A complete XTVERSION reply is delivered immediately (past the daemon shell-ready gate) and echo-filtered like colour/private-DSR replies, so fish's startup XTVERSION reply no longer leaks into Codex's composer. Fixes#16489. Supersedes #16491.
Co-authored-by: Luis Urrutia <3771248+LuisUrrutia@users.noreply.github.com>
The daemon records each terminal's spawn pane key and reports it in session listings; the sleeping-agent activation gate uses it as an exact-match fallback to find a live agent PTY after the host re-keys its tab, so paired clients and phone wake no longer start a duplicate `claude --resume`. Fixes#21235, #24385. Supersedes #24386.
Co-authored-by: Minidoracat <11269639+Minidoracat@users.noreply.github.com>
Orca-driven Codex launches that type their prompt after start (workers, automations, continuation/handoff, pane-spawn and other submit-after-ready flows) pass `-c check_for_update_on_startup=false`, so Codex's "Update now" screen can't block them or be accepted by Orca's Enter. User-typed launches and resumes are unchanged. Fixes#15814, #18153. Supersedes #18156.
Co-authored-by: luisgonzaleznf <47302972+luisgonzaleznf@users.noreply.github.com>
* chore(lint): remove disable directives that suppress nothing
Each was reported unused by the oxlint config that owns its rule (root,
casting, react-doctor, anti-slop, native-plugins), including 17 file-level
react-doctor blanket disables whose rule no longer fires. An unused
react-hooks disable was masking a react/purity finding in
useAgentBucketCounts (compiler rules skip functions with hook
suppressions); suppress that one explicitly where the code explains it.
* test(tab-bar): use typed tab/file fixtures instead of @ts-expect-error partials
* chore(lint): fix misc suppressed lint violations instead of disabling
- consistent-type-imports: the "vi.importActual requires inline import()"
rationale was wrong; use typed vi.mock(import(...), importOriginal) or a
type-only namespace import.
- no-control-regex: source-control commit/push failure summaries, shell PATH
hydration, and ipynb ANSI parsing reuse the shared ansi-escape-sequences
stripper and control-character pattern instead of private copies.
- no-explicit-any / no-useless-spread / no-this-alias: typed `this` in
bridge test mocks, drop blanket file-level disables, drop a this-alias.
* refactor(main): replace avoidable type assertions with checked narrowing
17 production cast suppressions in main/wsl-guest removed: untrusted IPC
and RPC payloads (Jira issue update, WSL guest plugin install, handshake
type) now narrow through isRecord/type guards and build typed results;
redundant casts dropped; hand-rolled object checks and errno casts use the
existing isRecord / hasErrorCode helpers.
* refactor(renderer,mobile): replace avoidable type assertions with checked types
13 production cast suppressions removed: RPC failures read through the
`ok` discriminant instead of casting to RpcFailure; react-native-web host
refs narrowed with instanceof HTMLElement; redundant reply/diff casts
become checked annotations; the TUI agent param uses z.custom(isTuiAgent)
like its sibling schemas; the agent-status slice cast that hid missing
actions is gone so the creator's return type checks the whole slice.
* chore(lint): drop dead tiptap wrapper; scope anti-slop mocking rule to test support
- safe-react-node-view-renderer patched handleSelectionUpdate, which
@tiptap/react 3.31.3 no longer has, so it always returned early. Use the
stock ReactNodeViewRenderer.
- The anti-slop test override only matched *.test.{ts,tsx}, forcing
file-level no-module-mocking disables in test harnesses and fixtures.
Match *-test-harness, *-test-fixture(s), .test-fixture and *.test.mjs,
then drop those disables and the now-redundant per-file exemptions.
* test: replace repeated cast suppressions with typed fixtures (main/shared/e2e)
Net -119 cast directives. Typed fixtures replace recurring casts:
unusedSshConnection/unusedOrcadHostTransport placeholders, a typed
readPersistedState harness read (exposed a test treating optional
httpProxyUrl as always set), real Response objects in fetch spies, an
updater main-window fixture, a CDP webContents adapter, one shared
releaseModuleExport for cross-version tests, and requireOverlayDir in
place of `as string` on possibly-undefined overlay paths.
* fix(runtime): validate loaded device rows and host scope instead of casting
Two cast suppressions claimed checks that did not happen:
- device-registry-file-read: "normalizeLoadedDeviceRow re-validates every
field" was false; deviceId, token, name and timestamps were never
checked. Rows without an identity are now dropped and the file is set
aside through the existing corrupt-file path (registry reads as
doubtful, so no revocation verdicts); a non-string token is stripped
so the row stays listed but cannot authenticate.
- client-ui: "only optionality differs" was false; any string reached
persisted workspaceHostScope. Narrow it with isWorkspaceHostScope and
ignore unknown scopes (wire schema unchanged for mixed versions). The
remaining cast now states what it actually covers.
