On wake, remote/SSH runtimes reconnect in a staggered burst; the sidebar refetched all worktrees once per host, piling up K synchronous full-sidebar remounts and freezing the UI. Wrap the reconnect refresh in a single-flight coalescer so at most one refresh runs at a time plus one queued rerun, for any K. fetchAllWorktrees and its lineage follow-up are unchanged; only how often they fire changes.
Co-authored-by: Orca <help@stably.ai>
#9804 added a leading `environmentId` parameter to recordWebSessionCloseIntent
(and isWebSessionCloseIntentPending) and updated the web-runtime-session.ts
callers, but missed the second caller in close-mirrored-editor-tab.ts, which
still passed 3 args. This broke the web typecheck on main and, had it compiled,
would have recorded the close intent under the wrong scope key
(closeIntentScopeKey(environmentId, worktreeId)) — so the host snapshot could
flash the just-closed mirrored tab back.
Pass the already-validated runtimeEnvironmentId (the same value handed to
closeWebRuntimeSessionTab immediately below) so the intent is scoped correctly.
Update the test's isWebSessionCloseIntentPending assertion to the 4-arg form.
Co-authored-by: Orca <help@stably.ai>
* fix(naming): remove identifier-first name post-processing
Workspace display names and tab titles were being rewritten after
generation by prompt-scanning heuristics from #8238 — a stray "#1" in
prose became a workspace named "#1 - Fix", and the rewrite ran
downstream of generation so user naming instructions couldn't override
it. Per the same principle as #9088, naming defaults stay minimal and
user overrides own the style.
- Delete work-item-reference.ts and display-name-from-work.ts (+tests).
- Auto-rename display names return to the humanized branch slug; tab
titles return to the cleaned first prompt clause.
- Explicit create-from-work-item naming returns to action-first
("Review PR 1234").
- Keep #8238's URL-before-markdown strip-order bugfix in tab titles,
with regression tests adjusted to the natural expectations.
* test(naming): pin incidental marker regression
* fix(editor): don't flag editor-initiated moves as changed-on-disk
An in-app move/rename (explorer drag-drop, inline rename, tab rename)
re-homes the open tab to the new path and carries its unsaved draft
forward. The move also physically relocates the file, which the worktree
watcher reports as delete(old)+create(new) a few ms later. Because the
tab already lives at the new path by then, that create echo was treated
as an external write landing on a dirty tab and raised a spurious
"changed on disk" banner.
Add a short-lived self-move registry (the move analog of the existing
self-write registry) stamped at the single remap choke point, and have
the external-watch handler recognize the move's own watcher echo:
suppress the changed-on-disk mark on the re-homed dirty tab and the
tombstone on the source path. Genuine external edits are unaffected.
Covered by unit tests for the registry, the remap recorder, and the
watch-hook suppression (plus a no-over-suppression guard).
Co-authored-by: Orca <help@stably.ai>
* refactor(editor): harden move-echo suppression per adversarial review
Addresses review findings on the self-move suppression:
- Stamp the self-move at the call sites BEFORE the on-disk rename
(recordSelfMoveForOpenTabs), not after the tab re-home, so the
watcher echo can't win the race. This makes the source-side delete
guard actually effective and removes a possible one-frame flash.
- Suppress only the move's own create echo, not update events, so a
genuine external write to the moved path within the TTL still raises
the changed-on-disk banner (closes an over-suppression gap).
- Track source/target roles independently per path so an immediate
undo can't clobber the original move's still-in-flight stamp.
- Raise the registry cap above realistic bulk-move sizes so a large
directory move never self-evicts its own not-yet-echoed stamps.
Updated + added tests: registry undo/role + cap, the new call-site
helper (incl. directory move), and a real-update-still-marks case.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): make move-echo suppression watcher- and TTL-robust
Round-3 hardening after adversarial review:
- Suppress the move's own watcher echo regardless of event kind. The
main-process watcher coalesces a create+attr-change burst into a lone
update, so a create-only gate let the echo through on some hosts and
re-exposed the false banner. Suppression is now bounded by the
self-move TTL; a genuine write to the exact path within that short
window is the documented trade-off (draft is preserved regardless).
- Bracket the on-disk rename with the self-move stamp via a single
renameOpenTabsPathOnDisk wrapper: stamp before (to beat the watcher),
re-stamp on success (a slow SSH/runtime rename can outlive the TTL, so
the fresh window must start when the file actually moved), and clear on
failure (a rename that never happened must not suppress real events).
All move entry points (explorer move, inline/tab rename incl.
undo/redo, untitled rename) route through it.
- Treat a tab as remote for TTL purposes when it has a runtime owner OR
an SSH worktree connection (an SSH tab can carry a null runtime owner).
- Registry tracks source/target roles independently per path so an
immediate undo can't clobber the original move's in-flight stamp; cap
raised above realistic bulk-move sizes.
Tests: registry role/clear/cap, the rename wrapper (success re-stamp +
failure clear), the call-site helper (dir move + clear), and watch-hook
coalescing-robust suppression + post-TTL surfacing.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): refcount self-move roles so a failed move can't clear a live one
Two concurrent moves onto the same destination both stamp that path as a
target; if the second rename fails and clears, it must not erase the
first (successful) move's still-live target stamp. Reference count each
role's registrations and clear only the failed move's own contribution.
Adds a regression test for the shared-destination case.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): give self-move stamps per-registration expiries + retract tokens
The refcount model used a single shared expiry scalar per role that only
grew via max() and reset at refs=0, so releasing the max-contributing
registration left survivors inheriting an over-extended window (and an
expired registration could be resurrected by a later stamp on a key the
opposite role kept resident). Both over-suppress genuine changes.
Model each stamp as an independent registration carrying its own expiry
(a list per role). recordSelfMove returns a ticket; clearSelfMove
retracts exactly that registration. A role is live while any of its
registrations is unexpired, so concurrent stamps, failed-move clears, and
expiry are all precise. Wrapper/helper thread the tickets through.
Adds regressions for the over-extension and resurrection cases.
Co-authored-by: Orca <help@stably.ai>
* test(editor): cover source-side self-move guard in the pre-remap ordering
Adds the case where the watcher's delete(old) arrives while the tab is
still at the old path (before remap re-homes it): with a live self-move
source stamp the tombstone must be suppressed. Pairs with the existing
naked-delete control (no stamp → deleted) to pin the guard's behavior.
Co-authored-by: Orca <help@stably.ai>
* docs(editor): document the failed-move suppression window as a bounded trade-off
A self-move stamp is placed before the rename and retracted if it fails,
so an event consumed during the pre-failure window is swallowed. Note
that this only matters for the rare unrelated-dirty-tab-at-destination
case and the recoverable missed-source-tombstone case, and that a move
has no bytes to echo-verify the way self-writes do.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): decide move echo vs external write by content identity
Replaces the time-bounded self-move suppression heuristic with a
correct-by-construction identity check, so a genuine external write to a
just-moved path is never swallowed and the move's own echo is never a
false conflict — regardless of watcher event-kind coalescing or timing.
