* fix(computer-use): scroll, expand and set sliders on Windows without raising the window
* fix(computer-use): wait for Windows scroll and slider writes to settle before verifying
* fix(computer-use): reject NaN for Windows slider set-value
* test(computer-use): wait on the Windows fixture state with vi.waitFor and a schema
* test(computer-use): check activation per action against a holder window in the Windows fixture
* test(computer-use): log fixture window events for activation failures
* fix(computer-use): report foreground when a Windows app raises itself for a UI Automation action
WPF activates its own window for Scroll, ExpandCollapse, RangeValue and SelectionItem calls from any UIA client, so the runtime now compares the foreground window before and after a pattern action instead of assuming background. The Windows e2e checks delivery against the fixture's own activation count, with a holder window in another process.
* test(computer-use): skip an unstarted holder when closing the Windows fixture
* fix(computer-use): bound Windows pattern scroll paging and tighten slider read-back
* fix(computer-use): cap Windows slider read-back tolerance and run the UIA e2e only on CI
* feat(dictation): optional AI cleanup of dictated text, with a correction word
Off by default. When on, a dictation's text goes through the user's agent
CLI (the AI text actions' runner, Haiku by default for Claude) before it
lands: the pill says "Cleaning up…" and the text is inserted once. Failure
or a 10 s timeout inserts it as heard with a warning; the pill's X skips
cleanup. A consent dialog asks before text first goes to an agent. The
correction word ("scratch that") survives filler removal for cleanup to act
on. The microphone test gets "Try cleanup", and phone dictation the computer
transcribes is cleaned on the host.
* fix(dictation): keep finals that arrive during cleanup and tighten cleanup edges
* fix(native-chat): let a chat continue on the account you switch to after a usage limit
A usage-limit reset belongs to the account that hit it. After a switch the
host kept holding the chat until the old account's reset, and desktop and
phone hid Continue until then, so Switch Account on the card did nothing.
The host now releases the hold once the chat would start on another
account, letting only that account's own reading hold it, and publishes the
earlier continue time that both clients read.
* fix(native-chat): save the account a usage limit hit, per cut
The fallback to the chat's founding account could report a switch that
never happened for a chat that had already moved, releasing it before the
new account's reset. Save the cut's account while the child that ran it is
live, use only that, and key the switch time by the cut it belongs to.
* fix(native-chat): record the account each chat runtime launched on
record.accountHome names only the founding account, so after a switch
nothing said which account a usage limit hit. Owner proof now records the
account each runtime fence launched under, every host cut carries its
turn's fence, and the hold reads the cut's account from that pair. This
replaces the sweep's saved copy, which a fast child exit could miss.
Spending the new account showed before a switch now holds the chat until
its own reset; only a reading taken after the switch releases it.
* fix(native-chat): restart the switch time when the chat moves to yet another account
A second switch for the same cut kept the first switch's time, so a reading
of the newer account taken before it was chosen could release the chat.
The agent already has full thread data from selectedCommentGroups. Report
only the host-resolvable thread count in the human-readable section to
avoid duplicating thread bodies in the JSON payload.
* fix(computer): verify macOS type-text and paste-text sent as keys by reading the field back
When text can't be written through AXValue (Chromium/Electron fields, fields
that refuse the write), type-text and paste-text send keys or Cmd+V and always
reported unverified. Now the helper predicts the focused field's value from its
value and selection before sending, then reads it back until it settles:
verified on a match, unverified (text_mismatch) otherwise. Secure fields and
fields without a readable value and selection stay unverified as before, and
the result never repeats the typed text or the field's contents.
* fix(computer): keep the caret put after a refused macOS text write and skip unprovable readbacks
A refused AX value write no longer moves the caret before falling back to keys, so the keys and the prediction both use the user's selection. Text with control characters, a value the field already holds, and a field still filling at the 2 s cap stay unverified rather than verified or text_mismatch. The quiet window starts after the first read answers.