* test(runtime,ipc): drop redundant cast suppressions; typed runtime store fixture
-98 cast directives across runtime/ipc tests: 61 casts that typecheck
without the assertion; a typed vi.fn for scoped invalidation; a
partialRuntimeStore fixture in place of `store as never` for
OrcaRuntimeService; typed worker terminal/authority builders in the
incarnation-fallback suite (the old stub lacked runtimeId, ptyId,
worktreeId and launchTokenHash) plus removal of stacked duplicate
directives there.
* chore(lint): typed vi.mock imports and explicit listener snapshot in shared-bucket tests
Remaining files from the misc-rule pass that overlapped other buckets:
codex-accounts mocks use the typed vi.mock(import(...)) form instead of
a consistent-type-imports disable; the daemon late-exit fixture copies
its listener set with Array.from instead of a no-useless-spread disable.
* refactor(github,mobile): narrow routing settings type; drop remaining avoidable casts
- work-item-routing cast a one-field object to AppState['settings'] under
a claim that readers only consume activeRuntimeEnvironmentId. Return the
existing RuntimeFocusSettings pick instead and narrow the cache-key
chain's parameters, so the compiler enforces that claim.
- mobile file preview reads refusals through the RpcResponse `ok`
discriminant rather than a cast.
- terminal document host-notify accepts `unknown` errors, removing the
message-bridge cast.
- native chat readability drops a redundant repo-list cast.
* test(renderer): replace repeated cast suppressions with typed fixtures
-140 cast directives (and ~150 unsuppressed casts of the same shapes):
- mockPanePtyArgs owns the connectPanePty fixture casts, so a wrong
argument order or fixture is now a type error; drop binding casts for
members PanePtyBinding already declares.
- Seed AppState tab rows with the typed makeTerminalTab; this exposed a
split direction 'row' that is not a TerminalPaneSplitDirection.
- Partial GlobalSettings use getDefaultSettings overrides; Jira-only
stores use createTestStore; runtime environment rows/statuses come from
a typed paired-runtime-environment fixture.
* chore(lint): drop no-module-mocking disable now covered by the test-fixture glob
* test(e2e): fix all 221 grandfathered e2e type errors; baseline to zero
The e2e typecheck baseline grandfathered 221 errors in 119 files. About a
third were tests drifted from the current API, several of which would
fail or mislead at runtime:
- terminal-shortcuts called a nonexistent xterm buffer method;
- the daemon-lifecycle fake lacked terminateOwnedTree, hidden by importing
its type from a module that does not export it;
- arguments in the wrong position (listProcesses(hostId, opts), a dropped
pty.write inputKind, an extra toWebTerminalSurfaceTabId argument);
- removed enum values ('drawer', 'idle', 'editor',
'session-insecure-origin') and a launch_source the telemetry schema
rejects;
- missing required fields (turnScope, childWorkOpen, providerIdentity,
reviewLookupOutcome, runtimeServiceAccount behind an `as RelayConfig`);
- dead reads (tab.customTitle, bucket.targets, changedPixels).
Also lifts variables that narrowed to `never` after poll-callback
assignment, and adds a typed xterm render-dimensions accessor. Includes
the cross-version suites' shared releaseModuleExport adoption.
* chore(typecheck): gate the now-clean e2e typecheck in local lint
The e2e baseline is empty, so the ratchet now rejects any tests/ type
error. CI already runs it via run-ratchets; add it to pnpm lint's
explicit ratchet list and replace the stale 'not yet clean' note.
* test(mobile): typecheck every mobile test; baseline 105 files -> 0
mobile/tests-typecheck-baseline.txt grandfathered 105 test files (531
errors) whose types CI never checked. Contract changes had landed without
these tests following, and type pins in them silently checked nothing.
- Root cause: salvagedOptional (src/shared/zod-salvage.ts) cast away
zod's optional marker, so every reply type built on it claimed
salvaged fields were always present. Return a real ZodOptional;
runtime is unchanged (the outer optional short-circuits undefined).
- Production now takes the port it uses: RpcOperationSender instead of
RpcClient for send-only callers, a narrow fetch signature, and only the
request fields push-receive reads.
- findAllByHostType/findByHostType replace `'Text' as never` lookups;
stubRpcClient gives tests a typed RpcClient.
- Real test bugs: settings-host-client-lifecycle "relay" hosts were
direct hosts (relayHostId no longer exists); two toEqualTypeOf pins
could never hold; a recovery hook ran with an undefined scope key;
a create-PR test cast to a never-imported type; "no URL" assertions
passed on null; plus stale required props, args and enum values.
