* Fix static analysis page stuck in loading state
- Bound check-details requests with 30s timeout, matching remote RPC budget
- Track request IDs to discard stale responses when context changes
- Propagate githubRepository through store and components for proper routing
- Add retry button for failed check-details loads
- Improve accessibility with ARIA labels for loading and error states
* Fix static analysis page stuck in loading state
When an open check-details tab's repository is removed, the loading
state would continue indefinitely because the fetch was still being
triggered. Prevent the fetch call in this scenario to unblock the UI.
Also migrates translation keys to obfuscated identifiers.
* Fix static analysis page stuck in loading state
Add deadline-based timeouts and request ID tracking to prevent stale responses
from freezing the checks panel. Include abort signal propagation throughout the
request chain and provide retry UI for failed check details loads.
* fix(checks): prevent loading state from getting stuck on retry
- Consolidate mount checks into a helper function
- Details now clear when a new request begins
- Add i18n strings for retry status
* fix(sidebar): close the workspace rename editor opened by the shortcut
The workspace.rename shortcut opened the editor with setEditing, while
every other transition went through setEditingMode, which also mirrors the
flag into editingRef and guards on it. After a shortcut-opened edit the ref
still read false, so Escape, commit, and blur all returned early and the
editor stayed on screen until the card unmounted. The borderless sidebar
editor gives no sign it is still live, so the row looked like a finished
rename.
The editing element also took its React key from the display name and the
unread flag. Neither is an edit, but both moved the key, so React remounted
the input and the ref callback re-ran focus and select over a half-typed
name. That half was never shortcut-specific: the double-click and hovercard
editors lost typed text the same way.
Remove editingRef so the editing state is the only source of truth, route
both entry points through a single openRenameEditor, and keep the key on
the rendered title where remounting is how truncation gets measured again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(sidebar): guard rename editor transitions
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <Jinwoo-H@users.noreply.github.com>
Every snapshot in a batch scanned the whole openFiles array three times and did
a linear find per editor tab, so a reconnect paid for open files those snapshots
never touched. Bucket open files by worktree for the duration of a batch, skip
the global rebuild when a snapshot has nothing to drop or mirror, and retarget
the index at the array each snapshot produced.
Per-snapshot semantics are unchanged: openFiles still flows through each patch,
so the equality bail is still evaluated per snapshot against the current array.
An earlier draft deferred that bail to the end of the batch, which let the batch
keep pre-batch file objects that sequential reconciliation rebuilds; the two
regression tests here pin both cases.
1,200 workspaces, 3,000 unrelated open files: no workspace with editors
99.7ms -> 3.1ms, 5% with editors 105.3ms -> 7.7ms. Where every workspace has
editors the array genuinely changes each snapshot, so the rebuild remains
(113.9ms -> 84.2ms).
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): unmount closed setup guide content
* fix(renderer): keep setup-guide progress live through the close linger
Dropping shouldRefreshCoreState on close disabled skill discovery and
computer-use permission state while the dialog was still fading out, so
'Agent capabilities' visibly un-completed mid-animation. Mirrors the
paletteStatusInputsActive guard from the worktree palette.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): unmount closed workspace cleanup content
* fix(workspace-cleanup): restore unconditional delete-state clear on batch error
The session extraction swapped the batch-level onError handler from an
unconditional clearWorktreeDeleteState to the conditional queued-only
helper. When the batch driver dies, nothing settles those rows later, so
a hung 'deleting' row stayed stuck in the sidebar and was permanently
excluded from retry by filterWorkspaceCleanupRemovalCandidates.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): index GitHub resume lookups
* perf(renderer): skip the resume cache sweep publication when nothing changed
Every eviction helper already returns its input reference untouched when it
evicts nothing, so the opening sweep in refreshAllGitHub can compare identities
and return the previous state. Window resume then stops waking every store
subscriber on a no-op sweep.