* fix(computer): bound macOS text readback size and say a mismatch can mean keys went elsewhere
* fix(computer): treat a macOS text readback past the cap as undetermined
* fix(computer): refuse quit, log out and lock shortcuts unless explicitly allowed
* fix(computer): close Linux keysym bypasses in the system shortcut guard
* fix(computer): refuse Linux keycode, L1/L2 and VT-switch keysym bypasses
* fix(computer): catch control characters in Linux keycode tokens and point recovery at the stated effect
* feat(computer): show where snapshots were cut and read one element's subtree
* fix(computer): validate subtree targets against the fresh walk and keep scope for focused input
* fix(computer): return whole-window action results after subtree reads
* fix(computer): count kept records toward the macOS limit and index subtree reads against the latest cache
* fix(computer): index Linux/Windows subtree reads against the snapshot they started from
* fix(skills): stop calling another Orca build's skill copy out of date
Every Orca build on a host (the installed app, dev builds, the CLI, a paired
server) shares one skills folder, and each one auto-updates it to the text it
ships. A build only recognises SKILL.md text from itself or older releases, so
a copy a newer build (or a dev build) wrote looked like a user edit: the
nudge said "An installed Orca skill is out of date" and Update offered to
replace it with older text.
Whenever Orca writes a skill it now leaves a marker,
~/.agents/.orca-skill-digests/<skill>/<sha256>, on the disk of the host that
plans. A copy whose bytes match a marker plans as leave 'other-build': it
reads as current, is never nudged, and silent update leaves it alone. A user
edit changes the bytes, so it is still asked about. A paired server plans and
records on its own disk, so the client never compares hosts.
* fix(skills): mark copies already at this build's digest so other builds see them as Orca's
A copy that already equals this build's bundle plans keep-only, so no write
ever recorded its marker, and copies written before the marker existed stayed
'edited' to any other build. Executing a plan now records the marker whenever
a location holds this build's bytes, and the silent update records it for
keep-only entries. The startup scan asks the host (this machine or a paired
server) once per session to run that keep-only update, so an already-current
build marks its copy on its first run. Preview stays read-only.
* chore(skills): drop unreachable other-build setup copy and document touched planners
'other-build' leaves are always replaceable, so the non-replaceable setup
attention lookup never selects one; it now shares the generic fallback and its
dedicated string is removed. Add short docstrings to the touched planning,
execution and copy functions.
* fix(skills): retry the startup marker when the host did not record it
A marking-only call kept its session mark even when the host never ran the
recording, so a failed or busy call left the copy unmarked for the rest of the
session. Release the mark when the call rejects, another update held the
target, or the host reports the skill busy or changed, so the next plan
refresh asks again. A host without silent update keeps its mark, avoiding a
call per scan.
* fix(skills): include Codex session's P2 fixes; warn only when a marker call may have written
Includes two P2 review fixes from a Codex session in this worktree:
- A newly selected agent links to a recognized other-build shared copy
instead of being left as shared-not-current, and execution re-checks that
shared copy so the dependent link is skipped if it changed after planning.
- Installed-skill views refresh after every silent-update call, since a
marking-only call re-plans on the host and can still update a copy.
A rejected marking-only call now shows the uncertain-outcome warning only
when the request reached a paired host and its reply was lost. A refusal
before sending, or the host's own error reply, cannot hide a write: the mark
is released for retry without a warning. Calls that started real updates
keep warning on any rejection. Restores the docstrings removed in that
session.
* fix(skills): stop retrying a failed skill marker on every plan refresh
Every marker call ends in a plan refresh, and a refresh re-scans. Freeing
the mark after a busy or failed call made each refresh ask again, so a host
that stayed busy or unreachable looped without end. Ask once per target,
skill and bytes per session; a later session, a manual update or any write
of the skill records the marker instead.
* fix(skills): recognise another build's copy under a skill's former name
A build from before a rename records its marker under the former name.
Check that marker for former-name copies too, so a renamed build no longer
calls such a copy edited and nudges about it. A user edit, a cloud receipt
or extra files still keep the copy as it was.
* fix(skills): warn about any failed skill update that may have reached the host
A paired host's timeout or lost reply also arrives as an RPC error, so an
RPC error is no proof that nothing was written. Only a refusal before
sending now stays quiet.
* fix(skills): send a silent skill update only to the host that was checked
Pin the update to the runtime and pairing that answered the capability
check, so a re-pair while the check awaits cannot send it to another host.
* fix(skills): record markers without updating, and never offer to replace another build's copy
A marker call now asks the host to record copies already at its bytes and
nothing else, so it can never write a skill and needs no warning or
re-plan; hosts that predate it reject the request and write nothing. It
is sent only in a scan that starts no update.