* test(e2e): parse workerStart result instead of casting it
* test(runtime): typed partial runtime stores with production-shaped fixture data
Route every partial store passed to OrcaRuntimeService through
partialRuntimeStore with typed row builders, removing 60 cast directives
that hid fixture data production never produces:
- paired-client-navigation-test-harness keyed setWorktreeMeta writes by
`[object Object]` (it took an id where the store takes a target), so
reads never saw them;
- invalid worktree lineage origin/capture and incomplete workspace lineage;
- getWorkspaceSession returning null where the store returns the default
session; getGitHubCache returning undefined;
- orcad migration states missing migrationId/manifest/receipt, with a
toEqual pinned to that incomplete shape;
- partial repos, metadata, folders, project groups and notification rows.
* refactor(renderer): resolve suppressed React hook lint instead of disabling it
109 of 187 react-hooks/react-doctor suppressions fixed:
- ~95 exhaustive-deps disables only hid stable refs and setters passed
through controller objects; list them (identity never changes, so
nothing re-runs), plus a few real stale closures (tabId/worktreeId).
- Effects keyed on one value that read the latest props now use
useEffectEvent (WebConnect, skill freshness, Bitbucket dialog seeding,
Landing preflight, automation catalog, structured-session recovery,
file explorer).
- The conditional layout-owner hook is selected once at module load from
the build constant instead of a rules-of-hooks disable that also hid
the whole controller from compiler and react-doctor rules.
- A hook disable was masking a react/purity Date.now() in the palette's
recent-tabs memo; sample it when the snapshot is captured.
- Three identical debounced-search effects share
useTaskSearchDebouncedApply; layout snapshot merge helpers move out to
stay under max-lines.
Remaining suppressions are mount-once resources, invalidation epochs,
deliberately keyed fields, and test harnesses that mock the dispatcher.
* chore(ratchet): exempt test harnesses and fixtures from the focus-read ratchet
The ratchet skipped *.test-fixture.ts but scanned *-test-harness,
*-test-fixture(s) and *.test-support files. Those seed settings with
getDefaultSettings (which the ratchet discovers as a focus reader) and
never route host work, so 17 baseline entries were false positives, and
replacing a test's `settings: {...} as never` with typed defaults tripped
it. Match the repo's test-support names and prune (which also drops one
stale entry), and rename the frame-ordering harness to *-test-harness like
its siblings. A blanket "-harness" match would also exempt
e2e-terminal-pty-harness, which production imports, so the names stay
explicit.
* test: merge duplicate shared/constants imports
* revert(file-explorer): restore original tree load effects pending SSH e2e investigation
* test(runtime): drop RuntimeStore cast now that the fixture is typed
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Devin launch prompts are delivered as argv (`devin [flags] -- '<prompt>'`, Devin's documented interactive-prompt form) instead of typed after start, where they were lost before Devin was ready. Fixes#26302. Supersedes #26387.
Co-authored-by: ggbdpq <67929842+ggbdpq@users.noreply.github.com>
Claude AskUserQuestion with option previews: Orca's ask answers now send digit (focus wiggle for option 1 with a note), optional `n`+note, then Enter, since a digit only moves the highlight in Claude's preview layout. A bare digit on a preview question no longer clears waiting. Fixes#16865.
Co-authored-by: Frederic Barthelemy <209712+fbartho@users.noreply.github.com>
* fix(editor): add bounded Zig syntax highlighting
Recognize .zig files and load the existing pinned Shiki Zig grammar through
the lazy TextMate provider. Map its scopes to stock Monaco theme categories
while preserving the shared tokenizer state and per-line bounds. Keep .zon
and formatting outside this lexical-only change.
Reuse the optional scope-mapping hook reviewed in Haskell PR #25411 and
its refreshed candidate 12908d0341,
retaining the original contribution credit from #25315. Ship the existing
grammar package MIT notice in renderer public assets for desktop and web.
Requested by @thinkAfCod in issue #11313. This addresses highlighting only;
it does not close the formatting portion of the issue title.
Co-authored-by: davidwis <davidwis000@gmail.com>
* fix(build): serve Zig grammar notices through allowed assets
Move the unchanged Shiki notices beneath assets/ and reference both files
with relative HTML metadata links. Preserve reverse-proxy prefixes and let
the existing projection and serving allowlists accept the browser client.
Do not expand either allowlist.
Exercise real Vite output, projection, manifest validation, and static HTTP
serving at root and /orca paths. Follow the relative-assets notice strategy
used by the coauthored Haskell adaptation and retain its contribution credit.
Co-authored-by: davidwis <davidwis000@gmail.com>
* test(editor): verify Zig source and diff highlighting
* chore(editor): drop Zig grammar notice assets
Zig grammar comes from the existing shiki dependency (already shipped via
syntax-highlighter's bundled-language loader), so no separate notice is needed.
---------
Co-authored-by: davidwis <davidwis000@gmail.com>
Pi: a finished answer followed by Pi's own threshold compaction is announced (done/unread) when the compaction starts instead of waiting for it to end. Skipped when follow-ups are queued; the settle post still ends the row. Refs #33267 (idle-compaction case unchanged).
