Use the shared agent picker for Source Control Customize and AI-author setup. Preserve existing Arguments, templates, Custom commands, model/effort choices and settings ownership; keep nested menus and tooltips within their dialog portal.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com>
Co-authored-by: Andy Zhang <hiandyzhang@gmail.com>
* fix(pi): keep a native chat awake while its background subagents run
The idle sweep stopped a Pi chat 30 quiet minutes after its last turn even
while pi-subagents workers it had started in the background were still
running. On Windows those workers are children of Pi and died with it, so
the coordinator never got their results.
Pi extensions with detached work already declare it through the shared
session-liveness registry that Pi hosts read before idle eviction, and
pi-subagents registers there. Native chat runs Pi as a child process, so
Orca now loads a small bridge extension into native-chat Pi launches that
installs that registry at load and reports, over Pi's RPC stdout, whether
the session has active providers. The Pi adapter keeps the last report and
the idle sweep treats it like provider-held sends: the chat is not stopped
while work is declared, and idles a full window after it ends. Nothing else
reads it, so clear and compaction are unchanged.
Tracked in #28710.
* fix(pi): harden the background-work bridge after review
Keep the bridge ticking after a failed report so the next answer is
re-derived, validate registrations the same way the reference host does,
log a bridge that could not be written, and use type guards in its test.
* fix(pi): confirm Pi background work at idle-stop time
A cached report could be stale when work starts between samples, so the
idle sweep now asks a running child's provider right before stopping it
and stops only on a fresh idle answer. Pi's bridge answers requests that
Orca drops into a private per-child folder, replying on its status line,
so the probe never becomes a dialog or a prompt other extensions or the
model would see. A child launched without the bridge stops as before;
one with the bridge but no ready instance is left for the next sweep.
* test(pi): replay the bridge's recorded probe answers
Recorded on Windows from Pi 1.5.0 with pi-subagents 0.84.0 and the bridge:
ready, active while a worker ran, idle after its wake turn, and shutdown.
* fix(pi): let the Pi child own its probe folder and reject malformed answers
A launch abandoned before Pi started left its prepared folder behind, so
the bridge now creates the folder itself. An answer with no probe pending
could throw while reading Pi's output; replies are now matched exactly and
anything else times out as unknown. Leftover folders are reclaimed only
when their Orca process is proven gone.
* test(pi): reproduce an unasked-for answer from the ready bridge
* fix(native-chat): apply an idle window changed while a provider answered
The idle stop now re-reads the chat idle setting after the provider's
answer, so switching a chat to Never during the probe keeps its agent.
Normalize each Pi launch's private probe folder in the launch parity
snapshots, which now include the background-work bridge.
* fix(session-tabs): send per-client frames without projecting them twice
A frame sent to one client (a tab it opened, picked or reopened) was already
that client's projection, but delivery projected it again. That stacked the
:client-navigation epoch suffix and the selection revision, so the client
treated it as another publication and fenced it. A link clicked in a server
browser page then only brought its new tab forward the first time.
* test(session-tabs): fold the per-client frame publication check into the caller-selection test
Use the shared searchable agent picker in Quick Commands while preserving the full catalog, disabled-agent explanations, independent form drafts and saved commands.
Keep dialog search focused through opening and host-preference reloads, and avoid setup-only cleanup for agent-only menus.
The @ and / suggestion list lifts itself to the menu layer only inside a
popover. Since #37576 the new-tab agent setup is a dropdown submenu on the
same z-[70] layer, so the list stayed at z-50 and drew behind it.
The @ file and slash suggestion list was placed once from the composer's
viewport rect and only re-measured on composer resize, ancestor scroll or
window resize. Dragging the floating panel or resizing it from its bottom
edge moved the composer without any of those, so the list stayed behind,
over the transcript or the message box. Near the top of the window it also
ran off-screen.
Position it with floating-ui's autoUpdate and computePosition, which follow
any anchor movement and cap the height to the space above the composer.
Rows show their project, two-line layout with fixed time/size columns and hover actions; Ignore can be undone per row; delete confirmation reads 'Delete N workspaces?'. Fixes Ignore/Stop ignoring being reverted by streamed scan frames or scan settlement, and the git-unknown flash on open/close.
