setActiveWorktree's no-op guard now compares activeWorkspaceKey with the key
derived from the target worktree, so reselecting the current worktree repairs
a stale key instead of returning early.
Session hydration always derives activeWorkspaceKey from the restored
activeWorktreeId instead of trusting a persisted key that may name another
workspace, which kept the wrong sidebar row highlighted after restart.
Fixes#14474
Co-authored-by: Neil <neil@stably.ai>
An Orca launched from inside a Claude Code session inherits CLAUDECODE,
CLAUDE_CODE_EXECPATH, and CLAUDE_CODE_ENTRYPOINT alongside the child-session
stamps #9961 already strips. Every pane then looks nested to Claude Code and
to agent-aware tools, and the inherited entrypoint overrides Claude's own
detection. Add them to the existing inherited-stamp deletion list so every
local, daemon, and relay spawn drops them while explicit pane values win.
Closes#9155
Co-authored-by: Neil <neil@stably.ai>
* fix(claude-accounts): restart System default sessions on the outgoing login when switching
A Claude account switch only restarted sessions in the outgoing account's
own folder. A session on System default (~/.claude) signed in to that
account's exact login, as older Orca's copied login leaves it, was skipped
silently. Match it by email and organization, read by main at switch time;
never compare managed folders by login. Sessions in the user's own
CLAUDE_CONFIG_DIR are no longer treated as System default, and legacy
accounts match their current launch folder.
The ask dialog groups sessions into Running on X, Not on X and Can't move,
and the Always restart toast names sessions it left and offers Review.
* refactor(claude-accounts): simplify the switch login match, scan and toast styling
Inline the single-use login adapters, carry each pane's foreground result with
its row, keep the header-pin listener local to its effect, move the inline
toast action classes to the Sonner module, and stop the Review dialog
promising a restart for sessions that cannot move.
Each terminal tab and the Floating Workspace own separate PaneManagers, each
with its own activePaneId. The hover gate skipped any pane that was already
its manager's active pane, so a single-pane main terminal never took focus
back from the floating terminal (or vice versa). Refocus an already-active
pane when DOM focus sits in another terminal pane; focus outside panes
(chat, editor, inputs) is still left alone.
Fixes#29912
Co-authored-by: Neil <neil@stably.ai>
Grouping a GitHub Projects view by a NUMBER field sorted group headers as
text (1, 10, 2, 8). Number values now carry their value as the group order
hint and the NUMBER comparator sorts by it, falling back to label. Stale
non-number values use the finite unknown-option sentinel so mismatched
single-select/iteration comparators stay consistent.
Fixes#19395
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Usage caches and their source sidecars hold session ids and project
paths, but their durable temp files were created with the process
default mode, so a replace under umask 022 published them as 0644.
Thread an optional creation mode through writeFileDurable /
writeFileDurableIfCurrent and pass 0o600 from UsageCacheSnapshotWriter
and the usage source sidecar writer. Other durable writers are unchanged.
Fixes#31026
* Apply Codex Ask permissions at each fresh turn
* fix: admit fresh Codex input with current host permissions
* fix(native-chat): finish cancelled Codex input under its owner
* fix(native-chat): preserve mobile type boundary for input finalization
* test(native-chat): bound input finalization work at scale
* Fix cancellation result fences and exercise host proofs
* Fix input finalization type contracts
* Remove obsolete Portuguese permission description
* Preserve proven Stop outcomes during input finalization
* Preserve input handover proofs with session-ending Stop
* Preserve pending input recovery before lifecycle cancellation
* Assert one recovery card across overlapping close requests
* Preserve unwritten inputs across shared-agent Close preparation
* Narrow cancelled dispatch to its rejected outcome
* Import Codex app-server types from their colocated modules
* Use standard Ask policy for fresh Codex chat input
* Deliver applied Codex permission reports to the host
* Cover applied reports with pending settlement waiters at scale
* Fix settlement waiter timer portability on mobile
* Keep pre-send exit failures with their original input result
* fix(sidebar): show chat-only workspaces as active before the first message
A workspace whose only tab is a native chat showed the grey Inactive dot
until a message was sent, because the dot counted only live terminals and
browser tabs. Count a chat that is not explicitly slept, the same rule the
sleeping-workspace check already uses, in the sidebar cards, the parent
picker and the Cmd+J switcher.