* fix(runtime): a pane's new process does not wear its previous run's Done (STA-12043)
* fix(runtime): keep the superseded turn's segment and date process start at spawn request
* fix(runtime): take the identity row's segment from the turn clients were shown
A CSI scan now stops at ESC/CAN/SUB (as xterm's parser does), so a hidden-startup carry ending mid-CSI no longer swallows the next OSC's introducer and leaks `104;255` onto the prompt. Fixes#31410.
Co-authored-by: Neil <neil@stably.ai>
Claude tool events from agent-hook runs (`hook-agent-<uuid>` ids, which never send SubagentStop) no longer mint phantom "Working - Agent" subagent rows. Fixes#27775. Supersedes #27776, #15326.
Co-authored-by: DamHV <251416543+DamHV@users.noreply.github.com>
Fold a standalone copy of the leading spinner frame in agent titles (Codex 0.155–0.163 `⠙ renaming... ⠙ | x`) so the title tracker stops republishing session tabs every 100ms. Fixes#27598. Supersedes #27599.
Co-authored-by: outof-place <69466055+outof-place@users.noreply.github.com>
Claude's hook script refills ORCA_PANE_KEY / ORCA_AGENT_LAUNCH_TOKEN from the scrub-safe aliases when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB strips them, so scrubbed Claude panes report status and resume again. Fixes#31832. Supersedes #31834.
Co-authored-by: David De Smet <2607383+daviddesmet@users.noreply.github.com>
* fix(agent-status): keep Codex /side threads from taking over the pane after a restart
The /side guard keyed on transient caches (the parsed rollout and the
listener's own row), so after an Orca or relay restart a side thread's
hooks claimed the pane and its Stop showed the pane finished while the
main turn was still running. Decide by the stored row's thread instead,
on the execution host and again when a relayed hook arrives.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): recognise Codex side threads on the execution host only
Record ephemeral forks from their own SessionStart and fall back to the stored row's thread, so the host keeps dropping /side hooks across restarts without a desktop rule that cannot tell a fork from a new conversation.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): keep a running Codex turn when a relay restarts mid side chat
A relay that restarts during a /side chat has lost the fork's SessionStart, so the desktop keeps a running main turn against the rest of that thread's relayed hooks. Any relayed SessionStart still passes, so a new conversation can replace the row.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(ssh): move a managed tunnel off an unbindable saved local port
When the saved local port of a managed SSH server's tunnel can no longer
be bound (EADDRINUSE from another listener, or EACCES from a Windows
excluded port range), pick a free port, save it with the pairing and the
deployment link together, and build the tunnel again. The pairing, server
identity, remote port and projects are unchanged.
A move interrupted between its sidecar and store writes reads the moved
port from the stored endpoint, so the deployment link is never dropped.
Fixes#33182
Co-authored-by: SahilZ0810 <sahil@zamp.ai>
* test(e2e): drop squatter connections so teardown never waits on them
* fix(ssh): move the tunnel port before pairing repair and retire old transports
Move outside buildWithPairingRepair so a refusal on the moved port is
repaired against the revision the move saved, and retire transports and
status owners still dialing the old port, as a repair does.
* fix(ssh): refresh maintenance pairings on the current tunnel port
Update, rollback and restart reread the deployment's local port when they
save the new pairing, since the census before them may have moved it.
* fix(ssh): let concurrent tunnel builds follow a port another caller moved
---------
Co-authored-by: SahilZ0810 <sahil@zamp.ai>
* fix(runtime): stop paired desktops republishing mirrored editor tabs
When two desktops pair both ways, B mirrored A's editor tabs and then
published them in its own session inventory as if B had opened them. A
then applied B's copy, which took over A's own tab.
isMobilePublishableOpenFile now skips rows marked
mirroredFromRuntimeSession, the marker is part of the open-files sync
projection so a flip republishes, and the marker is saved with the
session and restored so a relaunched client does not republish its
restored mirrors before the host's first snapshot.
Based on #25877 by BearMett.
Co-authored-by: BearMett <agomdole@gmail.com>
* fix(runtime): keep restored mirrors through unpublished frames and out of headless publication
A restored mirror now carries its marker, so an unpublished host frame
must not cull it (and its recovered draft). The windowless publication
skips persisted mirrored rows for the same reason the window does.
