* fix(source-control): resolve delete/modify conflicts and complete merges from the panel
* fix(source-control): address review findings on conflict resolution
* fix(source-control): save every view of the file before marking a conflict resolved
* fix(source-control): match unsaved conflict views by physical file only
* test(source-control): prove completeMerge refuses with a commit template set
* refactor(source-control): reuse autosave view matching and refresh only after a completed merge
* fix(source-control): drop the untranslated Complete merge fallback text
* fix(source-control): refuse Keep file when the file is gone and re-read unsaved views on retry
* fix(source-control): let Keep file stage conflicted symlinks with missing targets
* fix(source-control): run one conflict resolution per file at a time
* fix(explorer): open folder links that lead outside the project again
#24489 replaced in-memory path grants with declared file access, and the
explorer started refusing folder links out of the project with a toast.
fs:readDir now accepts user-named access; the explorer retries a contained
listing that main refuses only as outside the project, and files listed
that way open by absolute path so their tabs keep access after restart.
* fix(explorer): let main verify outside folder links, and list them only on a gesture
Review follow-ups:
- New project-folder-link access kind, accepted only for fs:readDir: main
lists a folder only when the nearest project folder above it holds a
symlink on the path, so an unregistered root's child or an arbitrary
folder stays refused. user-file no longer lists folders.
- The explorer follows a link only on a user act or under a folder already
listed as outside; refreshes never upgrade a contained listing.
- A link target that fails to list (EPERM, ENOENT) shows its own error.
- Open Markdown Preview opens outside rows by absolute path too.
- New/Duplicate/Rename/Delete are disabled on rows listed through an
outside link, since writes stay inside projects.
* fix(explorer): keep keyboard edits off outside-link rows, and follow listed link rows on reveal
- Enter-to-rename and the delete binding skip rows listed through an outside
folder link, matching the disabled context-menu items.
- A folder the parent listing shows as a symlink may follow the link without
a click, so reveal and re-expansion after a workspace switch list it; a
folder that only became a link stays refused until clicked.
- Pass followProjectFolderLink only when set, so existing read-call
expectations hold.
* fix(explorer): limit folder-link listings to project roots; no rename on outside-row double-click
- Orca's floating folder is not a project, so a link there no longer
authorizes an outside listing (direct IPC callers included).
- Double-clicking an outside-link row's name pins the preview instead of
starting a rename main would refuse.
* fix(pi): the thinking menu before the first message matches the chat's
Pi's pre-session catalog now asks Pi for its models over RPC and builds each
menu with the same projection a running chat uses, falling back to the text
listing only when Pi cannot answer over RPC.
* fix(pi): preserve remembered off effort on precise model lists
* test(pi): focus effort regression and stop fallback contracts
* test(pi): allow metadata reads between ordered option writes
* fix(pi): derive supported effort without replacing accepted intent
* test: cover host effort projection and refreshed frozen queues
* test: consolidate session option imports
* test: normalize absent catalog fixture records
* test: isolate host fixture types from client projects
* Preserve legacy effort capture for other agents
* fix(windows): start the WSL holder outside Orca's jobs so a crash doesn't take it down
* test(windows): prove the job closed with a non-breakaway control before checking the holder
A host-native hook path proves the agent ran on the host, so the 5s
session-ID fallback no longer walks every running distro's roots over 9P
while the transcript is unflushed. Mirrors the existing guest-hook-path rule.
* fix(native-chat): keep chats stopped by a delivered kill readable after a downgrade
v1.4.244 accepts only three death kinds and sets aside any other record,
so a chat Stop force-killed (exit never observed) vanished after a
downgrade. Store the delivered kill as the absent pid an older build's
restart probe would itself record, plus an exact marker this build reads
back; in-memory code still sees kill-delivered.
