtime), resolved from the row's own host so folder workspaces and host twins match; recipe-VM
targets and unknown hosts keep click activation.
* fix(sidebar): activate on press only for local workspaces
Remote hosts can connect, boot or resume when their workspace gains focus, and the
focus subscribers resolve a workspace by bare id, so a twin or an SSH folder row could
still reach a remote host from a press that becomes a drag. Press activation now needs
the row's own host and the id's owning host to both be local; every SSH, WSL, runtime
and VM workspace keeps click activation.
* fix(sidebar): keep click activation while a text field has focus or a terminal would respawn
* fix(sidebar): keep click activation for workspaces without a running terminal; leave focus to the list when the press moved none
* fix(sidebar): keep a multi-selected folder row's press for the group drag
* fix(sidebar): drop the pre-press focus reference when the gesture ends
* fix(sidebar): keep click activation while a menu or dialog is open
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(browser): retire passkey account requests with their documents
* test(browser): fold passkey document-retirement coverage into the picker suite
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(session): a managed host's old SSH rows no longer replace its runtime workspace on reload
On a desktop that still catalogs a host's pre-managed-server SSH repo, startup
adoption let the old ssh: partition supersede the runtime partition's rows for
the same workspace. Its editor tabs and split were dropped, and stale closed
tabs came back on every reload. Workspaces a runtime partition holds are now
foreign to SSH adoption; the SSH rows stay parked in their own partition.
Moves the SSH partition catalog attribution into its own module unchanged
apart from the runtime-owner check, to stay under the file line limit.
Fixes#34376Fixes#34416
* fix(session): only an SSH host's own server supersedes its old SSH rows
Treating every runtime-held workspace as foreign to SSH adoption broke the
contested gap-fill for unrelated hosts that share a bare workspace id. Limit it
to the managed or SSH-tunnelled server running on that same SSH host, which
startup now learns from the runtime environment list.
A workspaceDir of "~/..." was never expanded, so it resolved relative to
each repo and worktrees were created under <repo>/~. Expand a leading ~
when settings are loaded and on every settings write, and share the
expansion with the floating-workspace path resolver.
Co-authored-by: Neil <neil@stably.ai>
* fix: retire extension frame listeners with their document
* fix: snapshot extension owner before native destruction
* refactor(extensions): keep listener registry within its line budget
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The legacy Compact card-property migration returned the Compact preset even
when the stored list already was a current Compact preset, so every clean
reload of a Compact profile scheduled a full profile write. Treat both the
raw ['status'] and the normalized ['status', 'unread'] form (persisted by any
UI write) as already migrated.
Fixes#34828
Co-authored-by: Neil <neil@stably.ai>
A background hooks:check refused for a stopped WSL distro now says so (unavailable:
'wsl-distro-stopped'). The setup-script prompt maps it to a distro-stopped state: the card hides
instead of showing 'Couldn't verify…' with a Retry that cannot succeed, and focus re-inspects, so
the card returns once the distro runs. An unverifiable distro stays a retryable error.
* fix(wsl): never boot a terminated distro off a list taken while it was still stopping
WSL keeps listing a distro for a moment while it stops. A bridge pane's exit now marks its distro
as possibly stopped, its host-loss verdict and boot-id reread only count a running list started
after that settles, and deferred background work (file watcher and hook relay restarts, history
cleanup, CLI repair) is drained only by a settled list. Before, a bridge exit's own list could
read 'running' mid-stop and lead to a boot-id exec, and any confirmed list probed mid-stop
drained deferred restarts that spawn wsl.exe, booting the distro the user had just terminated.
* fix(wsl): gate the hook-relay restart and setup-script inspection on a settled running read
- A deferred hook-relay restart re-reads a settled running list right before spawning the relay
(wsl.exe), and waits again if the distro stopped; a drained deferral is only a hint.
- Setup-script import-candidate inspection (sidebar prompt, runtime RPC) opens nothing under
\\\\wsl.localhost while the distro is stopped or unverifiable: those UNC opens booted it about 2 s
after each terminate on the awin verify.
