## ELI5
Keep the test suite working with the Jira features that have just landed. There is no visible app change.
## What Changed
The host-picker test now expects the host-qualified selection the parent already accepts. The startup fixture provides Electron's protocol handler and verifies that ready installs the Jira image scheme. Jira edit tests use exported wrappers with module-local setters that are cleared on unmount, preserving the issue/source switch tests without the banned mutable function export.
The WSL storage inventory classifies Jira list columns, linked-view choice and prompt templates as device preferences, matching their keys and the existing Linear policy. Skill-guide tests check the actual generated discovery projection rather than assuming it is shorter than every full guide or uses one fixed phrase. The cache test follows the headless workflow's deliberate removal of its push trigger; cache-warmer checks remain intact.
## Why
Final CI found six stale integration assumptions after the Jira batch. Updating the fixtures and inventory preserves the landed behavior and the underlying checks. Changing production code, padding the Jira guide, or restoring an intentionally removed workflow trigger would change the product to satisfy incorrect test assumptions.
## Linked Issue
Follow-up to #28622, #28631 and #28592. The existing headless trigger policy was introduced in #28664.
## Visual Proof
N/A — tests, test fixtures and storage inventory declarations only; no visual or interaction change.
## Testing
- [x] Automated tests updated.
- [x] 196 focused tests across nine files pass on macOS, covering every failed shard assertion, fixture consumers and the headless workflow policy.
- [x] Node and web typechecks pass; all seven changed-code quality stages, formatting and diff checks pass.
- Reproduced five failing assertions in startup/export/storage tests and the skill projection failure before the repairs. The host-picker owner also reproduced the stale selection failure before correcting it.
- Final full CI will run on this PR. The prior Ubuntu 22.04 persistence job crashed in the native watcher build before persistence tests ran; this change does not claim a Linux release, live Jira or real SSH pass.
## Review
Independent source review found no issues; all six reviewed file hashes and the complete diff match committed head `aa703eb50147ba95646cb82f10b6d86b4f890fc4`. Risk: low. No authentication, network, protocol implementation, workflow, renderer behavior, remote messages or migration rewrite logic changes.
## Agent skill upstream boundary
- [x] Not applicable; no upstream skill-installer source or artifacts copied.
## Notes
The three storage keys contain device-level preferences, without workspace paths or identifiers. Tests preserve host disambiguation and issue/source switching. Platform, SSH and provider behavior remains in the existing implementations.
## Checklist
- [x] Small and focused.
- [x] Explained the before/after, mechanism and choice of approach.
- [x] Visual proof marked N/A with a reason.
- [x] Self-reviewed for correctness and cleanup.
- [x] Cross-platform and SSH impact considered.
- [x] Focused tests, types, formatting and quality checks pass; full CI covers the broader build.
* fix(cloud-auth): never drop a rotated refresh token, and stop after a 401 even when the store cannot be written
A refresh whose session save failed (write error, or a moved mutation fence)
discarded the rotated token, so the relay broker's ~10 s renewal kept
replaying the spent one until the server revoked the family. The 401 then
could not clear the session because the revocation write failed the same way,
so the broker looped on 401s indefinitely.
* fix(cloud-auth): one compare-and-swap save for rotated tokens; org selection keeps them
- Rotated tokens save only while the store still holds the spent token and the
identity is not signed out; linkage (and a server-reported org change) moves
only under the refresh's own fence.
- Org selection refreshes through the shared single-flight and merges onto the
latest stored session instead of writing back the tokens it started with.
- A failed session write removes the stale file so a restart cannot replay it.
- A cleared session refuses conditional saves until the next sign-in.
* refactor(cloud-auth): one read-merge-save helper for stored sessions; tokens before relink
- updateStoredOrcaCloudSession re-reads, applies an update and saves under the
fence in one turn; org selection, capability refresh and rotation all use it.
- Rotation saves tokens first and relinks best effort, so a failed fence write
cannot leave the spent token stored.
- Only a rotation removes the on-disk file after a failed write; other saves
leave a still-valid token in place.
- Capability refresh fences at request time, after any inner refresh relink.
* fix(cloud-auth): roll the fence back when relinking after a refresh fails
A fence left on the server-reported org while the profile link kept the old
one made every later capability refresh return reconnect-required.
* refactor(cloud-auth): one owner for each profile's cloud session
profile-cloud-session-owner.ts is now the only code that reads or writes a
profile's session. Renewal, org selection, capability refresh, sign-in and
sign-out ask it for changes; it keeps an in-memory generation (sign-in/out)
and link version (org changes) instead of the on-disk mutation fence.
Deletes profile-cloud-session-mutation.ts (account-session-mutation.json),
profile-cloud-session-rotation-save.ts, updateStoredOrcaCloudSession and the
profile-switch fence write.