* test(native-chat): explain release-checkout timeout
* test(native-chat): cover downgrade recovery and workspace rekeying
* test(native-chat): preserve checked record types at test boundaries
* fix(editor): preserve sibling tasks beneath ordered list items
* fix(editor): preserve wrapped inline markup in task items
* fix(editor): keep nested task continuations valid and editable
* fix(editor): keep literal task markers out of mixed checklists
* fix(editor): apply review fixes to task-list parsing stack
- Trim synthetic test matrices to the behavioral cases
- Regenerate pnpm-lock (drops a stale github-slugger importer entry)
- Assert the plain bullet's node type under an ordered parent
* fix(editor): keep one-column-deeper ordered tasks as sibling checkboxes
Dedent an ordered item's task block by the first task's column instead of
keeping its leading whitespace. A task one column deeper stays a sibling
checkbox, and text at or within the first task's column stays nested as
before. Strip leftover paragraph indent from task children.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(mobile): preserve literal code through rich Markdown edits
* fix(mobile): preserve inline code containing backticks
* Preserve adjacent inline-code text when saving mobile Markdown
* Preserve quote paragraphs and blocks in mobile Markdown
* fix(mobile): preserve selected text when creating code blocks
* test(mobile): choose native history shortcut from browser host
* Preserve paragraph-owned mobile code blocks when saving
* Preserve code selected inside mobile headings after saving
* fix(mobile): keep code serialization space-normalized and trim review tests
- Inline code and code blocks keep turning browser-created NBSPs into spaces;
only the reader-side entity fix is needed for literal code.
- Inline code line breaks save as spaces so table rows and headings stay intact.
- Code blocks keep trimming trailing newlines left by placeholder <br>s.
- Heading- and paragraph-owned code blocks join adjacent inline code runs.
- Empty nested quotes reopen as a plain empty paragraph.
- Trim synthetic and behavior-locking tests.
* fix(mobile): keep quoted text literal when block reading would rewrite it
Quoted list continuations and lazy lines were restructured on save because the list reader drops them; reopen quote blocks only when they save the source or the same bytes as the literal paragraph.
* test(mobile): use template literal for saved code-block markdown
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Plugins settings: one list with an Installed badge, inline switch and install-state filter
* test(plugins): drive card enablement through the inline switch
* plugins: keep the installed-read error on Not installed; cover installed cards past the cap
* plugins: inline category filter chips with icons from one category-icon module
* plugins: single-select category chips, marketing icon table, Remote/VMs label, trusted-code access copy
* plugins: Not installed waits for the installed-plugin read
* ci: retrigger
* fix(editor): keep keyboard completion results visible
* fix(editor): keep completion menus placed and keyboard results visible
* fix(editor): restore link bubble anchor and keep completion menus tied to their editor
Restore the link bubble's required anchorElement, keep editor clicks and
refocus from dismissing completion menus (selection sync still governs),
close them when the editor is hidden, and cover keyboard scrolling and
outside dismissal.
* fix(editor): share #34980's editor-visibility dismissal so completion menus close when their workspace is hidden but painted
* fix(editor): read latest dismiss callback via useEffectEvent instead of render-time ref write
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(editor): give the emoji picker dismissal and app theme behavior
Move the slash-command emoji picker onto the shared Popover so Escape and
outside clicks dismiss it, follow the app theme instead of the OS theme,
name the dialog for assistive tools, and close it when its editor is hidden
so the portaled picker cannot float over another tab or workspace.
* fix(editor): dismiss emoji picker when its workspace is hidden but still painted
Extract the link bubble's ancestor visibility check (opacity-0, inert, aria-hidden,
hidden, display/visibility) into editor-anchor-visibility.ts and reuse it, with an
ancestor MutationObserver, for the portaled emoji picker.
* fix(editor): read latest dismiss callback via useEffectEvent instead of render-time ref write
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Removed paired workspaces kept their cached frame and reported pane until
environment teardown, and every workspace switch scanned those tombstones.
Clear them with the other per-worktree tracking and never cache removal frames.
useNativeChatTurnStatus returned a fresh object each render, busting the
slots memo and re-running buildNativeChatTranscriptSlots' transcript-length
passes on turnActivity/stopping/awaitingInput-only renders.
Hosted-review eligibility (baseRefExistsOnRemote) and PR remote-base probes
spawned one `show-ref --verify` per configured remote. Eligibility re-runs on
every source-control state change (commit, ahead/behind, dirty toggle, worktree
switch), so a repo with many remotes bursts dozens of git children each time.
Add probeExactRefsViaForEachRef: one stdin-free `for-each-ref -- <refs>` child,
keeping only exact matches (descendants do not count), with fallback to the
existing per-ref probes on any failure. On a 77-remote repo: 77 children /
~570ms -> 1 child / ~40ms, identical present/absent results.
Exact probes are now case-sensitive on every filesystem (for-each-ref matches
refnames byte-for-byte, unlike loose-ref show-ref on macOS/Windows), which
matches packed-ref and hosting-provider semantics.
