The explorer's workspace-open read and the first git status took a pending
user switch with no age limit, so a switch no consumer used (sidebar closed)
could be redeemed long after the distro stopped. They now use the same 10 s
window as pane restore and git history, through one shared
takeRecentWorkspaceSwitchWake.
When a host restart restores a pane by starting a new shell, the pane kept
the dead process's title and the client's xterm kept its input modes. A
pane that had Claude open came back as bash but still read as Claude, so
the reattach picked the agent-preserving reset and mouse moves and focus
changes were typed into the shell as escape codes.
Two process-bound facts now follow the respawn verdict:
- Title: the cold-restore payload no longer carries the checkpoint's last
title into the new process's records, and durable checkpoints of the new
process take the title from the live terminal only. The title, agent
identity and title-derived status reflect the new shell.
- Input modes: a pane records which process incarnation its xterm's modes
belong to. When the host binds a different known incarnation, the pane
grounds the process boundary before the new process's replay, the same
ground a fresh spawn already writes, so only modes the new process set
are armed.
Older servers still report incarnations, so new clients ground their modes
against them; older clients get the neutral title from new servers and
take the shell reset path.
Fixes#35559
* fix(wsl): Codex WSL hook installs and host hook checks never start a stopped distro (E9)
(a) installManagedHooksIntoWslRuntime checks the settled running gate inside
its trust queue right before the first UNC read, and again before the
post-hash fallback trust write; a later reconcile checks before revoking or
reinstalling. A stopped or unverifiable distro skips (null, as with no WSL
plan). The canonical-path probe runs through process-host behind
blockedWslDistroForExec; a refused probe settles as unavailable and keeps the
known identity. The guest shell preflight and a pane launch's home preparation
run as user acts on their distro.
(b) repo.hooksCheck takes an optional background flag (older hosts ignore it);
the renderer sends it, and the host refuses a stopped distro's background
check the same way the desktop's hooks:check does.
* fix(wsl): a pane launch is not a user act for the Codex hook install
A passive restore or remount reaches launch preparation too (#35813), so it no
longer runs as a user act; a stopped distro skips the install and the relay
installs once the distro runs. A skipped WSL home now returns not_installed
instead of falling through to the host writer, which would have written the
WSL home over UNC.
* fix(wsl): a fallback grant skipped mid-install reports trust pending
hooks.json is written before the hash wait, so a skip after it is not a clean
skip: return an error status saying the trust is pending instead of null.
* chore: drop the stale process-host direct-import baseline entry
* fix(wsl): Commits history wakes a stopped distro only on the user's own act
Showing Commits woke the distro on every mount, remount and re-show. Now
only the user expanding Commits in the same worktree, or the user's own
switch to the workspace (once per switch), may start it; the Refresh
button keeps its explicit wake (E9).
* test: a mount and a base-ref move read Commits history in the background
#35778's base-move refetch test expected every shown-history read to
wake a stopped WSL distro; only the user's own act does now.
* fix(wsl): Settings' issue-command and path checks never start a stopped distro
Opening the repository and MCP settings sections read .orca/issue-command,
orca.yaml and stat'ed the repo root over \\wsl.localhost, which starts a
stopped distro (E9). The issue-command read (IPC and runtime) now returns
the unreachable result for a stopped distro unless a launch passes
wakeWslDistro, and shell:pathExists is gated like shell:pathsExist, with the
two link-click callers passing wakeWslDistro.
* fix(wsl): never save over an issue command a stopped distro kept unread
A refused read showed an empty, editable field, and typing then saved over
the hidden local override and started the distro. The editor now stays
read-only with a stopped-distro note, skips both saves, and re-reads when
main signals the distro running. Writes are gated too unless the user is
saving their own edit (wakeWslDistro). The MCP section's stopped message no
longer offers a Retry that cannot start the distro.
* fix(wsl): translate the stopped-distro issue command note; listen before reading
Adds the note in every shipped locale, and attaches the editor's running
listener before its read so a distro that starts while the refused read is
in flight still triggers a re-read.
* fix(wsl): keep the issue-command editor and writer tests on their seams
The editor reads window.api optionally, as hosts without a preload do, and
the writer tests spy on the gated write that the handlers now call.
The explorer's workspace-open read and the first git status woke WSL on every
mount, so a remount, launch restore or host loss after the user stopped the
distro started it again. Both now wake only when takeWorkspaceSwitchWake
reports a new user switch to that workspace, once per switch per consumer;
an expanded folder wakes only when it is newly expanded in the same
workspace, not when a mount or switch re-runs with the same folders.