Co-authored-by: BearMett <agomdole@gmail.com>
---------
Co-authored-by: BearMett <agomdole@gmail.com>
* test: exercise mobile controller and strengthen audit assertions
* test: use array syntax required by React Doctor
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(git): preserve unmerged branches with no net file changes
* fix(workspace): show launch actions in empty tab groups (#32182)
* fix(workspace): show launch actions in empty tab groups
* fix(workspace): resolve empty-pane browser policy by owner
* Scope daemon inventories for safe worktree teardown (#32171)
* Fix scoped daemon inventories without changing terminal input routes
* Serialize daemon owner inventory refreshes safely
* Serialize daemon owner inventory refreshes safely
* test(daemon): protect baseline inventory budgets and recovery
* fix(daemon): clear route proof during synthetic exits (#32196)
* docs: condense test anti-pattern guidance (#32201)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor: colocate repository draft input and tests (#32155)
* test: consolidate discovery coverage and replace copied oracles (#32211)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: retire copied oracles and implementation inventories (#32206)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: remove classification inventories and verify settled boundaries (#32216)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: keep explicit regressions without legacy algorithm copies (#32218)
* test: keep explicit regressions without legacy algorithm copies
* test: use Number.NaN in latency fixtures
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* ci: avoid slow Ubuntu mirrors during WebKit setup (#32205)
* ci: reuse bounded Ubuntu mirror setup for WebKit
* ci: preserve Ubuntu setup for dispatched older refs
* perf(renderer): scope runtime connection and parking subscriptions (#32199)
* fix(chat): allow visuals to declare open without breaking scripts (#32226)
* fix(native-chat): keep queued messages in the chat's own record, so a refused one can't be skipped (#30418)
* fix(native-chat): a refused queued message still blocks the queue when its card write fails
Every reader of a queued card goes through one derived view of the journal's dispatch facts,
so a card whose message was refused reads as returned even when its card-table update and heal
both failed. One decision and one writer store the derived state for every action.
* refactor(native-chat): keep each queued message in the chat's journal, not a second table
A queued message lived in its own SQL table, and a hook that may be skipped copied
each refusal from the journal into it. When that write failed, a refused card
vanished: the cards behind it sent, and its Send and Delete did nothing.
Each queued message is now a `queue` row in the chat's journal beside the
submission that hands it off and the dispatch row that answers it. The reducer
folds the card from those rows, so a refusal returns the card and holds the
cards behind it with nothing written, and replay reads the same. Every action
writes its own rows in one transaction. Cards an earlier build stored are read
through the same classification until they move: each action moves its own
card, and a bulk import runs once per open. A new epoch restates every card
still owed an answer in the transaction that deletes the old rows.
The settlement hook and its savepoint, the open-time heal, the drain's heal and
the derived-card view are gone. The published card list is unchanged.
* test(native-chat): adapt the queue tests to cards kept in the journal
Cards are written through the journal, so tests queue them with their body
alone and hand them off under their real fingerprint. Tests of the removed
settlement hook, heal and SQL store are deleted; the text-update spec now
covers the edit decision alone, and a test of an earlier build's stored holds
seeds the legacy table and reads the imported cards. Rolling over an epoch now
keeps a card whose hand-off was never handed over, so that test checks the
retried id never sends rather than that nothing sends.
* test(native-chat): a refused card holds the queue through rewind, a new epoch and a restart
One whole-flow test through the host: the refusal writes no card row, a rewind
that retires the refused hand-off and a rolled-over epoch keep the card
returned, a restart and Resume send nothing behind it, its own Send refused
again still holds the queue, and its Delete releases the next card in order.
* test(native-chat): an earlier build's queued cards move into the journal once, each read the same
One mixed-import test through the host. The first open's import fails and
moves nothing, yet every card reads as it will; Delete and Send each move only
their own card. The next open moves the rest in one transaction, writing a
refusal only where its hand-off is gone, nothing for answered cards, and leaving
an unreadable row on disk. A later command turn spends a moved command card, a
third open writes nothing, an old Delete replays from its receipt, and a chat
with only answered legacy rows clears them in a delete-only transaction.
* test(native-chat): adapt typechecked tests to cards kept in the journal
The row-kind table lists a queue row, the clear and legacy-import tests
match the current signatures, and the downgrade test keeps only the
leftover-send case: a queued card is now a newer-version journal row an
older build keeps read-only, and users don't downgrade.
* refactor(native-chat): drop the journal row writer's unused transaction hook
No caller passes one since the queue's savepoint bookkeeping left.
* test(native-chat): downgrade probes write rows at the version older builds read
The highest version this build reads is now 4, the queue row's. A newer
build's row in these probes is written at version 3 so the older build
meets its kind, not a newer version, and the Stop-event probe hands the
older build the rows as stored, since a read raises each row's version.
* test(native-chat): unit tests follow the queue row's version 4
The legacy-import test opens real SQLite, so it runs in the Node runtime
project. The newest version this build reads is now 4, and a read raises a
row's version to it, so the turn-lifecycle test no longer pins the
in-memory version (the written one stays pinned by journalRowSchemaVersion).
* fix(native-chat): one batch echoing two refused queued messages spends both
The per-row delivery check returned only the first waiting card an echo
proved delivered, so when one settlement carried echoes for two cards the
second stayed waiting and was sent again. It now returns every card the
row proves delivered, and the fold withdraws each; replay folds the same.