Co-authored-by: Jingyue-Wu <75918217+Jingyue-Wu@users.noreply.github.com>
* fix(dictation): keep the transcript when the composer's stop button ends dictation
* fix(dictation): leave focus where the user moved it when late text lands
* fix(native-chat): don't double the space before text that brings its own
* refactor(native-chat): name the draft-only insert for what it does
* fix(native-chat): wrap long answers in a question card's answer field
The free-form answer field was a one-line input, so a long answer
scrolled sideways out of view. It is now a one-row textarea that grows
with its text (CSS field sizing, like the Linear title and agent-args
fields) up to six of its own lines, then scrolls. Enter still submits,
and a pasted line break becomes a space, so the answer stays one line.
The answer ref is typed for the textarea along the card chain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native-chat): keep Undo after a multi-line paste into the answer field
Rewriting the field value to strip pasted line breaks cleared the
textarea's undo history. A paste that holds line breaks now inserts the
one-line text with insertText right after the paste event, so it is one
undoable edit and the caret lands after it. The in-place cleanup in
onChange stays for dictation and drops.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native-chat): keep caret-aware arrows on the wrapping answer field
* fix(native-chat): drop the answer field's paste-event path
Desktop Cmd+V and menu Paste reach the field through the paste bridge, not a paste event, so the field's onChange is the one place line breaks become spaces.
---------
Co-authored-by: Michael Schaecher <276865230+big-sheq@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native-chat): run Codex /goal pause|resume|clear and /usage from chat
Codex app-server has no slash parser, so a chat's /goal pause set the goal's text to "pause" and /usage reached the model as prose. /goal pause|resume|clear now change the current goal through the host, and /usage opens the Codex usage section in Settings for the chat's host.
* fix(codex): say a chat has no goal when /goal pause or resume finds none
Codex rejects a status change without a goal in words naming the thread id; read the goal after that rejection and show Orca's copy instead.
* fix(native-chat): address review on Codex /goal controls and /usage
Look goal words up without inherited properties, keep text after a picked /usage, let Send run what Enter runs on a held host, name Codex when there is no goal (clear included), and drop the shared /goal hint that phones and goal-less hosts would show for words they send as text.
* fix(native-chat): keep the draft after a picked /usage and hold goal-mode Send
Picking /usage opens Settings and leaves the text typed after the command; Enter on the row no longer sends /usage to the agent. Goal mode submits its draft as an objective, so a held host keeps Send held there, and an enabled Send is not labelled with the hold.
* test(native-chat): build the picker state instead of casting it
* fix(native-chat): honor Stop before naming a missing goal, and own any Codex /usage row
A canceled pause or resume no longer reads the goal to word a refusal, and an agent-reported /usage row gives way to Orca's, as /resume already does.
* revert(native-chat): leave /usage for its own change
Brennan wants /usage to show the status bar's Codex usage panel for the chat's account, in a separate PR; this PR keeps the /goal controls and the held-chat Send fix.
* fix(native-chat): let arrow keys reach a question card's answer field
Up and Down cycled only the option rows and wrapped past the free-form
answer field, so only a mouse click could reach it. The field is now the
last stop in the loop. A one-line field always hands plain Up/Down back
to the options; a multiline field does so only from the very start or
end of its text, so caret moves inside a draft keep working. Arriving
by arrow focuses the field without choosing the typed answer and puts
the caret at the end.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(native-chat): find the question answer field by its existing marker
Mark the multiline answer field with data-native-chat-answer-field like
the one-line field already is, and find it by that marker instead of a
deny-list selector that a markdown task-list checkbox could defeat.
Paste routing is unchanged: it only claims an input element. Trim the
tests to one case per behavior.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Michael Schaecher <276865230+big-sheq@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(browser): save and fill passwords in Orca's browser (experimental)
Off by default under Settings > Experimental > Saved passwords.
* fix(browser): secure saved passwords and fix login lifecycles
* fix(browser): keep the guest preload self-contained so saved passwords load
The shared uuid import split into a chunk the sandboxed preload can't require, so the
whole preload failed on every page. Element tokens now come from crypto.getRandomValues.