* fix(wsl): close a pane's clean exit at once, and settle the guest-process fast path
- A bridge pane's code-0 exit is the user's own (a terminate gives -1): it now closes at once,
with no stop mark, settle wait or running-list read. Non-zero exits keep the E9 discipline.
- readWslGuestPaneProcesses' fast path for a live pane (Sleep, quit) trusts the cached running
list only when it was probed after any stop of the distro settled.
- When a mid-stop list skipped deferred work, one unref'd probe just past the settle drains it,
instead of waiting on an unrelated probe.
* fix(wsl): mark a clean bridge exit as a possible stop, and fix the exit check test's probe timing
A code-0 bridge exit still closes at once, but now also marks its distro as possibly stopped, so
an in-guest poweroff or wsl --shutdown that exits 0 cannot leave background reads trusting an old
running list. The coalesced-probe test waits for the probe, which now starts after the settle
anchor, before answering it.
* fix: preserve successor plugin panels after renderer loss
* test(plugins): drop redundant panel lifetime control test
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(electron): target persisted UI broadcasts to main renderer
* test(ui): use a supported top-level view in broadcast regression
* test(ui): collapse UI broadcast routing tests into one wiring check
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
hooks:check takes an optional background flag. The sidebar setup-script prompt and the setup
guide's progress probe, which run on render, pass it: on a stopped or unverifiable WSL distro
the check answers status 'error' without opening orca.yaml over \\\\wsl.localhost, which would boot
the distro. Launch preflight and settings, user acts that start the distro anyway, are unchanged.
When the pinned Bun binary is installed but its version probe times out,
required typecheck callers (repo typecheck, CLI build, E2E and mobile
typecheck) now report the timeout with the executable path and budget
instead of claiming Bun is missing. Each caller suggests its own compiler
fallback. Optional Bun consumers keep returning null and falling back.
Fixes#33707
Co-authored-by: Neil <neil@stably.ai>
run-use --takeover-legacy on an ordinary (non-legacy, non-adopted) Run
hit the takeover authority gate first and told the caller to repair
terminal authentication, even though the flag can never apply there.
Only require takeover authority when the target is legacy, missing, or
the adopted Run, so ordinary Runs reach bindRun, which keeps the caller
and worker fences and rejects the flag before any binding changes.
Fixes#30779
Co-authored-by: Neil <neil@stably.ai>
Pass --literal-pathspecs to the per-file diff in collectAddedLineRanges so
filenames containing glob characters (e.g. `[ab].tsx`) match only
themselves instead of also pulling in other files' hunks (e.g. `a.tsx`).
Covers both edits and renames with real-Git regression tests.
Fixes#34784
Co-authored-by: Neil <neil@stably.ai>
On awin a wsl --terminate exited each bridge pane with -1, while exit and exit 0 gave 0, so a
terminate never yields 0. A clean exit keeps today's verdict without the extra wsl.exe spawn.
Co-authored-by: Claude <noreply@anthropic.com>
resolveSimulatorUdid matched the first device whose name contained the
requested name, so asking for "iPhone 17" could attach an earlier
"iPhone 17e". Prefer a case-insensitive exact name match first, then fall
back to the existing substring/UDID match.
Only srcset is a comma-separated candidate list; src and href hold one URL.
Splitting them invented missing targets for paths containing commas or
spaces and could pass a missing target whose fragments were tracked.
Fixes#34815
* perf(terminal): release hidden WebGL canvases' drawing buffers
Chromium keeps a display:none WebGL canvas's drawing buffers alive (on macOS
a back buffer plus up to four pooled full-size surfaces). Hidden terminal
tabs and retained worktrees therefore held ~80 MB of GPU memory each until
they were parked. Collapse the canvas backing store while it has no layout
box and keep the context; xterm's device-pixel observer restores the size
and redraws synchronously on reveal.
7 terminal tabs, 1920x1050@2x: GPU process 670-760 MB -> 350-408 MB.