Another build's copy is no longer offered for Replace, which could
downgrade it, and its dialog line reads "Kept: written by another Orca
version".
* fix(skills): keep other-build setup current across host pairings
* fix(skills): preserve other-build prerequisites during migration
* feat(computer-use): add orca computer wait for text, enabled controls and window titles
* fix(computer-use): bound wait reads by the deadline and wait out missing Linux/Windows windows
* fix(computer-use): read disabled traits after role text with parentheses and bound the capability probe
* fix(computer): check macOS click targets are enabled, in view and on top before sending input
* fix(computer): scope macOS click cover checks to the target window
* fix(computer): scroll before trusting container hits and stop hit walks at the shared container
* refactor(computer): share the one-scroll rule in the macOS click check
* Keep model picks independent of answer metadata
* Remove unused answer model extraction
* Verify model selection stays separate from answer metadata
* Keep the agent-chosen model as a display default
* Keep agent-chosen model text out of input selections
* fix(agent-picker): stop listing Claude short-name rows beside the versioned model they run
* fix(agent-picker): hide a short name only on reported proof; keep hidden rows searchable
* fix(native-chat): keep a pending hidden model pick listed
* Hide projects from the sidebar without stopping them
Adds Repo.hiddenAt, a per-host, view-only flag. A hidden project's
workspaces, empty header and project-filter entry leave the desktop
sidebar, the paired phone's list, the new-workspace picker and the
palette's project filter. Its terminals, agents and automations keep
running, and repo.list / worktree.ps still list it.
- Hide Project in the project menu (toast with Undo), a collapsed
"N hidden projects" list under the workspace list with Show buttons,
and a Hide from sidebar switch in Settings > Projects.
- repo.setHidden RPC ({repo, repoHostId?, hidden} -> {repo, hostId,
hidden}) and `orca repo hide|unhide [--host]`; `repo list` marks
hidden rows.
- Opening a hidden project's workspace (notification, CLI, deep link)
focuses it without unhiding it, lifting sidebar filters, or leaving a
pending sidebar reveal.
- repo.update echo check: a host that drops hiddenAt reports failure
instead of reading as hidden.
* Address hidden-projects review: multi-host hide, picker scope, mute, stale filters, shared predicate, restore list styling
* Hidden projects re-review: keep saved filters, Agents filter, composer seed, per-toast Undo, shared default host
* Hidden projects: address review threads (pre-feed, palette search, notices, dialog default, seed remap, row keys, a11y)
* Hidden projects: no implicit dialog default when every project is hidden
* feat(plugins): host API 1.9: agent.listSessions (history:read), resume past sessions, agents.list task titles
* test(plugins): host API 1.9 coverage; regenerate plugin artifacts
* fix(plugins): host API 1.9 review fixes
- agent.resume starts a past session where the desktop's Resume would: the same preparation
request and answer handling (now shared), and the transcript in the home it pins
- AI Vault list cache keeps four scopes, so plugin reads never evict the panel's list
- list fingerprints ignore scan id and issues, so an unchanged history revalidates
- workspace mapping resolves symlinked workspaces and prefers a project over a folder
- agents.list task only for open dispatches, read at most once a second
- running matches OpenCode versions; history reads reset when the vault list is invalidated
- truncation, consent copy and limitations documented
* fix(plugins): forced history refresh supersedes cached scopes; resume legacy Codex sessions from their recorded transcript
* fix(plugins): address host API 1.9 review threads
- a scan that began before a forced history refresh no longer caches its older result
- list fingerprints count which issues there are (not their wording)
- symlinked workspaces rank by their resolved folder
- a session-only status row is no live pane: resume prepares the session
- a failed task-title read leaves agents.list rows intact
- the symlink test uses a junction on Windows
* test(ai-vault): order the stale scan before the forced refresh
* feat(plugins): proposed tier for host methods not yet frozen
A method spec may set `proposed: true`: only development plugins may call
it (others get not_permitted), and the minor, frame/worker method lists,
typings and skill references omit it. The reference renders such methods
in a separate Proposed section; dev workers' host.has answers for them.