* fix(browser): fill a saved login on mouse press so clicking a row works
Pressing Orca's UI blurs the page field, which closed the list before the click landed.
* feat(browser): manage saved passwords from a Passwords section in Settings › Browser
Replaces the Manage passwords dialog with an inline section: save and Touch ID
switches, import menu, a searchable list grouped by site with last-used times and
hover actions in a capped scroll box, delete confirmations, and an Add/Edit dialog.
* feat(browser): turn saved passwords on for everyone instead of behind Experimental
Drops the experimental flag, its Experimental toggle and the badge; the Passwords section in
Settings › Browser now shows on desktop for the local host without opting in. With no toggle,
the guest disable message and the apply-to-open-pages step had nothing left to trigger them.
* fix(browser): refuse protected password actions when Touch ID is set up but unavailable, and keep fills on the matched page
Touch ID lockout or a closed lid made canPromptTouchID() false, which counted as a Mac without
Touch ID, so show, copy and protected fill went through unchecked. Enrollment from bioutil now
tells the two apart. A fill also kept no hold on the page across the Touch ID prompt, so a page
that navigated meanwhile got the password; it now goes only to the frame and origin it was matched for.
* fix(browser): keep a browser profile when its saved logins can't be deleted
Profile deletion removed the profile first and only logged a failed vault delete, so the
encrypted vault could stay on disk with nothing left to retry it. The vault now goes first,
and the profile stays (deletion reports failure) when it can't.
* New chats run the agent's configured model when no model was picked
A new chat with no model pick sent the default Orca had learned from an
earlier chat on its first message, so the agent ran that remembered model
instead of the one its own configuration now chooses (STA-13542: OMP chats
ignoring config.yml). Unpicked defaults are now shown but never sent, for
model as already for effort; the Claude create/send fallback no longer
turns a shown default or an agent report into the chat's own model.
* Phone declared-effort test: only saved models are sent
* Show changed files directly in chat turns
* Use the fixture frame for the diff interaction
* Keep changed filenames readable and preserve file actions
* Keep unconfirmed file changes in tool activity
* Capture changed files in completed transcript fixtures
* Preserve patch data with authoritative history status
* Keep mobile diff interaction coverage beside its card
* Assert the decoded patch line contract
* Exercise full returned history in catch-up coverage
* test(chat): target file summary when reopening patches
* fix(sidebar): extend the workspace list scrollbar hit area past the seam
Add a 4px strip just right of the sidebar seam that drives the list
scroll position like the native thumb (drag the thumb, or jump on track
click), and falls back to resizing where no list scrollbar is under it.
The resize handle starts past the strip; the divider line stays on the seam.
* fix(sidebar): keep seam scrollbar drags alive over native plugins
* Keep long chat turns alive past timeline entry limits
* Retire completed tool payloads and preserve late event ownership
* Use canonical payload metadata in the long-turn benchmark
* Explain the real-scale benchmark timeout
closeTerminalTab defaulted a missing reason to 'user', so programmatic
closes (a withdrawn launch pane, a host-retired pane) reached a paired host as session.tabs.close reason:'user' and
killed its live terminal. The reason is now required; only gestures
declare 'user', CLI/RPC/phone closes forwarded by main declare
'requested', and housekeeping declares 'cleanup', which never kills a
paired host's live terminal. A launch pane closed by housekeeping no
longer tells main the user stopped its launch.
Refs #37245
Headless orca serve (orcad and Electron --serve) was missing services that only
the desktop composition or a window attach started.
- orcad now wires the orchestration environment transport, so a headless Run
home can place workers on its paired servers again. The transport moves into
a shared factory both hosts use. Its routing graph broadcast to renderers
through BrowserWindow directly; that now goes through the desktop-surface
port, so the graph runs on plain Node.
- orcad also resolves paired-device names, which was a declared gap.
- Usage polling runs from the account composition every host builds. Polls
fire while someone watches: the focused desktop window, or a live
accounts.subscribe stream. A headless host's remote readers now get the polls
that stream promises, and unwatched hosts spend no usage budget.