- Remap now carries the edit-session identity (lastKnownDiskSignature,
externalMutation, pendingDiskBaselineVerification) onto the re-homed
tab. Previously the close+reopen dropped it, so a moved tab lost its
disk baseline (and any pre-existing changed-on-disk conflict silently
vanished on move).
- On a live self-move-target dirty event the watch hook now reads the
destination and compares getDiskBaselineSignature(disk) to the tab's
carried baseline: equal => move echo (suppress), differ/binary =>
genuine write (banner). Autosave is suspended synchronously before the
read so a write landing mid-read can't be overwritten; a generation
token makes overlapping reads safe. Fails CLOSED (marks changed) on a
missing baseline or read error — never blind-suppresses.
- The self-move registry now only scopes WHEN to verify. The source-side
delete still can't be content-verified (nothing to read), so it stays a
bounded, documented suppression.
- Trim the verbose Why-comments across these files to 1-2 lines.
Adds content-identity verification tests (echo/differ/no-baseline/read-
error/binary/autosave-gate) and a remap test for the carried identity;
splits the watch-hook suite to stay under the max-lines limit.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): give live move-verification its own autosave gate
The live self-move echo verification reused pendingDiskBaselineVerification
as its autosave gate, but that field is also the always-mounted restored-tab
conflict scanner's work queue: the scanner scans any pending dirty tab,
launches its own read, and clears the flag without checking the live
generation — so it could lift the gate mid-read and let autosave overwrite a
genuine external write. Give live verification a dedicated
pendingLiveDiskVerification field (both suspend autosave; each cleared only by
its owner). Transient, not persisted, not carried across a re-home.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): atomic rekeyOpenFilesForPathChange store action (move restructure stage 1)
Foundation for treating an Orca-owned move as an in-place retarget of the
open edit session (not close+reopen), per the locked design. One commit-only
store update migrates every path-derived id + all id-keyed state
(openFiles full-spread, the 6 file-id maps, activeFileId(+byWorktree),
tabBarOrder, unified tabs/groups via the now editor-family-widened
migrateHydratedEditorTabsAndGroups, pendingEditorReveal, untitled consume).
Preflight fails closed on collision (never merges two live sessions) or stale
with zero mutation. Not yet wired to a coordinator (stage 4).
Stage 1 of 5; behind the shipped content-identity fix.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): op-scoped in-flight move registry + source integration (stage 2)
editor-path-move-inflight.ts tracks Orca-owned moves for the exact duration of
the rename+rekey (no TTL): source paths suppress the delete tombstone, target
paths latch a destination event seen before the rekey (never suppress). Wired
into the watcher's delete filter alongside the old TTL registry (OR fallback)
so suppression keeps working until the stage-4 coordinator drives every move
through beginEditorPathMove. Stage 2 of 5.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): move-echo provenance + autosave gate on OpenFile (stage 3 store)
Adds pendingSelfMoveEcho {operationId,targetPath} to OpenFile and has the
rekey action install it + pendingLiveDiskVerification on dirty autosave-capable
destinations (moveOperationId arg), atomically in the same commit that re-homes
the tab — so the verify gate survives the rekey and its op-id token supersedes a
stale in-flight verification. Replaces the module-scoped generation map (which
broke under rekey). Verification-reader wiring + coordinator follow.
Co-authored-by: Orca <help@stably.ai>
* refactor(editor): remap moves via atomic in-place rekey, not close+reopen (stage 4a)
remapOpenEditorTabsForPathChange now builds an owner-aware rekey plan (plain-path
id to the first owner, owner-qualified to the rest; previews resolve their source
to the moved edit's new id) and applies it via rekeyOpenFilesForPathChange in one
commit — preserving the full OpenFile + cursor/view/group/MRU state and closing
the close/reopen watcher-race window. Passes moveOperationId through so dirty
destinations get the content-verify gate. 4545 tests green.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): move coordinator drives rename/drag/undo/redo/untitled (stage 4b)
executeOpenEditorPathMove is the single transaction for every in-app move:
quiesce affected saves -> op-scoped begin (per runtime owner) -> on-disk rename
-> atomic in-place rekey (installs the content-verify gate/provenance) -> settle
-> re-verify any destination echo latched before the rekey. On failure the store
is untouched. Verification now triggers off the on-OpenFile provenance (consumed
on resolve) and the watcher latches pre-rekey destination events. Wired into all
five call sites; old renameOpenTabsPathOnDisk + separate remap removed from them.
2751 tests green. (TTL self-move registry now dead; removed next.)
Co-authored-by: Orca <help@stably.ai>
* refactor(editor): remove the dead TTL self-move registry (stage 4c)
The coordinator + op-scoped in-flight suppression + on-OpenFile provenance fully
replace the time-bounded self-move registry, so delete it and its two helper
modules (record-self-move-for-open-tabs, rename-open-editor-tabs-path). The
watcher source filter now uses only isActiveMoveSourcePath and the verification
trigger only the tab's pendingSelfMoveEcho. Rewrote the self-move test suite onto
the new primitives. 7225 tests green.
Co-authored-by: Orca <help@stably.ai>
* test(editor): end-to-end coordinator move test (stage 4 done)
executeOpenEditorPathMove renames on disk, retargets the session in place with
draft/dirty/baseline preserved + gate/provenance installed, settles the in-flight
transaction; on rename failure the store is byte-identical and the transaction is
released.
Co-authored-by: Orca <help@stably.ai>
* feat(editor): mirror-safe move — detach moved mirrored tab + close-notify host (stage 5)
The atomic rekey changes a tab's id, so a moved mirrored tab would be culled by
the host snapshot (losing its draft) or resurrect the old path. Ship the safe
minimum: the rekey detaches a moved tab from the host mirror
(mirroredFromRuntimeSession cleared) and the coordinator close-notifies the
host's old-path tab (close intent suppresses re-mirroring). Prevents the
data-loss/resurrection; the moved tab becomes companion-local. The full
host-rekey path-change protocol (preserving mirror ownership) is a documented
follow-up.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): address review round 1 (4 majors)
- Coordinator now propagates the rekey result: a collision/stale AFTER a
successful on-disk rename triggers an inverse rename + throws, instead of
reporting success with the source tab stranded at a vanished path (#1).
- Cross-worktree: affected set spans all worktrees at the source path, sub-ops
scoped per (worktree, owner), and the rekey partitions tab/group/tab-bar
migration by each file's own worktree (was applied under one scope) (#2).
