Vitest rejects a console-log RPC still in flight when a worker tears
down, failing a shard whose tests all passed. Ignore only that rejection
(the lost line belongs to a finished file and passed-only shards drop
it anyway), and stop the two specs seen in CI from spawning real git and
wsl.exe in fire-and-forget background work.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(settings): unify terminal theme pickers
Reuse the Appearance searchable selector and palette swatches while preserving imported-theme actions and independent terminal theme slots.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(settings): don't replay a handled theme import after remount
Settings search unmounts the theme row, so the picker remounted with
handledImportSignal=0 and reopened at Imported without a new import.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(terminal): send one ACK overflow recovery image per drained window
Recovery snapshots bypass ACK windows, so on a link slower than a flooding
TUI each ACK while overflowed published another full-screen image behind
the queued window. Measured through real orcad over a 1 Mbit/s shaped link
this queued images without bound: keystroke echo grew from 22s to 50s over
a 45s flood and the pane took 51s to settle. Holding the next image until
the output sent ahead of the previous one is acknowledged bounds that
queue to the window plus one image (echo <= 18s, settle 7s, 10x fewer
snapshot bytes). Server-only; no protocol change.
* fix(terminal): let adaptive ACK pacing engage under overflowing TUI floods
Through real orcad on a shaped 1 Mbit/s link, ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=1
never paced a 60fps full-screen TUI: once its queue overflowed, recovery
images cleared the queue, so later sends counted as idle trickle and the
estimate never collected window-limited samples. When it did, the images
(never acked) inflated paced RTT and tripped the divergence fallback.
- A stream whose output outran the window stays backlogged until an ACK
finds its queue empty, so sends after a recovery still measure the link.
- The estimate records recovery images: they count as queue ahead of later
sends (no drained/paced samples behind them) and as delivered bytes once
an ACK of a later send confirms them.
Shaped-link soak (1 Mbit/s, 50ms): echo p50 13s -> 2.2s, settle 7s -> 1.1s.
Bench gains a 6.4 MB/s TUI scenario: paced 7.7s -> 1.2s.
The batch skipped it because the rewrite would cross the line budget;
with the panel's current shape the converted file fits, so convert it
in place with no split.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor(main): organize runtime implementation owners
* test: retire wall-clock CLI title recovery case
* refactor: route new folder mutation to runtime store owner
* test: import folder mutation store contract from its owner
Both would go over budget once converted. The send-target ordering and
the resume tree's group node move to their own modules first, then the
codemod converts the menu, its target rows and the resume tree nodes.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Its placeholder and submit labels defaulted through translate() in the
parameter list, which runs before a hook can bind. Resolve them from
`t` in the render instead.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Cap merged atlas pages at FORCED_MAX_TEXTURE_SIZE instead of the device
MAX_TEXTURE_SIZE (16384 on Apple Silicon), stop the link render layer
from acquiring the shared atlas with a mismatched 2048 texture size, and
reset GL texture slots of removed atlas pages to the 1x1 placeholder.
Mirrors xtermjs/xterm.js#6187, #6156 and #6306 in the addon-webgl source
patch and regenerates the runtime patch and lock hash.
Co-authored-by: FlamingoPg <1106310035@qq.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The usage chart test called both charts as plain functions, which kept
them on translate() and getIntlLocale(). Render them instead and
convert the charts. The pull request page's back label moves from a
parameter default into the render.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor(terminal): own multiplex ACK window accounting in one module
* perf(terminal): pace alternate-screen multiplex output to the measured link BDP
Slow SSH links queued up to 2MB of superseded TUI frames ahead of keystroke
echo. orcad now estimates delivery rate and base RTT from existing output ACK
timing, caps in-flight output for alternate-screen streams near 2x BDP on links
under 4 MB/s, and replaces a backlog larger than that budget with the existing
recovery snapshot. Normal-screen streams and fast links keep the legacy
windows. ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=0 restores legacy behavior.
* perf(terminal): back off unavailable superseding snapshots and bound legacy echo checks
* perf(terminal): gate ACK pacing to measured remote links and keep supersedes history-neutral
Pacing now needs a base RTT of at least 40ms, 16 fresh window-limited samples,
and a sample within 15s, so LAN/local links and stale estimates keep the legacy
windows. Superseding snapshots are screen-only, only replace frames that never
switch screen mode (rechecked after serializing), and leave client history
untouched. Paced streams keep today's total buffering before overflow, so
overflow recovery fires no earlier than with legacy windows.
