* fix(mobile): preserve agent icons across stacked routes and tab updates
Closes#31939
* fix(renderer): address review feedback on mobile agent icon stability
* fix(renderer): fall back to customTitle when saved leafTitle is blank
* Keep mobile agent icons painted across retained routes
Use instance-specific OMP gradients and preserve bundled icon fallback during web image reload failures. Add a real mobile-web route-retention pixel regression.
Adapted from zhangxaochen’s scoped rendering fixes in #31948; unproven session equality and title changes are excluded.
Co-authored-by: zhangxaochen <zhangxaochen@163.com>
---------
Co-authored-by: Neil <neil@stably.ai>
* test: strengthen hook, build, and mobile lifecycle coverage
* fix: use relocated Jira types in issue user field
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(acp): ACP agents can declare a managed runtime installed on first chat start
An ACP launch spec may name a pinned runtime Orca installs under its locked
data folder. The stock lookup searches it last (Command, PATH, install
directories, managed folder); a start whose lookup missed installs it under
the acquisition's signal, then resolves the launch again. A Command setting,
restart-recovery reads and catalog probes never install.
The pinned-runtime materializer can now publish a verified multi-member
folder: extract once into staging, check each member's sha256, rename into
place, with a per-asset download size limit. Node's runtime path is unchanged.
* Fix ACP managed runtime lookup precedence
* feat(acp): ACP agents can run with a private per-process temp folder
* feat(acp): old managed runtime versions are removed at host start
Once per host start, the ACP registration removes every version beside an
agent's current managed runtime folder, and staging left by an earlier
process. One host owns the data root and ACP servers are never reattached
across host runs, so nothing runs from them. This process's own staging is
kept (a publish may be in flight). Best effort: a failure is logged and never
holds up a launch.
* feat(acp): a sign-in prompt on an ACP agent's stderr ends the start or turn signed out
An agent that waits for a browser sign-in prints a link on stderr and blocks for
minutes. A launch spec can now name that line (signInPrompt); the connection then
closes with a typed sign-in failure through the existing process owner, so a start
reads notSignedIn and a running turn fails signed out instead of settling unknown.
The matched line, which carries the sign-in URL, never enters the retained stderr
tail, errors or diagnostics.
* Prevent sign-in URLs leaking from long stderr lines
* feat(acp): an agent can enforce the permission mode itself through a session config option
An optional launch-spec field names the session config option and its ask/full values. Every new or
reopened session gets the value for the chat's full-access posture before it is exposed, and a refusal
fails the start. With the field present Orca no longer answers permission requests for the person.
No agent sets it yet.
* fix(acp): reject unconfirmed permission mode during acquisition
* feat(acp): an agent enforcing the permission mode itself runs the chat's own mode
The launch spec maps each chat permission mode to its session option value; a start sets the
value for the mode the host launches with (ask when it names none), replacing the global Agent
Permissions full-access read. A mid-chat change takes effect through the host's existing restart
of a child launched with another mode before the next send.
* Keep ACP session acquisition within the line limit
* feat(acp): open Antigravity in the Chat UI over its ACP server
With the experimental chat setting on, Antigravity chats run Google's
Antigravity ACP server, which Orca installs on the first chat start: a
pinned 1.3.0 release whose archive and both executables are verified by
hash (macOS arm64/x64, Linux x64/arm64).
Each host keeps one private sign-in folder for these chats under Orca's
data folder, made owner-only before every start; the server keeps its
sign-in there as a file. A chat signs in with the server's Google method
through the existing auth-required retry; with no saved sign-in the
server's sign-in prompt ends the chat signed out. The Agent Permissions
setting maps to the server's own mode, and a question the server asks
shows as a question that takes one of its choices, never auto-answered.
A chat reopens its session with session/resume.
* fix(acp): separate Antigravity chat command and require pinned host
* test(acp): assert Antigravity launch arguments across hosts
* feat(acp): Antigravity chats offer Ask, Accept edits and Full access per chat
Each mode maps to the server's own (default, auto_edit, yolo). No Approve for me:
the server has no automatic reviewer. Accept edits gets its own description,
since auto_edit approves file edit tools only.
* feat(native-chat): offer host-provided chats without their CLI detected
A host now marks each agentSession.agents row whose chat program Orca provides there
(an ACP managed runtime with a pinned build on this host). With Chat UI on, the tab-bar
picker, the empty-workspace default chat and the new-agent shortcut offer those agents
beside the detected ones when the launch opens as a chat. Terminal launches still follow
detection, and an older host that sends no mark keeps today's detection-only offer.