- Diff tabs: single-file unstaged diff tabs are now retargeted on a directory
move (rebuild the diff id + relative path) instead of stranding (#3).
- Mirror close-notify moved to AFTER a successful rename so a failed rename
can't desync the host by closing its authoritative tab (#4).
Adds tests: collision->inverse-rename, diff-tab retarget. 6698 tests green.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): review round 2 (mirror ordering, rollback error, diff sources)
- Close the host mirror tab only AFTER the rekey commits (capture pre-rekey
resolution first): a rekey collision after a successful rename no longer
desyncs the host by closing its authoritative tab (high).
- Surface a failed inverse rename instead of swallowing it: the thrown error
now states the on-disk move may remain at the new path (high).
- Restrict diff-tab retargeting to staged/unstaged (purely path-derived ids);
branch/commit diffs carry compare metadata and combined 'Changes' is
worktree-rooted, so rebuilding them from path would produce a wrong id (med).
Co-authored-by: Orca <help@stably.ai>
* fix(editor): resolve the move verify gate proactively (review round 3)
The rekey gates every dirty moved tab pending a destination content check,
but verification only ran when a watcher event arrived for that path. If the
watcher was down, throttled, or the event coalesced away, the gate never
cleared and autosave stayed suspended for the tab.
The coordinator now drives verification for every tab it gated once the
rename has committed, so the gate resolves on its own. That makes the
destination-side event latch redundant, so the in-flight tracker is
source-only again.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): review round 4 (gate strand, cross-worktree verify path, leak)
- Don't install the move-echo verify gate on a tab already showing the
changed-on-disk banner: it's autosave-suspended via externalMutation and
verification skips a 'changed' tab, so the gate would strand forever.
- Content-verify reads each moved tab's own filePath. A cross-worktree/
floating tab's relativePath is relative to its own root ('../…') and must
not be joined onto the initiating worktree path (would read the wrong file
and raise a false conflict banner on unsaved work).
- Coordinator settles the in-flight source suppression in a finally so a
throw between rename and commit can't leak it, and only after the rollback
rename so a late forward-rename delete stays suppressed.
- Migrate pendingEditorReveal.fileId across the rekey (matcher prefers it).
Co-authored-by: Orca <help@stably.ai>
* fix(editor): don't consume move-echo provenance in the safety-net verify (round 5)
The round-3 proactive post-commit verify ran resolveLiveMoveVerification,
which consumed pendingSelfMoveEcho. On FSEvents/SSH the real destination
watcher event reliably lands AFTER the fast local read, so it then found no
provenance, took the immediate changed-on-disk mark (no baseline check when
there is no recent self-write), and raised a false conflict banner on the
just-moved dirty tab — the exact data-loss this change removes.
The proactive verify is a safety net: it now releases the autosave gate but
leaves the provenance, so a later destination event is still recognized as
the move's own echo and content-verified. Only a real watcher event consumes
the provenance. Keeping it is safe — every watcher consumer verifies by
content, which is strictly safer than the immediate mark.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): scope move rekey to the initiating execution host (round 6)
Co-authored-by: Orca <help@stably.ai>
* fix(editor): prefix-suppress the move root so late tabs under a dir move aren't flagged (round 8)
Co-authored-by: Orca <help@stably.ai>
* chore(editor): trim move-fix comments to the why; drop redundant rename quiesce
Co-authored-by: Orca <help@stably.ai>
* fix(editor): record mirrored-close intent synchronously to close the ghost-tab window
Co-authored-by: Orca <help@stably.ai>
* fix(editor): use flavor-aware path containment for move selection (Windows/UNC case)
Co-authored-by: Orca <help@stably.ai>
* fix(editor): reconstruct moved path by segment count (WSL alias / duplicate-separator safe)
Co-authored-by: Orca <help@stably.ai>
* fix(editor): infer moved-path flavor by syntax, preserving legal POSIX backslashes
Co-authored-by: Orca <help@stably.ai>
* test(editor): lock POSIX ancestor-backslash destination flavor
Co-authored-by: Orca <help@stably.ai>
* fix(editor): flavor-aware trailing-separator strip; preserve POSIX literal backslashes
Co-authored-by: Orca <help@stably.ai>
* fix(editor): flavor-aware separator folding in relative-path recompute (POSIX backslash)
Co-authored-by: Orca <help@stably.ai>
* perf(editor): keep the fs-watcher delete path O(deletes) when no move is in flight
Co-authored-by: Orca <help@stably.ai>
* docs(editor): tighten move-fix comments to one-line why-only
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(sidebar): keep branch-discovered PR status visible on worktree cards
The sidebar status lane and the right checks panel read the same PR
caches but disagreed for unlinked worktrees: every successful GitHub PR
fetch mirrors the result into hostedReviewCache stamped with a
linked-style hint key ('github:<n>'), and getWorktreeCardPrDisplay
suppresses unlinked reviews with a non-empty hint. The checks panel
renders straight from prCache, so it showed "#9387 OPEN" while the same
worktree's card fell back to the plain branch icon.
Thread the branch-keyed PR cache number into getWorktreeCardPrDisplay as
corroboration: when the branch cache names the same PR the hosted entry
holds, the review provably belongs to this branch and stays visible.
WorktreeCard passes its existing cachedBranchFallbackGitHubPRNumber,
which is already guarded for linked metadata and the merged-head rule.
The hint stamping itself is unchanged on purpose: the 'github:' marker
also flags the entry as GitHub-scoped so neutral lookups still re-run
GitLab MR discovery.
* fix(sidebar): preserve PR lookup provenance
* fix(sidebar): preserve merged PR head guard
* test(github): assert exact refresh cache write
The default DialogContent close button is absolutely positioned at
top-4/right-4 for standard p-6 dialogs; the agent terminal dialog uses
p-0 with a compact py-2 header, so the X floated below the title line.
Render the close control inside the header row instead so it centers
with the title and matches the header's horizontal padding.
* feat: continue agent work in a new session
* fix: harden new-session continuation
* fix: source last prompt from provider-authenticated transcript records
Preview user entries can be tool results or harness-injected skill text,
so the continuation prompt's last-prompt hint now comes from the vault
scanner's provider-authenticated lastUserPrompt. Also softens the
continuation instructions for already-complete tasks and adds a cost
warning to the full-transcript option.
* fix: move Continue in New Session row action into the hover group
Edge-usage action; keep the resting row at three icons and reveal it with
the other session actions on hover, matching Resume's gating.
---------
Co-authored-by: jz.feng <jz.feng@aftership.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(dashboard-popout): zoom the pop-out window, not the main window behind it
The View menu's zoom handlers always sent terminal:zoom to the main
window, so zooming while the dashboard pop-out was focused zoomed the
window behind it. The pop-out also never applied the persisted
uiZoomLevel, so it always rendered at 100% in a zoomed app.
