The mobile session tab strip no longer shows Done while the workspace list shows Working: once the PTY-title renewal has kept a newer non-done status against the same clocked OSC title, the mobile projection no longer re-demotes it without the clock (seen on Windows ConPTY where the spawn-time cmd.exe title lingers).
Supersedes #32472
Co-authored-by: zhangxaochen <3416677+zhangxaochen@users.noreply.github.com>
Hermes workers no longer time out at agent_readiness while the TUI is ready: Orca recognizes Hermes' ready status + composer (including built-in skin prompt symbols) and Hermes started through its own installer launcher (`python -I -c … import hermes_bootstrap`, interpreter -c only).
Fixes#23723
Supersedes #24748
Co-authored-by: Route Smith <2595827+routesmith@users.noreply.github.com>
Panes follow a Claude Code conversation that moves into a background job (agent view ← then Enter, and /clear inside the job): on the presence recheck Orca reads the pane's own transcript `continued-in` record and the job's state.json (UUID-validated, sibling-folder only, overtaken pointers ignored, cwd kept) instead of trusting job hooks, so mobile and native chat stop freezing on the old session.
Refs #24117
Supersedes #26569
Co-authored-by: mtsr404 <10844682+mtsr404@users.noreply.github.com>
Co-authored-by: dimakrest <12894495+dimakrest@users.noreply.github.com>
On Windows, a cached foreground name that flaps to the tool shell (pwsh.exe) during Codex tool calls no longer makes Orca treat the agent as exited (clearing its working row and possibly writing the mouse-reporting reset): a fresh uncached foreground read must agree before the exit settles. Unknown-shell panes still detect real exits.
Fixes#29996
Supersedes #30606
Co-authored-by: Stone.W <218376701+Stoneeu@users.noreply.github.com>
* feat(native-chat): OpenCode and Grok chats show the turns made outside them
When an OpenCode or Grok chat reopens its conversation, the agent replays its
saved history before it answers. Orca used to drop all of it. Now the turns in
it the chat never saw (made in the agent's own CLI, or anywhere else) are added
once, in the agent's order, after the chat's rows and behind the existing
"Continued outside this chat." divider.
Turns are matched by the agent's own ids: Grok's prompt id (Orca's own turns
carry the id Orca sent) and OpenCode's saved message ids, plus the rows of a
transcript the chat was adopted from. A send of the chat's own that failed
before any reply is matched by its text between the turns proven around it,
because OpenCode never tells a client the id it gives a person's message.
The import is translated by the same translator and assembler as a live turn
into an in-memory overlay, then written as one settlement: a stale or failed
import writes nothing, and it never fails the open. A turn imported part-way
gets the rest of what the agent saved on a later open.
* fix(native-chat): type the ACP catch-up staging and origin reads
* refactor(native-chat): share the catch-up open runner across agents
The Codex catch-up's agent-neutral parts move to one module: the open-time
envelope (its own deadline and cancellation, never gating the open), the
bounded staged batch, the single settlement commit that re-checks the
journal before writing, and the "Continued outside this chat." divider.
Codex keeps only how it reads its saved turns and what the chat already
holds. No behavior change; the other agents' catch-up builds on this
instead of copying it.
* fix(acp): bound final catch-up journal barrier
* chore: remove unrelated pnpm executable metadata
* refactor(native-chat): the catch-up runner reads the chat's view only when the agent asks
* refactor(acp): catch up through the shared history runner
The open envelope, budget, divider and one checked commit now come from the
shared catch-up runner; ACP keeps only how it reads the reopen replay and what
the chat already holds. The final-barrier deadline test moves with the barrier
to the runner.
* chore: remove regenerated pnpm executable metadata
* fix(native-chat): the catch-up deadline also bounds waiting for its commit to be written
A journal write barrier that never settled after the import was admitted held
the provider's open past the catch-up deadline. The wait now ends with the
deadline or the open's cancellation, like every other step.