* Fix CLI-free chat fallback and picker updates
* Fix admission refusal reason test expectation
* feat(native-chat): the host health snapshot says whether each chat's program is on the machine
Antigravity's chat runs Orca's own download of Google's ACP program, not the agy CLI, so clients
could not tell from CLI detection whether it can open as a chat. Each snapshot row now carries an
optional chatProgram (available, installable, missing, unknown), found through the agent's own
launch resolver without spawning anything, and re-derived after a managed runtime install or
removal. Health state and reason are unchanged, so older clients decode the frame as before.
* feat(native-chat): one renderer reading of whether an agent can open as a chat on its host
Pickers asked CLI detection whether an agent can open as a chat, which is wrong for Antigravity,
whose chat runs a program Orca downloads. This module answers from the host's published chat
program fact, and for hosts that publish none, from the host's managed-runtime mark and install
capability or else CLI detection. Facts not yet learned read as unlearned, not as no.
* fix(native-chat): a declined chat opens its agent's terminal only where the CLI is installed
Once a chat can be offered without its CLI, a host refusal used to fall back to a terminal that
runs a CLI that is not there. The one admission boundary now reports the host's refusal instead
when the workspace host's detected agents lack the CLI, for new-tab, work-item and workspace
creation launches alike. A caller's own fallback, like the empty workspace's shell, still opens.
* feat(native-chat): the + menu and Settings offer a chat wherever its program runs
With Chat UI on and no agy CLI, Antigravity had no chat row in the + menu (or a disabled
'Not installed' one when switched on), because both read CLI detection. The menu now reads the
host's chat-program answer: a chat row where the program runs or installs from the chat, no
'(CLI)' row or terminal button without the CLI. A failed CLI check no longer keeps the menu from
learning that answer. Settings shows an unchosen provider on when its CLI or the program Orca
runs for it (downloaded or found outside Orca) is installed, and holds the switch until that is
known. A saved default that opens as a chat no longer says it is not detected.
* feat(native-chat): a default agent that opens as a chat starts without its CLI
An empty workspace and the new-agent shortcut skipped a default agent whose CLI is not detected,
even when it opens as a chat on that host (Antigravity without agy). Both now honor that default,
waiting briefly for the host's chat facts when they are not known yet, while the automatic pick
with no default still chooses only detected agents. Blank and the shell fallback are unchanged.
* feat(native-chat): new workspaces, work items, continuations and the dashboard offer chat-only agents
The new-workspace composer, work-item launches, session continuation and the dashboard launcher
listed only agents whose CLI is detected, so an agent that opens as a chat without its CLI could
not be picked, and an explicit pick of it was dropped. They now also offer agents that open as a
chat on the workspace's host, keep such an explicit choice, and the dashboard republishes when
the host's chat facts arrive. Automatic picks still choose only detected agents.
* feat(native-chat): Source Control and Fix Checks accept a chosen agent that opens as a chat
The Source Control action dialog, its saved auto-start, the checks panel, recovery launches and
Fix Checks (before and after its workspace exists) rejected a saved or default agent whose CLI
is not detected, even where it opens as a chat. They now accept it there and list it, through
the shared source-control pick, while the automatic pick still chooses only detected agents.
* fix(native-chat): an empty workspace does not wait on chat facts for a Claude or Codex default
Claude and Codex have no program Orca downloads, so without their CLI only the host's own answer
could offer them as a chat; holding the workspace empty for the host's agent list could not
change that.
* test(native-chat): pin the chat-program fact, cold explicit defaults and the CLI-less decline
Covers the host's program lookup and its re-read after an install, older and unknown snapshot
values falling back to the managed mark and install capability of the same host, an explicit
default opening as a chat with CLI detection failed while automatic and blank picks stay on
detected agents, kept composer and saved Source Control choices, and a declined chat reporting
the refusal instead of opening a terminal for a missing CLI on both launch paths.
* refactor(source-control): the action dialog's agent list lives in its own hook
The dialog hook was over the file-length limit after it learned which agents
open as a chat without their CLI; detection and that offer now live together
in use-source-control-launchable-agents.
* fix: typed test mocks and record the dialog's pre-existing reset effect
The Source Control dialog's open-cycle reset effect was already on main; the
changed-code gate reported it because the effect now also learns which agents
open as a chat.
* fix(native-chat): a declined chat refuses its terminal only when the CLI is known to be missing
When a host declines a chat, Orca falls back to that agent's terminal. A chat can now be offered
without its CLI, so the fallback must not open a terminal that cannot start. But a failed or
still-pending CLI check is not proof the CLI is missing: treating it that way blocked a working
terminal fallback (for example an OpenCode version that runs in a terminal but not as a chat).
Each detection producer (local, paired server, SSH) now records the outcome of its latest attempt
for the exact target, next to the IDs it already keeps. The decline check refuses the terminal
only when the same host's latest attempt succeeded and did not list the CLI; pending, failed or
unresolved outcomes keep the existing fallback, and a caller's own shell fallback is untouched.