The pop-out now applies uiZoomLevel on dom-ready and follows app-zoom
changes while open (main-window zoom, settings control, mobile ui.set).
Menu zoom routes to the pop-out when it is the focused window, stepping
its own webContents zoom, and a narrow before-input-event handler
resolves the zoom.in/out/reset chords (honoring keybinding overrides)
since the pop-out has no renderer-side shortcut plumbing. The step/clamp
constants move to shared/ui-zoom-level.ts so main and renderer share one
definition.
* fix(dashboard-popout): isolate window zoom
* fix(dashboard-popout): deny unused permissions
* docs(dashboard-popout): clarify wheel zoom path
* fix(dashboard-popout): wire terminal copy/paste in the popped-out window
The Edit menu's Paste is a custom item that routes Cmd/Ctrl+V to the
focused window as ui:appMenuPaste, and only the main window's React root
listens for it — the popout dropped it, so paste silently did nothing.
The copy chord similarly resolves in the main window's before-input-event
handler, which the popout window never registers; the menu's role:'copy'
no-ops on xterm's empty hidden textarea.
AgentTerminalPreview now subscribes to onAppMenuPaste (guarded on focus
inside the preview) and pastes via terminal.paste(), which xterm flags as
user input so the existing preview->PTY routing and main-process input
limits apply. A custom key handler honors the terminal.copySelection and
terminal.paste keybindings, skipping plain Mod+V since the menu
accelerator owns that chord (handling it twice would paste double). The
popout bootstrap fetches keybinding overrides so custom bindings apply.
* fix(dashboard-popout): harden terminal clipboard routing
* fix(dashboard-popout): authorize terminal clipboard text
* test(dashboard-popout): harden terminal paste coverage
* fix(terminal): normalize streamed paste newlines
* fix(dashboard-popout): forward macOS IME native-text commits in the preview terminal (#9771)
* fix(dashboard-popout): forward macOS IME native-text commits in the preview terminal
The preview terminal enables xterm's kitty keyboard protocol (via
buildDefaultTerminalOptions), whose encoder can encode and cancel a
printable keydown before Chromium commits the real IME/native text —
silently dropping macOS input-source commits and synthetic Unicode
injection. Main-window panes guard this with the IME native-text
forwarder; the pop-out preview never installed it.
Install the composition tracker + forwarder (macOS-only, mirroring
TerminalPane) and claim native-text key events at the top of the
preview's custom key handler so the committed glyph reaches the PTY via
terminal.input() and the existing user-input routing.
* fix(dashboard-popout): prewarm IME input source
* fix(skills): preserve released history across new tags (#9778)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(skills): record latest Linear release history (#9777)
---------
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
---------
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(settings): stop mislabeling a WSL default shell as PowerShell
The Terminal settings shell toggle coerced a stored `wsl.exe` default to
`powershell.exe` for display, so a WSL default (set in onboarding) showed
"PowerShell" selected and wrongly surfaced the PowerShell-version options.
Drop the coercion and surface WSL as a disabled, already-selected segment
when it's the active default, so the control reflects the real shell. WSL
stays non-selectable here because choosing it needs a companion distro that
only the onboarding step configures; wiring a full WSL picker into Settings
is left for a deliberate design pass against the per-project runtime model.
* test(settings): cover persisted WSL shell display
* fix(codex): count per-account homes in usage and state removal blast radius
- usage scanner now includes codex-accounts/*/home/sessions so multi-account
usage is no longer silently undercounted (audit F2)
- account-removal dialog copy now states that session history and MCP logins
are permanently deleted with the managed home (audit F1 mitigation)
* fix(codex): harden account usage discovery
* feat(settings): link Linear capabilities pane to Integrations settings
The Agent capabilities -> Linear pane installs the orca-linear skill but
gave no path to where the connection itself lives. Add a link to the
Integrations settings pane, where connected Linear workspaces and API
keys are managed.
* refactor(settings): move Integrations link to bottom of Linear pane
* refactor(settings): drop icon from Linear Integrations link
* feat(status-bar): add tooltips explaining Detailed vs Compact usage modes
The Detailed/Compact density picker in the usage popover named both modes
but didn't explain what they change. Add hover tooltips via a new optional
`tooltip` field on SettingsSegmentedControl's options (no behavior change
for existing segmented controls).
* reword usage tooltips + add zh/ko/ja/es translations
Detailed: drop 'in the status bar'. Compact: 'Condensed usage: only the
tightest window'. Translate both keys into all locales via the repo's
translate+repair policy.
* test(status-bar): wrap UsageRosterPanel renders in TooltipProvider
The new segment tooltips use Radix Tooltip, which requires an ancestor
TooltipProvider (present in the real app at App root). Wrap the test
renders to match, fixing 3 failures.
* i18n(usage-tooltips): fix zh/ja mistranslations of 'full usage'
The zh/ja 'Detailed' tooltips read as an imperative ('make full use of
bars/labels/percentages') instead of the intended noun ('full usage
shown with ...'). Correct to the usage-status noun, align ja Compact to
使用状況 (not 使用法/how-to), and drop a stray trailing period in es.
* chore(skills): regenerate skill bundle manifest for release-tag drift
New release tags cut since the manifest was last committed appended
orca-cli snapshots (releaseRevision 33→35). Append-only regen — released
history is preserved; only unblocks the verify:skill-bundle-manifest gate.
* i18n(usage-tooltips): polish zh Compact tooltip wording
The zh Compact tooltip read like an instruction ('only use the tightest
window'). Reword to a descriptive summary parallel to Detailed. Keep the
'tightest = highest-usage window' meaning (getTightestUsageSection picks
max usedPercent) rather than CodeRabbit's '最短/shortest', which would
misdescribe it as the shortest-duration window.
* fix(source-control): keep commit generation entry point visible
* fix(source-control): translate and clarify generate button visibility
Translate Chinese-language comments to English and improve clarity
around the showGenerate logic: config errors surface in the generation
dialog, and the Create PR flow owns generation state to prevent stacking
spinners.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Fix Linear skill-install modal CTA hierarchy
Remove the redundant 'Not now' button from the Linear agent-skill
install modal and make Install the filled primary action, matching the
other setup surfaces (filled primary + muted dismiss).
'Not now' was doing exactly what the dialog's × already does (session
snooze via onOpenChange), but styled as an outline button in the
footer-right CTA slot it read as the primary action over Install —
which itself was only an outline button buried in the panel body. Users
reflexively clicked the dismiss.