* fix(terminal): close supersede gaps found in review
Scan for screen switches and OSC side effects across frame and send
boundaries (raw and JSON-escaped), back off after an aborted supersede so it
cannot re-serialize in a loop, and keep paced pending headroom until the queue
drains so leaving the alternate screen cannot force an overflow recovery.
* fix(terminal): judge supersedable backlogs on decoded text across every seam
Scan the joined text of the whole queue (plus the sent tail) so screen
switches split across any frame, send, or covered/retained boundary are
seen; never supersede span frames; reject bells (via the shared bell
detector), OSC clipboard/notification writes and 8-bit OSC; back off for 1s
after a rejected scan instead of rescanning on every ACK.
* perf(terminal): make backlog superseding opt-in and forget the sent tail after snapshots
Every recovery snapshot makes current clients replay their reattach reset
(cursor shape/visibility, focus reporting), which is visible when it fires
routinely, so superseding is opt-in via ORCA_TERMINAL_SUPERSEDE_ALT_BACKLOG=1
until clients can skip it. Pacing stays on by default: on a slow link the
existing overflow recovery then reaches the client promptly instead of queuing
behind a 2MB window. After any snapshot the sent tail is unknown (it can end
inside an escape), so superseding waits for the next text frame.
* test(terminal): cover default pacing and opt-in superseding separately
* perf(terminal): read the supersede switch once per connection and skip its bookkeeping when off
* perf(terminal): make adaptive ACK pacing opt-in and fix review findings
- Default off: ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=1 enables it; when off every
new path is a single flag check, so behavior matches legacy windows.
- Base RTT is a windowed minimum kept honest by periodic probes that drain our
own queue; a paced RTT beyond what our window can add means the path changed,
so legacy windows hold while the base re-learns (no more self-tightening to
64KiB after an RTT increase).
- Paced pending headroom is capped by the connection window legacy would have
used and released on drain, pause and detach.
- Superseding refuses snapshots that end inside an escape.
- Replace the latency-threshold unit test with hardcoded estimator tests and
move the link simulation to bench:terminal-multiplex-ack-pacing.
* perf(terminal): drop backlog superseding and harden opt-in ACK pacing
- Remove the opt-in backlog-superseding snapshot path (code, env switch,
frame classifier and tests); it needs a client capability to skip the
reattach reset before it can ship.
- Paced-ness is decided once at admission (alt screen checked before the
estimate) and reused by the send, so a probe starting in between cannot
mislabel a sample.
- Base RTT is fed only by sends with a near-empty connection queue; probes end
only on such samples from paced streams, and a probe that cannot drain backs
off. A path change forgets the base and holds legacy windows until a drained
sample re-learns it.
- Paced pending headroom is sized from the steady window (never a probe's
zero) and released whenever the queue drains back within the legacy cap.
- Flow-level tests: disabled pacing keeps legacy frames on a measured slow
link; drained headroom returns so later output overflows at the legacy cap.
