* fix(mobile): phone server rows follow the desktop's other-client and sleeping filters
A phone created through a desktop now records whom it acted for, so the
desktop's Hide other-client workspaces filter keeps the user's own phone
workspaces (locally and on servers) and hides only other people's.
The desktop relay marks each server row its sidebar would hide, and the
rows its own browser or chat tabs keep awake; the phone applies both.
* test(e2e): dedupe sidebar row ids in the visibility spec
* fix(mobile): address review: owner naming, old-server relayed phones, scope trim
* refactor(mobile): record a phone's owner as creator and fold desktop tab activity into the host flag
A phone now records its owner as the creator (this host for a directly
paired phone, the relaying desktop for a delegated one), so the shared rule
is unchanged and onBehalfOf is gone. The relay ORs the desktop's saved
browser/chat tabs into hasHostSidebarActivity, so the phone's status dot
follows too, and local worktree.ps counts the same signals. The old-server
fallback is removed.
* test(e2e): poll the phone and the sidebar together in the visibility spec
* feat(wsl-mover): shell history moves with the project to the WSL host (D1b-6c-1)
* fix(wsl-mover): moved WSL history lands under the host's login shell (D1b-6c-1)
* fix(wsl-mover): history follows the shell a pane would actually run, fallback included (D1b-6c-1)
* fix(wsl-mover): history installs follow the real pane shell, wait for live shells, and mark what they installed (D1b-6c-1)
* fix(wsl-mover): history installs wait until live shells can be checked (D1b-6c-1)
* fix(agent-launch): find a repo's project the way the window does
The host now also takes a project named after the repo as that repo's project, as the window
does, so both pick the same project row and runtime even when a repo was moved out of the
project named after it.
* refactor(agent-launch): share one repo-to-project match with the window
The host's agent-launch lookup and the window's launch preflight now call one projectMatchesRepo
instead of each writing the match out. No behaviour change on either side.
* fix(ssh): the SSH password dialog no longer closes itself and comes back
A host that drops an unanswered login no longer replaces the open prompt
with a new one, a background dial no longer replaces a connection whose
reconnect is asking the user, one Cancel closes every open prompt for that
host, and a paired client's automatic connect stays automatic.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): a typed password its reconnect has yet to use is not replaced by a background dial
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude <noreply@anthropic.com>
A workspace with no groups got a random root group id from the window. It
now gets the name-based id the shared loader already mints for that
workspace's group, so main can derive the same id without the window.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(wsl-mover): a moved pane reopens in its last folder on the WSL host (D1b-6b)
* fix(wsl-mover): consume a restore hint only when its pane spawns, scope it to its worktree, retry failed installs (D1b-6b)
* feat(orcad-migration): a capability-gated blob channel beside scrollback, for the WSL mover's new data (D1b-6a)
* fix(orcad-migration): the commit names its blob set, prune clears leaked blobs, reserved names refused (D1b-6a)
* perf(ci): reduce test overhead and reuse expensive build work
* test(ci): keep worker startup outside failure-case deadlines
* test: isolate push fixture advisory locks
* test(ci): preserve fixed drain retry allowance
* Align CI contracts with current triggers and guide content
* Stabilize consolidated reveal scenarios and retain behavioral CI contracts
* Fix upstream lint blockers while retaining behavior and assertions
* Classify global Jira preferences in the WSL migration inventory
* Align Jira test fixtures with startup and build safety checks
* Include package-test routing dependency in CI checkouts and fixtures
* Keep native stream classes intact in transcript dependency tests
* feat(chat): Resume in New CLI for OpenCode and OMP chats
OpenCode's and OMP's CLIs have no copy flag, but their chat protocol copies a
conversation (ACP session/fork). For a fork of one of their chats, the chat's
host now has a short-lived agent, launched exactly as the chat's own, copy the
conversation; the terminal then opens the copy with a plain resume. The chat
keeps its own conversation, so the CLI is never a second writer on it.
The copy travels on the existing aiVault.prepareSessionResume fork request as
an optional forkedSessionId; a host that predates it answers without one, and
the client asks for an Orca update instead of resuming the original.
* fix(chat): open an OpenCode 2.x chat's CLI copy with opencode, not opencode2
The copy kept the row's agent, so Resume in New CLI ran `opencode2 --standalone --session <copy>`,
which OpenCode 2.x doesn't install. The chat's host now answers the copy with the agent whose CLI
opens it: the chat's own.
* fix(chat): type the copied conversation's agent as a history agent
* fix: preserve independent chat copies through CLI launch
* test: keep only the tests that pin user-visible behavior
* fix(chat): validate OpenCode copies on their execution host
* test(chat): expect copied OMP forks after main integration
* test(session): compare what the window shows before and after the shared session loader
Boots the window's real startup hydration on each saved-profile fixture as
stored and as the shared loader rewrites it (load then save), and compares
tabs, groups, active tabs, pane trees, terminal bindings, editor and browser
tabs. Today's eight differences are listed with the loader rule behind each;
the list may only shrink, so any new difference fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(session): let the parity test own its store so the harness reads no host focus
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(session): restore the parity boot's UUID spy even when the boot throws
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The layout stream (layout.subscribe, still unused) re-loaded every session
partition and ran the load's save-and-diff report after each write. A save
now names the partition it wrote, the stream re-loads only that partition
without the report, and the renderer layout client no longer re-subscribes
on a timer. Adds a latency spec variant with a subscriber attached.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(wsl-mover): pause a moving project's terminals through Sleep and prove they exited (D1b-5d)
* fix(wsl-mover): gate again under the fence, swap journal phases atomically, keep sessions frozen through commit (D1b-5d)
* test(wsl-mover): the fence e2e walks the journal one phase at a time, as a move writes it (D1b-5d)
* feat(telemetry): count agent start failures from the host too
The host spawn path (CLI, phone, orchestration workers, headless automations,
worktree startup) now records agent_error when starting an agent fails, as the
window path already did. Removes C5a's TEMPORARY recordsAgentError input; the
host already threads each launch's telemetry, so failures get real kinds.
* fix(telemetry): count a claimed start that several requests joined once
Concurrent resumes of one agent session join one claimed start. When it
fails, every joined request ran the host catch and recorded agent_error, so
one failed start counted once per request. Only the request that ran the
start records it now; the others still clean up.
* fix(telemetry): only skip agent_error for a request that joined another start
The host marked a request as joined before calling ensure, so a claim that
refused the request on its own (conflict, capacity, unreachable owner) recorded
no agent_error. ensure now reports the join itself, right before awaiting the
other request's start.
* chore: re-run CI after main's localization fix (#28810)
* feat(chat): Resume in New Native Chat for Pi terminal conversations
A Pi conversation started in the terminal now offers "Resume in New Native Chat" in its Session
History row menu and its tab's right-click menu, like the other chat agents: a new Pi chat takes
it over, showing its history and continuing it.