* fix(native-chat): a rewind moves an earlier build's cards into the journal first
While the open's import had failed, an earlier build's card that read as
refused through its hand-off lost that reading when an in-place rewind
retired the hand-off: it disappeared and the card behind it sent. The
rewind now adopts every legacy card ahead of its tombstones and deletes
their rows in its own transaction, as an epoch replacement already does,
so the fold latches each card's reading before its hand-off is gone.
* fix(native-chat): keep an earlier build's card whose hand-off is still unconfirmed
The import dropped a legacy card handed off as a send whose delivery was
unknown, though the fold keeps such a card linked and a later refusal
returns it. The import now keeps every card whose hand-off a later row can
still answer, through the same check the reducer folds dispatch rows by.
* fix(native-chat): one delivery echo withdraws at most one queued card
One provider echo proves one delivery, yet it withdrew every waiting card
with the same text whose hand-off was refused, so a second identical card
was lost. The fold now pairs each echo with one card: on its own row the
earliest-positioned match no other echo of that row took, and for a card
that waits again the earliest applied echo no card has taken. Paired echoes
live in the fold's state, so live and replay pair the same; readers of
cards not yet imported work on a copy.
* fix(native-chat): a queued message handed to the agent is sent again only on proof it never got it
Pressing Stop after Orca handed a queued or steered message to the agent,
before the agent confirmed it, put the card back in the queue, and Resume
or the next send sent it again. A check matching the agent's echo of the
text was the only guard against a double send, and it kept trading a
resend for a lost card. Whether the card waited again was decided by the
rejection's category, not by proof the agent never got the message.
A refused hand-off now waits again only where Orca proves the agent never
received it: the host still held it, or whoever settled it recorded that.
A failure still returns the card and holds the cards behind it. Anything
else may have reached the agent, so the card is spent and its message
reads as sent, derived on every fold from the stored rejection: with the
turn it was answered into, as that turn's unconfirmed message where it was
handed over; withdrawn before any turn opened, as a person's own send a
Stop took back. The reopen mark ignores a recovered doubt, and the restart
reconciler no longer judges a queued hand-off unsent from what history
lacks. The echo text matching and its pairing are deleted.
A close or quit while the agent starts settles sends with the unrun hold.
The host hands nothing to a child before its start answers
(structured-agent-session-delivery-loop.ts: a handover needs phase
ready), so such a send went to an earlier child and may have run: it now
reads as sent instead of waiting again.
* fix(native-chat): Claude's report that it removed a queued message unrun lets the card wait again
Claude says when it removed a send without running it: the interrupt
receipt's cancelled list, or a command_lifecycle cancelled, discarded or
refused frame for a command that never started. Every one settles through
rejectClaudeDispatchWaiters, which now marks the settlement unrun. For a
queued card's hand-off the host records that as proof the agent never got
it, so the card waits again under the queue's pause. A direct send keeps
the plain refusal: there the proof would owe it as stopped history.
* fix(native-chat): an earlier build's card stopped after hand-over follows the same rule on upgrade
Earlier builds put a card back to waiting after any refusal without a
verdict and cleared its link, so a card the agent may already have would
be sent again after the upgrade. The card's own hand-offs in the journal
decide now: unchanged and last sent as one that may have reached the
agent, it is spent on that hand-off and its message reads as sent; edited
or sent again since, it is held for its own Send under a host-only marker
that publishes as a plain hold; with no hand-off in doubt, including one
that never left Orca, it waits as before. The import writes a card spent
on a hand-off in doubt, so its message shows.
* fix(native-chat): read a queued row's hand-off before the lookup that uses it
The lookup's callback lost the narrowing of the row's change, which the
mobile test typecheck rejects.
* test(native-chat): a card steered into a turn a Stop ends stays sent in the Stop tests
Three tests pinned the old rule, that a card handed into a running turn
comes back to waiting when a Stop ends it. Under the new rule nothing
proves the agent never got it, so the card is spent: with the turn named,
its message reads as that turn's unconfirmed one; without, as a send the
Stop took back. Neither is ever sent again.
* fix(native-chat): a queued message stopped before Orca handed it to the agent waits again
A Stop that aborts a hand-off after its row is written but before the agent call now records
the withdrawal as never reaching the agent, for queued hand-offs only, so plan D's rule returns
the card to waiting under the Stop's pause instead of spending it. Direct sends keep the plain
withdrawal (the flag would owe them as stopped history). The agent's own refusal while aborted
is kept rather than overwritten, and an abort thrown during the call stays in doubt.
* fix(native-chat): a queued message stopped while the agent prepares it waits again
The abort signal reaches only an adapter's preparation (its options, the previous turn opening),
never its write, so the signal's own reason thrown back is the adapter saying nothing was
written. The handover now reads that, for queued hand-offs only, as never reaching the agent,
so the card waits again under the Stop's pause. Claude no longer wraps that abort as an option
refusal, which had returned a stopped card as a refused one blocking the queue. A real refusal
keeps its cause and its barrier; any other throw stays in doubt and is never resent.