- The composition parity test now accounts for every service a window attach
starts, so a new window-only start can't silently skip headless hosts.
Fixes#36853
Refs #37256
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(agent-state-rules): treat a 404 as nothing published, not a failure
No agent-state-rules release has been published yet, so every packaged
app logged a warning on each refresh. Log 404 at debug level; other HTTP
errors still warn.
Refs #37538
* test(agent-state-rules): drop the server-error case
Refs #37538
* fix(agent-state-rules): log nothing for a 404
orcad routes console.debug to stderr, so a debug line still reached
orcad.log on every refresh.
Refs #37538
* test(agent-state-rules): check the app fetches where the publisher uploads
A 404 is now silent, so a tag, engine-version or asset-name drift between
the publisher script and the app would go unnoticed.
Refs #37538
* fix(orcad): fit orcad inside a `ulimit -v` address-space limit
On hosts that cap virtual memory (ulimit -v 8 GiB on an HPC node), the
managed orcad crash-looped with "Failed to reserve virtual memory for
CodeRange" whenever it started a worker thread.
Two reservations used up the limit:
- undici's WASM HTTP parser, loaded by the first fetch, reserves a
trap-handler guard region (4-9 GiB). The pinned-Node orcad launch now
passes --disable-wasm-trap-handler --wasm-max-mem-pages=1024.
- each Worker isolate reserves V8's default CodeRange (512 MB on x64,
~600 MB of address space per worker). Main-process workers now go
through spawnWorkerThread(), which caps the code range at 64 MB, and
a lint rule keeps new sites on it.
Fixes#37538. Thanks to lin-tianyu for the report and logs.
* fix(orcad): keep the runtime selector one command; enforce spawnWorkerThread with ast-grep
Refs #37538
* test(orcad): run the address-space regression on Node
Refs #37538
* docs(orcad): note the WASM memory cap at the pinned-Node flags
Refs #37538
* fix(terminal): only resume a terminal stream where xterm is, so escape tails never print
After switching workspaces, Claude Code's prompt could show stray text such as
"43B": the tail of ESC[43B from a frame whose start was lost when output was
dropped (hidden panes, the pending cap, daemon background thinning, the
renderer backlog cap) and the stream resumed raw.
Main marks every delivery that cannot prove it starts at escape-parser ground
(midEscape: true, or 'unknown' after bytes it never saw), never batches bytes
across a gap, and routes salvaged query copies through the drop sentinel.
The renderer tracks where xterm's parser stands in the stream. Bytes enter
xterm only as an exact continuation of what it parsed, or from a boundary main
proves is ground (grounded with CAN); anything else is skipped whole, still
answers its queries, and is repainted by a restore. Snapshot and reattach
replays anchor the position; Orca's own CAN-led writes invalidate it. This
replaces the gap-label and seq-proof admission from #37269.
* refactor(terminal): tidy stream-boundary plumbing
Share the drop-sentinel check, build sentinel bytes once, name main's start field as a boundary, and drop unused test fixtures.
The remote host relays commands for desktop-hosted pages back to the
desktop, which ran every relayed command as the orca CLI. A terminal
link's follow-up browser.goto therefore marked the page agent-driven.
The host now tags relayed commands with whether its caller was an agent,
and the desktop only uses the agent identity for those.
* fix(chat): show running Codex image generation as generating
* fix(chat): settle an abandoned Codex image generation as not running
* refactor(chat): inline the running image status check
* fix(sidebar): show hidden discovered worktrees outside project grouping
* fix(sidebar): place hidden-worktree lines from the rendered rows in one pass
* fix(sidebar): keep shared-anchor hidden-worktree lines in row order
* fix(sidebar): count row visits without Reflect and drop a cast
* test(sidebar): build typed fixtures instead of casts
* fix(sidebar): show one hidden-worktrees line for all projects outside project grouping
* Say where to switch back from Chat UI wherever Orca turns it on
The Chat UI tip pointed to Settings → Agents, which users did not guess, and turning
Chat UI on from the tip or picking it in onboarding gave no reminder of where to undo it.