* fix(cloud-auth): retry an unsaved rotation until it lands; sign-in save failures throw as before
- The store keeps a rotation whose write failed and retries it on every read and at quit,
so one failed write no longer signs the user out on the next restart.
- Only a rotation keeps its session after a failed write; sign-in, org selection and
capability writes throw as on main.
- Org selection succeeds when the link already moved to the selected org.
- The owner reads the profile's link itself and bumps its link version only on an org
change; commitCloudSessionRelink returns the profile list.
- Adds the auth characterization suite that pins main's behaviour.
* fix(cloud-auth): a failed non-rotating save keeps a pending unsaved rotation
Found in the real-app run: a capability save that failed while a rotation was
unsaved dropped the pending rotation, so the next renewal resent the spent token.
* fix(cloud-auth): flush unsaved rotations on OS shutdown; stale capability replies match main
- Flush unsaved rotations on Windows session-end and powerMonitor shutdown, through the
owner, which now also owns the quit flush.
- Capability replies are refused once the org link moved at all, as on main; only org
selection accepts a link that already reached the selected org.
- Sign-in and sign-out reuse invalidateCloudSessionChanges; small store cleanups.
- Pins the A->B->A stale capability reply in the characterization suite.
* fix(cloud-auth): flush unsaved sessions before recording the Windows session end
Remember an optional Jira project for each repository so its issue picker and Tasks list start with the intended project and site. Keep temporary project overrides separate from the saved default, and choose a mapped workspace destination while retaining the Jira account that supplied the issue. Older hosts that discard the optional saved field return an actionable message.
Keep account ownership separate from repository execution identity. An explicit matching repository owner disambiguates repeated IDs; automatic defaults require ID uniqueness, and overrides include execution-host identity. Preserve existing preselection behavior, saved/manual query classification and linked-view choices. Reuse existing persistence, identity and query builders; check the final UTF-8 query length for searches and project-filtered presets and show a recoverable error before dispatch.
Validation at reviewed 9b174ae4: 205 affected tests, node/web typechecks, seven changed-source quality checks, and 189 fresh rendered assertion invocations with 39 inspected screenshots and 1,413 stable source hashes pass. Independent source and artifact reviews found no blocker. The rendered evidence uses synthetic transports. Ubuntu 22.04 persistence CI stopped before tests because the native watcher crashed during the build; those inputs are unchanged from the preceding passing head. Full CI is not claimed green.
Load Jira attachment images separately from issue Markdown so descriptions and comments stay small while screenshots load lazily and open in the existing lightbox. Downloads begin when an image mounts, capture its owning host, require negotiated image support, and use bounded authenticated byte streams and caches. Older clients retain their inline-image handlers.
Keep legacy and cancellable downloads in separate in-flight domains so cancelling a new image reader cannot abort a legacy reader; completed bytes share the bounded cache. Preserve the landed assignee, board, transition/comment queue and request lifetimes. Move unchanged project metadata IPC handlers into their domain module and tighten two inherited focus-check ceilings without changing behavior.
Validation:410 tests/54 suites; all changed-source quality stages, lint, format, routing and contract checks; exact final node/web types; independent source review;48/48 fresh hidden Electron checks with226 stable source hashes and nine inspected screenshots. Synthetic transports exercise production clients and UI. Current CI static checks, mobile bundle, wire compatibility, Linux/Windows packaging and Windows serve pass; five test shards were pending at review.
Extends the existing attachment work credited to Frank (@lifefloating) and Brennan Benson in PR #8938; existing contribution credits and media remain in this PR.
Show Jira issues as a board alongside the existing list and add the current-sprint preset. Status moves use the existing owner-scoped mutation queue, collect required workflow fields/comments, retain rejected drafts, and reload the mounted comment timeline once after success. Source/session fences keep older detail failures from undoing newer board moves.
Preserve statuses plus sprint in query preview and Edit-as-JQL. Older hosts must advertise sprint support; unsupported peers fail clearly. Existing capability definitions and test fixtures are split without changing public exports, wire strings, or coverage to meet current lint limits.
Validation:351 tests/42 suites,all46 changed sources full-file lint/anti-slop and7quality stages,localization/RPC checks,and independent source review passed. Node types passed on runtime-identical99d and web types passed on final602d. Fresh hidden Electron54/54 checks passed on99d; final two test-only changes were hash and emitted-runtime audited. The inherited IPC301-line failure is byte-identical main and being corrected separately by the image PR.
Adapted Eugenio Valeiras (@EugeValeiras)'s board contribution from PR #13054.
Co-authored-by: Eugenio Valeiras <eugenio.valeiras@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Add source-aware Jira assignee controls on the existing issue workspace and mutation queue. Search, self-assignment, rollback, pending edits, and stale-source replies retain captured account ownership alongside transition/comment forms. Move existing draft/menu callbacks into the existing actions module to stay within the current lint limit; correct the stale file-open arity fixture.