- Drop 'Not now' + its unused onSnoozeForSession prop / i18n key (all locales)
- Add opt-in installVariant to AgentSkillSetupPanel (defaults 'outline';
settings surfaces unchanged) and pass 'default' from the Linear modal
- Update tests to drive the session snooze via the dialog ×
* Keep 'Not now' as the safe dismiss; demote 'Don't show again' to a muted link
This modal auto-opens unsolicited (first activation of a Linear-linked
worktree with the skill missing), so the reflexive dismiss must be
non-destructive. Removing 'Not now' left the permanent 'Don't show again'
as the only labeled footer button — the reflexive target — which would
nuke a useful prompt forever.
Restore 'Not now' (session snooze) as a quiet ghost — the easy, safe
dismiss, matching Neil's original ask ('not now is fine, just not the
CTA'). Demote 'Don't show again' to a muted text link so permanent
suppression takes intent. Install stays the filled primary.
Restores onSnoozeForSession wiring + notNow i18n key (all locales);
tests exercise the Not now snooze path again.
* Remove 'Not now' from Linear skill-install modal; × handles session dismiss
Per product call: the modal is typically reached by clicking 'Set up' on
the reminder toast (an opt-in), and the dialog's × already dismisses for
the session. Drop the redundant 'Not now' button. Footer keeps only the
quiet muted 'Don't show again' (permanent opt-out); Install stays the
filled primary.
Removes onSnoozeForSession wiring + notNow i18n key (all locales); tests
exercise the × (Close) session-snooze path.
* Move permanent opt-out to an EyeOff icon next to the × (matches SetupGuideModal)
Replaces the footer 'Don't show again' link with a quiet EyeOff icon
button beside the dialog ×, matching the house pattern for hiding a
setup/teaching surface (SetupGuideModal, StatusBarUsageEmptyCta,
SetupGuideSidebarEntry). The footer is gone entirely, so Install is the
only labeled action; the two 'make it go away' controls (× = for now,
EyeOff = never) sit together and neither is a tempting text button.
- Rendered last in the branch so initial dialog focus lands on Install,
not the hide button (Enter-on-open must not permanently dismiss).
- Wrapped in a local TooltipProvider so it works outside the app's global
provider (isolated tests/mounts).
- Reuses the existing dontShowAgain i18n key for aria-label + tooltip.
- Tests locate the control by aria-label now that it has no text.
* Align EyeOff hide icon with the × (top-3 not top-3.5)
The icon-xs button is 24px tall vs the bare 16px × close, so its centered
icon sat 2px low. top-3 lines the two icon centers up (measured pixel-exact
in the running app).
The card column-move uses the View Transitions API, whose snapshot
pseudo-elements render in the browser top layer — above any z-index,
including the terminal dialog's z-50 Radix portal. So a card morphing
columns briefly flickered over the open terminal.
Skip the view transition while the terminal dialog is open; the card
just settles into its new column under the dialog (which covers the
board anyway) instead of animating on top.
Pin the large-QR grid track to a shared size token so long under-QR copy
(relay-degraded notice) cannot max-content the auto column and collapse
the pairing step to one glyph per line. Constrain the QR stack for wrap
and lock the layout contract in tests.
* fix(editor): fail safe when rich-markdown reconcile throws
commitRichMarkdownSerialization called reconcileSerializedMarkdown with no
guard. Its three callers all assumed the only failure was editor teardown —
which commit already handles internally (didSerialize:false) — so their empty
`catch {}` (debounced onUpdate, flush) and missing catch (Cmd+S shortcut)
actually only ever swallowed, or crashed on, a genuine reconcile throw.
When reconcile threw, the Cmd+S path crashed uncaught, and the debounced/flush
paths dropped the draft update silently — leaving editorDrafts stale and
stalling auto-save with no UI signal (the auto-save half of #9158/STA-2027,
diagnosed by @klay7w).
Make the shared choke point degrade to canonical `edited` on any reconcile
throw — the same fallback reconcile already uses internally — so no path can
crash or silently lose content; worst case is a canonical-style save (#6080).
The two remaining catch blocks now log instead of swallowing so an unexpected
serialize failure can't be invisible.
The multi-byte crash that was the known trigger is already fixed (#9642); this
hardens the shared path against any future reconcile failure.
* fix(editor): preserve source EOL on reconcile fallback
* perf(mobile): route graph-sync snapshot fanout through the notify coalescer
syncWindowGraph no longer unconditionally re-serializes+fans every worktree's mobile snapshot to every client. Serve-hydrate fast path skips the build-then-drop loop when no serve-owned pty exists (desktop case); changed-worktree gating (strict superset of snapshot inputs) routes only real changes through the existing coalescer. No-op syncs 720->0 emits; single-worktree churn 720->120 (~83% fewer bytes to phone). Real changes still propagate. 11-round GPT-5.6-Sol xHIGH review converged 2-consecutive-clean; independently verified tsc+830 tests.
Co-authored-by: Orca <help@stably.ai>
* fix(mobile): bump snapshotVersion on preserved prune frames + carry split-group layout
Pre-merge adversarial review found two stale-phone regressions: (1) preserved-headless snapshots did not bump snapshotVersion, so a pruned-but-serve-preserved worktree change was dropped by clients' same-epoch freshness gate (orca-runtime.ts:22316); (2) serve-only no-op hydrate dropped the phone's split-group layout (orca-runtime.ts:3731). Both fixed + mutation-verified regression tests. 3 typechecks + suites green.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(github): prevent unscoped work item queries
* fix(review): translate non-English rationale comment to English (client.ts:1151)
Restores the English '// Why:' convention and re-states the allSettled partial-results rationale that was dropped when the comment was replaced. Flagged by Ce-code-review (maintainability/previous-comments) and a prior PR reviewer. No behavior change.
Co-authored-by: Orca <help@stably.ai>
* fix(tasks): surface repos with no resolvable GitHub source
Since #9660 an unresolvable GitHub source returns an empty null-source
envelope instead of an unscoped search. That empty was indistinguishable
from a genuine zero-result query — no log, no telemetry, no UI signal.
Surface it in the Tasks list: a per-repo info row with Retry for each
fetched repo that resolved neither an issue nor a PR source (told apart
from genuine-zero and not-yet-fetched purely via the cached `sources`).
Renderer-only — the signal was already threaded through the envelope.
- selectTaskPageUnresolvedSourceRepos selector (+ unit tests)
- per-repo row reusing the existing banner region + handleRetryIssuesFetch
- suppress the generic empty state while those rows show
- assert the null-source envelope contract in client-work-items test
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
The Checks panel polls window.api.pty.getCwd every 4s to follow the active
terminal's cwd. It was gated only on panel visibility (isPanelVisible), not
window visibility — so a hidden or minimized window kept spawning lsof on macOS
every 4s (the 4s cadence exceeds getCwd's 1.5s per-pid cache TTL, so every tick
is a guaranteed miss and a fresh subprocess).