Pi joins the shared adoption path. Its import finds the session file Session History lists under
the row id, and reads it with OMP's decoder, since OMP kept Pi's session format. A Pi chat's handle
names its session file, so the import says so and create mints the adopted handle from the found
file; the committed-create replay compares through the registration's row id, and the adopted
link id is kept to the link-id alphabet. A Pi chat forks a conversation recorded in another folder
instead of resuming it, so the workspace rule covers Pi too.
* fix(pi): preserve adopted session identity and active history
* Fix saved Pi adoption history and summary content
* test: keep only the tests that pin user-visible behavior
* fix(files): never write through a dangling symlink
A path that doesn't exist yet was authorized by walking up to the nearest
existing folder. A dangling symlink fails realpath with ENOENT, so the walk
stepped over it and approved the link's own path; the write then followed
the link and created its target outside the allowed folders. The walk now
continues from the link's target, and returns that real destination.
* refactor(native-chat): rename the chat visuals folder to the chat scratch folder
The per-chat folder agents write into is the chat's scratch space, not only
a visuals folder. Its root becomes <state>/chat-scratch/<hash> (the hash is
unchanged) and the agent variable becomes ORCA_CHAT_SCRATCH_DIR. The old
ORCA_CHAT_VISUALS_DIR is never set and is still stripped from what every
agent child inherits, Pi included. The visuals skill names the new variable
and says the folder is temporary.
* test(native-chat): keep the delivery test to the rename
The launch parity snapshot already pins that every agent drops the
pre-rename variable.
* fix(files): refuse any dangling symlink in the missing-path walk
Following a dangling link by hand resolved relative targets against the
lexical parent, not the link's real folder: through a folder link the walk
could loop forever or authorize the wrong file. Refuse instead: realpath
can't say where a dangling link leads, but a write would follow it.
* feat(runtime-files): the host serves a chat's scratch folder as a file root
File commands accept `path:<this host's chat-scratch root>/<32 hex>` and
resolve it only when it names this host's own folder, at the file-commands
seam so the selector never reaches chat placement. They authorize against
the project roots plus the chat-scratch root, refuse files.open/openDiff
for the folder, and agentSession.readVisual's ok results carry the file's
absolute path so a client can build the selector.
* test(runtime-files): name the readVisual helper's parameter type
* test(files): drop the loop case that duplicated the dangling-link refusal
* test(runtime-files): run the readVisual RPC test, which opens a real SQLite store, under Node
* test(runtime-files): put the same-suffix folder inside the authorized root so only the selector refuses it
* refactor(native-chat): open a chat visual like any file
"Open in new tab" on an inline chat visual now opens the visual's file the
way any HTML file of the chat's workspace opens: a file:// browser tab for a
local chat (its overflow menu gains "Open source file"), the document
preview for a paired-host chat (with its existing source action and Share).
Edits save on the chat's host through the exact path: selector the host
serves, and a matching editor save re-reads the inline copy freshly. The
read-only chat-visual tab is removed.
* fix(native-chat): a visual read without a path is a malformed reply
A visual's path is always on the current host's readVisual answer, so the
inline Open needs no branch for a missing one. Also prune the deleted
chat-visual tab action from the layout-writer baseline.
* test(native-chat): give visual read replies their path without longer lines
* fix(native-chat): address a scratch file by its folder only outside every workspace
A workspace that contains the host's state folder keeps its own address, so
explorer drops, folder creation and renames inside it stay on one root.
Document preview Share reads a runtime grant's own selector and root
directly instead of passing the selector off as a workspace id.
* test(runtime-files): wait for the stores to close before removing the state folder
* feat(native-chat): record which agent run wrote each journal item
Each journal item row, subagent roster entry and background-task entry now
records ownerFence: the lease fence of the agent run whose output produced it.
Optional, persisted, no row version bump and no migration. The journal's
itemFence() returns it, so the turn-verdict rules and per-run provider activity
read the producing run rather than the writer's fence.
* test(native-chat): fewer provenance tests: fold reopen and unstated-owner checks into the main case
Drops the epoch-replacement case (Part 2 rewind test reads the same values through the same rebuild) and the corrupt-value case (no version writes one).
* test(native-chat): an unstamped roster entry from an older build reads as its row provenance
Moved here from Part 4 so it sits beside stampJournalEntryProvenance.
* test(native-chat): build the older-build roster row inline, after main removed its body helper
Main #27947 writes one row per subagent and deleted journal-subagent-group-body; a roster row from an older build is still what this case reads.
* refactor(native-chat): provenance is per item only; drop per-entry stamping
Main's #27947 writes one saved row per subagent, and each background task already has its own row,
so an item's own ownerFence names the run of every entry a producer still writes. Per-entry stamps
inside a row mattered only for the shared roster rows saved before #27947, and no run writes into
those any more, so the row's own provenance settles them correctly. Removes the entry stamping,
the optional ownerFence on roster entries and background tasks, and their tests.
* fix(native-chat): an item's provenance is set when it is created; revisions keep it
A newer run's provider can revise an item an older run created: Pi's start and an ACP
session/load both report context usage onto the newest saved turn. Restamping that turn with
the newer run let the newer run's exit settle the older run's unverifiable turn as interrupted.
Only creation states an owner now, as main's itemFences rule did.
* test(native-chat): keep the provenance test below the production lines it covers
* Bound and sanitize CI failure excerpts with linear ANSI stripping
* Fix excerpt regression checks and reduce bounded marker overhead
* Require signal proof for benchmark timeouts and load consumer fixtures portably
* Validate benchmark timeout framing and run required cases with a pinned CI baseline
* Strip dense generic ANSI escapes with bounded forward scanning
* Use the standard UTF8 encoder for byte-cap test oracles
* Gate CI log performance suites behind a dedicated job
The wall-clock performance suites run about 1k child workloads up to 63 MiB, so they were sharing runners with unit tests and could fail on noise. They now run only in their own `check_log_performance` job, opted in with `ORCA_CHECK_LOG_PERF=1`.
- Remove the pinned-baseline checkout and `ORCA_CHECK_LOG_BASELINE_DIR`. The baseline comparison is now a manual step that reads the pinned ref from local Git history.
- Run the current-implementation checks with `compareBaseline: false`, which skips baseline builds and audits.
* Inline check-log fixture and drop dedicated perf CI job
- Replace the captured failure-log JSON with a synthetic log built by `createCheckLogFixture()`, so no scraped job output or provenance metadata is kept in the repo.
- Remove the `check_log_performance` CI job. The log performance suites now run only when `ORCA_CHECK_LOG_PERF=1` is set, as a manual benchmark.
- Update the benchmark scripts and tests to use the new fixture helper and drop the `fixturePath` parameter.
* fix(terminal): store the Terminal shell setting trimmed
The Settings field only stripped leading spaces and a hand-edited settings file loaded as-is, so a trailing space reached agent tabs, the CLI and other host-planned launches, while plain terminal tabs trimmed it in their own reader. Trim the setting when the field loses focus and when settings load (whitespace-only becomes unset), and drop the plain-tab reader's now-redundant trim.