Refs STA-8433, STA-6289
* fix(wsl): refuse a drive/UNC conversion that would split a nested duplicate project
A refused duplicate inside a converting folder had its path rewritten while its ids stayed,
so its terminal history and sessions no longer matched. Another spelling of the same folder
still converts with it.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): refuse only duplicates inside a converting folder, as an overlap
Review: an enclosing duplicate never splits, the same-spelling exemption keys on the main folder,
the blocker reads as an overlap instead of naming the clicked row, and the scan is skipped when
nothing is a duplicate.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(editor): match Unicode heading anchors across rich and preview modes
* test(editor): drop slugger tests that only re-test github-slugger
The preview-parity test in markdown-anchor-scroll.test.ts covers the behavior that matters.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(editor): open the link that received the modifier-click
* fix(editor): read clicked link href from its mark, not the sanitized DOM
Tiptap blanks rendered hrefs for file:, Windows drive paths and custom schemes; resolve the clicked anchor's document position and read the link mark instead.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(terminal): retain only timings in typing diagnostics
* Remove typed text from latency diagnostics and cover task overlap
* Preserve text metadata in diagnostic lifecycle test
Catch-up scanned the whole chat journal once per retained prompt. Index prompt-to-turn matches once per reader, the same way the reader already indexes local prompts, keeping every match as a commit dependency in journal order.
Tracked in STA-12049.
* fix(editor): normalize heading whitespace when navigating the TOC
* fix(editor): resolve TOC headings containing images and document links
* fix(editor): read only text and image alt when matching TOC headings
Skip comment nodes in heading text, and trim test cases that overstated NBSP coverage or checked an inert negative path.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
NotificationCardStack publishes its height so the toaster stacks above it instead of rendering
behind it (z-47 under z-50), and lines up with the cards at 1rem. The one-time Codex shared
settings notice moves from a sticky toast into the card stack.
* Release the last closed rich Markdown editor
* test(editor): reduce retention test to one case and note configure() ordering
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(editor): preserve selected code when indenting
* fix(editor): keep Shift-Tab list outdent for selections starting outside code
Gate code-block outdent on the selection starting in (or being fully covered by)
a code block so list items containing a nested indented code block still outdent.
Remove the dead empty-indent branch, restore the DOM-less test fixture, move the
DOM-dependent undo/caret tests to a scoped happy-dom file, and trim duplicate tests.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(native-chat): stop the saved-status writer from remembering every closed chat
The writer deduped turn-edge writes with a per-chat memo that was never
cleared, so a long-running app kept one entry for every chat it had ever
shown. Dedupe against the saved record instead, holding only edges whose
write is still in flight; a reopened chat still skips an edge already saved.
* test: cover settled chat status writer retention
* test: simplify saved status retention contracts
* fix(bash): emit the shell-ready marker when ble.sh owns the prompt
ble.sh discards Bash's own readline prompt output and draws from its own
PS1 copy, so the daemon wrapper's PS1 ready marker never reached the PTY
and every startup command waited the 15s shell-ready timeout. Print the
marker directly from the prompt hook when BLE_ATTACHED is set.
Fixes#35784
* fix(bash): detect ble.sh 0.3 and ignore inherited ble.sh variables
ble.sh 0.3.x has no BLE_ATTACHED, so key the direct ready marker on
_ble_attached, and require ble.sh's functions in this shell so a stale
exported variable cannot select the cooked-mode path and double-echo
the startup command.
* fix(bash): wait for ble.sh's decoder and drop inherited ble.sh state
Nightly ble.sh renders its first prompt, which runs Orca's prompt hook,
before the key decoder attaches and can still fail back to cooked mode.
Print the direct marker only once _ble_decode_bind_state is set, and
unset inherited ble.sh attach state before profiles so exported
variables or functions cannot select the direct path.
* fix(bash): keep live ble.sh state from a system bashrc
Bash sources /etc/bash.bashrc before --rcfile, so ble.sh may already be
attached; the unconditional unset broke its decoder attach and hid the
ready marker. Drop only exported copies, which ble.sh never creates, and
make the wrapper tests require readiness before the first command.
* fix(computer-use): replace the macOS permission status gate with one 5s launch floor (#34390)
Follows up #36028. The earlier gate grew background/explicit flags, epochs,
backoff and a setup pgrep path that reviewers could not make correct.
- Status: one probe at a time and one 5s launch floor shared by every reader, so
every path stays at <=12 helper launches/min. Readers inside the floor join the
running probe or ride one trailing probe that fires only if someone waits.
Only grants are cached (until the floor expires); denials and errors are never
served, so a grant shows within one floor locally and on web. No app epochs:
without a denial cache they bought nothing. Off macOS the gate is skipped.