Validation: exact-head node/web typechecks,133 tests/14 suites,all changed source full-file lint and7 quality stages,source lifetime/catalog checks,and independent source/action-extraction reviews passed. Fresh hidden-renderer41/41 checks passed across assignment/transition/comment and extracted title/label actions;35 source hashes stayed stable,zero renderer errors. All owned proof processes cleaned. Full CI still contains protocol/IPCs max-lines violations confirmed byte-identical to current main; separate board/image corrections are in review.
Requested by Andy (@andyhorn) in issue #17052; no external source PR code copied.
Restore existing Jira CI lint checks without runtime behavior changes. Existing generation types are moved verbatim and re-exported; the mobile fixture retains object identity coverage with a named client type.
Validation: renderer typecheck, 10 generation tests, 3 mobile identity tests, changed-file quality, full-file lint, formatting, and independent source review passed.
* test(relay): check invariant 4 (one demotion winner) in the step-5 simulation
Every demotion now names its winner (the newer booking, or the row). The model
flags a director that names a different winner for a divergence another already
named, and a host whose two seats are each demoted for the other. A fault where
directors break level ties by their own cell order shows the check fires.
Violations are capped per invariant so one flood cannot hide another class.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* test(relay): bound unseen duplicates by the silence close and assert all invariants on contested ties
A reserve seat the booking director's map had not seen (joined, then half-open within a poll)
is never superseded and has no lease to re-check, so it lasts until the cell's control silence
close (75 s + one 15 s ping). Invariant 3 now uses that bound for such seats, and the
level-divergence config asserts every invariant.
Stale maps now judge a divergence another director already demoted, so the config's
"contested" counter (divergences judged by two or more directors) is the case invariant 4
guards. The silence-close constant now matches production (90 s, not 100 s).
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* test(relay): raise the floor on map-judged demotes and count only level contests
A reconcile whose map has not seen another director's demotion still demotes in
production, which raises its epoch floor; the model now does too. The contested
counter counts only same-epoch pairs, the only ones invariant 4 can split. The
keep-this-seat rule is one helper.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* refactor(relay): name the simulation's fault-kept seat check for the fault
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): count only confirmed level demotions and every second judgment, and bound duplicates by placement records alone
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
Collect required Jira transition fields through the shared issue save queue, preserve entered fields after rejected saves, and refresh the comment timeline after successful transition comments. Keep captured-host and older-peer compatibility.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
Choose Jira issue-key casing and review-title prefixes while preserving manual GitHub/GitLab title and body edits during generation, branch changes and remounts.
Co-authored-by: chucoding <56211193+chucoding@users.noreply.github.com>
Combine remembered Jira status filters with presets and saved JQL on the connection host, protecting obsolete owner actions and keeping incompatible controls hidden in linked mode.
Co-authored-by: Brennan Benson <brennankbenson@gmail.com>
Choose and sort Jira planning columns while bounding optional field discovery, preserving complete Cloud searches and aligning copy/workspace actions in responsive rows.
Co-authored-by: Dagan <idan.d@imagen-ai.com>
Save and apply named Jira queries on their connection host. Reject obsolete owner actions and exit linked mode only after a saved query is actually applied.
Co-authored-by: no-support <jwan0131@gmail.com>
Browse Jira on mobile and create linked workspaces through the paired desktop, retaining shared task queries and protecting account/session changes.
Co-authored-by: Minho Yi <tisohjung@gmail.com>
Reload externally changed Jira and Linear connection metadata and credentials on the next read using bounded file-identity caches. Existing captured requests and retained result expiry policies remain intact.
Co-authored-by: Minho Yi <tisohjung@gmail.com>
Show linked workspaces for Jira issues and offer starting another workspace even when one link already exists; preserve site and execution-host identity.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Complete Jira Cloud discovery and token pagination, reject incomplete pages, and classify presets by status while retaining strict CLI reads.
Co-authored-by: ggbdpq <ggbdpq@gmail.com>
Support scoped Jira Cloud API tokens through the configured gateway while keeping self-hosted routing, redirects, diagnostics, and selected-host capabilities bounded.
Co-authored-by: Jerome Würf <oss@scharom.de>
Use one token-based task search implementation on desktop and mobile. Preserve explicit issue/PR qualifiers, distinguish quoted search text, and follow shared reexports in mounted mobile recordings.
Refs #10950 and #11121.
Co-authored-by: MumuTW <42820974+MumuTW@users.noreply.github.com>
Expose host-owned verified Jira reads and single-attempt writes through the CLI. Preserve site ambiguity checks, old-host capability refusal, atomic label changes, and uncertainty after failed writes.
Refs #11986 and #26055.