* fix(terminal): release paced headroom whenever the queue drains, including after recovery
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
ChecksTabActions is called as a plain function, so it now takes the
checks tab's `t` instead of reading translate(). EditorFileTab would go
over budget once converted, so its mode icon choice moves to its own
module first.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(claude): sync the terminal theme into Claude Code
* fix(claude): retry missed theme reloads, keep settings key order, search entry
* fix(claude): persist theme ownership before settings writes, skip deliberate themes, restore only on toggle
* fix(claude): gate theme sync on Claude Code 2.1.119, follow Orca's Claude config dirs, keep restores owed
* refactor(theme): point markdown Monaco rules at the shared contrast helpers
* fix(claude): lock theme ownership edits across Orca processes, retry missed theme reloads with backoff
* test(e2e): opt-in real Claude Code theme sync journey; retry theme reloads for up to five minutes
* fix(claude): keep theme takeover recoverable when settings writes or the lock fail; steadier e2e journey
* fix(claude): serialize theme publication with takeover and restore, per-file reload retries; record the real-Claude e2e in the isolated home
* fix(claude): retry an owed restore publish, stop off-state retries, reread settings right before writing
* fix(claude): republish theme files under the cross-process lock
* refactor(theme): point chat selection contrast at the shared helpers
* feat(claude): default theme sync on for new profiles; offer it once to existing users at their next Claude launch
* fix(claude): offer theme sync to every existing profile, confirm only after the save, honest offer copy
* fix(claude): right-align the theme sync offer's two actions, primary last
IssueDialog's team list named its map parameter `t`, so the codemod
skipped the dialog; rename and convert. The run history's count label
memo reads the component's `t` and recomputes on a language switch.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
SshStatusSegment's target maps named their parameter `t`, so the
codemod skipped it; rename and convert. The owner usage, resource
merge and runtime host notice memos pass their hook's `t` into the
helpers they call and recompute on a language switch.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
BrowserAddressBar, AgentCapabilitiesSetupAction and FeatureWallTourSurface
would go over budget once converted. Move the address bar's form-unmount
timer clearing, the capability setup rows and the tour's skill reads to
their own modules first, then convert. The tour's parameter-default copy
moves into the render; an explicit null footer still hides it.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The codemod skipped both visuals because a timer-clearing callback
named its parameter `t`. Rename it to `timer` and convert their
copy to useTranslate.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
use-ai reads useTranslate for its conflict-launch toast, and the
create-review header actions take the action model's `t`. Both files
would go over budget, so the recipe-save callbacks and the provisional
hosted-review provider inference move to their own modules first.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The cursor-owner test called MonacoGutterContextMenu as a plain function
and dug its action out of the element tree, which kept the component on
translate(). Render it instead, reading each item's action by label, and
convert the component.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
IpynbViewer translates its invalid-notebook fallback at render instead
of inside the parse memo, so the memo still depends only on content.
CopyButton resolves its default title from `t` instead of a parameter
default.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* spike(relay-edge): local Durable Object relay prototype and de-risk harness
Stateless Worker routes control/phone/data sockets to one object per host.
Harness drives the shipped desktop control client and data transport against
wrangler dev. Not wired into builds or deploys.
* spike(relay-edge): one Durable Object per splice isolates slow phones
The host object keeps control, session and connection bookkeeping. Each
phone connection and its host data socket live in their own object and talk
to the host over DO RPC. Harness adds flood isolation, splice reset, budget
reclaim and RPC latency checks; the silent-bytes guard is measured and left
disabled.
* spike(relay-edge): Cloudflare de-risk kit (spike env, load, deploy, canary, rtt tools, runbook)
* spike(relay-edge): rebind after an object reset keeps the generation
* spike(relay-edge): pool splice objects per host to avoid object creation per phone connect
* spike(relay-edge): slow-phone flood test for Cloudflare
* relay-edge: MVP backend (credential store over Hyperdrive, JWKS, epoch check, host commands)
* relay-edge: MVP checks on local Postgres (credentials, commands, epoch, DB-down)
* relay-edge: refusal and database-latency metrics; Analytics Engine on the spike
* relay-edge: alerts cron Worker over Analytics Engine; edge.relay.orca.dev on the spike
* relay-edge: slow assignment check closes 4429, never 4401; staging env over Hyperdrive; db latency debug route
* relay-edge alerts: silence only after traffic
* relay-edge: Durable Object SQLite adapter; relay credential-store tests pass on it (P1)
* relay-edge phase 2: credential store on HostRelay SQLite, signed director push/export/erase; 17/17 in workerd
* relay-edge phase 2: Cloudflare env, push-assignments load prep, remote mode for phase-2 checks
* relay-edge: export freezes the host and is refused while connected; move-on replaces host data; stale/conflict carry the edge epoch; push location hint; admin content-length check
* relay-edge: daily store sweep on the object alarm (armed on every wake and admin call), wipe of objects whose host never arrived or left 30 days ago, erase guard ignores expired bases, admin and sweep metrics
* relay-edge: admin key renamed ADMIN_SIGNING_KEY; optional erase-only signer for the erasure job; a move onto the edge also voids audit rows from an earlier stay
* relay-edge: phase2 test env names the erasure issuer
* relay-edge: director ⇄ cell ⇄ edge round trip with the shipped desktop and phone clients
* relay-edge: round trip resolves the live phone first (a failed resolve rate-limits the host)
* relay-edge: per-source pre-auth limits; phones for unpushed hosts answered without storage
Phone and host data upgrades are counted per source (CF-Connecting-IP, IPv6 by /64)
through a Rate Limiting binding, failing open. A phone for a host the director never
pushed (or one since wiped) gets relay-hello 4409 from the Worker, so neither the host
nor a splice object writes storage. Local 25/25, phase2 21/21.