* fix(terminal): trim the shell setting at the settings write too
A keystroke write could still store a padded shell, and Escape closes Settings without a blur, so a plain tab could launch the padded value once its own trim was gone. Trim at the settings write boundary (shared with load, like the machine name), and keep the typed text in a local draft while the field is focused.
* fix(settings): drop the shell field's draft when the field unmounts
The draft lived on the whole Terminal pane, so a field removed without a blur (another window switching to System shell, or the settings search hiding it) left a stale draft that showed later instead of the saved shell. Move it into a small input component so it is discarded with the field.
* feat(serve): keep browser tabs across an orca serve restart
A host with no window now saves the browser tabs it opens in the same shape a
desktop window saves its own, and restores them the same way: listed at once
with their last address, each page started when a client first opens or
drives it. A closed tab is forgotten; a page that ends with the process is not
a close.
* test(e2e): the server's published strip now holds its saved browser tab
* fix(serve): save browser addresses cheaply, open once, restore by page id
Review fixes: a page's address is written onto its saved records without
reloading the layout, and only on committed navigations; reopening a saved
page writes nothing; a command naming only the page finds the workspace that
saved it; a refused save no longer throws from a page event or a close. The
browser-tab map is renamed to say it lists saved tabs too.
* fix(serve): list, switch and close saved browser tabs from commands that name no page or worktree
* fix(serve): a tab list does not start saved pages; only a command acting on a page does
* fix(serve): a pageless command starts the browser tab the layout shows, not the first saved one
A host now records the browser tab a window would show: the one it just
opened, and the one a tab switch picks. With nothing running, a command
that names no page starts that tab; when the layout shows none it starts
nothing and reports no browser tab open.
* fix(serve): report the saved active browser tab as current
Claude-Session: p2-headless
* chore(ratchet): count the serve browser-tab save as a main-process layout writer
Claude-Session: p2-headless
* fix(serve): use the window's active browser tab rule, one scope, one active row
Claude-Session: p2-headless
* fix(browser): pick the active tab among tabs this host can start
A desktop document page or a remote page recorded as active no longer leaves a
pageless command with no tab. Adds a test for the first-saved-worktree scope.
Claude-Session: p2-headless
* refactor(browser): restore saved serve tabs through the page wake point
Saved serve browser tabs now start where a window would mount them: the two
existing wake helpers ask one host hook before messaging a window. The offscreen
backend reports opened and moved pages, so the command layer no longer threads
save, list, select or close hooks. No worktree named and no page running reports
no tab, as a window does.
Claude-Session: p2-headless
* fix(browser): only page creation opens a saved serve tab
A navigation now only updates an existing saved tab, so a late load after a close
cannot re-add it; a restored page sends no open, so its saved title stays.
Claude-Session: p2-headless
* refactor(browser): drop the restore mark the open/navigate split made redundant
Claude-Session: p2-headless
* refactor(browser): save serve tabs from the create command, list unstarted ones as tab rows
The create command saves the tab (it holds the group), so the backend reports only
navigations. Unstarted saved tabs are tab-info rows the existing listings take
as-is, the restore dedupe map goes (a created page registers before createTab
returns), and one lookup gives a page's unified tab id.
Claude-Session: p2-headless
* fix(browser): opening a serve browser tab no longer records it as active
Which tab shows is a view's choice; after a restart the active tab is the one a
window recorded, else the first.
Claude-Session: p2-headless
* fix(browser): give the composed browser command owners the saved-tab host member
Completes the forward merge of main's browser command split (#27576).
Claude-Session: p2-headless
* test(unread): characterize today's workspace and pane unread transitions
Pins, against the real store, what every unread trigger does today: the workspace
flag per host row, the three tab/pane marker maps, persistence calls and payloads,
lastActivityAt and sortEpoch bumps, the Dock count and the floating launcher dot.
Events are replayed through one driver file so a later rewiring of who writes the
state changes only the driver, never these expectations.
* refactor(unread): one workspace-attention module owns every unread transition
Every write to the workspace unread flag and the tab/pane/completion markers now
goes through src/renderer/src/store/slices/workspace-attention: store operations
named by the triggering event (bell, agent attention, pane input, viewed-agent
auto-ack, manual mark read/unread) and pure transitions folded into other slices'
set() calls (activation, tab activation, close, sleep, hibernate, retire, rekey,
reconcile, mirror removal, purge, acknowledge). Behaviour, storage, readers,
persistence and wire format are unchanged; the characterization suites pass
without edits to their expectations.
* refactor(unread): review fixes for the workspace-attention module
- Ratchets: moved terminal-tab-attention baseline entries to terminal-tab-appearance; split
the characterization setup/observables into an exempt fixture so the driver holds only events.
- Removed the test-only writer seam; mocked-store tests assert the event they fire.
- The slice owns the experimental pane gate for completions too; groupAttentionEnabled is gone
from the attention request and write.
- Collapsed marker removals to removeTabsAttention / removePanesAttention /
removeCompletionAttention / removeTabMarkers / movePaneAttention; tab activation uses
omitRecordKeys.
- Mark read/unread is passed in like other store actions; readers of the workspace dot go
through isWorkspaceUnread.
* feat(unread): on screen means read; the workspace flag follows its markers
While Orca's window is visible and focused, the tabs on screen (active tab
of the active workspace, plus an open floating panel) are read: every tab,
pane and completion marker of each. One scan (the auto-ack hook, now
startViewedAttentionScan) replaces the keydown, pointerdown, tab
activation, group focus, workspace activation and auto-ack marker clears.
After a read, close, sleep, hibernate, retire or purge that removed a
marker, a workspace's flag is cleared once no tab or completion marker
remains on a live tab; a marker-less flag (Mark as unread, restart,
another client) is read when its workspace comes on screen. Mark as read
removes every marker in the workspace. Reads and removals dismiss the
affected panes' OS notifications in one IPC call.
* fix(unread): a bell or completion already on screen leaves no marker or flag write
Marking now asks the scan's own on-screen rule (isTabOnScreen: the window is
visible and focused and the tab is a scan target), so an on-screen bell no
longer persists the flag true then false. A completion in any split pane of
the tab on screen is viewed, matching the read. A superseded turn's
completion-marker removal settles the flag and dismisses like other removals.
* fix(unread): read the screen across hosts, groups and non-agent views; mark only for an absent user
- Arriving at a workspace in its own view settles its flag even when it shows an
editor, browser or nothing; Settings and other views read nothing.
- A bell or completion on screen skips marking only when the user is confirmed
present under the scan's own presence gate (input, or main reporting the
desktop active within the shared away threshold); otherwise it marks and the
gated scan reads it when the user returns.
- The active workspace's host is part of the screen, so switching same-id folder
rows between hosts is an arrival on the new host.
- Removal settles lower every same-id folder row and persist each host.
- Opening and closing the floating panel both rescan.
- Every visible tab group's active tab is on screen, not only the focused one.
- One pane-key parser, one marker-tab enumeration, one removal wrapper
(settleAttentionRemovedBy), one remove-and-dismiss; the hook is now
useReadOnScreenAttention over on-screen-attention-scan.ts, and terminal
keystrokes reach presence through a capture-phase window keydown.
