Scroll-spy pages rewrite the URL fragment with history.replaceState as
you scroll. The webview navigation handlers and setBrowserPageUrl treated
those same-document updates as a new document, retiring saved-note
badges and cancelling an open comment card. Fragment-only in-place
updates now keep the geometry; document navigations and in-place route
changes (path or query) still retire it, and the store no longer guesses
document boundaries from URL changes.
Without --enter, --text reaches the PTY unmodified, so integrators can send
Escape or Ctrl+U directly. With --enter and without --interrupt, prompts to a
recognized running agent are bracketed-pasted and embedded Escape is made inert.
Fixes#14032
Co-authored-by: Neil <neil@stably.ai>
An unexpected ACP agent exit reported only the whole-run stderr tail, so a
startup warning read as the cause, and the observed exit code/signal was
dropped. Add the exit code or signal to the ended reason and Details, file
the stderr tail as a log diagnostic like the Claude and Codex lanes, and
read the exit status from ManagedProviderProcess.exitStatus through a
shared formatter that Claude reuses.
Fixes#33035
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
QuickCommandsPane, useAddRepoCloneFlow, UntitledFileRenameDialog and the
workspace board column resize hook guarded a render-phase setState with a
ref written in the same render. When a sibling suspends, React discards
that render and its queued updates but keeps the ref write, so the retry
skipped the adjustment (no Add dialog, empty clone destination, stale
save-as name, stale column width). Track each guard in state instead, and
sync the column-resize handler refs in a layout effect.
The other two sites from the issue (WorktreeMetaDialog prevIsOpenRef and
use-native-chat-draft lastScopeKey) no longer exist on main: the dialog
remounts a keyed draft and the chat draft reads via useSyncExternalStore.
Fixes#25527
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Jcode accepts a string or an array of strings per hook event, but Orca's
[hooks] parser only understood single-line strings, so any array made
status and install report error and no hook was written.
Parse string arrays, append Orca's command as the last element (after the
user's pre_tool gates), repair a stale Orca element in place, collapse
duplicate managed elements on reinstall, and remove only Orca's element on
uninstall. Edits are offset splices on the original text, so user entries,
comments and layout survive; malformed or non-string arrays still fail
closed.
Fixes#33998
Co-authored-by: Neil <neil@stably.ai>
Codex paginated rollouts persist an item_completed ContextCompaction item
with no content, and legacy rollouts persist an event_msg context_compacted.
The Codex decoder dropped both, so the native Chat timeline never showed
that context was compacted. Emit a system row with the shared compaction
copy and presentation so it renders as the compaction divider.
Fixes#14188
Co-authored-by: Neil <neil@stably.ai>
The details tokenizer's start hook matched any `<details` substring, so
marked cut a paragraph at a `<details>` mention inside inline code and its
HTML-block rule swallowed the rest, rewriting the file on save. HTML blocks
open only at a line start, so anchor the hook there.
Fixes#19799
Co-authored-by: Neil <neil@stably.ai>
The observed (`worker-start --setup run`) and sequenced (`wait-for-setup`) setup
commands are typed into the user's interactive shell. Pair-inserting line
editors such as zsh-autopair rewrite the `( ` of the `( bash runner )` wrapper
into `( )`, so bash -lc receives a stray `)` and rejects the whole line: setup
never runs, no completion marker is printed, and the worker stays at
setup_state: running (or the agent gate waits out its timeout).
The runner command is always a single external command (bash/cmd.exe/
powershell.exe), so the subshell added nothing; run it directly.
Fixes#18059
Co-authored-by: Neil <neil@stably.ai>
Codex can render a separate `? for shortcuts` row below its status row. The
composer classifier returned on the first nonblank bottom row, so it never
examined the real status row above the hint and the IME placeholder mask
never activated, leaving the placeholder beside composing text.
Fixes#24337
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Andy Zhang <16486422+v01dstar@users.noreply.github.com>
The orchestration skill description only advertised coordinator work, so a
dispatched worker never loaded it and built its heartbeat loop from the
preamble alone. Neither the preamble nor the guide said to stop a background
heartbeat loop before worker_done, so the loop outlived the task.
Add worker-role triggers (heartbeats, ask, worker_done) to the description and
stub, and tell workers in the preamble and guide to restart an expired
heartbeat loop mid-task and stop it before worker_done.