* test(native-chat): the usage-limit Continue backlog case writes its card through the journal queue
Main's #30396 wrote its backlog card with the stored fingerprint and host-instance stamp the
journal queue derives instead; the card the Continue must yield to is the same waiting card.
* test(claude): the real-CLI queued Stop expects the unrun mark Claude's cancelled-unrun receipt carries
* fix(native-chat): retain spent legacy messages when import fails
* Bound per-write chat selector work and guard ownership scans (#32109)
* Guard per-write chat selector work with shared ownership indexes
* Use checked sender session identities in the scale fixture
* Read each indexed tab row once during snapshot rebuilds
* Fix lexical binding and cache matching in selector lint rules
* Keep behavioral selector guards and resolve imported bindings
* Require selector binding definitions to declare functions
* Key performance subscribers by saved chat scope
* Show activity status with worktree-style counts (#26443)
* Show prioritized agent counts on the activity bell
* Move activity badge into the corner and shrink its count
* Use a fixed side column for activity status and counts
* Fix activity count spacing and status alignment
* Use worktree-style superscript counts for activity
* Keep activity count positions and update only number styling
* Keep idle layout fixtures out of active agent status updates
* Show child workspace statuses in the children toggle (#32224)
* Show child workspace status counts in lineage toggle
* Give child status summaries room and wrap narrow layouts
* Use solid working dots and keep child summaries on one line
* Restore children icon and clarify worktree tooltip
* Keep child totals clear of status counts in narrow layouts
* fix: preserve workspace review references when clearing active reviews (#32263)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Saving a file, then closing that tab mid-save, no longer leaves its other tabs looking clean (STA-11786) (#32259)
* fix(editor): settle a save's shared record when the saving tab closed mid-write
With one file open in two workspaces, closing the saving tab while its write was in
flight left the other tab's disk baseline, dirty flag, draft and loaded text on the
pre-save version: every completion step looked the closed tab up by id and found
nothing, and the saved event listed only the closed tab as the record's views. An undo
back to the old text then read as clean and closed without asking.
The write now captures its record id with no await before the write, and completion
(rebaseline, dirty/draft settle, conflict clear or refusal banner, saved event's view
list) goes through a live view of that record, preferring a writable one. The save
runner and the write-lock wait do the same, so a save queued by a tab that closes
still writes through the record's remaining view. The chat visual's saved-event
listener also falls back to the record's views.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): follow a closed saver's record through re-keys, kept records and listeners
Review follow-ups to the closed-saving-tab fix:
- Completion now finds the record through the view ids captured before the write,
not the record id: a re-key mid-write (an unpinned runtime tab resolving its
pairing) keeps views but changes the id, which brought the original bug back.
- A fallback writer (asking view closed while queued or waiting on the file lock) is
chosen like autosave/restart's writer: writable and on a current connection, so a
stale-connection sibling no longer throws when a current view exists.
- With no view of the record left, a kept record (no-prompt removal) is dropped when
the write saved its text, else rebaselined; other open views of the file (a
detached peer) take the written baseline, keeping their edits.
- A save may mark a record clean through a read-only or CSV-preview view (markFileDirty
`written`); such views still never become dirty.
- Markdown preview refresh and the CSV pending-cell listener match the saved event's
record views, not only the saving view's id.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(editor): name the closed-view save harness as a test fixture
The focus-read ratchet scans non-test sources; the `.test-fixture.ts` suffix marks this
harness as test-only like the repo's other fixtures.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(ci): list the closed-view save rig as a unit support bridge
The rig builds on the autosave test fixture, which takes the editor slice harness, so
the routing check saw it as a product consumer of that harness. Bridges are an explicit
list, like the browser drawn-from-main fixture.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Show task names for Codex subagents (#32243)
* fix: name Codex subagents from rollout metadata
* Hide generic default role in child agent rows
* Reject non-regular Codex identity transcripts without blocking
* [comment audit] Shorten preload comments (#32257)
* chore: audit preload root comments and track repository coverage
* docs: track repository comment audit coverage
* chore: keep comment audit tracker local
* chore: shorten preload API contract comments
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix: offload macOS deletion spawns and reduce branch cleanup (#32227)
* fix: reduce worktree deletion branch cleanup overhead
Refresh only the remote base branches needed to prove a branch merged, with automatic maintenance disabled. Skip merge simulation when no common ancestor is available and preserve the branch when its remote base cannot be refreshed.
* fix: preserve fetch mappings and live branch cleanup fallbacks
* fix: spawn macOS worktree deletion commands off the main thread
* test: remove redundant cases and start comprehensive value tracker (#32269)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(web): the browser client advertises the desktop's chat capabilities, so its host opens chats (#32253)
* fix(web): the browser client advertises the desktop's chat capabilities, so its host opens chats
The browser client's handshake never named agent-session.structured.v1, so a paired
host refused every agentSession call with structured_agent_session_unsupported and
withheld chat tabs. The desktop window, the Electron remote handshake and the browser
client now build their lists from one shared array of what the renderer's chat implements.