* fix(unread): presence only from renderer input; host-exact folder flags; subjectless completions follow the screen
- Main's 'not away' answers only the scan that asked; presence is stamped
only by trusted input (wheel included), so it can't outlive the threshold.
- isWorkspaceViewed uses the on-screen rule (workspace view showing, focused
window, user present), so a subjectless completion marks under Settings or
while away.
- Folder flag writes resolve the row's host like updateFolderWorkspace does
(project-group fallback), so the row flipped and the owner persisted match.
- A runtime host purge dismisses but doesn't settle flags of surviving rows.
- DESKTOP_AWAY_SECONDS is the shared threshold's neutral name.
* test(unread): folder flag persists name the row's host
* test(unread): drop casts from the folder persistence seeds
* fix(unread): point the reliability gate and e2e fixture at the renamed on-screen hook
* refactor(unread): drop reshapes the follow-up deletes; keep the flag functions module-internal
Reverts the reconcile/mirror/activation/focus/group call sites and the isWorkspaceUnread
selector to main, removes removeTabMarkers, removeCompletionAttention and the activation
read helpers, and drives tests through public attention actions.
* test(unread): read the Dock badge flag down by putting its tab on screen
* fix(unread): keep the on-input read action removed after merging main
* fix(files): never write through a dangling symlink
A path that doesn't exist yet was authorized by walking up to the nearest
existing folder. A dangling symlink fails realpath with ENOENT, so the walk
stepped over it and approved the link's own path; the write then followed
the link and created its target outside the allowed folders. The walk now
continues from the link's target, and returns that real destination.
* refactor(native-chat): rename the chat visuals folder to the chat scratch folder
The per-chat folder agents write into is the chat's scratch space, not only
a visuals folder. Its root becomes <state>/chat-scratch/<hash> (the hash is
unchanged) and the agent variable becomes ORCA_CHAT_SCRATCH_DIR. The old
ORCA_CHAT_VISUALS_DIR is never set and is still stripped from what every
agent child inherits, Pi included. The visuals skill names the new variable
and says the folder is temporary.
* test(native-chat): keep the delivery test to the rename
The launch parity snapshot already pins that every agent drops the
pre-rename variable.
* fix(files): refuse any dangling symlink in the missing-path walk
Following a dangling link by hand resolved relative targets against the
lexical parent, not the link's real folder: through a folder link the walk
could loop forever or authorize the wrong file. Refuse instead: realpath
can't say where a dangling link leads, but a write would follow it.
* feat(runtime-files): the host serves a chat's scratch folder as a file root
File commands accept `path:<this host's chat-scratch root>/<32 hex>` and
resolve it only when it names this host's own folder, at the file-commands
seam so the selector never reaches chat placement. They authorize against
the project roots plus the chat-scratch root, refuse files.open/openDiff
for the folder, and agentSession.readVisual's ok results carry the file's
absolute path so a client can build the selector.
* test(runtime-files): name the readVisual helper's parameter type
* test(files): drop the loop case that duplicated the dangling-link refusal
* test(runtime-files): run the readVisual RPC test, which opens a real SQLite store, under Node
* test(runtime-files): put the same-suffix folder inside the authorized root so only the selector refuses it
* test(runtime-files): wait for the stores to close before removing the state folder
* refactor(jira): split issue workspace hooks and IPC param checks
- Move IPC argument normalization into jira-ipc-params.ts so the
jira:* handlers and its tests share one validator. Issue edits are
now also checked for labelOperations, which the host reads, so
malformed label edits are rejected before they reach Jira.
- Move issue hydration and remote detail state out of
JiraIssueWorkspace.tsx into use-jira-issue-workspace-data.ts, and
comment submission into use-jira-issue-comment-submission.ts, so the
component stays under the file-size limit.
- Split the reopened-issue and rollback optimistic-edit tests into their
own files to keep each test file focused.
- Move runtime capability constants into runtime-capability-constants.ts
and re-export them from protocol-version.ts, so the values keep the
same names and exports for existing importers.
* refactor(protocol): use named imports for runtime capability constants
Import the runtime capability constants by name instead of destructuring
them from a namespace object. The bindings and values are unchanged.
Named imports make the dependency explicit to readers and tooling, and
the protocol version comment now sits next to the constants it describes.
## ELI5
Keep the test suite working with the Jira features that have just landed. There is no visible app change.
## What Changed
The host-picker test now expects the host-qualified selection the parent already accepts. The startup fixture provides Electron's protocol handler and verifies that ready installs the Jira image scheme. Jira edit tests use exported wrappers with module-local setters that are cleared on unmount, preserving the issue/source switch tests without the banned mutable function export.
The WSL storage inventory classifies Jira list columns, linked-view choice and prompt templates as device preferences, matching their keys and the existing Linear policy. Skill-guide tests check the actual generated discovery projection rather than assuming it is shorter than every full guide or uses one fixed phrase. The cache test follows the headless workflow's deliberate removal of its push trigger; cache-warmer checks remain intact.
## Why
Final CI found six stale integration assumptions after the Jira batch. Updating the fixtures and inventory preserves the landed behavior and the underlying checks. Changing production code, padding the Jira guide, or restoring an intentionally removed workflow trigger would change the product to satisfy incorrect test assumptions.
## Linked Issue
Follow-up to #28622, #28631 and #28592. The existing headless trigger policy was introduced in #28664.
## Visual Proof
N/A — tests, test fixtures and storage inventory declarations only; no visual or interaction change.
## Testing
- [x] Automated tests updated.
- [x] 196 focused tests across nine files pass on macOS, covering every failed shard assertion, fixture consumers and the headless workflow policy.
- [x] Node and web typechecks pass; all seven changed-code quality stages, formatting and diff checks pass.
- Reproduced five failing assertions in startup/export/storage tests and the skill projection failure before the repairs. The host-picker owner also reproduced the stale selection failure before correcting it.
- Final full CI will run on this PR. The prior Ubuntu 22.04 persistence job crashed in the native watcher build before persistence tests ran; this change does not claim a Linux release, live Jira or real SSH pass.
## Review
Independent source review found no issues; all six reviewed file hashes and the complete diff match committed head `aa703eb50147ba95646cb82f10b6d86b4f890fc4`. Risk: low. No authentication, network, protocol implementation, workflow, renderer behavior, remote messages or migration rewrite logic changes.
## Agent skill upstream boundary
- [x] Not applicable; no upstream skill-installer source or artifacts copied.
## Notes
The three storage keys contain device-level preferences, without workspace paths or identifiers. Tests preserve host disambiguation and issue/source switching. Platform, SSH and provider behavior remains in the existing implementations.
## Checklist
- [x] Small and focused.
- [x] Explained the before/after, mechanism and choice of approach.
- [x] Visual proof marked N/A with a reason.
- [x] Self-reviewed for correctness and cleanup.
- [x] Cross-platform and SSH impact considered.
- [x] Focused tests, types, formatting and quality checks pass; full CI covers the broader build.