Folds in the remaining unique optimization from #13711, which this PR
supersedes on the lookup-indexing side.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): preserve unchanged remote mirror resources
* test(renderer): restore layout-value coverage and record the workspaceId dependency
Notes why browser page identity reuse is safe: browserPageEqual must keep
comparing workspaceId, since the removed-workspace page-list cleanup gates on
it. Also re-asserts the effective active leaf that the patch-only assertion
stopped covering.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): keep remote snapshot batches linear
* test(renderer): cover the prefix-colliding sibling worktree
The sibling-mapping test used a worktree id that shares no prefix with WT,
so it passed against the prefix-scan it was meant to pin. Use an id prefixed
by WT's and drain the new mapping index in the leak counters.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(dashboard): keep agent map rings open while the pointer works inside them
The project and workspace rings drove their hover styling from `:hover` on the
ring element itself. A ring is a sibling of everything drawn inside it, so the
style dropped the moment the pointer crossed onto a workspace or an agent, and
a pan drag killed it outright — pointer capture retargets `:hover` to the
`<svg>` for the whole gesture. Both read as the ring pulsing open and shut.
Move the trigger to the containing group, wrapped in `:where()` so the existing
`.is-open` / `.is-selected` / status rules keep winning the same properties, and
add `.is-held` for the pan, driven by which rings the press landed in. The hold
releases on the first move after the button comes up, when the browser
recomputes `:hover` in that same event, so the two signals never both read off.
Hovering a workspace now also always shows its name and agent count. That label
was gated behind the declutter pass, which suppresses any label overlapping an
agent — at fleet zoom that is nearly all of them, so hover revealed nothing. It
now bypasses declutter and draws in a layer above every project, so a
neighbouring ring cannot wash it out.
* fix(dashboard): complete agent map ring interaction lifecycle
* fix(terminal): skip a too-wide alt frame on snapshot replay
Reopening a parked worktree could paint a stale full-width TUI frame
through a narrower viewport, leaving clipped gutter fragments and
mid-word omissions until the live application repainted.
Replay pins xterm to the snapshot grid so soft-wrapped normal-buffer
history stays exact (#7279), then the post-replay fit returns the pane
to its container grid. Alternate buffers have no scrollback and do not
reflow; an absolutely positioned frame remains at its capture layout,
so narrowing exposes only clipped portions of those fixed-grid rows.
Skip only the visual frame when its capture is wider than the grid the
fit will land on. The alt buffer is still entered and cleared, so the
resize signal lands on a clean screen that the live application can
repaint. Equal-width and wider restores retain the frame, while normal
history always replays at its capture grid before fitting.
The target width comes from proposeDimensions, not terminal.cols: an
unfitted pane can still read xterm's default grid even when its actual
container matches the capture.
* fix(terminal): preserve offline SSH prepaint frame
* fix(terminal): drop a too-wide daemon alt frame on reattach
The renderer-only gate did not run on the user-visible remount path.
Instrumentation showed that daemon-connectResult-snapshot won before
the model-snapshot branches, so the composed snapshot painted in full
and the later narrower fit exposed its stale fixed-grid frame clipped
at the new viewport.
The daemon branch could not omit only the visual frame while main sent
one merged string. Publish the normal-buffer/mode prefix and visual alt
frame as additive optional metadata while retaining the merged snapshot
for mixed-version fallback. New renderers can keep history and restore
state without painting a frame captured for a wider grid.
Replay ordering remains capture-grid, write, then fit so normal-buffer
soft wrapping stays exact. The application owns the foreign-width alt
frame and repaints it after the resize signal rather than Orca trying to
transform an absolutely positioned screen.
* fix(terminal): preserve split daemon snapshot payload
* fix(terminal): preserve live state when dropping alt frame
* fix(terminal): restore DECOM cursor state exactly
* fix(terminal): preserve ordinary snapshot bytes
* test(terminal): cover fixed-grid alt replay resize
* fix(terminal): repaint after dropping mismatched frames
A hidden snapshot can omit an alternate-screen frame before the pane has a measurable target grid. If reveal later lands on the capture grid, a same-size PTY resize emits no SIGWINCH, so pulse the local PTY size whenever that frame was skipped.\n\nKeep performSafeFit's measurable-pane contract intact, publish daemon snapshot prefix and frame as explicit optional strings, and fall back to the merged payload when either field is absent. Cold owner-gone restores now omit a mismatched frame while retaining history and fresh-shell reset treatment; offline SSH preconnect remains unchanged.\n\nPin the vendored SerializeAddon out-of-range-row behavior used to capture live SGR state.