* fix(i18n): translate updater failure messages shown in the renderer
* fix(i18n): localize the dev-channel platform list and paired-server updater errors
* fix(i18n): sync runtime catalog and coded updater status expectations
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* plugins: make Try it do the thing instead of opening the plugin page
* plugins: address review on Try it (row's icon theme, language switch result, pending plugins)
* fix(i18n): localize remote server pairing, host sign-in and Bitbucket connect failures
* fix(i18n): map pairing guard codes without a partial switch
* fix(i18n): type the Bitbucket connect bridge with its coded result
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(i18n): localize Orca's agent output and Kimi failure messages in AI text generation
* fix(i18n): keep Kimi option connectives inside the translated sentence
* fix(i18n): narrow Kimi empty-input diagnosis without an undefined case
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(wsl): a passive restore never starts a stopped WSL distro; its bridge panes wait with Start
* fix(wsl): a restore may start the distro only on the user's own open, once; an unanswered read holds too
* perf(editor): compare worktree owner rows by identity instead of JSON signature
Activity/unread/rank patches to worktreesByRepo still stringified every
worktree's owner fields on each write to decide the route token. Walk
buckets and rows identity-first against the last tokenized map instead;
same order-sensitive owner-field semantics, no per-write allocation.
300 worktrees, 200 open files: route check per activity write ~40-70us -> ~0.8us.
* perf(editor): hold the last owner-rows baseline weakly and pin token semantics
* fix(wsl-host): say which WSL distro an agent isn't installed in
* i18n: translate the WSL-distro missing-agent sentence
* test(wsl-host): reach the missing-agent words through a chat whose agent left the host
* fix(wsl-host): a stop published after the host came back says ready again; retry the card's panes
- e9-reviewer: a runtime call's stop could land after liveness had already reconnected and said
ready, leaving Start on a working host. Once the distro runs, the deferred un-park re-reads the
host and says ready from the live connection, or reconnects open work as before.
- fix-reviewer-2: the return retry picks panes by the Start card's rule, so a pane whose create
failed before it reached the host is retried too.
- Pins that the refusal stays a plain, final Error with the same words for the move and automation
callers.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): the stopped dot keeps panes on another, running server live
e9-reviewer: match the Start card's rule; only a pane with no server or on the stopped host ended.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(terminal): pin that the host-refusal unwrap leaves SSH words and other channels as they were
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
OpenCode/ZCode transcript database lookups read inside the WSL homes
they get, so they take only confirmed homes. A WSL session delete runs
as a user act on its distro, so background readers stop trusting an
older stopped read. The carryover notice gets a stable code and
catalog copy in every locale.
A paired host's repo.baseRefDefault now names the stopped distro that refused
it. Clients that cannot hear that host's running signal re-ask on window
focus and every 30 s while visible, until it answers. Locally, the running
listener is attached before the first read, so a signal that lands while main
is answering triggers a re-read instead of being lost.
* perf(terminal): stop re-reading the fit grid on every foreground write once it matches (#35273)
After a grid-drift probe finds xterm matching the fit, foreground output waits
for a geometry signal (pane ResizeObserver, xterm resize, visibility resume,
window wake) or a 2s backstop before forcing another proposeDimensions() read.
The first probe after connect and after any signal still runs at the 250ms
cadence, so drift without a pane resize is still repaired on output.
* fix(terminal): trailing grid-drift probe, unknown fit never settles, 1s backstop (#35273)
- A foreground write skipped by the probe interval arms one trailing probe
(per session, cleared on probe and dispose) so drift can't stick when output
stops right after a throttled write.
- measureTerminalGridFitDrift() returns 'drifted' | 'matched' | 'unknown';
only a valid matching proposal settles the probe.
- Settled backstop shortened from 2s to 1s.
- Probe moved to foreground-grid-drift-probe.ts (pty-input-forward max-lines).
- Specs use fake timers and cover backstop, trailing probe, and unknown fit.
* fix(terminal): pull an armed grid-drift trailing probe forward when the cadence speeds up
* fix(wsl-host): a terminal that meets its stopped distro shows Start, and comes back with it
After an external `wsl --terminate`, the first keystroke's runtime call found the distro stopped and
parked the host, but only liveness ever published a stopped status, and here liveness saw a quick
reboot instead. So no Start card appeared: the pane kept its old prompt, typing did nothing, and a
red toast showed Electron's raw "Error invoking remote method 'runtimeEnvironments:call'" text that
stayed after the distro ran again.