* test: type the history catch-up sink fixture without assertions
* fix(acp): reconcile imported history snapshots without claiming live work
* fix(native-chat): bound and revoke history preparation
* feat(native-chat): validate expected saved items during history catch-up
* fix(acp): preserve user boundaries and visible catch-up dividers
* fix(acp): replay ordered messages within provider executions
* fix(acp): report replay overflow and refresh journal test reads
* test(rpc): explain partial runtime fixture boundary
* Bound ACP history reconciliation and rejected-copy projection work
* test: use typed calls for history scaling instrumentation
* test: account for history views and exit provenance work
* fix: type history scaling test fixtures explicitly
* test: route history probes to Node and bind replay sink before open
* test(acp): explain journal scaling timeouts
After an Orca restart with the PTY daemon alive, a surviving terminal placed in a different pane than its spawn ORCA_PANE_KEY now carries that key's agent status (prompt, session) to the live pane, using the daemon-reported spawn key and the manual pane-move mechanism; ambiguous keys (claimed by more than one live terminal) are left alone.
Fixes#23753
Supersedes #31841
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
The health check compared two copies of the daemon identity with ===, which is never true because getDaemonIdentity() returns a fresh copy. Every read came back unverifiable, so the banner from #29087 could never appear. Compare the identity fields instead.
On Windows, WSL Claude transcripts reported through an Orca account-profile symlink (claude-profiles/<id>/home/projects → ~/.claude/projects) are found: when the Windows-visible path is missing, Orca resolves the folder's realpath inside the same running distro (realpath -m, cached 30s) and reads it from there.
Fixes#33165
Co-authored-by: Kooooojun <99903251+Kooooojun@users.noreply.github.com>
A slept agent whose tab disappeared now resumes in a fresh tab (with --resume, through the existing duplicate/host guards) when its workspace opens, and main's stranded workspace-sleep record is then dropped (only if no tab still lists that pane), instead of the record sitting forever while the workspace opens a bare shell.
Fixes#22657
In-process pi-subagents helper sessions no longer take over the lead Pi session's pane: Orca's Pi status and title extensions keep the first Pi session in the process as owner and only move ownership on new/resume/fork session starts (helpers start with reason startup), so resume ids, turn completion and the title spinner stay with the lead. OMP behaviour is unchanged.
Fixes#31526
Supersedes #31739
Co-authored-by: Yash Kakade <28981385+ykakade@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(terminal): keep restored history when ConPTY repaints after a resize
The Windows daemon's emulator grew rows the way a Unix terminal does,
pulling scrollback back into the screen. ConPTY then repaints the grid
it owns from the top and overwrote those rows, so a relaunched window's
first fit lost about a screen of restored history and printed the new
shell's prompt onto the restored prompt's row. Give ConPTY-backed daemon
sessions (WSL shells included) xterm's windowsPty resize model, as the
window already does for native Windows panes.
* test(terminal): model ConPTY's repaint at the height it was resized to
ConPTY's screen holds only what the shell wrote at its current height, so a
shrink drops the rows above the cursor and each resize repaints that screen.
Assert every restored and shell row appears once, in order, across shrink,
shrink-then-grow and grow-past-original heights.
* test(terminal): show the Unix grow model loses restored history under ConPTY
A pane's owning agent takes the pane back from a nested/background child on its next hook when the hook matches the owner's recorded session (agent type and session id), instead of staying hijacked until the child finishes; stale owners and nested same-type children with new sessions stay rejected. No recorded session (older hosts/relays) keeps main's behavior.
Fixes#30589
Refs #13341
`orca terminal send --text … --enter` now uses the bracketed paste + Enter agent-prompt path for every recognized agent (not just Claude/Codex), so Pi's #/@ completion and Grok's y/n trust question no longer swallow or answer typed prompts. Agents whose process names collide with ordinary tools (orca, acli, cn, vibe) still need title/hook evidence. A send into a permission/trust menu is refused with a hint to send --text and --enter separately.
Refs #20695
Refs #18399
* Open links beside their source and reuse matching browser pages
- Preserve source-group placement across terminal, chat, file, and runtime links
- Add explicit “Open in this group” actions with safe refusal handling
- Match browser pages by host, session, resource, and exact page identity
* Preserve file link ownership when opening beside source
* Isolate browser link sessions by workspace profile
* Wait for browser tabs to render before activating links
* Respect explicit group requests when opening detected files
* Preserve legacy link ownership when opening browser tabs
* Clean up unactivated browser tabs after failed link opens
* Reveal routed browser links without stealing focus
* Preserve browser profile reuse and foreground ownership during link open
* Prefer visible browser panes and reuse exact link destinations
Reuse matching pages within the same workspace, execution host and browser
profile. Otherwise open in the focused or most recently used visible browser,
or create a split beside the source when no browser is visible. Keep explicit
group placement and background/focus ownership protections.
Incorporate visible-browser selection and popup routing from #22686 into
#32907, including selector regression coverage.