* relay-edge: production env on edge.relay.orca.dev; object schema version; frame caps; place on metrics
- production env (orca-relay-edge): custom domain edge.relay.orca.dev moved off the
spike env; object backend, production auth JWKS, no debug/reset routes.
- Object storage carries a schema version; code older than an object's schema refuses
it; a test pins the version to a hash of the tables so changes need a migration.
- Frames over the cells' limits close 1009 (control 1 MiB, splices 8 MiB).
- Metrics carry the client's ingress '<continent>/<colo>'.
Local 26/26, phase2 22/22, unit 24/24.
* relay-edge: production alerts env (reads the production dataset)
* relay-edge: keep only local dev config in this repo
Deployed environments (Worker names, hostname, account id, dataset names,
rate limits, Hyperdrive id) move to the private deploy config. The local
config and tests are unchanged.
* cloud: keep relay-edge out of the pnpm workspace (own npm lockfile)
* Revert "cloud: keep relay-edge out of the pnpm workspace (own npm lockfile)"
This reverts commit a55955d3c023964ccd2dfb644e2d09ca67322722.
* cloud: relay-edge as a pnpm workspace member (lockfile; workerd binary-only)
* relay-edge: follow main's relay module moves; alias workspace packages by directory so subpath imports resolve
* relay-edge: splice byte counters on the socket attachment (survive hibernation)
* relay-edge: keep deployed-target load tools out of the public tree; abort routes only on the spike backend
The local harness (spike/run-all.ts, lib.ts, keys.ts) stays. The tools that drive a deployed
Worker and the Cloudflare runbook live with the private deploy config.
* relay-edge: satisfy the changed-lines lint gate
Braces on every if, type aliases over interfaces, template strings, no explicit any,
!== -1 index checks, and a justified max-lines header on the per-host object, the splice
object and the end-to-end harnesses. No behaviour change: unit 19/19, object MVP 26/26.
* relay-edge: split the host object and harnesses under the 300-line limit
HostRelay is layered base → handshake → control → phones → HostRelay (one object, one state;
method bodies moved verbatim, private → protected). SpliceRelay's state types move to
splice-state.ts. The harnesses' helpers move to sibling modules. No max-lines disables.
Unit 19/19, object MVP 26/26, local spike harness 19/19.
* relay-edge: run its vitest suite from cloud's pnpm -r test and register the runner
TerminalPane's default-shell search entry and the terminal link action
keywords move to their own search modules, like their sibling sections.
The search catalogs bind `t` once through searchKeywordTranslator, so
threading it keeps them within budget; the bound function keeps the
translateSearchKeyword name so catalog extraction still reads its keys.
TerminalSettingsPreview reads useTranslate; its lifecycle test's hook
mock now covers useContext. ShortcutsPane and the catalog app themes
pass `t` into the helpers their memos call.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
readFullOutput listed failedAt as a dependency without reading it, so a
compiled build would keep one reader across failures and the dialog
would keep the first run's output. recomputeOn makes failedAt an input.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(terminal): use Regular weight by default on Windows
Cascadia Mono, the Windows default, has no Medium face, so a 500 request
rasterizes as SemiBold. New Windows profiles default to 400; Windows profiles
still on 500 move to 400 once and see one persistent toast with a live
preview and a switch to keep 400 or go back to 500. Skipped when the
terminal font renders both weights identically.
* chore: prune stale renderer layout-writer baseline entry
* fix(i18n): translate the Windows weight toast label reactively
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
OrcaWinandOrcaWin
NeilandCopilot
Jinjing
Jinwoo HongandSeiya Iwaoka