Swap the raw window.setInterval for installWindowVisibilityInterval — the shared
helper every sibling timer already uses — which pauses while the window is hidden
and runs an immediate refresh on becoming visible so a cd made while hidden is
picked up on return. A visible-but-unfocused window (second monitor) keeps
polling, matching prior behavior.
Co-authored-by: Orca <help@stably.ai>
* feat(dashboard): open-worktree dialog control + finished-time parity
Pop-out agent dashboard polish:
- Terminal dialog: replace the footer Close button with the standard top-right
X, rename the primary action from Focus worktree to Open worktree, and prefix
it with an open-in-window icon.
- Card time column: finished agents now read time-since-finish (matching the
left worktree sidebar) instead of time-since-start. Extracts the sidebar's
finished-timestamp logic into a shared helper so the two surfaces cannot
drift, and threads finishedAt through the dashboard snapshot contract.
* fix(dashboard): thread finishedAt through payload validator + test fixture
CI typecheck caught a DashboardCard fixture in dashboard-payload-validation.test.ts
missing the new finishedAt field; also validate finishedAt in the relay guard.
* feat(dashboard): swap pending-question emoji for MessageCircleQuestion icon
The amber pending-question chip used a raw hand emoji (renders differently
per-OS and off the design system); use the lucide chat-with-question icon.
xterm.js has no bold-color theme slot (upstream xtermjs/xterm.js#6032), so the Bold Text override was silently dropped — a false affordance. Makes the Settings copy and the Ghostty importer honest that it isn't applied yet, while preserving any persisted value for a future real implementation. No terminal-rendering change.
Closes#8595
The code editor was hard-wired to the terminal font, so Nerd Font 'Mono' CJK glyphs overlapped in the editor. Adds an opt-in editorFontFamily setting; default is empty so the resolved value is byte-identical to today for every existing user.
Closes#9628
xterm's Linkifier only re-runs providers when the hovered cell changes; window blur fires mouseleave which clears the current link but leaves the cell cache, so on refocus with a stationary pointer the link stays dead until a scroll. Adds the same guarded hover-cache reset the reveal/on-write paths already use, to the window-wake path.
Closes#9116
In compact worktree-card mode, two Radix HoverCard roots shared one open-state boolean, causing an open/close flicker loop when hovering the Live Ports plug. Un-shares the control so each hover owns its own state.
Closes#9304
* fix(sidebar): attribute spinner-only pane titles to the launched agent
A braille-spinner terminal title proves activity but carries no agent
identity, so the title-derived sidebar row resolver dropped it. Agents
without working status hooks — Codex over SSH (#8711) — only ever emit
spinner+cwd titles, so their worktrees showed no agent row at all while
Claude (hook-backed) rows appeared.
Fall back to the tab's launch identity (tab.launchAgent) for
spinner-only titles, mirroring the precedence the hook-row path already
uses. Explicit title identity still wins, Claude-specific prefixes
(✳ / '. ' / '* ') are unaffected, and panes without launch metadata
keep the existing no-row behavior.
* test(sidebar): pin spinner fallback no-launchAgent gate; note split-pane residual
Adds a regression test asserting a spinner-only title with no tab launch
identity produces no row, pinning the `launchAgent ?? null` gate that the two
existing tests do not exercise. Expands the fallback comment to record why it is
spinner-gated (vs the hook path's unconditional launchAgent fallback) and the
split-pane braille-title residual.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
* fix(editor): surface file-save failures instead of swallowing them
handleSaveForFile wrapped requestEditorFileSave in an empty `catch {}`, so a
rejected save vanished with no toast, no dirty-state change, and no log — the
edit stayed dirty in the buffer and was lost on tab close (silent data loss,
STA-2027). Only main.trace.ndjson revealed the file was never written.
Route the rejection through a new notifyEditorSaveFailure helper that logs the
error and shows a toast. Extracted to its own module so the reusable callers
(mobile bridge, file-deletion autosave) can adopt it and to keep EditorPanel
under the code-line budget.
Follow-up to the multi-byte reconcile crash (that was the known trigger); this
hardens the swallow that turned any save failure into silent loss.
* fix(editor): preserve failed save result
* fix(automations): retire owned desktop terminals (#9479)
* fix(automations): diagnose late settlement failures
* fix(automations): clear retired terminal identity and guard finalize close
- Clear the run's terminalSessionId/PaneKey/PtyId when finalize() actually
retires the owned terminal, so 'View run' resolves to the workspace/snapshot
instead of dead-ending on a now-closed terminal.
- Guard finalize()'s closeTab in a try/catch; a throwing close reports
not-closed so the run keeps its still-valid terminal identity and no stale
clear runs.
Review follow-ups from PR #9493 (does not attempt the durable cross-reload
reconciliation that #9479 needs).
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
* fix(editor): reconcile multi-byte markdown saves without byte-offset crash (#9492)
@sanity/diff-match-patch's adjustIndiciesToUcs2 treats patch.start1 (a char
index) as a UTF-8 byte offset, so on multi-byte text (Chinese/emoji/accented
Latin) its byte counter overshoots the seed target and throws "Failed to
determine byte offset" when saving via Ctrl/Cmd+S.
Pass allowExceedingIndices to applyPatches so it returns the nearest index
instead of throwing; the fuzzy match relocates the hunk and branch 6's
round-trip proof already rejects any misplacement, so the seed offset need not
be exact. Regression introduced by #8862.
Adds a position-sweep regression test over a mostly-Chinese doc.
* fix(editor): preserve Unicode reconciliation seeds
* test(editor): cover rolling Unicode patch seeds
* perf(renderer): patch sidebar live-agent index on within-state status pings instead of full rebuild
Co-authored-by: Orca <help@stably.ai>
* refactor(renderer): extract live-agent index patch into worktree-agent-live-index-patch module (max-lines)
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(github): load PR diffs for Enterprise remotes
* fix(github): encode PR content paths by segment
* Fix PR review actions failing on GitHub Enterprise remotes
- Threads GitHub host identity (not just owner/repo) through the client,
work-item-details, issues, and RPC layers so gh commands target the
correct Enterprise server instead of silently falling back to github.com
- Adds a shared github-api-repository helper to resolve/host-qualify repo
identity consistently across REST, GraphQL, and CLI shorthand calls
- Scopes the gh rate-limit breaker and singleton rate-limit snapshot by
host/runtime so a github.com block or probe can't affect GHES or WSL
- Coalesces concurrent host-auth probes and paginates PR file fetching
beyond 100 results
- Propagates `host` through renderer PR caches, checks-panel keys, and
preload IPC types so Enterprise and github.com data never collide
* Route gh host qualification through runner options instead of argv sniff
Move GHES/GH_HOST resolution from parsing --hostname/--repo out of gh argv to an explicit options.host passed through ghExecFileAsync, since SSH-backed repos spawn gh with no cwd and argv sniffing couldn't reliably detect the target host. The runner now injects --hostname and qualifies --repo/-R at spawn time from options.host, and rate-limit scoping/guards use the same explicit host instead of inferring it. Also adds a shared githubRepoIdentityKey helper to keep cache/store keys consistent with the new host-aware repository identity.