- Setup: one launch per 5s across every permission, claimed synchronously; a
request inside the window is queued (latest wins) and reported as
launchQueued. Kill-and-relaunch stays so a click always re-shows the helper.
Setup reuses the gate's in-flight/cached/last result instead of probing.
- Reset checks helper availability from the bundle and invalidates after any
tccutil attempt, including partial failures.
- Remove the background flag from preload/IPC/renderer/web, the app-activity
binding, and the sidecar permission_denied invalidation.
* fix(computer-use): close the remaining gaps in the permission launch floor (#34390)
- Clear the trailing timer whenever any probe launches and re-check the floor
when it fires, so a late timer can never launch inside the floor.
- Setup reuses a denial only until the floor expires.
- A reader that joins a probe older than 300ms and gets a denial rides the next
probe, so a grant shows within about one floor even after a stale web/RPC probe.
- Setup requests are numbered on arrival, including ones that coalesce, so the
latest request wins (A, B, A launches A); a queued launch already covered by a
newer launch is dropped. Reset and will-quit cancel any queued launch.
- The settings pane says "Opening…" and the CLI says queued for queued launches.
* fix(computer-use): measure permission launch floors from real spawns and cancel setup on every host (#34390)
- Both 5s floors use performance.now, so a wall-clock step cannot stretch or skip them.
- The status floor counts from the later of claim and the actual `open` spawn, and
the setup window from after its spawn, so a slow mkdtemp or pkill can't allow a
13th spawn in a 60s window.
- Setup cancellation registers through AppEnvironment quit handlers (desktop,
headless Electron serve, orcad) and orcad's shutdown trigger; reset and
shutdown bump a generation so an Open still waiting on status never launches.
- Reset cancels queued setup before its first await.
- A setup request leaves the coalescing map when it launches, so a later request
for the same permission queues and wins (latest-wins across microtasks).
- A failed probe clears the remembered denial.
* fix(computer-use): drop setup coalescing and gate setup on a host-wide shutdown flag (#34390)
- Remove the per-permission setupInFlight map. Every Open goes through the 5s
window and seq-ordered queue; a queued request with the same args that arrived
before the last spawn was already shown by it, so concurrent same-permission
Opens still spawn once. This fixes stale entries after reset turning the next
Open into a no-op or a cancelled one.
- A cancelled Open (reset or shutdown) rejects with an error instead of returning
launchedHelper: false, which every client rendered as "setup complete".
- Replace the per-host cancel calls with src/main/host-shutdown-state.ts, set
synchronously by Electron will-quit and orcad's shutdown admission; setup
checks it before every spawn, including the queued timer.
- Track the status cache's expiry from the probe that produced it, so starting a
new probe cannot revive an expired grant.
- The queued setup timer re-checks its deadline and re-arms when early, and both
timers round delays up; a throwing spawn there is logged, not uncaught.
* fix(computer-use): keep setup latest-wins after slow probes and surface cancelled setups (#34390)
- Record the launching request's seq; an older request that resumes or is queued
after a newer one spawned is dropped, so latest-wins holds when requests
resume out of order behind a probe.
- orcad sets the host shutdown flag on every cleanup entry, including failed
startup.
- The web facade only falls back for hosts without computer.permissions; other
failures, such as a cancelled Open, reject so the pane and onboarding show them.
- The cancellation check runs before an untargeted Open can report everything granted.
- Opens that arrive mid-reset wait for it, so reset's helper cleanup cannot kill
what they open.
- Queued wording now says a newer request or a reset may replace it.
* fix(computer-use): wait out a reset before an Open reads permission status (#34390)
* feat(telemetry): report plugin installs and removals from Orca's public catalogs
* refactor(plugins): move marketplace install origin out of the installer
* fix(wsl): main's background start preps its host env without waking the distro (E9)
* fix(wsl): daemon-off background starts prep their env without waking the distro (E9)
* fix(acp): update Antigravity model and effort metadata
* fix: confirm ACP model families and idle option metadata
* Preserve provider-owned model and effort selection
* test: repair model option host and consumer fixtures
* Use the provider child type for optional delivery ownership
* test: match model option fixtures to their protocol contracts
* fix: isolate resting options from adapter type dependencies
* Preserve Antigravity option fixture types
* Match option fixture control response contract
---------
Co-authored-by: Vyacheslav Scherbinin <gentslava@mail.ru>
* fix(editor): preserve literal text in citation paste fallback
* test(editor): drop paste-meta implementation assertion from fallback test
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Kelvin Amoaba
Neil
OrcaWinandOrcaWin
Brennan Benson
Jinjing
Jinwoo Hong