* improve automations page ui
* Improve automations page UI: fix menu interactions, extract components,
- Extract status cell to reusable component
- Fix portaled context menu clicks re-selecting rows
- Use explicit selection IDs instead of resolved objects for reliable detail state
- Close detail when selection is lost during refresh or deletion
- Improve escape key navigation through nested detail views
- Use native input for search field to avoid unwanted shadow elevation
- Add i18n keys for table and button labels
* fix: merge duplicate type imports in AutomationListLocalRows test
Static analysis fails under --deny-warnings when the same module is
imported twice; combine the Automation and external types into one import.
* Fix row keyboard activation to not intercept nested controls
Row handlers for Enter/Space were preventing the actions menu button from
opening when activated via keyboard. Extract a reusable check that only
treats these keys as row activation when they originate on the row itself,
not on child controls. Also consolidate the search input to use the shared
Input component for consistency.
* fix: use stable keys for automations page skeleton rows
React Doctor no-array-index-as-key failed static analysis on the
loading skeleton map. Give each static row an id for the React key.
* Reorganize i18n keys for automation components
Move translation keys to their proper component namespaces (rowActions to AutomationListLocalRows, normalize loading key), update all locale files.
* fix: move automations detail selection refs out of render
React Doctor fails CI when refs are mutated during render. Sync
selectedExternalKey and isDetailOpen into refs in effects instead.
* style: soften automation search field focus state
- Reduce focus ring opacity to 70% for a subtler focus indicator
- Set focus-visible:ring-0 to eliminate elevation effect
- Add dark:bg-background for consistent dark mode appearance
* fix(tabs): keep widths stable during title updates
* review(tabs): reduce the width rule to the definite width and harden its tests
Why: once the tab container has a definite width the shrink-wrapped strip never
has free space, so flex-grow and max-w-[280px] were unreachable and only
duplicated the 180/220 numbers across two properties. Measured widths, strip
scrollWidth and clientWidth are identical to the flex-based version across four
window widths, five tab counts and short/long titles.
Tests: pin the width classes literally so the guarantee cannot be edited away
via the constant, and guard the e2e check against passing vacuously on a
saturated strip.
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* feat(ai-vault): isolate scanning in service processes
* fix(ai-vault): retire idle service processes
* fix(ai-vault): discard unverified cache processes
* fix(ai-vault): clear relay sidecar cancel watchdog on acknowledgement
A cancelled relay call is settled before its 2s cancel watchdog is armed, so the acknowledgement path bailed out of settle() before clearing the timer. The watchdog then faulted a healthy sidecar two seconds after every aborted scan, killing whatever request had since become active.
* fix(ai-vault): clear the pending restart before scheduling another
recordFault overwrote this.timer, stranding a restart that dispose() could no longer cancel.
* refactor(ai-vault): drop the orphaned first-prompt IPC wrapper
session-first-user-prompt-handler.ts now owns this entry point and routes through the service; the copy left in the read module had no callers.
* fix(ai-vault): retry a faulted cold start before surfacing it
A slow first start surfaced a raw 'did not become ready' error to the caller even though the supervisor was already respawning. Requeue an unsent call once onto the scheduled respawn instead.
Also stop arming the cancellation watchdog for a call the child never received: no acknowledgement is coming, so it killed a healthy service and stalled the lane.
Invalidation bookkeeping and ready-waiter construction move to the state module to stay under the max-lines cap.
* fix(ai-vault): give relay title reads their own lane
Before this branch the relay read title files directly, concurrently with scans. Routing both through one sidecar lane put title resolution behind a list scan that may run up to 130s, so SSH tab titles could lag minutes behind.
Split cache and interactive lanes in both the relay client and the sidecar entry, mirroring the desktop service.
Also: clear the ready deadline on fault, so a sidecar that dies before ready cannot fault its healthy replacement five seconds later; retry an unsent call once across a respawn; and skip the cancellation watchdog for a call the sidecar never received.
Restart/circuit bookkeeping moves to its own module, mirroring the desktop policy, to stay under the max-lines cap.
* fix(ai-vault): degrade relay title resolution on sidecar failure
listSessions already returns a host issue when the sidecar is unavailable; titles propagated the raw RPC error instead. Return no titles so callers fall back to preview text, and keep cancellation propagating.
* fix(ai-vault): scrub the service child environment
The children are forked with a 384 MiB heap cap and no loader, but both
spawn sites handed them the full parent environment, so an exported
NODE_OPTIONS silently raised the cap or --require'd code into them.