* Fix gh CLI GHES host pinning and rate-limit scope leaks
- Pin `--host` on every gh call site so a process-level GH_HOST can't
silently redirect requests, and qualify `-R`/`-R=` repo shorthand
alongside the existing `--repo=` handling.
- Check the target scope for an active rate-limit block before each
WSL/native or host fallback retry, not just on the initial attempt,
so a blocked scope can't be hit again through a fallback path.
- Compute idempotency once per call instead of re-deriving it after
fallback reassigns args.
* Fix GitHub Enterprise host identity loss across PR/work-item paths
- Thread `host` through mobile PR RPC params, IPC work-item lookups, and
RPC schemas so GHES identity survives the renderer/mobile/main boundary
instead of silently falling back to a same-named github.com repo.
- Qualify `--repo`/`-R` args for github.com too (not just GHES), since
gh resolves bare shorthand against a process-level GH_HOST that can
redirect pinned github.com commands.
- Cache `getOriginGitHubApiRepository` to avoid a per-call uncached
`git remote get-url` round trip on connection-backed repos.
- Add a local-fork fallback in `getWorkItemDetails` so PRs living on a
base repo (not visible via the origin slug) still resolve via cwd.
- Centralize the github.com-vs-GHES host predicate in
`isDefaultGitHubHost` so cache keys, quota scoping, and identity
checks can't drift out of sync.
* Make repository identity host-aware across all GitHub surfaces
Generalize the auth-gated enterprise resolver to any remote and build a
cached hosted-identity family (origin/issue/candidates/source) on top of
it, then migrate every github.com-only consumer: Tasks listing/counting,
branch-to-PR discovery, push targets, fork upstream, issue operations,
Projects, web links, avatars, and PR-link facts. Scope the rate-limit
breaker probe per runtime:host and classify WSL UNC cwds correctly.
Co-authored-by: Orca <help@stably.ai>
* Fix expected slug to include host field in GitHub PR link test
Updates the smart-source paste-intent test fixture to match the
repository slug shape that now carries a `host` field, keeping GHES
host identity intact through the paste-intent parsing path.
* Surface per-host gh auth state for GitHub Enterprise
diagnoseGhAuth accepts the host a surface needs credentials for, scopes
the account/scope diagnosis to that host, and reports whether gh has any
login there; GhAuthErrorHelp renders host-qualified login/refresh
commands so an unauthenticated GHES host stops masquerading as a
github.com scope problem. Also fixes the mobile paste-intent expectation
for host-carrying parsed links.
Co-authored-by: Orca <help@stably.ai>
* Bound GHES identity caches and preserve non-default ports in host identity
Cap the origin-repo and host-auth caches like ownerRepoCache; keep ports
from remote/link URLs so GHES on a non-default port is a distinct
identity; make positional github.com slugs explicit against GH_HOST;
compare work-item sources by host-aware identity key; bail cwd-less
branch lookups when no repository candidate resolved; thread host
through the renderer work-item slug lookup.
Co-authored-by: Orca <help@stably.ai>
* Thread GitHub host through issue detail requests
Incorporates ghes-issue-host-support (ed6bb96ef): one hosted issue
repository identity is resolved before the details fan-out so comments,
timeline, participants, and mention lookups cannot drift across hosts,
with SSH guards so unresolved issue/PR repositories never fall through
to gh's default host.
Co-authored-by: Orca <help@stably.ai>
* Scope remaining GitHub rate-limit accounting
* Resolve typed PR lookups across hosted repository candidates
getWorkItem's PR path probes upstream-then-origin hosted candidates
instead of origin alone, so fork checkouts resolve the base repo's PR
with the right host; issue detail resolution reuses the up-front hosted
identity and keeps the SSH unresolved-host guards.
Co-authored-by: Orca <help@stably.ai>
* Refactor GitHub repository execution setup
* Carry host on smart-submit link intents
Co-authored-by: Orca <help@stably.ai>
* Carry the project host on GitHub item dialog origins
Co-authored-by: Orca <help@stably.ai>
* Keep GHES web ports but drop SSH transport ports in host identity
Supersedes PR #9118 on this branch: http(s) remote ports identify the
Enterprise web/API endpoint and are preserved, while ssh/git transport
ports (including ssh.github.com:443) never leak into gh's host identity.
Replaces the ssh.github.com:443 special case with the structural
protocol split and ports the PR's parsing test suite.
Co-authored-by: Orca <help@stably.ai>
* Support GitHub Enterprise diffs and mutations with host-scoped caches
Parse GitHub host identity from work-item URLs and carry it through PR/issue mutations, labels, and assignments. Bound rate-limit and scope-probe caches (1024 and 512 entries) to prevent unbounded growth when interacting with multiple GHES instances. Normalize repository identity keys to include host so github.com and GHES slugs don't collide in cache and equality checks.
* Support GitHub Enterprise diffs and mutations with host-scoped caches
- Carry host identity through PR mutations and reads so fork PRs on
different GHES instances don't collide in cache or state tracking.
- Validate host authentication before routing requests to unconfigured
Enterprise servers; ambient credentials must never reach untrusted hosts.
- Scope rate-limit guards and spend tracking per host so GHES quota stays
independent from github.com quota.
- Respect explicit --hostname arguments in gh CLI calls ahead of GH_HOST or
ambient defaults, so breaker state follows the actual request target.
- Detect implicit WSL runtimes from UNC paths for consistent host auth and
execution-options scoping across mobile and desktop clients.
* Support GitHub Enterprise work-item diffs with host-scoped execution
Enterprise PRs must use their selected host consistently across diff, comments,
and file-content loads. Validate repository slugs before authenticated execution
to prevent path-injection via renderer overrides. Scope project browsing cache
and rate-limit tracking by host to prevent cross-host pollution. Use parsed
URLs as authoritative over ambient hosts for project resolution.
* Support GitHub Enterprise work-item diffs with host-scoped execution
Preserve host identity on PR/issue work items throughout the mutation and diff
pipeline so Enterprise instances (including ported endpoints like
github.acme.test:8443) can execute mutations without ambiguity. Rate-limit gh
commands by the pre-qualified --repo host, cache auth state per ported host,
and surface Enterprise hosts in project metadata and error messages.