Remember an optional Jira project for each repository so its issue picker and Tasks list start with the intended project and site. Keep temporary project overrides separate from the saved default, and choose a mapped workspace destination while retaining the Jira account that supplied the issue. Older hosts that discard the optional saved field return an actionable message.
Keep account ownership separate from repository execution identity. An explicit matching repository owner disambiguates repeated IDs; automatic defaults require ID uniqueness, and overrides include execution-host identity. Preserve existing preselection behavior, saved/manual query classification and linked-view choices. Reuse existing persistence, identity and query builders; check the final UTF-8 query length for searches and project-filtered presets and show a recoverable error before dispatch.
Validation at reviewed 9b174ae4: 205 affected tests, node/web typechecks, seven changed-source quality checks, and 189 fresh rendered assertion invocations with 39 inspected screenshots and 1,413 stable source hashes pass. Independent source and artifact reviews found no blocker. The rendered evidence uses synthetic transports. Ubuntu 22.04 persistence CI stopped before tests because the native watcher crashed during the build; those inputs are unchanged from the preceding passing head. Full CI is not claimed green.
Load Jira attachment images separately from issue Markdown so descriptions and comments stay small while screenshots load lazily and open in the existing lightbox. Downloads begin when an image mounts, capture its owning host, require negotiated image support, and use bounded authenticated byte streams and caches. Older clients retain their inline-image handlers.
Keep legacy and cancellable downloads in separate in-flight domains so cancelling a new image reader cannot abort a legacy reader; completed bytes share the bounded cache. Preserve the landed assignee, board, transition/comment queue and request lifetimes. Move unchanged project metadata IPC handlers into their domain module and tighten two inherited focus-check ceilings without changing behavior.
Validation:410 tests/54 suites; all changed-source quality stages, lint, format, routing and contract checks; exact final node/web types; independent source review;48/48 fresh hidden Electron checks with226 stable source hashes and nine inspected screenshots. Synthetic transports exercise production clients and UI. Current CI static checks, mobile bundle, wire compatibility, Linux/Windows packaging and Windows serve pass; five test shards were pending at review.
Extends the existing attachment work credited to Frank (@lifefloating) and Brennan Benson in PR #8938; existing contribution credits and media remain in this PR.
Show Jira issues as a board alongside the existing list and add the current-sprint preset. Status moves use the existing owner-scoped mutation queue, collect required workflow fields/comments, retain rejected drafts, and reload the mounted comment timeline once after success. Source/session fences keep older detail failures from undoing newer board moves.
Preserve statuses plus sprint in query preview and Edit-as-JQL. Older hosts must advertise sprint support; unsupported peers fail clearly. Existing capability definitions and test fixtures are split without changing public exports, wire strings, or coverage to meet current lint limits.
Validation:351 tests/42 suites,all46 changed sources full-file lint/anti-slop and7quality stages,localization/RPC checks,and independent source review passed. Node types passed on runtime-identical99d and web types passed on final602d. Fresh hidden Electron54/54 checks passed on99d; final two test-only changes were hash and emitted-runtime audited. The inherited IPC301-line failure is byte-identical main and being corrected separately by the image PR.
Adapted Eugenio Valeiras (@EugeValeiras)'s board contribution from PR #13054.
Co-authored-by: Eugenio Valeiras <eugenio.valeiras@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Collect required Jira transition fields through the shared issue save queue, preserve entered fields after rejected saves, and refresh the comment timeline after successful transition comments. Keep captured-host and older-peer compatibility.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
Choose Jira issue-key casing and review-title prefixes while preserving manual GitHub/GitLab title and body edits during generation, branch changes and remounts.
Co-authored-by: chucoding <56211193+chucoding@users.noreply.github.com>
Combine remembered Jira status filters with presets and saved JQL on the connection host, protecting obsolete owner actions and keeping incompatible controls hidden in linked mode.
Co-authored-by: Brennan Benson <brennankbenson@gmail.com>
Choose and sort Jira planning columns while bounding optional field discovery, preserving complete Cloud searches and aligning copy/workspace actions in responsive rows.
Co-authored-by: Dagan <idan.d@imagen-ai.com>
Save and apply named Jira queries on their connection host. Reject obsolete owner actions and exit linked mode only after a saved query is actually applied.
Co-authored-by: no-support <jwan0131@gmail.com>
Complete Jira Cloud discovery and token pagination, reject incomplete pages, and classify presets by status while retaining strict CLI reads.
Co-authored-by: ggbdpq <ggbdpq@gmail.com>
Support scoped Jira Cloud API tokens through the configured gateway while keeping self-hosted routing, redirects, diagnostics, and selected-host capabilities bounded.
Co-authored-by: Jerome Würf <oss@scharom.de>
Use one token-based task search implementation on desktop and mobile. Preserve explicit issue/PR qualifiers, distinguish quoted search text, and follow shared reexports in mounted mobile recordings.
Refs #10950 and #11121.
Co-authored-by: MumuTW <42820974+MumuTW@users.noreply.github.com>
Expose host-owned verified Jira reads and single-attempt writes through the CLI. Preserve site ambiguity checks, old-host capability refusal, atomic label changes, and uncertainty after failed writes.
Refs #11986 and #26055.
Co-authored-by: Dan Cieslak <dcieslak19973@users.noreply.github.com>
Co-authored-by: kokbee <kok2209@gmail.com>
* Recover orphan browser processes and clarify blocked updates
* Use isolated Electron launch flags for sidecar lifetime tests
* Keep update retries fenced while describing blockers
* Keep update translations and context clock valid on current main
* Use the option context clock restored on main
* fix(updater): address status guidance and test launch reviews
* fix(runtime): save a windowless host's chat tabs in its layout
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab on the index's hidden notice, which every close reaches
Claude-Session: p2-headless
* fix(runtime): a chat whose record is gone loses its saved tab at startup
Claude-Session: p2-headless
* test: run the windowless chat-layout host test in the Node runtime project
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab from whichever partition still holds it
Claude-Session: p2-headless
* refactor(runtime): list saved chat tabs across partitions in the layout module
Claude-Session: p2-headless
* refactor(runtime): read saved chat tabs straight from the store's partitions
Claude-Session: p2-headless
* fix(chat-tabs): save a windowless chat tab under its own tab id
Review pass: the saved tab reuses the id status and attention address, the close
checks for a window before scanning partitions, and the host tests seed readable
records with unreadable, other-host and no-index cases.
Claude-Session: p2-headless
* test(chat-tabs): a window opening a windowless-saved chat reuses its tab
Claude-Session: p2-headless
* test(chat-tabs): check the saved tab with the lookup a window reuses
The window's existing-tab lookup moves to the shared projection so the
windowless-layout test exercises it without importing the renderer.
Claude-Session: p2-headless
* test(chat-tabs): assert the reused tab's identity directly
Drops the shared lookup added for the test; two functions already carry that name.
Claude-Session: p2-headless
* fix(chat-tabs): leave an unstamped chat tab in an SSH partition to that host
Claude-Session: p2-headless
* fix(chat-tabs): count an unstamped chat tab as this host's only in the local partition
A desktop mirrors a remote server's chats into that server's runtime partition
without a host stamp; the startup sweep must not delete them.