* feat(plugins): param capabilities, host confirmations, automation provenance
- PluginHostMethodSpec.paramCapabilities: a passed param can require a
second capability; executePluginHostCall and the mock host refuse it with
capability_denied before any audit or effect, and the reference shows it.
- confirmPluginAction generalizes the external-open prompt into a host-owned
confirmation, exposed as PluginHostServices.confirm (desktop only; absent
in headless serve). It re-checks the plugin's approval after the answer.
- Automations record createdBy { kind: 'plugin', pluginKey, name }, set by
the runtime from the in-process plugin caller (RpcContext.plugin), never
from params; the Automations detail shows "Created by <plugin>".
* feat(plugins): workspace:create, automation:read and automation:write capabilities
New closed-enum kinds (older Orcas refuse such manifests with the engines
message), worker-only, with consent copy that names what each allows;
release floor PLUGIN_HOST_API_1_8_SINCE (1.4.259) joins
PLUGIN_SCHEMA_NEWEST_SINCE. agent:launch copy now says it also resumes.
* feat(plugins): host API 1.8 methods: workspace.create, agent.resume, automation.*
- workspace.create (workspace:create; agent also needs agent:launch): a
worktree in a Git project, as orca worktree create does; with agent, the
CLI's agent.launch create-worktree path, so the agent starts after setup.
Setup is skipped or follows the project's settings; never run, an
approved hash or a startup command.
- agent.resume (agent:launch): terminal.ensureAgentSession by session id;
started is false when a terminal already ran it. agents.list rows and
agent.status.changed carry sessionId.
- automation.list/create/update/delete (automation:read/write): create
forwards only name, prompt, agent, target, schedule, time zone and
enabled; update/delete of automations another plugin or the person made
ask the person first and report cancelled or consent-unavailable.
* test(plugins): host API 1.8 coverage; regenerate plugin artifacts
Covers param capabilities (host and mock host), workspace.create payloads
and refusals, agent.resume keys and adoption, sessionId on agents.list,
automation projection, forbidden create fields, confirmation outcomes,
runtime-set provenance and capability access growth. Regenerates the
reference, schemas, typings, declarative runtime and skill references.
* fix(plugins): host API 1.8 review fixes
- Confirmations spend the frame dialog budget, allow one question per
plugin at a time and pause after a refusal (rate_limited); a worker's
question shows in the focused window, else the first visible one.
- Changing what an automation with extra agent settings runs (prompt,
schedule, resuming) asks first even for its creator, showing the prompt.
- Removing, disabling or blocking a plugin pauses its automations and ends
its ownership (createdBy.endedAt), so neither re-enabling nor a reinstall
under the key resumes or edits them silently; the remove dialog says so.
- workspace.create and agent.resume record the terminals they return as
the plugin's own; a launch that fails after its worktree exists names it.
- Setup-decision refusals are told by the runtime's error class (kept as
the in-process RPC error's cause); generated names see every worktree
of the project; resume transcripts match the workspace and host.
- Created by shows the plugin id beside its name.
* fix(plugins): end automation ownership only on uninstall, disable or block
- The ownership sweep no longer reads discovery: only an uninstall
(announced by the removal path), the disabled list, the kill list or
the plugin-system switch end it, and only once the service is ready,
so an unreadable plugins folder pauses nothing. An install under the
same key after a removal keeps what it creates.
- A new time zone on an automation with extra agent settings asks first.
- A failed launch names only a new worktree made from the requested name.
- Settings' plugins-off state and the CLI's plugin system off and plugin
disable say that plugin-created automations are paused and stay so.
* fix(plugins): address host API 1.8 review threads
- Confirmations close when the worker's call ends, freeing the plugin's
turn; they name the automation (short id, project, workspace,
schedule), show any new prompt, and are refused as `changed` when the
automation was edited while the person was asked.
- automation.create takes hostId (through the project's setup on that
host) and a creationKey scoped to the plugin; the runtime rechecks the
plugin's approval right before the write.
- agent.resume records only terminals it started; both it and
workspace.create recheck approval before recording.
- automation.list never cuts a schedule (null when too long) or fails on
an id too long to show.
- The Automations detail says when a creator plugin was removed or
disabled.
Windows hosts' Git Bash (and agents that shell through it) print drive
paths as /c/Users/..., which resolved as POSIX paths and never linked.