Co-authored-by: Luca Critelli <lucacri@gmail.com>
* Route browser links by workspace without reading global focus
* Validate SSH browser ownership before opening links
* fix branch file size limit
* fix(ci): track extracted browser link ratchet entries
* fix(test): follow source-aware browser link opening
---------
Co-authored-by: Luca Critelli <lucacri@gmail.com>
On Windows, the Codex at-rest skills probe no longer starts its 70s-lived `codex app-server` inside the worktree (which locked the folder and made worker release / worktree removal fail with EBUSY); it starts from Orca's stable probe folder and still lists the worktree's skills via the per-request cwd.
Fixes#33174
Codex account re-auth no longer signs the account out on cancel/failure: `codex login` revokes and deletes existing auth before it starts, so re-auth now logs in inside a staging CODEX_HOME and copies auth.json in only on success. Listing accounts relabels a host account whose auth.json identity no longer matches its saved record.
Fixes#10795Fixes#22284
Supersedes #11852
Co-authored-by: Rod Boev <106971+rodboev@users.noreply.github.com>
Opening a workspace while its local creation is still pending no longer seeds an idle terminal that steals focus from (or drops) the agent launch: the creating event carries the new workspace id, activation during creation shows the existing "Creating worktree…" panel, and the workspace takes over when creation finishes. A terminal the user explicitly opens is kept and the agent gets its own tab.
Fixes#25807
Supersedes #25812
Co-authored-by: Eotel <49769982+Eotel@users.noreply.github.com>
Resuming a Codex session on Windows no longer fails with a misleading credentials error: Codex reports a resumed rollout path with a \\?\ prefix, and the legacy migration, account-restart move and selected-account repin now share codexDatedRolloutRelativePath (the trust check's normalisation) instead of comparing against the plain sessions root.
Fixes#27200
* test: tighten transport, recovery, and diagnostic checks
* test: use at for last mock socket access
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The WSL hook relay now also tries the Node Orca installs for its WSL server (~/.orca-remote/runtimes/node-*) after any system Node, test-running each candidate, so distros without their own Node get in-distro agent status instead of the slow fallback and the repeating "no node >= 18" warning.
`worker-start --terminal` can reuse an idle native-install Claude worker on macOS again: when the cached foreground name isn't a known agent, shell or wrapper (e.g. Claude's `2.1.310` version-named binary), the presence check does one awaited fresh process read (the same read message sending uses, #18238) before refusing.
Fixes#32090
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* test: strengthen transport recovery and benchmark assertions
* test: use preferred array type in reconnect fixture
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
A Codex terminal worker whose remote app-server reconnect fails no longer hangs its orchestration dispatch forever: Codex's reconnect-failed error cell (column-0 U+25A0 notice, detected on the settled screen via the shared Codex notice tracker, Codex panes only) fails the active dispatch with stage agent_session_lost and escalates to the coordinator; the terminal stays open.
Fixes#24791
* fix(terminal): keep desktop history in main's copy after a phone or paired desktop subscribes
A phone subscribe rebuilt main's hidden copy of a pane from the phone
snapshot (at most 1000 rows, or the screen alone under the byte budget),
so a later desktop reveal repainted the pane truncated again. Seed the
copy from a desktop-depth renderer read of the same sequence instead,
falling back to the phone snapshot if the renderer moved on.
Paired desktop clients' initial snapshot now carries desktop depth within
the 2 MB requested-snapshot budget, matching what their reveal snapshots
already allow; phones keep 1000 rows and 512 KB. The headless emulator's
default scrollback now names the shared desktop default.
* fix(terminal): publish the phone recovery before deepening main's copy
The desktop-depth read ran before the late-renderer recovery's sequence
check, so output during that read aborted the phone recovery and left the
phone blank. Keep the original order (check, seed from the phone snapshot,
publish) and deepen main's copy afterwards, only while no output has
followed. Paired desktop initial snapshots keep a margin under older
clients' 2 MiB cap (1.75 MiB) and step down through 2500 rows.
* revert(terminal): keep paired desktop initial snapshots at 1000 rows
Deeper first snapshots cost every pane on every reconnect; a lazy
background top-up is the follow-up design. This PR keeps the phone
recovery's hidden-copy fix and the shared scrollback default.