Claude-Session: p2-headless
* refactor(chat-tabs): one chat tab writer, one startup match, local partition only
Chats run only on local hosts, so their saved tabs live in the local partition:
the cross-partition listing and its writer go. Open and close share one layout
load, the startup fill and sweep become one function beside the index seed, and
the tab filter is the existing savedSessionId.
Claude-Session: p2-headless
* fix(chat-tabs): restore and sweep saved Claude chat tabs like any structured chat
The Claude skip predates Claude structured chats (#18519, #18560); an id the host
has no record of is already dropped by the readable restorer.
Claude-Session: p2-headless
With a Hangul syllable still composing, macOS reports Ctrl+2 as key 'Process', so
tab.selectByIndex (and every other chord) matched nothing and the press only
committed the syllable. A Cmd/Ctrl chord (or Alt off macOS, minus AltGr) is never
IME text, so fall back to the physical code for 'Process' the way '' and
'Unidentified' already do.
Fixes#28159
* Carry a person's stopped messages to the agent with their next send
A message a person sent and then stopped before the agent started on it was kept
on screen as "Stopped manually" but never reached the agent. The delivery loop
now derives the stopped messages the agent is still owed, names them on the next
ordinary send's handover row, and each agent receives them in that same write as
framed context (Claude and Pi: framed text and images in the prompt; ACP: leading
blocks; Codex: turn/start additionalContext, or framed input items for images
and steers). Codex withdrawals that may have reached the agent are marked so they
are never carried.
* Let a queued card's hand-off carry stopped history; test the exactly-once outcomes
A card's hand-off records no sender, so carrier eligibility also accepts a
queued card whose body names no other agent. Tests cover every row of the
exactly-once table against the real host, each agent's rendering, the journal
fold, and that nothing a client parses changes.
* Keep a send that carried stopped history out of fingerprint reconciliation
After a host crash, restart reconciliation matches an unsettled send to the
agent's transcript by fingerprint. A carrier's transcript copy leads with its
stopped history, so it could never match and would read as never delivered,
which would also release its history again. Like a send with an attachment,
it now stays unconfirmed.
* Owe a stopped message only on proof it never reached the agent; carry Codex history as input
- Codex: every stopped message rides as leading framed input on turn/start and
turn/steer (an older Codex silently ignores additionalContext and would read as
delivered); add a Codex fit check against its 1,048,576-character input limit.
- Flip the marker: a withdrawal is owed only with `neverReachedAgent`, written where
Orca proves it (host-held Stop, ACP held steer, Claude queue clear, a start the
Stop ended). Old journals and Codex withdrawals read as not owed.
- A carrier releases its history only for Orca's own pre-write refusals or a marked
withdrawal; provider refusals and not-signed-in are doubt.
- If the history does not fit, try once without its images, then send alone.
- Re-read the turn scope after selection; owed excludes typed slash commands;
dropped-history fallbacks log through the host logger.
* Owe stopped messages only where Orca held them; list only the history actually written
- Claude's queue clear (lifecycle and interrupt sweep) and a start ended by
Stop write plain `cancelled` again, as on main: Claude may already hold a
swept send, and the child-exit site proved nothing for leftover rows. The
proof sites are the host-held Stop withdrawal and ACP held steers.
- An adapter that leaves the history out after it fit calls the host's new
`historyLeftOut` before writing; the host rewrites the pending row without
`carries`, so those messages stay owed.
- History is chosen oldest first: each message with its images if it fits,
else without them, else skipped this time without holding back later ones.
- Session History titles and previews skip `<stopped-message>` blocks through
the existing hidden-block list.
* Build the swept-send test's marked fact with the shared builder
* Keep a person's own words when a rewind rebuilds their message
A rewind rebuilt each kept message from the provider's copy. Codex's copy of a
send that carried stopped history starts with the framed history, so that
bubble showed it. Keep Orca's body for a person's own message, as the live
fold already does; other senders keep the provider's body with their sender.
* Require the logger on the handover context
* Write a plain Claude send as soon as before when no stopped history rides
Wrapping the content build in an async function added microtask ticks before
every Claude write, even with no history, which a turn-timing test caught.
Return the same promise when nothing rides.
* Keep stopped messages and their carriers' coverage through a rewind
A rewind rebuilt history from the provider's items, which hold none of the
host's send facts, so a stopped message the agent never received lost its
bubble and its submission, and a surviving send that carried it lost its
coverage. The rebuild now restates those sends with the submission and
dispatch rows that first recorded them, in both the epoch and the post-clear
paths. A carrier the rewind removed is simply absent, so what it carried is
owed again with the next send.
* Test that a rewind keeps stopped messages owed or covered
Drives the real host, store and journal through a Codex-shaped rewind:
before and after the carrier, after a /clear, across a host restart, for a
stopped message nothing carried, and for a rewind that crashed after its
history committed. Each checks what the desktop and the phone draw and what
the next send carries.
* Owe stopped history again when a carrier provably never reached the agent
A Pi prompt refused for sign-in after its retries, and an ACP prompt line the
encoder refused before writing a byte, now settle with neverReachedAgent. The
owed derivation treats any carrier rejection carrying that proof as refused
before write, so its history rides with the next send instead of being lost.
Pi checks sign-in before it records a prompt from 0.84.0 (Orca's floor).
* Share the Pi adapter test harness with other Pi tests
Moves the scripted connection and setup out of the adapter test, unchanged, so
a stopped-history test can drive the real adapter without growing that file.
* Prepare each send once with the stopped history that fits, in one batch frame
Stopped messages now reach the agent in one frame ahead of the next send: a
header saying they are earlier, stopped history, one tagged element each with
its images numbered in the order sent, then a 'User message:' label. Only a
'<' that would open or close the frame's own tags is escaped.
Each adapter prepares the send once (prepareDispatch): images are read once,
each message's cost is weighed once against that agent's real limits, and the
result is the exact payload plus the ordered ids inside it. The host lists
those ids on the pending row and dispatch writes that same payload, so what a
row says it carried is what the agent got. A message that does not fit goes
without its images, then shortened with a marker; only when not even that fits
does it wait, and the frame says how many were left out. A plain send with
nothing owed is prepared and written exactly as before.
ACP measures every prompt's whole line, text included, and refuses a text-only
message too long for one line before writing it. Titles, previews and copied
first prompts hide the whole frame and its label, however long.
* Keep a stopped or restarted queue paused through a rewind after a /clear
After a /clear the rewind rebuilds in place, so a restated accepted carrier
reads as a turn after the person's Stop (or a restart's pause) and released
the cards it held. Restate those pauses above it, as a new epoch does.
* Restate a rewind's stopped messages in the order they were sent
Owed history follows the restated rows' order, so write them in their old
send order within each anchor rather than the order they were refused.