* fix(native-chat): every launch surface learns whether a chat opens before it decides
A chat whose program runs on the host without its CLI (for example Antigravity) could be missing,
greyed out or swapped for another agent depending on which surface launched it: the composer
dropped an explicit pick while the host was still answering, Fix Checks and the Checks panel
refused a saved chat agent, an inactive paired host was never asked about its chats, the Providers
switch flashed off, and session continuation auto-picked an agent that was only offered.
One lease per host, runtime and pairing now acquires the host's agent list and health stream
for whoever needs it: the + menu, composers, Settings, the dashboard and its pop-out, Source
Control and Checks, Fix Checks, work items, shortcuts and continuation. Actions wait for those
facts within one bounded deadline (ordinary CLI detection keeps its own wait), cancel when the
workspace's host is genuinely replaced, and re-read settings before launching. A saved, default
or explicit choice may open as a chat without its CLI; automatic picks still come only from
detected agents. Pending or unknown facts never erase a choice or flash a switch off.
The dashboard's holds are reconciled by the publishers that read them, and a hold that notifies
while it is being created no longer leaks a second stream holder.
* fix: the new-workspace composer memoizes its launch workspace from its own fields
* fix: a declined chat reads the launch host's own agent inventory; test fixtures match their types
* fix: work-item launches detect before waiting on chat facts; the composer and Source Control list agents from one owner
The composer card no longer holds its own chat-facts lease beside its modal's, Source Control reads agent
inventory only while its dialog is open, and a work-item launch keeps the new workspace's own detection
when the store has not loaded that workspace yet.
* fix(native-chat): keep acquisition tied to the current host resource
* fix(native-chat): verify the current acquisition before returning choices
* fix(i18n): retain legacy terminal-list English entries in the runtime catalog
* fix(native-chat): the dashboard republishes launch options when the active workspace's host changes
Both dashboard publishers now watch the active workspace and its selected host, which own its launch
options. Two QuickLaunchButton tests assert the current "couldn't list terminal agents" wording.
Restores base forms and drops a duplicate workspace helper to stay inside the change budget.
* test: the dashboard publisher test reads its watched state from the function it tests
* fix(native-chat): dashboards watch one checked route-input view; saved Source Control discovery settles every outcome
Both dashboard publishers observe and derive launch options from one exhaustive, compiler-checked view of
the store slices the launch-route readers take, so a route input can no longer be missed by one list. A
saved Source Control action's discovery now ends as success, cancelled or failed; only success can auto-start,
and a cancelled or failed attempt reveals the editable dialog instead of launching on a replacement runtime.
Restores base forms and shares one worktree workspace helper to stay inside the change budget.
* style: format the runtime metadata resolver
* fix: merge duplicate imports the code-quality gate rejects
* test: the dashboard watch fixture seeds every route-input field
* test: the dashboard watch fixture is fully typed without a cast
* fix: an unknown agent scan stays unknown for Fix Checks and recovery, and a saved Checks agent keeps its message
* fix: the action-first chat path asks the same missing-CLI check before opening a declined terminal; compact to the size cap
* refactor: compact the chat-program changes to the size cap after merging main
* Pickers list an agent that can't open here as disabled with its reason instead of hiding it
The Create workspace and continuation pickers only searched the agents the caller could launch, so an enabled agent with no chat on this host (for example Antigravity when the host can't run it) lost its disabled row, while the + menu showed it.
* Continuation test accepts more than one disabled subfolder row now that disabled rows are listed
* Re-run CI: the code scan was cancelled across the repository
* test: cover chat selection without terminal CLI
* test: compact host chat program fixtures
* ci: move routine checks and unsigned builds to Blacksmith
* ci: retain GitHub Mac images for isolated SSH fixtures
* ci: keep shared terminal perf preparation on Blacksmith
* test: allow encrypted slow-link fixture to finish on ARM CI
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* ci: run relay integration on the Blacksmith x86 pool
* ci: use the validated Blacksmith pool for Linux packaging
* test: allow shared Linux download caches across validated runner pools
* perf(watch): stop watching all of userData and .git for a handful of files
On macOS a directory fs.watch is a recursive FSEvents stream. Two watches used
that to notice a few files:
- The Active Server preference watched the whole userData directory for
orca-environments.json, so Orca's own writes there (agent-hooks status,
terminal history, browser caches; ~10 events/s measured) were routed back
to it.
- The shallow git metadata watch ran fs.watch on each repo's whole common
.git dir (and .git/logs), receiving objects/, refs/, lfs/ and every linked
worktree's churn to see six files.