- The runtime-call gate (moved to wsl-host-runtime-call.ts) publishes distro-stopped when it parks
a host, as liveness does, so every pane on it shows the Start card and its error gives way.
- The park lifts once a running list confirms the distro runs again (never booting it), and a
host with open work reconnects.
- Panes that gave up on the stop retry when their host is ready again, not only after Start.
- A host refusal's toast drops Electron's IPC wrapper.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): a workspace on a stopped WSL host shows no live terminals
Its panes keep their bindings for Start, so the card dot stayed green over dead terminals.
Co-Authored-By: Claude <noreply@anthropic.com>
* perf(wsl-host): no new store listener per card or surface for the stopped host
The activity status folds the stopped-host check into its existing pty selector, and the pane
recovery portals derive both the Start card and the return retry from one host-status
subscription. The live-capture listener budget (8,000) is back under, with no budget change.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(terminal): stop HTTP link backward scans at rows that cannot continue a URL
Framed (hard-wrapped) detection walked back up to 2048 rows per hovered line,
building column maps for every URL row; edge-wrapped walked ~54 rows at 80 cols.
Stop once a later row cannot be a continuation (borders, prose, blank rows).
Table-heavy buffer: provideLinks 1.3-2.1ms -> 36-79us per call.
* test(terminal): pin the edge-wrapped HTTP link backward-scan bound
* fix(native-chat): turn a big paste into a file in terminal-backed chats and goal mode
A paste of 32 KiB or more already became a "Pasted text" file in
structured chats, but terminal-backed chats and goal mode put the whole
text in the editor, where one long line can stall the window for seconds
(issue #32355). Every composer that can store the file now follows the
same rule.
- Terminal-backed chats on this machine save the file in the paste
folder, where their pasted images already live; their sends claim
nothing, so the attachment store's 30-day sweep must not reach it.
- Terminal-backed chats never get the structured 256 KB refusal.
- Setting a goal claims the uploads its objective names in the same
journal write, so a goal's pasted file is not swept; a file already
gone refuses the goal before the agent starts.
* Preserve paste sources until submitted and retire refused goal claims
* Recover staged paste reads and cancel preparation before option commands
* Stabilize paste ownership test setup and sweep clock
* Keep large-paste folding scoped to structured chats
* Restore journal prototype forwarding methods
* Prepare attachment receipts from actual journal output
* Align goal and deferred paste fixtures with current contracts
* fix(wsl): don't start a stopped distro to read a repo's default base ref
Opening a repo's Settings pane ran git for-each-ref and git remote through
the repo's WSL distro, which started it after the user had stopped it (E9).
Background reads now return the existing unknown result while the distro is
stopped; an explicit refresh can pass wakeWslDistro. The runtime RPC that
serves the same read to paired clients is gated the same way.
* fix(wsl): re-read a refused default base ref once its distro runs
A refused read now names the distro and defers a preflight:wslDistroRunning
broadcast; Settings and Source Control re-ask on it, so base comparison
returns without a repo switch. Drops the unused wakeWslDistro option.
* Unify dedicated agent launch choices and argument badges
* Enable action model and effort menus with argument migration
* Bound argument choice edit range processing
* Preserve independent action effort through launch and migration
* Preserve literal config arguments and explicit launch permissions
* Respect repository action argument groups and share launch controls
* Remove duplicate action launch command coverage
* Unify Source Control action choices and repository overrides
* Use precise types in action choice contracts
* Consolidate action choice test imports
* Correct action choice types and integration test boundaries
* Complete prepared terminal test result contract
* Align action integration expectations with canonical choices
* test(mobile): type the file preview retry test helpers so the test typecheck passes (#35431)
(cherry picked from commit 0774fc9373)
* Commit edited action arguments before planning and launch
Reconcile deliberate raw edits once into the submitted action recipe so replacement model and effort flags reach Save and Start together. Preserve captured sources and untouched load conflicts.
* Name portable Source Control dialog fixture results
* fix(plugins): load installed plugins whose engines floor predates their fields
The engines.orca floor rule is an authoring check. At runtime (install,
discovery, update, rollback) a manifest now loads when this host parses
every field and meets engines.orca; dev folders, validate:plugin and
catalog CI stay strict. Installed copies that can't load show user-facing
copy and offer Reinstall when the catalog has a loadable release with
different bytes.