* Fit the rewind tests to the prepared-dispatch frame
* Cap carried history at 64k characters and degrade only the oldest stopped message
* Owe stopped history again when ACP or Claude refused its carrier before writing it
* Strip a carried-history frame before capping a Grok preview
* Leave a title that opens like a frame but never closes it unchanged
* Drop the image labels Codex writes for carried history images from titles and copied prompts
* Read a stopped message's images one by one so a refused image leaves the readable ones riding
* Settle a Pi prompt still waiting out a sign-in refusal as never reaching Pi when the session ends
* Name the journal rewind module after the rows it builds
* Type Pi's rejection helper with the facts that can reject a message
* Hide everything ahead of a carried-history frame within a bounded lookahead, and cap carried images at 20
* Fit Pi's stopped history beside the line it is written, and settle an encoder-refused prompt as never reaching Pi
Preparation measured the prompt without the streamingBehavior field PiRpcTurns adds, so a nearly full
carrier could exceed the line limit; the encoder then refused it and the write settled as unknown,
covering the carried history forever. Both now measure the frame from the same builder, and an
encoder refusal settles as writeFailed with neverReachedAgent, leaving the history owed.
* Record stopped messages appended to the agent's own log in the journal
A host-only mark on an id no item takes, written before the append and
cleared by a later proven refusal, so an older host reads past it and
clients never see it.
* Derive owed stopped messages from append records as well as ACP and Pi carriers
* Append owed stopped messages to the agent's own log at the next handover
The record is written first and covers them; only a proven refusal owes
them again. A failed or unknown append is logged and never holds the
send. Agents that cannot append keep carrying them in the send.
* Write Claude's stopped messages as shouldQuery:false frames that run no turn
Each message is its content and then Claude's own block-form
"[Request interrupted by user]". The append settles when Claude names
every frame in a result, and its zero-turn commands are claimed by uuid
so they open no turn, show no Working and write no row. The prepared
carrier send and the startup-failure never-reached mark are gone.
* Inject Codex's stopped messages with its own turn_aborted record while idle
One thread/inject_items holds each message and the default-mode
user-role marker. Only "method not found" proves a refusal; any other
error may have recorded them, so they are never injected again. The
prepared carrier send is gone.
* Carry stopped messages for ACP and Pi as plain text, whole messages only
Each rides as its words and Claude's interruption line ahead of the
send's own words, oldest first, while it fits the agent's own limits;
the first that does not fit waits with the rest. The frame, numbering,
labels, shortening and history caps are gone.
* Drop the stopped-history frame stripping from Session History scanners
Nothing writes the frame any more. Claude's and Codex's own interruption
records were already never read as a title or first prompt.
* Keep stopped messages and their append records through a Codex rewind
Only stopped sends are restated, each with the record that covers it, so
a kept message is never injected twice. Carrier coverage on rewind is
gone: Claude and Codex no longer carry, and ACP and Pi never rewind.
* Keep an append record through a Codex rewind only where Codex keeps its pair
A turn can come between a Stop and the send that appends the stopped message (another
agent's mail, a slash command, a busy Codex). A rewind to before that turn kept the
bubble and its append record, while Codex dropped the injected pair, so the message
read as covered when the agent no longer had it.
The reducer now keeps each record's row position. A rewind restates a record only when
that row precedes the rewound turn, and writes it back after the row it followed, so a
later rewind compares the same way; the same-epoch rebuild after a /clear takes back
every record after the floor first. A stopped send is restated with its submission and
rejection rows only: the queued withdrawal never wrote a handover row.
* Check, bound and settle each stopped-message append once
Each session now gives one answer for how its agent takes stopped messages (append,
carry or none), instead of a per-session check beside a router that always offered
the append.
Right before writing, both agents check again that the child, connection and fence are
the same and that no turn runs, by the agent's account or Orca's journal; a failed
check is refused, so the message stays owed. Reading a stopped message's images has its
own 2 s limit and the write and its settlement another 2 s, so a send or Stop queued
behind a stalled append waits about 4 s at most; work abandoned on a timeout never
writes later. A message with nothing left to read is logged as such, not as unknown.
Claude: the append keeps only a uuid observer. Its own lifecycle, echo and result
settle it and stay out of turn tracking, even late; its running, init and idle frames
are left alone. It holds the child from rest only while unsettled, and a child that
ends settles it from what the writes prove, so frames it never took are refused.
Codex: every inject error is unknown. A Codex without the method answers an error Orca
cannot tell from a failed write, so it is never asked again, as before appends existed.
Remote image URLs are left out: Codex refuses them before recording anything.
* Give ACP's carried stopped messages a text block of their own
The carried words were folded into the send's first text block. With an image-only
send its own images came before the interrupted text and read as part of the stopped
request. The prompt is now the carried images, one text block with the carried words,
then the send's own blocks unchanged. Pi keeps text and images apart, so it cannot
interleave them, and stays as it was.
* Hide Codex's own <turn_aborted> record in Session History
Codex writes a user-role <turn_aborted> message for its own Stop. After a first message
holding only an image, that marker became the session's title, its copyable first
prompt and a preview row, in natively interrupted sessions as in appended ones. It is
now hidden like the other harness blocks in titles and previews, and never seeds the
first prompt.
* Give carried stopped-message preparation one time limit, so a stalled image never holds the send or Stop
* Read Codex's stopped images within Orca's attachment limit, not Claude's
* Append only while the agent is idle by its own account, and record nothing while it is busy
* Find a Codex rewind's cut in one place for kept rows and kept append records
* Drop the rewind send-order sort, share the interruption marker, and return untouched files to main
* Test the append end to end through the router, and a late append echo with the next send's words
* Leave out a stopped image whose read stalls, and never read that file again while it is stuck
* Inject Codex's stopped images only into a Codex that resizes injected images, read from its handshake
* Skip and log a kept append record no rebuilt row precedes, instead of anchoring it at the end
* Restate a rewound stopped send's rejection through the one dispatch-row builder
* Keep a stopped image unread until every abandoned read of it settles, not just the first
* Read stopped-history transcripts through the one projection every client now shares
Main removed the rejectedInPlace option: the desktop and the phone now draw a recorded-then-rejected
send the same way, so the tests read one transcript instead of comparing two.
* Deliver stopped messages with the next send: Codex by injection, every other agent inline
Claude no longer writes stopped messages as separate shouldQuery:false appends with
their own frame-claiming, idle gate and settlement. Like ACP agents and Pi, it now gets
them at the front of the person's next words-only send, followed by the
"[Request interrupted by user]" record. Codex keeps thread/inject_items right before the
send, idle only, at most once; a Codex without the method is refused and its sends carry
them instead.
One selection serves both: words only, the newest that fit a 1 MiB encoded bound, in the
order sent, older ones left out and covered. A send with attachments carries nothing, so
history can never push a send past an agent's limits; the per-agent prepare and fit
modules, stopped-image reads and Codex version plumbing go. The injection record is
renamed for what it is. Rewind restatement is split out: a rewind drops stopped
messages with their bubbles, as before, and nothing is injected twice.