* test: bound chat status work on unrelated store writes
* test: correct chat status contract formatting
* test: use a fixed clock for chat status fixtures
* test: prune obsolete chat status clock allowance
* test: complete sidebar status store fixtures
The bundled orca-cli skill guide never mentioned `terminal read --screen`,
so agents onboarded from it used the stream read on repainting TUIs and got
stacked fragments. Add a --screen example plus the stream-vs-screen and
--screen/--cursor rules, and realign the root help usage lines for
terminal read and terminal split with their command specs.
Fixes#15856
When the floating workspace panel had focus, Ctrl+Tab (tab.previousRecent)
and the recent-tab switcher resolved tabs from the main workspace, so the
shortcut either did nothing or switched main-workspace tabs. Route the
previous-recent command and the RecentTabSwitcher to the floating
workspace's group when the panel is focused, and share the recent-tab
lookup via getPreviousRecentTab. Floating simulator tabs are now included
in the visible-tab set used for cycling.
Fixes#33134
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Match Terminal only redefined --foreground on the sidebar surfaces, but
inherited text color comes from body's already-computed color, so labels
without their own color class (e.g. project names) stayed the app
foreground. Set color directly on the surface as well.
Fixes#29151
Co-authored-by: Neil <neil@stably.ai>
When the daemon's PTY spawn check fails, the DegradedDaemonPtyProvider
routes fresh terminals to the in-process LocalPtyProvider. bindProviderListeners
decided whether to feed the runtime via `instanceof LocalPtyProvider` on the
registered provider, so behind the degraded wrapper every in-process chunk and
exit was ingested twice (once through configure().onData/onExit, once here),
doubling output sequence numbers and exit handling.
Tag each data/exit event with `runtimeFed` when the emitting provider already
reported it through configure(), and gate the listener's runtime feed on that
per-event flag instead of the provider's class.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
The daemon's spawn-file foreground and child-process readers and the tmux
client attachment reader compared root.tty against Linux's '?' only, so a
macOS root reported as '??' (or '-' on some ps builds) was read as having a
controlling terminal. All three now use the shared hasControllingTty
predicate from src/shared/posix-controlling-terminal.ts.
Fixes#23245
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
dnd-kit's drag-end delta is scroll-adjusted, so a pointer derived from
activatorEvent + delta drifted by the source tab strip's scroll offset and
dropped tabs into the wrong group or split. The tab drag pointer sensor now
records the actual cursor coordinates on pointerdown/move, and
getDragPointer prefers that recorded position.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
PR close/reopen/merge confirmation titles were built from a fragment
template ("{{value0}} PR #{{value1}}?"), so locales could not reorder the
verb, and merge method labels came from English-only shared constants.
Add whole-sentence title keys per action and merge method plus translated
merge method labels in a renderer copy module, and route every PR surface
(item dialog, PR page, Tasks MergeCell, right-sidebar HostedReviewActions)
through it. Drop the English labels from the shared merge-method
presentation and remove the dead fragment keys from all locales.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
The workspace details dialog body is an overflow-y-auto scroll area, which
also clips horizontally, so the fields' 3px focus ring was cut off on the
left and right. Add -mx-1 px-1 to the container so the ring has room
without shifting the fields.
Fixes#31427
The orca-cli skill guide said `--direction horizontal` splits left/right and
`vertical` splits top/bottom, but terminal panes map `vertical` to a
side-by-side split (flexDirection 'row'), matching the "Split terminal right"
menu. Swap the wording and regenerate the bundled guides.