* test(terminal): build the late-renderer runtime fake with checked types
An idle saved Claude account whose ~8h access token lapsed (Orca never refreshes Claude logins; the CLI does on its next run) keeps its last-good usage for up to 24h and reads "Updates when Claude runs" instead of "signed out". Logins that can't recover (no refresh token, expired refresh token, or a revoked 401) still ask to sign in again, and the status bar keeps its warning icon when shown usage is over 30 minutes old. Kept snapshots drop windows whose reset has passed.
Fixes#30289
Supersedes #31105
Co-authored-by: luijoc <96428056+luijoc@users.noreply.github.com>
On macOS the temp dir sits behind the /private symlink and the runtime
stores the resolved path, so two existing-folder tests failed locally.
realpath is a no-op on Linux CI.
Resumed Claude/Codex agents come back in the folder they were started in: resume records save the agent's starting cwd from hooks (kept within a session and across Claude /clear and compact), persist it, and resume as `cd <folder> && <agent> --resume <id>` when it differs from the workspace root. A deleted folder now fails loudly at the cd instead of silently resuming in the root.
Fixes#16960
Refs #15485
* fix(worktrees): one host's git status no longer rewrites a same-path twin's branch (#32918)
* fix(worktrees): match a twin through its runtime alias and persist its review clear on the same copy
* fix(worktrees): keep the id-only patch for a lone copy; background refreshes refuse an unplaced twin
* fix(worktrees): a twin's identity patch skips the id-keyed review clear instead of reaching its sibling
* fix(worktrees): count runtime provenance when finding twins; Source Control refresh refuses an unplaced twin
* fix(worktrees): a twin's branch switch clears its own push target and review link on its host
* fix(worktrees): a twin's review clear keeps its stale-refetch guard and relink check, scoped to its own copy
* fix(worktrees): a twin tombstone names its full owner, and detected rows are stamped before sanitizing
* fix(worktrees): each twin copy keeps its own review-clear tombstone
* fix(worktrees): a rename carries each twin copy's review-clear tombstone
* fix(worktrees): a copy's tombstone from its twin days still drives its clear retry
* chore(worktrees): name why the existing review-link cast is safe
* fix(worktrees): one resolver names the copy for every git-identity read and write
* fix(worktrees): a Create PR run refuses when its copy no longer resolves; local null stays local
* fix(worktrees): an unselected twin stays unplaced; a legacy row's guard survives its first stamp
* fix(worktrees): a Create PR run keeps the copy it pinned at start; a legacy row's relink drops its stamped guard
* fix(worktrees): key review clears by the full stamp the next listing gives the row
* fix(worktrees): fill only missing stamp parts when keying review clears
* fix(worktrees): stamp review-clear keys from repo registrations, not the focused host
* fix(worktrees): a local row keeps its review-clear guard when discovery stamps it local
* fix(worktrees): stamp review-clear keys from the sole repo registration first
* fix(worktrees): a runtime-hosted copy's owner key ignores backfilled provenance
* fix(worktrees): Create PR and post-generation refresh read the pinned copy's push target
* fix(worktrees): a lone copy's push target still answers when the host index misses
* fix(worktrees): the push-target fallback accepts only an unstamped lone copy for a named host
* fix(worktrees): only SSH copies borrow a registration's provenance for review-clear keys
Claude panes show Needs You while a Claude Code MCP server's elicitation dialog is open: install Claude's Elicitation/ElicitationResult hooks (>=2.1.63), map Elicitation to waiting and restore the pre-dialog state on ElicitationResult (done when there is no prior record).
Fixes#25020
Supersedes #25057
Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
Main built its copy of a hidden pane from the renderer's xterm at the
phone's 1000-row limit, and the hidden-output reveal repaints the pane
from that copy, so a restored pane with more history lost all but its
last 1000 rows on first reveal.
A woken sleeping agent keeps its launch config (flags like permission mode, model, custom args) so a later Orca restart restores it with the same flags; consuming the sleeping record no longer deletes the pane's launch config (retirement and launch-token/session matching still govern it).
Supersedes #31756
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
When Antigravity's Orca-managed chat runtime isn't installed, default-chat launches (orchestration workers, agent.launch from CLI/mobile/automations) fall back to a terminal running agy with reason chat_runtime_not_installed instead of failing at terminal_create; an explicit --surface chat is refused with an install hint. Desktop chat tabs still show the install card.
Fixes#30973
Neilandzhangxaochen
Jinwoo Hong
Brennan Benson
Kooooojun
OrcaWinandOrcaWin
JinjingandLuca Critelli