* perf(terminal): free hidden canvases only after 30s and never for suspended worktrees
Reallocating the backing on reveal cost about one frame. Delaying the release keeps rapid
switching allocation-free, and worktree-suspended panes keep their backing so worktree
switches match main. A MutationObserver re-checks a canvas that xterm resizes while hidden.
* fix(terminal): restore released WebGL canvases before the reveal frame paints
- Reveal restore reallocates at the current DPR and draws past xterm's paused
renderer inside the ResizeObserver callback, so the first painted frame has
content; also covers engines without devicePixelContentBoxSize.
- DPR repair reports released canvases as 'released' (current) instead of
'deferred', so window-resize recovery stops retrying them.
- Veto release for panes of a hidden worktree surface (marked from
isWorktreeActive) instead of webglAttachmentDeferred, which a hidden
prewarm clears.
- Schedule release for canvases attached or regrown while already boxless;
a zero-size element gets no initial ResizeObserver entry.
- Clear the timer through the canvas's own window.
* test(terminal): guard hidden WebGL canvas release and reveal restore
* perf(terminal): restore a released WebGL canvas at its exact device size without a full resize
Set the backing to the reveal entry's device-pixel size (xterm's own fallback
size where that box is unavailable) and draw once, instead of handleResize:
xterm's device-pixel observer then finds nothing to resize, which removes a
second reallocation and redraw from the reveal. A DPR change while hidden
still takes the full resize path.
* fix(terminal): paint a revealed released canvas through a held synchronized-output frame
A released canvas has no last coherent frame to keep, so when a TUI holds DEC
2026 at reveal, the buffered refresh left it blank for up to xterm's 1s
watchdog. Use forceFullViewportPresent, which draws the current buffer once
directly; the TUI's sync end still presents its finished frame normally.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
When git status failed (e.g. a corrupted index), the read returned an empty
result and Source Control said the workspace was clean. getStatus now carries
Git's error as an optional readError; the store keeps the last known entries
and conflicts while it is set, and the panel shows a status-read banner with
Git's message and Retry instead of the clean empty state. The Retry logic is
shared with the too-many-changes banner, and the per-worktree error is cleaned
up on teardown and migrated on worktree rename.
Fixes#28033
Co-authored-by: Neil <neil@stably.ai>
Follow-up to #35050 review: a pane spawned after a running list saw its distro stop, but before
any bridge exit reached the adapter, could take the old boot's id. The identity now drops the
distro's cache on a stop observation, listening only while bridge panes live. The relaunch
suite waits on the daemon reaping the session rather than assuming it is synchronous.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(files): page a remote server's big folders in the explorer
* fix(files): list a remote folder whole unless the host refuses it as too large, then page it
* fix(files): page a remote folder after a cursor entry, not at an offset
* fix(files): release expired folder listings, share one in-flight listing, keep an oversized one alone
* fix(files): cap and time out cached folder listings, bound the cursor name, match id: selectors
On Windows/Linux, window-all-closed quit unconditionally. A hidden browser
extension native page (content-script restore) destroyed before the first
main window existed emitted window-all-closed and quit the app mid-startup.
Gate the quit policy on the main window having opened at least once.
Fixes#34911
* fix(terminal): a WSL bridge pane keeps its session when its distro is booted again before the check
A bridge exit that the running list calls 'running' is now host loss when the distro's boot id
changed since the pane spawned (something booted it again first), and an unanswered list is asked
once more before the exit stays an exit. Boot ids are read once per distro boot, only into a
distro the background-work gate confirms running, so the read never boots one.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): an exit drops the distro's boot id at once, and a new incarnation takes the current one
Reviews of #35050: a pane spawned during another pane's exit verdict, or the same session
respawned into a rebooted distro, kept the old boot's id, so its own later exit read as
'rebooted' and its tab never closed. A burst of exits now shares one read of the current id,
and the verdict log names the exit code.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): a stale bridge exit drops the boot id, and the respawn that beat it re-reads its own
Co-Authored-By: Claude <noreply@anthropic.com>
* test(terminal): wait on the exit, not the clock, in the bridge relaunch suite
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(orcad): qualify a bundled slot once per unchanged host instead of every launch
Every bundled orcad launch ran a second full orcad-server.js process (the startup preflight)
before serving: 0.7-1.4 s after a WSL distro restart. Once a launch with the same key reaches
readiness, the slot records a marker; the next launch with that key skips the child. The key
covers the artifact version, each installed file's stat identity, the runtime identity, Node
version, libc and kernel. The marker is consumed at startup and rewritten only after readiness,
so a launch that fails or crashes before readiness re-qualifies; it is written via temp + rename,
and any read, parse or write problem falls back to the preflight.