Allowlist both, following the plugin worker. The desktop child keeps the
eleven agent-root overrides it resolves its own roots from; the relay
sidecar takes remoteHome and hostPlatform from its init message and so
needs none of them. Both children share one priority module while they
share this one.
* fix(ai-vault): soft-disable relay vault when the service is missing
A missing service threw out of the constructor, so a Vault wiring bug
would abort relay startup and take every PTY on the host with it. The
unsupported-platform branch three lines above already treats a Vault
failure as a soft disable; do the same here.
Threading the service through the two handlers instead of a field also
retires the definite-assignment assertion the throw was propping up.
* fix(ai-vault): drain consumed cache invalidations
invalidatedPaths was re-applied in every request's finally and never
drained, so once N paths had been invalidated every later request paid N
evictions for the life of the process; the 4096 cap only bounded how bad
that got.
The re-apply exists to cover a read that overlapped the invalidation, so
drain once nothing is executing. Clearing unconditionally would drop the
re-apply for a request still running on the other lane.
* fix(ai-vault): keep a busy child through slow invalidation acks
invalidate() reused the 5s ready budget as its acknowledgement deadline
and killed the child on expiry, so a delete issued during a large scan
could kill a healthy process mid-scan and burn a slot toward the restart
circuit.
Fault only when nothing is executing. Fork IPC ordering already puts the
invalidation ahead of any later request, so a busy child owes no ack
here, and the 130s/15s request deadlines still catch a wedged one.
The start-retry predicate moves to the state module to stay under the
line cap, matching the shape the relay client already uses.
* fix(ai-vault): report a failed local scan as a host issue
A local-scope scan let its error escape to the renderer, which paints it
over the session list. Service supervision now produces those errors, so
"AI Vault service restart circuit is open." replaced the list.
Route local scope through the degradation the all-hosts leg and every SSH
leg already use, so it lands as a retryable host issue row instead. Same
result shape either way, so no IPC or wire contract changes.
* test(ai-vault): cover the relay restart circuit transitions
The relay policy shipped without tests. Pin both circuit edges, the
aging-out case, the forced-refresh reopen the relay has and the desktop
does not, and the backoff schedule.
* fix(ai-vault): keep the OpenCode roots in the service child env
The scrubbed allowlist dropped XDG_DATA_HOME and OPENCODE_DB, which the child
reads to locate the OpenCode store and database. The pre-PR worker thread
inherited them, so a user who sets either lost every OpenCode session.
* test(ai-vault): anchor the service spawn env assertion
* fix(i18n): restore identifiers and commands machine translation localized
39 values in ko, zh and es are code rather than copy — shell commands, CSS
class strings, git-style identifiers, sample filenames and hostnames — and had
been machine-translated. pnpm install read pnpm 설치, text-foreground read
文本前景, pr-view read PR视图, and localhost:3000 read 本地主机:3000.
pnpm install is the font-mono placeholder of the setup-script input, and
gh auth login / glab auth login are the commands the integration panes tell the
user to run, so the translated forms are shown to users as text to type.
Catalog-only. Running repair-locale-catalog.mjs over these locales fixes the
same values but rewrites several hundred unrelated ones, because the catalogs
are stale against the current policy.
* fix(i18n): restore the zh code strings found by call-site context
@smwbev scanned by where a translate() renders — inside <code> or a font-mono
element — rather than by value shape, and found nine more in zh: upstream read
上游 in the base-ref picker, nbformat read nb格式, orca.yaml read Orca.yaml,
LIN-329 read 林-329, GH #1799 lost its space, and orca · zsh read Orca·zsh.
The matching NEVER_TRANSLATE_VALUES entries landed with #12934.
* test(i18n): guard restored technical literals
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(settings): widen font size input so values are fully visible
The number input for terminal font size was too narrow (w-14) to display
two-digit values cleanly. Changed to w-24 to ensure 10-24px values fit.
* fix(settings): hide the native spin buttons clipping the font size value
The overlapping webkit spinner was what cut off the second digit, not the
box width. Adopt the number-input-clean idiom every other numeric settings
input already uses; the spinner also duplicated the -/+ steppers.
* fix(settings): keep font size stepper compact
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Jinjing
Neil
Brennan Benson
Jinwoo Hong
bokjkandBrennan Benson
makoto-developerandBrennan Benson
闲人andBrennan Benson