Map /<drive>/<segment>... to <DRIVE>:\... when the workspace lives on a
Windows drive and no WSL distro owns the pane; bare /c stays literal so
'cmd /c' is not linked to C:\. Moves the existing MSYS drive conversion
from the main-process shell args to shared so both sides reuse it.
Closes#41357
* feat(plugins): host API 1.7 — workspace ids, project/terminal list, terminal focus/close
Plugins that track workspaces and terminals across Orca had to read the private runtime
token or shell out to the CLI. Host API 1.7 gives them the same through consented methods:
- workspace.readContext (and workspace.changed) carry `workspaceId`, the id workspace.list
gives; workspace.created/removed and agent.status.changed add `workspaceListId` beside
their existing raw `workspaceId`, which keeps its meaning.
- workspace.list rows name their `projectId`; opt-in `includeStatus` joins each row's agent
state, unread flag, live terminal count and last activity from worktree.ps.
- project.list (workspace:read), terminal.list (workspace:read), terminal.focus
(workspace:write, desktop only, steers only this window) and terminal.close
(terminal:send, reports whether the process is known to have stopped).
- Runtime refusals (unknown or ambiguous workspace, stale or exited terminal) reach plugins
as fixed messages instead of runtime wording.
- Consent copy for workspace:read, workspace:write and terminal:send says what they now
allow; terminal.focus and terminal.close are audited by terminal id.
- PLUGIN_SCHEMA_NEWEST_SINCE covers the editor typography and theme video floors it missed,
and the provisional 1.7 floor, so development builds accept plugins requiring them.
* fix(plugins): narrow terminal.close and harden host API 1.7 from review
- terminal.close closes only terminals of the focused workspace (the check terminal.sendText
uses) or ones this plugin opened with terminal.create or agent.launch, recorded in a bounded
per-plugin registry that is forgotten when its worker stops or it is disabled or removed.
terminal.focus stays any-terminal; summaries and terminal:send copy say so.
- Lifecycle events carry the worktree's identity and host: from the new row on create, and read
host-qualified before the purge on every removal path. agent.status.changed looks up the
identity on the reporting host only. The global removed-identity map is gone.
- includeStatus shares one in-flight worktree.ps and a 1 s cache across plugins, and reports
statusTruncated when that listing stopped short.
- Stored remote contexts get their identity host-qualified; panels and editors never get a raw,
path-bearing workspace id from readContext or workspace.changed.
- Runtime refusals map to fixed messages (tab pinned, no window, tab gone, host disconnected);
any other runtime error or malformed answer is a fixed action_failed with the detail logged.
- hostId is `local`, `ssh:` or `runtime:` in both workspace.list and project.list; rows past the
id or path bounds are left out with truncated set instead of failing the list.
- The mock testing host answers terminal.focus and terminal.close by default.
* fix(plugins): keep shipped host API values and codes; honest terminal results
- workspace.list hostId keeps the values 1.3 shipped (recorded host, else null; folder rows
their executionHostId); project.list always names the host. Both summaries say which.
- Methods that shipped before 1.7 report every runtime refusal as action_failed, as before;
the unavailable/conflict mapping applies to 1.7 methods only.
- includeStatus shares a pending worktree.ps however long it runs; the 1 s TTL starts when it
lands.
- The opened-terminal registry records only for a call still approved and not cancelled, and is
pruned on disable or removal only, so event-driven workers keep close rights across restarts.
- terminal.close answers { closed: true }: a local close cannot tell whether the process exited.
terminal.focus answers focused: false when the request was superseded or not navigated.
- workspace.list and project.list cut labels to 512 instead of failing the list.
- Removal events from the runtime job and the IPC retry are tested to carry the identity read
before the purge; folder deletion carries its host.
* fix(plugins): name the status-listing owner type
* refactor(ai-vault): group scanner modules by defining owner
* refactor(ai-vault): consolidate owner imports and isolate path absence
* Preserve mobile CI triggers for extracted absence predicate
Select each child's workflow state in the issue detail query and render
a colored state dot plus the state name on every sub-issue row. Rows
without a state (older servers, sub-issues created locally before a
refetch) render as before.
Fixes#41348
Kelvin Amoaba
OrcaWinandOrcaWin
Brennan Benson
Jinjing
Neil
yodaka