Both now watch the individual files (kqueue on macOS, no fseventsd) through a
new rebinding file watch: events and a 30s sweep re-stat the path, rebind when
a rename-replace or deletion moved it, and pick up files created later. Events
are confirmed by a stat (size/mtime/ctime/inode) because macOS raises an
attribute event for every mmap read of the index and packed-refs; the watch is
one-shot with a backing-off window so a file every git process maps costs about
one rebind a second instead of a wakeup per read. The registry path is
unchanged, so CLI/serve readers and older peers are unaffected. Linux and
Windows keep the non-recursive directory watch for shallow subscriptions.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(watch): don't hang unsubscribing an errored watcher; find late metadata files sooner
- Node closes an errored fs.watch handle without emitting 'close', and a later
close() is a no-op, so awaiting 'close' could hang a watcher-child unsubscribe
and every subscribe queued behind it. Errored watchers are now dropped without
a close, and closeFileSystemWatcher also settles on 'error' or after 1s.
Applies to both the macOS file watch and the Linux/Windows directory watch.
- Missing metadata files (packed-refs from pack-refs/gc) are re-statted every
2s instead of waiting for the 30s rebind sweep.
- On macOS the delivery probe watches a file, matching the kqueue path the
shallow subscriptions now use.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* test: remove redundant cases and repair behavioral assertions
* docs: reconcile audit records with current main
* fix(deps): apply security updates from #32101
Apply the six-file DOMPurify 3.4.17 and Next.js 16.4.1 patch from PR #32101 to resolve the dependency security gate for this test audit. Original patch by Brennan Benson.
* test: satisfy changed-line quality gates
Add required braces and replace filter indexing with find. Rerun both CI quality gates and the 27 affected relay tests; refresh audit hashes and record the corrections.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* Use incremental tsrs for local typechecks
* Update pinned Bun to 1.4.4
* fix(deps): bump dompurify to 3.4.17 and docs next to 16.4.1 for security advisories
dompurify 3.4.17 patches GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr and
GHSA-c6gr-qvv4-5v3f in the root and mobile lockfiles. next 16.4.1 patches
GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r in the
docs site.
* Prepare mobile bundle for smoke benchmarks
* Give native compiler benchmarks a larger ARM runner
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix: reduce worktree deletion branch cleanup overhead
Refresh only the remote base branches needed to prove a branch merged, with automatic maintenance disabled. Skip merge simulation when no common ancestor is available and preserve the branch when its remote base cannot be refreshed.
* fix: preserve fetch mappings and live branch cleanup fallbacks
* fix: spawn macOS worktree deletion commands off the main thread
* fix(editor): settle a save's shared record when the saving tab closed mid-write
With one file open in two workspaces, closing the saving tab while its write was in
flight left the other tab's disk baseline, dirty flag, draft and loaded text on the
pre-save version: every completion step looked the closed tab up by id and found
nothing, and the saved event listed only the closed tab as the record's views. An undo
back to the old text then read as clean and closed without asking.
The write now captures its record id with no await before the write, and completion
(rebaseline, dirty/draft settle, conflict clear or refusal banner, saved event's view
list) goes through a live view of that record, preferring a writable one. The save
runner and the write-lock wait do the same, so a save queued by a tab that closes
still writes through the record's remaining view. The chat visual's saved-event
listener also falls back to the record's views.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): follow a closed saver's record through re-keys, kept records and listeners
Review follow-ups to the closed-saving-tab fix:
- Completion now finds the record through the view ids captured before the write,
not the record id: a re-key mid-write (an unpinned runtime tab resolving its
pairing) keeps views but changes the id, which brought the original bug back.
- A fallback writer (asking view closed while queued or waiting on the file lock) is
chosen like autosave/restart's writer: writable and on a current connection, so a
stale-connection sibling no longer throws when a current view exists.
- With no view of the record left, a kept record (no-prompt removal) is dropped when
the write saved its text, else rebaselined; other open views of the file (a
detached peer) take the written baseline, keeping their edits.
- A save may mark a record clean through a read-only or CSV-preview view (markFileDirty
`written`); such views still never become dirty.
- Markdown preview refresh and the CSV pending-cell listener match the saved event's
record views, not only the saving view's id.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(editor): name the closed-view save harness as a test fixture
The focus-read ratchet scans non-test sources; the `.test-fixture.ts` suffix marks this
harness as test-only like the repo's other fixtures.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(ci): list the closed-view save rig as a unit support bridge
The rig builds on the autosave test fixture, which takes the editor slice harness, so
the routing check saw it as a product consumer of that harness. Bridges are an explicit
list, like the browser drawn-from-main fixture.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Neil
OrcaWinandOrcaWin
zhangxaochenandNeil
Brennan Benson
Leo(오영택)andJaeyoung22