Fixes#32145
* refactor(web): keep the browser client's capability list beside the desktop's in shared
The host-side test parses both handshakes with the host's own parser, which the node
typecheck project can only import from src/shared.
* test(web): assert close-intent support in the auth frame, not the whole capability list
* fix(terminal): a timed-out CLI split names its pending pane, and a retry can never re-run its command (#32278)
* fix(terminal): a timed-out CLI split names its pending pane and can be retried without splitting again
Fixes#32169
* fix(terminal): a blank retry id or a closed pane never re-runs a split's command
* refactor(terminal): a split retry only waits for its pane and never asks the window again
* fix(terminal): a split missing from the graph is reported pending, never closed
* fix(ssh): never block or over-read on an SSH identity file (#32274)
Every place Orca reads an SSH key or identity file now goes through one
reader that refuses directories, FIFOs and devices (including through
symlinks) with a nonblocking open, and caps the read at 1 MB. An auth
failure now names any identity file that was skipped and why.
Fixes#31965. Reported by @Huge, who also proposed the first fix in #31966.
Co-authored-by: Martin Vlach <mr.huge@seznam.cz>
* test: finish fixture work before unit-test cleanup (#32285)
* fix(mobile): keep a terminal tab's chat identity while its handle is unchanged (#32251)
* fix(mobile): keep a terminal tab's chat identity while its handle is unchanged
A status frame that omits agentType or providerSession flipped chat back to the
terminal for tabs with no launchAgent (#31977), and left a launched tab with no
session to read (#32134). Mobile now remembers the last resolved agent and
session per tab and handle, so a missing field is treated as missing evidence.
* fix(mobile): keep remembered chat read-only and drop it on relaunch
A chat resolved only from this phone's memory may sit on a bare shell, so its
writes stay locked until live status confirms the agent. A live agent frame
without a session no longer inherits the previous conversation, and the
latest remembered agent outranks an older launch hint.
* fix(mobile): gate native-chat image sends on a confirmed live agent
An image send from a chat only this phone remembers could paste into a bare
shell; it now shares the confirmed-agent gate with text sends.
* fix(mobile): type remembered chat identity structurally
Importing MobileSessionTab into the eligibility module pulled React Native
globals into the e2e program through nested-agent-idle-session-owner.spec.ts,
retyping setTimeout as number there.
* fix(terminal): never present a half-built synchronized-output frame on reveal or recovery (#32281)
Settled reveal and every other atlas recovery forced the current xterm buffer
onto the screen even while a TUI held DEC 2026 synchronized output. Codex
erases rows inside each held redraw, so a reveal mid-redraw showed a blank
pane for a frame (#32198).
Viewport presents now have one mode: they keep the last coherent canvas and
let xterm present when the TUI closes the frame, bounded by xterm's 1s
synchronized-output safety timeout. Structural replay keeps its retained frame
up until an open synchronized frame closes, bounded by its existing hold cap.
Co-authored-by: YEONGUK LEE <contact@abruption.dev>
* refactor(renderer): colocate task page pagination rules (#32297)
* perf(test): bundle Zod once per isolated Vitest invocation (#32298)
* Use incremental tsrs locally and update Bun to 1.4.4 (#32276)
* Use incremental tsrs for local typechecks
* Update pinned Bun to 1.4.4
* fix(deps): bump dompurify to 3.4.17 and docs next to 16.4.1 for security advisories
dompurify 3.4.17 patches GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr and
GHSA-c6gr-qvv4-5v3f in the root and mobile lockfiles. next 16.4.1 patches
GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r in the
docs site.
* Prepare mobile bundle for smoke benchmarks
* Give native compiler benchmarks a larger ARM runner
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* test: trim redundant coverage and fix vacuous assertions (#32305)
* test: remove redundant cases and repair behavioral assertions
* docs: reconcile audit records with current main
* fix(deps): apply security updates from #32101
Apply the six-file DOMPurify 3.4.17 and Next.js 16.4.1 patch from PR #32101 to resolve the dependency security gate for this test audit. Original patch by Brennan Benson.
* test: satisfy changed-line quality gates
Add required braces and replace filter indexing with find. Rerun both CI quality gates and the 27 affected relay tests; refresh audit hashes and record the corrections.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(ci): retain ambiguous unit-test import consumers (#32366)
* test: exercise real boundaries and trim redundant cases (#32353)
* test: replace redundant checks with observed behavior
* docs: reconcile completed audit batches and upstream review
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(git): retain zero-net history with current merge-base guards
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Martin Vlach <mr.huge@seznam.cz>
Co-authored-by: YEONGUK LEE <contact@abruption.dev>
OrcaWinandOrcaWin
NeilandLuis Urrutia
Pr1p
mmarabel
Hoang Le QuocandNeil