Co-authored-by: Dan Cieslak <dcieslak19973@users.noreply.github.com>
Co-authored-by: kokbee <kok2209@gmail.com>
Preserve safe ADF hyperlinks and rich-text marks through the existing Markdown renderer, with escaping and punctuation regressions.
Refs #13604.
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Adapt Jira rows and sort headers to their panel width so titles remain readable in narrow side panels.
Refs #16627.
Co-authored-by: Leopold Tripot <leopold.tripot@gmail.com>
Any press on a <webview> guest moves Chromium focus into it, so an agent click
took the user's terminal focus (#20595). Main now asks the hosting pane to guard
focus for each agent press (Orca's click/mouse down and the CDP proxy) and the
pane puts it back inside the webview's focus event, and again when the press
ends. Offscreen pages keep their native focus.
* test(native-chat): replay recorded Linux Sogou commits into the chat composer
Guards #26722: keyup-only pinyin, plain Space/digit selector picks (GTK IM
and XIM shapes), Process/229 phrase picks, and a client-preedit commit all
land in the composer. The recorded fcitx4 shapes do not reproduce the issue.
* test(native-chat): read the composer event log through a typed dataset value
* Recover orphan browser processes and clarify blocked updates
* Use isolated Electron launch flags for sidecar lifetime tests
* Keep update retries fenced while describing blockers
* Keep update translations and context clock valid on current main
* Use the option context clock restored on main
* fix(updater): address status guidance and test launch reviews
* Require exact-commit PR checks before agent merges
* Give full PR checks a unique required status context
* Validate required context ownership on every pull request
The connection pool replaced any connection that was not fully up
(reconnecting, failed, closed by a census) with a fresh one, and the
teardown wiped the in-memory password, so background dials after a drop
or sleep/wake prompted again. The pool now keeps the sign-in the host
accepted and hands it to the replacement for the same endpoint. A
password the host refused or re-asked for is never handed on, an edited
endpoint asks again, and an explicit disconnect forgets it.
Co-authored-by: m4air <m4air@Mac.localdomain>
A first connect onto a host whose managed server another Orca version
started deferred the update (its terminal count needs pairing) and failed
the connect. Pair with the running build as it is, before uploading
anything, then let the linked update check ask it for its terminals.
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(runtime): save a windowless host's chat tabs in its layout
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab on the index's hidden notice, which every close reaches
Claude-Session: p2-headless
* fix(runtime): a chat whose record is gone loses its saved tab at startup
Claude-Session: p2-headless
* test: run the windowless chat-layout host test in the Node runtime project
Claude-Session: p2-headless
* fix(runtime): remove a chat's saved tab from whichever partition still holds it
Claude-Session: p2-headless
* refactor(runtime): list saved chat tabs across partitions in the layout module
Claude-Session: p2-headless
* refactor(runtime): read saved chat tabs straight from the store's partitions
Claude-Session: p2-headless
* fix(chat-tabs): save a windowless chat tab under its own tab id
Review pass: the saved tab reuses the id status and attention address, the close
checks for a window before scanning partitions, and the host tests seed readable
records with unreadable, other-host and no-index cases.
Claude-Session: p2-headless
* test(chat-tabs): a window opening a windowless-saved chat reuses its tab
Claude-Session: p2-headless
* test(chat-tabs): check the saved tab with the lookup a window reuses
The window's existing-tab lookup moves to the shared projection so the
windowless-layout test exercises it without importing the renderer.
Claude-Session: p2-headless
* test(chat-tabs): assert the reused tab's identity directly
Drops the shared lookup added for the test; two functions already carry that name.
Claude-Session: p2-headless
* fix(chat-tabs): leave an unstamped chat tab in an SSH partition to that host
Claude-Session: p2-headless
* fix(chat-tabs): count an unstamped chat tab as this host's only in the local partition
A desktop mirrors a remote server's chats into that server's runtime partition
without a host stamp; the startup sweep must not delete them.
Claude-Session: p2-headless
* refactor(chat-tabs): one chat tab writer, one startup match, local partition only
Chats run only on local hosts, so their saved tabs live in the local partition:
the cross-partition listing and its writer go. Open and close share one layout
load, the startup fill and sweep become one function beside the index seed, and
the tab filter is the existing savedSessionId.
Claude-Session: p2-headless
* fix(chat-tabs): restore and sweep saved Claude chat tabs like any structured chat
The Claude skip predates Claude structured chats (#18519, #18560); an id the host
has no record of is already dropped by the readable restorer.
Claude-Session: p2-headless
Main-session CDP key and text input on a <webview> guest is routed by the window's
focus, so it landed in the user's terminal (#20595). Embedded guests now get
widget key/char events; child-frame focus and untypeable text keep the CDP path
after focusing the guest.
Neil
Jinwoo Hong
OrcaWinandm4air