Fixes#26605
Main now tags each Orca-authored PR/MR create failure with a reason code
(the English error is unchanged for mobile, older clients and logs), and
the renderer maps the reason to translated copy in the Source Control
notice, the Checks panel and the pre-create blocked notice. Sign-in steps
are single-sourced across providers.
Fixes#33321
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Japanese IMEs convert one clause at a time, but the terminal's preedit overlay
painted the whole composition uniformly, so the clause the candidate window
targets was invisible. Read the IME's selection from xterm's textarea on the
insertCompositionText input event (Chromium only updates it there) and paint
that range of the preedit in the theme's selection colors. Cell-grid advance
corrections are unchanged and nothing reaches the PTY; a collapsed caret or a
range outside the preedit highlights nothing.
Fixes#27873
Co-authored-by: Neil <neil@stably.ai>
The store-driven Agents drawer has no Radix trigger, so dismissing it with
Escape or the close button dropped focus to document.body. Capture the
focused element on each open transition and return focus to it on close,
unless focus already moved elsewhere or the close hands focus off (outside
pointer dismissal, agent reveal, switching to the pop-out).
Co-authored-by: kambarakun <kambarakun@gmail.com>
`orca worker start --worktree new-top-level --repo <selector>` no longer
requires the dispatching terminal to sit inside a managed git worktree; the
explicit repo is all a top-level worktree needs. new-child (and
new-top-level without --repo) still need a caller worktree, and now fail
with an actionable invalid_argument error before any effects are recorded
instead of a bare selector_not_found.
Fixes#22345
kiro-cli agent upgrade (and Kiro CLI 3.0) turns an agent's hooks into a
list of {name, trigger, matcher, action, timeout}. Orca rejected that shape,
so status reported an error and on/off left the files untouched. Orca now
refreshes its list entries in place, appends missing ones, removes only its
own on off, and writes the list form into upgraded agents that have no hooks
yet so they stay in the universal format. The remote installer shares the
same path.
Fixes#34194
* fix(wsl): start no running-distro read inside the stop settle window
settledStartedAfter slept with one setTimeout until the settle anchor. Node truncates timer
delays to whole ms against a ms loop clock, so the wake can land up to ~2ms before the anchor
by performance.now(), and the probe then started inside the window and could still see the
stopping distro as running. That is the hook relay stop-settle flake ("expected true to be
false"). Sleep until performance.now() has passed the anchor.
* test(wsl): spy on setTimeout without a type assertion
* test(wsl): fire the spied timer far early so a single sleep always fails
* fix(wsl): re-read a settled exit only from a probe started after the window
After a watch or holder exit, the liveness supervisor slept EXIT_SETTLE_MS and re-read the
running list with no bound, so it could join a list probe that started inside the settle
window and still listed the stopping distro. The re-read now passes the exit time, and the
wiring reads through the gate's settledStartedAfter with exit + EXIT_SETTLE_MS as the bound.
* feat(quit): add Quit and Stop All Sessions to the app menu and tray
Quit keeps daemon sessions alive for warm reattach. The new item, placed
directly above Quit in the macOS app menu and menu bar icon, the Windows
File menu and tray, and the Linux File menu, asks for confirmation, runs
Settings' Kill all sessions in the renderer, and quits only when every
session stopped. Closing the tabs first means nothing reopens or resumes
on the next launch. Serve hosts do not offer the item.
* fix(quit): keep Orca open when Kill all cannot prove every session stopped
- Kill all no longer reads a daemon generation that failed to list as
"no sessions": a failed poll keeps the last confirmed remaining set,
and a failed initial listing sets listingIncomplete.
- Quit and Stop All Sessions stays open on an incomplete listing or a
terminal tab opened during the sweep, logs why it stayed open, and
reveals the window before the final quit.
- Share the main-window message box helper, stub the request on the web
client, and add Portuguese strings.
- Cover the windowless path, request expiry, the in-flight guard, and
failed listings in tests; bound the E2E exit wait.
* fix(terminal): count Kill all per daemon generation within a time window
- A poll updates only the daemon generations that answered, so one
failing generation no longer hides the kills of the others.
- Poll for 6.5 s of wall-clock time instead of 65 attempts, because a
wedged generation fails each listing only at the request timeout.
- Flag a sweep with no daemon provider as listingIncomplete.
- Log the leftover-tab exit, share the one-shot window intent with
Open Settings, and cover the sender check, the reveal before the final
quit, and retries in tests.