Point every surface at the Chat UI is on / Turn off switch in Settings → Chat UI, and
confirm the switch with a toast that names that path.
* Point browser and phone users at their own switch-back control, and word the toast as a default change
The browser client has no Chat UI launch switch, so its onboarding note names the
Onboarding checklist. Phone onboarding names Settings → Chat UI. The toast after Use
Chat UI says Chat UI became the default for new agents, since agents with their own
choice keep it.
* fix(chat): show the requested Codex wait duration
* test(chat): complete sleep activity test inputs
* test(chat): keep activity rendering within the web project
* test(chat): follow the translator module relocation
Manual runs refused when a GitHub/GitLab-tagged automation's source tool or
auth was unavailable, while scheduled runs of the same automation ran. Drop the
source check and the per-row source-host probing that only fed it, so manual
runs match scheduled runs.
Fixes STA-13275
During creation the prior worktree stays active until handoff, and since #36920
the right sidebar stays open, so its panels showed the old worktree's files.
* fix(terminal): parse ligature fonts once and skip fonts whose rules explode
Since 1.4.247 the main window holds the local-fonts permission, so
@xterm/addon-ligatures reads and parses the whole font file once per
terminal. Fonts with large calt chained-context rules (Commit Mono: ~200MB
and ~1.7s per parse) then OOM the renderer when a session restores many
terminals, crash-looping Orca on every launch.
Share one parsed font per font stack across terminals, and estimate the
calt context expansion from raw GSUB bytes before parsing; over-budget,
oversized, or unreadable fonts keep the addon's common-ligature list, which
matches 1.4.246 behaviour.
* chore(terminal): document the ligature delegate terminal casts
* fix(terminal): keep the ligature addon from reading font files
Replace the shared-parse approach with the conservative fix. Since 1.4.247
the main window holds local-fonts, so @xterm/addon-ligatures read and parsed
the whole font file once per terminal; fonts like Commit Mono (~200MB per
parse) OOMed renderers on restore and crash-looped Orca.
Hide the terminal's font family from the addon so it never loads font files
and joins its common-ligature list, exactly as before 1.4.247. The settings
preview now uses the same wrapper. local-fonts stays granted for the font
picker.
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* Add Chat UI choice to onboarding and tailor agent tours
* Add setup guide controls for Chat UI and Yolo permissions
* Refresh native chat agents and improve surface radio controls
- Re-read the host inventory alongside workspace refreshes, including WSL
- Recognize downloaded, ready chat runtimes without a CLI on PATH
- Standardize onboarding and checklist surface choices on accessible radio variants
* Show full-access agent overrides in Yolo mode settings
* Polish Chat UI onboarding and clarify terminal fallbacks
- Group agents by launch surface and refresh selection previews
- Add scroll-edge fades to reveal clipped onboarding content
* Recognize ready custom Chat commands and nested scroll changes
* Advance agent tour after selecting a new tab type
* Install onboarding skills for selected chat providers
- Route Chat UI setup to local provider-specific skill roots
- Improve tour focus, Escape handling, and delayed target transitions
* Keep split lesson while a new pane mounts; update renamed skill in test
* Assert agentDefaultSurface in Chat UI onboarding e2e
* Open the chosen Chat UI agent when a new project's default checkout opens
* Make the onboarding chat preview match native chat
- Soften the selected preview tile styling.
- Accept a leading separator in dev:fresh arguments.
* Fix scrolling in the onboarding agent step
* Preserve initial working directory when opening empty workspaces
Also check only remaining tour steps for unfinished actions.
* Fix tour resumption after completed split steps
The floating panel has one tab row, and it shows only the focused split.
A browser in another split had no tab and no close button on screen, so
the terminal beside it could be closed but the browser could not.
Show an X in the browser toolbar when the page is in a floating split,
using the same close command as the tab row. The main window is unchanged
because each of its splits has its own tab row.
Fixes#38167
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
OrcaWinandOrcaWin
Kelvin Amoaba
Jingyue Wu
Neil
Jinwoo Hong
Younghwan ChaeandClaude Opus 5.5