* Bound stopped history by one send's size beyond the newest, counting its marker, and keep scanning older messages
* Keep a whole stopped-history delivery within one send, counting either transport's framing
* Budget stopped history by the agent's remaining context beside the send, and carry none when none fits
* Bound stopped history by one send again, not the agent's context: each would have reached the agent unstopped
* Bound stopped history together with the send it rides with
The delivered stopped messages and the send's own words never exceed one send's size, so the agent is never handed more than a send the person could make. If the newest doesn't fit, they all stay owed for a later send.
* Never owe a stopped message too large to deliver beside any send
Such a message could never fit, so it held every older one back for good.
* Owe a stopped message only if it fits beside a one-letter send
The smallest send that carries history has one letter, so the owed bound reserves that, not an empty send.
* Deliver Codex's stopped messages inline, like every other agent
Codex no longer gets stopped messages through thread/inject_items. Its next
turn-opening send carries them at the front, the same text every other agent
gets, and the carrier's own pending row records what it carries. That removes
the injection module, its host-only journal row and reducer handling, the
adapter and router hooks, the unsupported-method fallback flag, and the
<turn_aborted> hiding in Session History that only injected items needed.
A Codex rewind rebuilds kept messages from Codex's copy, which now leads with
the carried words, so a person's own message keeps the words Orca recorded, as
the live fold already does. The per-message size allowance is now the inline
framing itself.
Measured with real Codex 0.159.0 before building: inline acted on "go ahead"
8/8, never on "ignore", and 0/21 on unrelated follow-ups, matching the injected
pair and a real Stop.
* Owe a Codex send's stopped messages again when Codex declines its turn/start
A request Codex answered with an error recorded nothing, so the rejection now
carries the never-reached proof and any stopped messages that send carried are
owed again instead of covered forever. A timeout or transport failure still
proves nothing.
* refactor(migration): one durable journal-directory store for every source kind
* feat(wsl-mover): a WSL move journal in its own directory, one move in flight per distro (D1b-5a)
* feat(wsl-mover): the WSL move journal fences and hides the rows it names
* fix(wsl-mover): journal records only move forward; a new journal directory is durable
* test(migration): pin the SSH journal's path and bytes across the shared store
* fix(wsl-mover): journal records are detached, unique per id, rooted, kept while in flight, and digest-checked
Accept positive safe-integer line and column flags through the existing file-open path. Reject invalid or incomplete positions before changing the editor. Bind deferred reveals to the requested workspace and tab, including floating panels, and clamp oversized positions without moving another editor or stealing late focus.
Co-authored-by: Nikita Maketryuk <n.maketryuk@lince.studio>
vitest's 30 s default cut the test's 60 s relock waitFor short; it failed
package (windows) 3 times at 30-33 s in ~1,000 runs.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(chat): Resume in New Native Chat for OpenCode terminal conversations
An OpenCode conversation started in the terminal now offers "Resume in New Native Chat" in its
Session History row menu and its tab's right-click menu, as Claude, Codex, Grok and OMP do: a new
OpenCode chat takes it over, showing its history and continuing it. OpenCode 2.x rows
(`opencode2`) and 1.x rows both open an OpenCode chat.
Two pieces kept OpenCode off the shared adoption path. Its account is a locator, not a folder, so
the transcript import now works over the account the chat pins, whatever its kind; the folder
agents wrap their lookups in directoryTranscriptImport, unchanged. Its conversations live in a
database, so the journal import reads the found database with the reader the OpenCode transcript
view already uses. OpenCode refuses to reopen a session from another folder, so the workspace rule
covers it too.
* test(chat): Pi is now the agent with no transcript import
* fix(chat): find an OpenCode 2.x terminal tab's Session History row
The pane reports `opencode` while Session History lists the conversation as `opencode2`, so the pane
header's and tab menu's Resume in New Native Chat found no row. Match by the chat agent that takes the
conversation over.
* Fix OpenCode chat adoption environment and pane eligibility
* test(chat): adapt parent adoption fixtures to account identities
* test: keep only the tests that pin user-visible behavior
* refactor(chat): map a Session History row to its chat agent where the chat starts
Both Resume in New Native Chat callers repeated the row-to-chat agent lookup. The launch now
takes the row agent and maps it once, so the Session History actions file stays unchanged.
* Replace workspace None agent option with a clear action
* Limit agent clearing to new workspace creation
* Let selected default agents toggle off in settings
* Keep default tab templates out of setup-only creation
* Remove duplicate clock property blocking CI
* fix(agent-launch): an AI button plans its agent inside its own pane's spawn, with the host's planner and no launch record
The window queues the launch on the tab; the pane's reserved spawn plans it with the planner every
host launch uses and starts it at the pane's size, with its launch token. Every way the spawn ends
finishes the launch, and the window pastes the prompt only once this pane says the agent started.
An ordinary spawn reaches its provider without waiting on a plan. An OpenCode tab with a model
keeps main's host hop untouched (TEMPORARY, until a local producer of model options exists).
* fix(agent-launch): an AI button's prompt waits for its pane to start before the spawn budget runs, so a pane that settles slowly still gets its prompt; stale comments
* test(agent-launch): the late pane-start test's store double is typed without an assertion
* test(agent-launch): the late pane-start test pins the prompt written once and Enter once, and nothing when the pane didn't start
* fix(agent-launch): an AI button's prompt goes only to the PTY its pane started, never a split's shell that bound first; the pane's start answer names that PTY
* fix(agent-launch): an AI button's launch watches each split's readiness as it binds, so the launch pane's own ready output is seen even when a split bound first and it drained at once
* fix(agent-launch): an AI button's pane plans with the host's current planner and runs its runtime fact's shell, so its command is quoted for the shell it is typed into, as a host launch is; the tab's inferred shell is not sent as a request
* fix(files): never write through a dangling symlink
A path that doesn't exist yet was authorized by walking up to the nearest
existing folder. A dangling symlink fails realpath with ENOENT, so the walk
stepped over it and approved the link's own path; the write then followed
the link and created its target outside the allowed folders. The walk now
continues from the link's target, and returns that real destination.
* refactor(native-chat): rename the chat visuals folder to the chat scratch folder
The per-chat folder agents write into is the chat's scratch space, not only
a visuals folder. Its root becomes <state>/chat-scratch/<hash> (the hash is
unchanged) and the agent variable becomes ORCA_CHAT_SCRATCH_DIR. The old
ORCA_CHAT_VISUALS_DIR is never set and is still stripped from what every
agent child inherits, Pi included. The visuals skill names the new variable
and says the folder is temporary.
* test(native-chat): keep the delivery test to the rename
The launch parity snapshot already pins that every agent drops the
pre-rename variable.
* fix(files): refuse any dangling symlink in the missing-path walk
Following a dangling link by hand resolved relative targets against the
lexical parent, not the link's real folder: through a folder link the walk
could loop forever or authorize the wrong file. Refuse instead: realpath
can't say where a dangling link leads, but a write would follow it.
* test(files): drop the loop case that duplicated the dangling-link refusal
Jinwoo Hong
Neil
Kelvin Amoaba
Brennan Benson
Jinjing