* perf(orcad): keep running the startup preflight on Windows
There the child also proves the process identity table, which depends on host services rather
than on the slot's bytes.
* docs(wsl): note when the version GC memo can leave a stale dir behind
* fix(orcad): harden the startup qualification marker
- A failed preflight child deletes any marker, so a concurrent launch cannot rely on it.
- Only managed slots (launched with the managed activation root, as for the compile cache)
outside process.resourcesPath ever read or write a marker.
- The key fingerprints NODE_OPTIONS, LD_PRELOAD, LD_LIBRARY_PATH and TMPDIR as orcad sees them.
Chats with an explicit mode showed a disabled 'Permissions' placeholder whenever no running agent had reported, which is every idle or resumed chat, so the mode could not be read or changed. A live report still wins; chats that follow the agent's own settings still wait for the report.
* perf(wsl): read the kernel, login home and platform in one exec
The WSL connect's first exec now prints the kernel release, $HOME and the marker-backed uname
platform probe together, and hands the platform and home to resolveOrcadRemoteContext, which
then skips its own uname and $HOME probes: two fewer serial guest round trips per connect. SSH
passes neither, so its probes are unchanged.
* fix(wsl): accept the folded host facts only in their exact shape
Each fact now prints after its own marker, and the output is used only when it has exactly the
kernel line, the home line, the blank separator and the platform line. Anything else (stdout
noise, a HOME containing a newline) falls back to reading the kernel alone and lets the context
probe the platform and home itself, so no truncated path is ever used.
R39 follow-up. When one Orca's Remove kept the server for another, that other
Orca's later Remove must tear it down once the first is gone. The test covers
it end to end on a real server: kept while both are connected, still kept
inside the first Orca's 60-second reconnect grace, and no peers after it.
* fix(wsl-move): say a moved project's host was kept for another Orca and needs re-adding
When this Orca removed a WSL host while another Orca kept its server running
(R39), "Use on this computer again" refused with the generic "the host isn't
answering, connect it or remove it". Neither works, because the host is
already removed here. It now says: "<project> moved to the <distro> host, which
is still running for another Orca. Re-add the host to use it here again."
* i18n(wsl-move): German for the kept-host undo copy
mobile/ is a separate pnpm project, so the root pnpm install leaves
mobile/node_modules empty and pnpm build failed in build:mobile-web with
hundreds of unexplained esbuild "Could not resolve" errors.
build-mobile-web-app-bundle now checks for mobile/node_modules first and
exits with the one command that fixes it. The probe path is shared with
the bundle tests' dependency check. CONTRIBUTING documents the install in
Local Setup and points "Before Opening a PR" at it.
Fixes#24324
Co-authored-by: Neil <neil@stably.ai>
* fix(wsl-host): give phone, resume and fork agent launches the Windows-only refusal
* fix(wsl-host): hint the Command setting on required-CLI refusals
* fix(wsl-host): refuse explicit resumes of a Windows-only CLI with the fix-it message
Idle retirement (last-client disconnect, initial-adoption timeout, ownership
loss, and shutdownIfIdle) skipped onShutdownRequested(), so a stalled resource
disposal left the daemon alive with no five-second exit deadline.
Fixes#29406
Co-authored-by: Neil <neil@stably.ai>
OrcaWinandOrcaWin
NeilandClaude
berceandNeil
Vyacheslav ScherbininandNeil
Blue DaydreamingandNeil
Henry SuandNeil
BingZ
Samuel VilaandNeil
Brennan Benson
Oleksandr SuvorovandNeil
TotoroandNeil