Fixes#9023
A throwing ui-changed listener (e.g. webContents.send on a destroyed
secondary window) propagated out of store.updateUI() during
app:stage-before-unload-sync and cancelled the shutdown checkpoint,
leaving the user unable to quit. notifyUIChanged now isolates each
listener, the ui:stateChanged broadcast skips destroyed webContents, and
the staging failure cause is returned to preload so the error toast
names it.
Fixes#20897
Co-authored-by: Neil <neil@stably.ai>
The Commit & Sync tooltip, the Rebase label/tooltip, and the Create PR
blocked hints were bare English literals while the labels beside them went
through translate(). Route all 25 strings through translate() with named
placeholders and add the keys to the English catalog.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): expand %d and other tokens in ssh -G IdentityFile paths
OpenSSH prints IdentityFile values from `ssh -G` with their percent
tokens unexpanded (it expands them only at connect time), so a config
line like `IdentityFile %d/keys/work.pem` reached Orca as a literal
relative path. The key was silently skipped and the connection fell
back to a password prompt even though plain `ssh <alias>` worked.
Expand the tokens OpenSSH supports for IdentityFile that can be derived
locally or from the ssh -G output (%%, %d, %u, %i, %l, %L, %h, %n, %p,
%r). Paths with tokens that need OpenSSH internals (%C, %j, %k) are left
unchanged. A configured, non-default identity file that does not exist
is now named in the auth error instead of being skipped silently.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ssh): reproduce #33849 end to end and keep tests off the real ~/.ssh
Adds a Docker e2e: a host from ~/.ssh/config whose IdentityFile uses %r
and %p connects with that key. It fails on v1.4.241 and passes with
the token expansion. Drops a unit assertion that read the real
~/.ssh/id_xmss.
* fix(ssh): expand ${NAME} in ssh -G IdentityFile paths too
ssh -G also prints IdentityFile's ${NAME} environment references
unexpanded, so a key at ${KEYS}/work.pem fell back to a password prompt
in the same way as #33849's %d. Expand the braced form first, and keep
the raw path when the variable is unset, as OpenSSH refuses it.
---------
Co-authored-by: william <wanglv93@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The agent terminal preview auto-focuses xterm, which claims Escape and Tab,
and it swallowed the pane-close chord because a preview has no pane. Route
that verdict to an optional requestClose callback so the dialog (modal or
adjacent panel) closes; plain SSH terminals pass none and keep swallowing it.
The workspace keyboard router also treated the preview textarea as terminal
context, so the chord would have closed the active editor/browser tab or hid
an empty floating panel behind the dialog. Mark the preview container and
skip those close handlers for its targets.
Fixes#19757
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
When a worker reported its outcome (succeeded or failed) before the
worker-start path finished, a late startup error such as a rejected
prompt delivery overwrote that settled outcome with a start failure and
tore down the live worker session. The start-failure path now checks for
a settled report first and returns a ready receipt carrying the reported
workerOutcome without teardown; otherwise it records the failure before
awaiting teardown so no report can slip in between.
Co-authored-by: Neil <neil@stably.ai>
link-routing-preference-dialog.tsx exported both the provider and
useLinkRoutingPreferenceDialog, so it was never a Fast Refresh boundary.
When another file in the terminal subtree changed in the same watcher
batch (e.g. a branch switch), createContext ran twice and the terminal
pane read a different context than the provider published, throwing
"must be used inside LinkRoutingPreferenceDialogProvider".
Move the context and hook into a component-free module, matching the
confirmation-dialog-context split from #11980.
Since #27214 every SSH session is retagged runtime:<env>, so the #24236
check that drops a deleted cwd (and its prebuilt `cd`) before resuming
only ever ran for the legacy ssh: spelling. Resume on a paired or
SSH-managed server therefore ran `cd '<deleted folder>' &&` and failed.
The check now covers runtime hosts too, probing the folder with the
existing files.browseServerDir RPC; only a definite "missing" answer
drops the cwd, so an older or unreachable host keeps today's behaviour.
Search-hit cards carry no turns and remote hosts cannot reparse a first
prompt, so a server session found through search showed "No first
prompt" and "No conversation preview". Hits now borrow the preview of
their scanned history row.