* fix(plugins): give installed copies user-facing copy for every load failure
* fix(plugins): installing a one-mode theme now visibly applies it
Most official themes are dark only. Installing one while the app was light
filled the unseen dark slot and nothing on screen changed. Switch the app to
the theme's mode (Switch back restores it), and put a lone terminal theme for
the other mode in the terminal slot that is showing.
* fix(plugins): lone terminal theme shows in the visible slot and reads as selected
* fix(keybindings): show the ⇧ glyph for Shift on Windows and Linux
Spelled-out Shift made non-mac shortcut labels long (Ctrl+Shift+Backspace).
* test(menu): expect the ⇧ glyph in non-mac app menu hints; align double-tap hint
* feat(wsl): offer the drive-path conversion in project settings, and convert the window's stores (D1c-4d)
* fix(wsl): tell the user why saved state blocked the drive-path conversion
A refusal over saved state now names the cause: a folder with different details under both its WSL
path and its drive path, or a project that also holds a repository that isn't converting. An older
host's refusal without a cause keeps the general message.
* fix(wsl): explain a conversion refused because the distro's /mnt/<letter> is not that Windows drive
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl): give the renderer-rewrite journal fixture the profile the journal now records
* test(wsl): give the e2e conversion journal the profile field the journal now requires
* test(wsl): carry the #33135 startup tests onto the window-store journal: it waits for the window, and finishes on any platform once the gate is open
* test(wsl): off Windows the conversion IPC still reports startup's outcomes, as the journal can finish on any platform
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
* fix(i18n): code AI Vault scan issues and chat auto-name failures for the renderer
* fix(i18n): read scan issue params through the wire type
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix: copy local Windows paths with native separators
Copy Path for a proven-local absolute Windows path now writes backslash
separators, the form native Open/Attach dialogs accept (#26204). Applied at
the clipboard boundary of the editor tab menu and header, File Explorer Copy
Path(s) and its shortcut, source control Copy Path, Monaco Copy Path to Line,
HTML document preview Copy file path, workspace sidebar and activity Copy
Path, skills Copy path, and AI Vault Copy Log Path, each with the owner its
Reveal/Open in action already resolves. Remote, unresolved, web-client, URL,
relative and non-Windows output is unchanged.
* fix: sync Copy Path owner refs after commit
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Register a cmake Monaco language for CMakeLists.txt backed by Shiki's
CMake grammar, mapping its storage/entity/argument scopes to token
types the stock Monaco themes style. .cmake files stay with plugin
syntax packs.
Fixes#35452
- the command extension registry: workers registered every command into it,
but nothing ever looked one up (commands run through the service directly)
- PluginListRow, a list row no screen renders anymore
- hasPluginSyntaxFailure, called only by tests
- six exported types nothing imports, and a re-export nothing uses
* fix(plugins): keep binary editor edits across renames, reloads and twin tabs
- Renaming a binary file with unsaved plugin-editor edits gave its tab a new
id, and the bytes store took the old id's disappearance as a close and
dropped the edit. The bytes now move with the tab as the rename lands.
- Tabs of one file share one dirty flag, so they now share one bytes draft;
before, saving one tab marked both clean and dropped the other's edit.
- A reload that reads the same bytes keeps the document, so the editor is not
sent a new version that turns an edit in flight into a conflict.
* fix(plugins): finish a twin-tab bytes save through any tab still open
A tab that closed mid-save left its twin with the old hash, and a twin
adopting a shared draft no longer lets its own older read replace it.
* fix(plugins): hand a closed tab's bytes draft to its open twin; drop stale reads
A twin that had not shown the file yet lost the draft when the tab holding it
closed, and a read that started before an edit and save could replace the
newer saved bytes. Boxes now count edits and saves; a read only lands if none
happened since it started.
* fix(i18n): format renderer dates and numbers in the UI language
About 80 renderer sites formatted with the OS locale: Intl constructors
given undefined (or nothing) and argless toLocale*String calls, while
nearby text followed the UI language.
- toLocale*String calls pass getIntlLocale().
- Module-level Intl formatters and collators use new ui-intl-formatters
helpers, cached per options object and rebuilt on language switches;
per-call constructors pass getIntlLocale().
- ReleaseBuildPicker's memoized labels re-run on language changes.
- An ast-grep rule (renderer-intl-ui-locale) rejects undefined/omitted
locales in src/renderer; machine-facing code passes a fixed locale.
* fix(i18n): collators check their own locale support; re-sort memoized lists on language changes; widen the Intl guard
* fix(i18n): name the formatter options type
* fix(i18n): reuse the CSV viewer's existing language subscription
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Neil
OrcaWinandOrcaWin
Brennan Benson