* fix(quit): stay open while a newer build's daemon is held
- Set listingIncomplete while this build holds a newer protocol's
daemon, whose sessions it can neither list nor stop.
- Reuse getDaemonAdapters in Kill all, type the shared one-shot helper
by its flag factory, and move the app-menu quit handlers next to the
tray options so both serve/desktop splits are tested.
- Cover a quit that outlasts the request expiry and a failed request
pull, and fix the docs lead-in for the new quit-time case.
* fix(quit): explain, without stopping anything, while a newer version runs terminals
- Check the newer-version daemon hold before the confirmation and show
an explanation instead, so Kill all no longer closes every tab and
then refuses. listingIncomplete stays as the backstop.
- Translate the explanation, describe listingIncomplete generically,
and assert the single timed-out poll in the Kill all test.
* fix(quit): explain before asking whenever Kill all cannot list every session
- Show the explanation instead of the confirmation while the daemon
provider is missing (still starting or failed) as well as while a
newer version's daemon is held.
- Name only the steps that work (wait for terminals to open, reopen a
terminal opened in a newer version), avoid stating a hold as fact, and
label the dialog's button through the catalog.
* fix(quit): add the relaunch step to the explanation and align the ja wording
* test(pty): keep a confirmed stop when its generation fails a later poll
* test(quit): give the E2E timeout bump its reason
* fix(quit): stay open when the daemon still lists a session after Kill all
Kill all counts only the sessions of its first listing, so a session
started since then, for example from the CLI or an automation before its
tab reaches the renderer, would outlive the quit. Main now lists every
daemon generation again before quitting, and quits only after a listing
in which every generation answers and none lists a session. It polls
within Kill all's 6.5 s window so the tab sweep's PTY shutdowns can
finish; otherwise the renderer shows the existing error and Orca stays
open.
ui:quitAfterStoppingAllSessions becomes an invoke that answers whether
main quits.
* feat(quit): rename to Quit Completely with a macOS hover hint, and explain plain Quit in the confirmation
* fix(quit): show progress while Quit Completely runs, and refuse at once when the daemon can't be fully listed
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(wsl): start no running-distro read inside the stop settle window
settledStartedAfter slept with one setTimeout until the settle anchor. Node truncates timer
delays to whole ms against a ms loop clock, so the wake can land up to ~2ms before the anchor
by performance.now(), and the probe then started inside the window and could still see the
stopping distro as running. That is the hook relay stop-settle flake ("expected true to be
false"). Sleep until performance.now() has passed the anchor.
* test(wsl): spy on setTimeout without a type assertion
* test(wsl): fire the spied timer far early so a single sleep always fails
* fix(workspace-board): paired hosts keep their own custom status columns
A desktop client grouped a paired host's workspaces with its local column
list, so cards in host-only columns (e.g. status-6) fell back to the default
column. Fetch each host's workspaceStatuses via the existing ui.get RPC and
merge them after the local columns for grouping, without persisting them.
Fixes#34227
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workspace-board): keep paired host columns safe from local column edits
- Removing a local column resolves cards against the merged board list, so a
host card in a host-only column is never rewritten.
- New column ids are unique against the merged list, not just local ones.
- The context menu status submenu and the closed-sidebar order use the merged
columns too; the shared-status helper moves to the menu policy module.
- A host that sends no columns adds none instead of the defaults; identical
replies keep the stored identity and out-of-order replies are dropped.
- The merged list is named boardStatuses and tolerates stores without the
host fields, so the earlier WorktreeList fixture edits are reverted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workspace-board): keep host cards whose host still defines a removed id
Removing a local column whose id a paired host also defines rewrote that
host's cards to the local fallback. Skip runtime-host cards when their own
host still has the column.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workspace-board): keep host column ids in the composer and drop a retired host's columns
Creating from a host-only lane now keeps that column's status, a host that is
removed or re-paired to another machine no longer leaves its columns behind,
and the new tests use checked fixtures instead of casts.
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
* fix(workspace-board): deliver a host's workspaceViewChanged so its columns refresh
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
* fix(workspace-board): show and offer a paired host's columns only for that host's cards
The board adds a host's column only when one of that host's own cards uses it,
never the host's copy of the default column, so local cards keep falling back
to the local list. The context menu offers host columns only when every card
is on that host, the composer applies a lane's host column only when creating
on that host, and status writes drop another host's column id.