The Add project host picker showed a failed SSH host as "Needs attention
- SSH" with no reason. Its Connect handler also overwrote the failure
main had just published with the host's earlier state, and toasted
Electron's raw IPC error. The picker row now shows the same reason
Settings → SSH Hosts does. The handler keeps main's published failure
and toasts through the shared SSH connect-failure toast.
Fixes#29648
Revoking a paired device, syncing repository settings drafts, and
auto-expanding the first failed check all mutated refs or queues inside
setState updaters, which React may run twice (StrictMode) or late. Move
the impure work into the event handler or effect that queues the update.
Fixes#25529
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
@parcel/watcher reports FSEvents MustScanSubDirs ("... File system must be
re-scanned.") as a non-fatal per-batch error while the native stream keeps
running. Orca forwarded it as watch-error, which retired the watched root and
silently stopped external-edit delivery for the rest of the session.
Route rescan-required errors to a new delivery-queue overflow() so consumers
resync and the subscription stays live. A root deleted in the same batch is
still reported as watch-error. Other errors keep the existing path.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Electron's BrowserWindow.webContents getter throws "Object has been destroyed"
once the native window is gone. Several ipcMain reply listeners (terminal
reveal, CLI/mobile terminal create, browser tab create, remote CLI scope) and
the main window focus lifecycle read mainWindow.webContents on every event, so
a late or replacement-window reply after close threw inside ipcMain.emit,
crashing main and starving the new window's listener.
Capture the renderer webContents once at setup and compare event.sender
against that reference instead. Adds a regression test for a pending reveal
on a closed window while a replacement window answers.
Co-authored-by: Neil <neil@stably.ai>
When the scrollback is full and the user has scrolled up, new output trims
the oldest lines and renumbers every buffer row. The pinned scroll intent
stored an absolute viewportY, so enforcing it later (mouse report, reattach,
visibility resume) jumped forward by the number of trimmed lines.
Pinned intents now carry a single xterm marker on the pinned line. Restore
and enforce use the marker's live line and fall back to the stored
coordinates when the marker is disposed (trimmed away or a replay clear).
A pinned sync after trimming compares against the live anchor and refreshes
the stored coordinates so keyed remounts restore the same content.
Fixes#23333
Co-authored-by: Neil <neil@stably.ai>
Windows runtime file watches run in-process, so closeFileExplorerWatchersForPath
never has a watcher child to close there. Re-resolving the authorized path after
Git already dropped an external sibling worktree's registration threw
'outside allowed directories' and aborted the Windows partial-removal recovery.
Fixes#26764
Co-authored-by: Neil <neil@stably.ai>
* fix(terminal): adopt another client's terminal under its own tab instead of a second one
A paired client that spawns a terminal in a host's local worktree leaves the host renderer without that tab. On activation the host reports the PTY unowned with the recorded pane, and adoption minted a tab with a random id because the recorded tab was not in this window, so the client showed the PTY in two tabs. Adopt it under the recorded tab id and leaf instead, unless that id was closed, and let PTYs the host names as a pane's owner bind before PTYs that only recorded one.
* fix(terminal): never mint a second tab for a PTY a recorded-tab create already bound
If createTab had to give the recorded tab another id, that tab already holds the PTY, so the fallback create would show it twice.
* test(terminal): pin the clock for the closed recorded-tab case
The wall-clock tombstone tripped the flaky-test ratchet. Also tightens the adoption doc comment and keeps the fixture header first.
---------
Co-authored-by: Minidoracat <11269639+Minidoracat@users.noreply.github.com>
Dispatched workers were told to run `orchestration check` but never to ack
the returned deliveryId, so the same batch replayed on every check and newer
coordinator mail stayed hidden. The dispatch preamble, orchestration skill
guide, and worker contract now tell workers to ack each processed batch with
`--ack <delivery_id>` (which also reads the next one) and repeat until count
is 0.