* fix(review): drop dead rateLimitGuard/noteRateLimitSpend re-export
Both callers (project-view.ts, mutations.ts) moved to the host-scoped
repositoryRateLimitGuard/noteRepositoryRateLimitSpend; the bucket-only
re-export in internals.ts had zero importers left.
Co-authored-by: Orca <help@stably.ai>
* fix(ci): split Enterprise host work-item tests under max-lines
Move GHES/SSH host-routing cases out of work-item-details.test.ts so
the suite stays within the 800-line test max-lines budget.
* test(github): align mocks with host-scoped repository resolution
- Route origin repository resolution through getOwnerRepoForRemote, not getOwnerRepo, to match production path
- Pin github.com host on origin results so host-less fixtures pass host gate in resolveGitHubApiRepository
- Add generation-based invalidation to prevent stale slug-cache writes from in-flight resolutions
- Fix ref-sync race in ProjectPicker: use useLayoutEffect so committed tree owns browse cache key
- Defer handledCrossRepoUrlRef assignment in SmartWorkspaceNameField until resolution succeeds
- Update Enterprise host routing: found work items must not silently fall back to default host when unresolved
- Normalize GHES avatar URLs: accept explicit port 443 as canonical form, not a fallback trigger
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): gate xterm contrast correction by theme mode (#7934)
minimumContrastRatio: 4.5 (added in #5986 to rescue invisible
white/bright-white ANSI text on light backgrounds) was applied globally,
over-correcting vibrant ANSI colors on dark themes. Keep 4.5 on light
themes; disable it (1) on dark themes.
applyTerminalAppearance re-gates it in its per-pane loop, so live
auto/system dark<->light flips are handled for free. buildDefaultTerminalOptions
keeps 4.5 as the initial value so the first paint on a light theme never
flashes low-contrast text. Supersedes #7939.
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): gate contrast correction by terminal background luminance
Contrast correction rescues white text on light backgrounds but over-corrects
on dark. The previous mode-based gate failed when the terminal theme didn't
match the app mode (e.g., terminalUseSeparateLightTheme=false). Now gates by
the theme's background luminance via isTerminalBackgroundLight() instead.
* refactor(terminal): extract contrast correction gating into shared helpe
Centralizes the minimumContrastRatio gating logic (#7934) into a
dedicated module so both the settings preview and live terminal
appearance apply the same contrast-by-luminance rule, preventing drift.
Adds value-gating to skip redundant writes that would clear xterm's
contrast cache on re-applies.
---------
Co-authored-by: Orca <help@stably.ai>
* fix(accounts): follow the runtime for WSL provider account detection (#9537)
On Windows + WSL, provider-account detection (usage recognition and the
status-bar account switcher) was pinned to the Windows host even when the
project runs in WSL, so WSL accounts were never recognized and the WSL
switcher group never appeared.
Root cause: `localAccountRuntime` hard-defaulted to 'host', which
short-circuited `getInitialClaude/CodexRateLimitTarget` before the existing
"follow the global Windows runtime default" branch could run. That branch was
therefore dead for every real user.
Fix: add an 'auto' value for `localAccountRuntime`, make it the default, and
migrate the untouched legacy 'host' default to 'auto' once (guarded by
`localAccountRuntimeDefaultedToAutoForAllUsers`; explicit 'wsl' is preserved).
'auto' resolves via a shared `resolveLocalAccountRuntimeTarget` helper: on a
windows-host default it stays host (no behavior change); on a WSL default it
follows WSL, so WSL accounts are recognized and the WSL group appears.
Wired the shared resolver into the managed-account default target, the
status-bar WSL-group gate, and the Accounts settings location toggle.
Note: detection follows the global Windows runtime default, not the live
active project's runtime (the fetch target is a single global value); the
latter is a larger follow-up.
* fix(accounts): align auto runtime consumers
* fix(accounts): keep runtime polling aligned with settings
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* Fix 6 e2e flakes: worktree teardown, window focus, and terminal cleanup
Tolerate selector_not_found during destructive worktree removal, retry transient
window reopens with bounded attempts, collapse dead split leaves in parked tabs,
stabilize tab-close persistence and diff-scroll assertions, and forward app logs
for visibility into failures. Each fix addresses a root cause—not a test workaround
—and includes a verification pass confirming no regressions. Fixes identified in
shard-10 CI failure (oracle #29710852934).
* Remove E2E fix verification document
This smoke-evidence file was used to track adversarial verification of the 6 e2e fixes during development. Now that the fixes are committed and tested, the temporary verification notes can be removed.
* Unify win32 window activation for sync and retry paths
Extract activateWindow to prevent drift between sync and async
paths on win32 reinforcement (moveTop, pulseAlwaysOnTop, retry
focus). Adds test coverage for window recovery on retry.
* feat(status-bar): consolidate agent usage into a single roster popover
The footer usage cluster is now one quiet, borderless control: each agent
shows its tightest window as neutral text (letter badges at icon-only
width), and clicking anywhere opens a consolidated Usage popover listing
every agent worst-first — icon, name, plan, soonest reset, and per-window
threshold-colored bars. Claude/Codex rows drill into their existing
account switcher, runtime toggle, and Codex reset credits via a submenu
variant of ProviderDetailsMenu; all other providers drill into their
detail panel. Row actions and the footer links route to Settings.
Also: barColor's <60% band goes green -> neutral so color is reserved for
approaching limits (threshold color now lives only in the popover, the
always-visible bar stays monochrome), Codex plan_type is surfaced as
ProviderRateLimits.planType for the "Codex · Plus" label, and the Fable
weekly window is labeled "Fable" so it no longer collides with "wk".
* fix(status-bar): single-line sign-in row + review dedup
Signed-out roster rows now read as one line (name · "not signed in" ·
right-aligned Sign in) instead of a floating button over an orphaned
second line. Review follow-ups: the non-submenu ProviderDetailsMenu
branch reuses the extracted panelBody, and the icon-only letter badge is
one shared component so its has-data dot condition can't drift.
* fix(status-bar): harden usage roster interactions
* chore: remove unrelated formatting change
* chore(skills): refresh bundle manifest for rc.2
* fix(status-bar): preserve usage roster semantics
* fix(status-bar): preserve roster menu interactions
* chore: remove unrelated formatting changes
* fix(status-bar): keep usage reset countdowns live
* feat(status-bar): toggle compact usage summary
* fix(status-bar): simplify usage mode toggle
* feat(status-bar): replace usage footer toggle with Compact/Detailed segmented control
Swap the bottom-of-popover on/off switch for a SettingsSegmentedControl at
the top of the Usage popover (view-switcher pattern), so both modes are
named and discoverable on first open. Reuses the repo's canonical
Compact/Detailed vocabulary from the Workspace card-layout control.
NeilandOrca
OrcaWin
Brennan Benson
fsdwen
余辉andJinjing