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
* fix(workspace-board): read cards through the record selectors and skip foreign-lane drops
Board lanes and the context menu now leave out a host's copy of the default
column, so a host card's menu matches its lane. Lanes skip the card scan when
no host adds a column. A drop into another paired host's lane is ignored
instead of re-ranking the lane.
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
* fix(workspace-board): sync tasks against every offered column and test host-lane drops
Task-status sync now finds a paired host's column that no card uses yet, as the
card's menu offers it. A write left empty after dropping another host's column
is skipped. New tests cover board and sidebar drops into a host-only lane.
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
* fix(workspace-board): resolve host columns by runtime owner and compare mixed selections per card
A paired host's SSH workspace, which the host's runtime owns, now gets that
host's columns like its other cards. A mixed selection marks and moves each
card against its own host's columns. A status write for a card the store does
not know yet passes through unchanged.
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
---------
Co-authored-by: Kooooojun <edisonhuang1122@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(projects): register a folder once when two adds race on a server
A paired server's repo.add looked for an existing project, then awaited icon
and upstream detection before saving. Two adds of the same new folder both
passed the check and saved it twice. Re-check right before saving, as the
desktop's local add already does.
Part of STA-12331.
* refactor(projects): reuse the add's store when adopting an existing project
* test(wsl): hand the reap test's fake cat its real stdin
The fake cat backgrounded the real cat with `&`, which a non-interactive sh starts on
/dev/null (dash even under `<&0`). The socket reader therefore ended at once, before orcad
hung up, and the relay killed its partner, sometimes before that cat's TERM trap was set:
on Linux under load the trap count stayed at 1 even after #34329 (3 of 6 rounds of 50
failed). The fake cat now passes stdin on fd 5, as the relay itself does, so the socket
reader ends only when orcad hangs up and the stdin reader blocks until killed.
* test(wsl): mark the fake cat armed only once its child is known; tighten the comment
Only the automations and client-hosted-browser steps had an id-keyed
entry in the localized step copy map, so every other contextual tour
(workspace board, agent sessions, browser, tasks, floating workspace,
workspace creation) rendered English titles, bodies, and action labels
next to localized Back/Next/Done controls.
Give every tour step a required stable id and move the copy lookup into
contextual-tour-step-copy.ts. The map `satisfies` a record over all step
ids, so a new step without localized copy is a type error. Primary and
secondary action labels (Split terminal, Got it, Browser settings) are
localized through the same entry. Existing automations and
client-hosted-browser keys are unchanged so shipped translations keep
resolving.
Add the new strings to en and translate them for ko, es, ja, zh, fr,
and pt.
Co-authored-by: Neil <neil@stably.ai>
Bell, test, task-complete, tool-preview, permission-probe and startup
registration notifications now read their sentences from the i18n
catalogs instead of English literals. The notification translator
accepts interpolation values; the English default fills them so
headless hosts produce unchanged English copy. The startup permission
prompt waits for main-process i18n before it is shown.
Fixes#27068
Co-authored-by: outof-place <contact@outofplace.space>
The queued-message test rig deleted its temp state directory while the
shared journal SQLite handle was still open, so teardown failed with
EBUSY on Windows. Close the rig root's journal database after the host
drains, then remove the directory.
On repos whose base branch requires a merge queue and that disable
auto-merge, gh pr merge --auto always calls enablePullRequestAutoMerge,
which GitHub rejects. Call the enqueuePullRequest mutation directly in
that case and report enqueue failures as merge-queue errors.
Fixes#19638
Co-authored-by: Neil <neil@stably.ai>
It raced the relay's kill against the stub cats setting their TERM trap, and picked the cat to
keep blocked by start order. It now hangs up only once both traps are in place, and tells the
socket reader from the stdin reader by whether its stdin is the relay's socket (fd 3).
* feat(wsl): let an idle WSL distro stop once its orcad idle-exits
The WSL host's holder kept the distro (and the WSL VM) running after Orca quit, even with
nothing running in it. orcad now leaves a release request in ~/.orca when a managed idle stop
retired its terminal daemon; the holder waits for that orcad to exit, claims the request and
ends, so WSL can stop the distro. Live terminals, working agents, enabled automations or a
returning client keep the distro held as before. A host whose distro is stopped at startup
reads as stopped instead of unreachable, and the real-WSL lane gains a phase that proves the
release and records memory.
* fix(wsl): key the holder release on the WSL-host launch marker; name the lane phase
The real-WSL lane showed orcad idle-stopping with its daemon retired while the distro stayed
up: the setsid'd orcad's environment is not guaranteed to carry WSL_DISTRO_NAME, so the
release request was never written. Use ORCA_WSL_ORCAD_HOST, which only WSL-host launches set.
Phase 3 now carries its phase name and path filter, and records what kept a distro running.
* test(wsl): dispose the idle-release lane's guest transports
Each guest command left its exec loop running, a wsl.exe client that kept the distro up after
the holder had already let go (the receipt showed no holder, no orcad, no request left).
* test(wsl): record which wsl.exe clients keep the idle-release lane's distro up
* test(wsl): satisfy the flaky-test ratchet; feed the new idle port in the release test
* test(wsl): snapshot guest processes after launch to find what holds the session
* test(wsl): locate the step that leaves the zombie holding the idle distro
* test(wsl): log the idle-release lane's guest commands with times to place the zombie
* test(wsl): follow the remote runtime client's move
* test(wsl): record when each leftover WSL session init started
* fix(wsl): keep the distro while the user still runs anything, and never trip on the request file
Review of #33084:
- The holder now checks, before claiming a release, that no process of the user runs outside
the holder itself (session plumbing aside: systemd --user, (sd-pam), dbus-daemon). A detached
tmux, nohup job or dev server keeps the distro; it fails toward holding.
- A new holder drops any request left from before it started, so an older orcad's request can
never end a holder a client just asked for.
- orcad touches the request file only for WSL-host launches and never throws over it.
- The real-WSL lane proves a detached job keeps the holder and its request, and the distro
stops once the job ends.
* fix(wsl): a running container keeps the distro, whoever owns its shim
Docker's containerd-shim processes run as root, so the user-only scan missed them and a
release would have stopped running containers. Any containerd-shim process now keeps the hold.
* fix(wsl): read each process status only up to Uid; document what keeps the hold
Delta review of #33084: dash reads a status file a byte at a time, so stop at Uid. Document
that a root default user never releases, that per-user agents hold it, and the hidepid
exception. The lane's pkill no longer matches the shell running it.
* fix(orcad): materialize the app's agent-browser driver into the local slot
Replaces #34111's ORCA_AGENT_BROWSER_DRIVER hand-off, Windows profile copy and
claimed snapshot store. Packaging now references the app's own
resources/agent-browser-<target> from the orcad template manifest
(packagedBrowser, like packagedRipgrep), so the materialized slot carries it and
every local orcad launch finds it beside orcad-server.js. macOS signs the driver
before hashing; Windows reseals it after SignPath. The resolver now also tries
the musl driver name on Linux.
Refs #33846
* build(orcad): let a checkout keep template drivers with ORCAD_OMIT_AGENT_BROWSER=0
Startup evaluated every structured-agent adapter (claude, codex, acp, pi)
even when no chat was opened. The host install already loaded the
registrations with a dynamic import, but structured-chat-cli-fork imported
the same module statically to read sessionHistory, which the lightweight
metadata already exposes.
- structured-chat-cli-fork reads structuredAgentRuntimeMetadata (the same
objects, so behavior is unchanged).
- installOnJournal moves unchanged into structured-agent-session-host-assembly,
which install() loads on first host install; the existing installing slot
already single-flights and retries it.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The SSH port-forward dialog renders its four fields as raw inputs inside a
form with a submit button. IMEs that redispatch an unmarked Enter after
compositionend therefore trigger implicit submission with the half-typed
value. The pre-revert ImeEnterGuardedForm covered this form; #25480 moved
the guard into shared fields but did not reach these raw inputs, and the
#28609 lint rule only inspects Enter handlers, which these fields lack.
Render the fields with ImeInput so the shared gesture tracker swallows the
confirmation and its redispatch while ordinary Enter still submits.
Co-authored-by: Seiji Kohara <sage.0118@gmail.com>
Kelvin Amoaba
BingZandNeil
Neil
Théophile DiotandNeil
erishandNeil
Frederic BarthelemyandNeil
OrcaWinandOrcaWin
mmarabelandNeil
Seiji KoharaandNeil
Takuya AkiyaandNeil
HansssandNeil
C.P.
Wooseong KimandNeil