Co-authored-by: Neil <neil@stably.ai>
* fix(session): clear an emptied field on a runtime partition this window loaded
* fix(session): leave hosts with parked contested rows to the shadow
Also replaces the new type assertions with checked types.
On macOS with a Korean IME, pressing Option+Left while a syllable was in
the preedit moved the shell cursor two words. Chromium forwards a
composing keydown for the chord, commits the composition, then replays
the same native key event (same timeStamp). Orca deferred the first
copy until the composition settled and then sent the replay too.
The deferred chord sender now remembers the deferred keydown's code and
timeStamp and absorbs exactly one matching replay. The absorb check runs
before the composing-defer branch, so a replay arriving before xterm
ends the composition session is covered as well. Any other checked
keydown, blur, or teardown forfeits the slot.
Fixes#17616
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: kunsanglee <85242378+kunsanglee@users.noreply.github.com>
Daemon suites handed Windows production branches POSIX-shaped values, so
they failed on Windows checkouts:
- Preflight client replacement bound `join(dir, 'daemon.sock')`; win32
listens on the path verbatim and refuses a file path. Use
getDaemonSocketPath like the sibling daemon suites.
- Cwd-validation fixtures used POSIX cwds, which win32 preflight never
validates, so cancel/missing-dir cases reached spawn. Give them a native
`C:\` cwd on win32. The skipped validation also leaked a pending
mockImplementationOnce gate into the next test, which then timed out.
- ORCA_SHELL_FEATURES is only written on the POSIX launch path; gate the
history-wrapping expectation on platform.
Refs #18261
On Linux, PTYs inherit the daemon's RLIMIT_RTTIME. When the soft or hard
limit is 0 the kernel kills timer-armed jobs (SIGXCPU / SIGKILL, exit 152
or 137) and unprivileged code cannot raise the hard limit. Read
/proc/self/limits at terminal-scope initialization and log a
rttime-limit-zero event with a remedy hint (rtkit, or the launcher /
systemd LimitRTTIME that starts Orca). No-op off Linux or when the limits
file is unreadable.
Co-authored-by: Neil <neil@stably.ai>
* Enable continuing remote CLI conversations in Chat UI
* fix(native-chat): send the host's own pane key; ask older hosts to update
On a paired host the desktop names a pane by its mirrored surface key, but
the host matches cliSource against its own agent-status rows, so every
remote "Continue in Chat UI" create was refused as unreadable. Translate
the key with toHostSessionPaneKey before sending.
A resume launch's join identity now includes its execution host, so a
remote resume never joins an in-flight resume of the same conversation id
on another host.
A verified host that lacks resume-history now shows the pane-header action
disabled, with "Update Orca on this host to continue in Chat UI." in its
tooltip and accessible name, instead of hiding it.
---------
Co-authored-by: Zrzzzz <1160026659@qq.com>
* fix(session-tabs): retire kept terminal rows the host closed, and offer Close Pane on a closed remote terminal
* fix(session-tabs): a live handle outranks an older close record
* fix(runtime): recognize hand-typed native Claude at its startup dialogs
A shell-typed claude emits no title at the trust dialog, so nothing asked
which process owned the pane, and native Claude's process name is its
version (2.1.310). agentWait now identifies a title-less, unowned pane
from its foreground process, confirming an unfamiliar name with one process
scan whose verdict is kept while that name stays in the foreground.
* fix(runtime): scan only native Claude's version-named binary, only when a dialog is on screen
Review follow-ups: an untitled, unowned pane earns a foreground read only
when its live screen shows a blocked dialog, so plain shells answer without
a round-trip; the process scan runs only for a semver-shaped foreground name
(native Claude's versions/<semver> binary), never on win32, and only an
answered scan is cached.
* fix(runtime): don't persist a titleless pane's scanned identity
A hand-typed native Claude identified for an interactive-wait query was
stored as the pane's foregroundAgent. If the user declined the trust
dialog before Claude set a title, no title transition fired, so the shell
stayed labelled Claude until the next inventory refresh.
The identity now answers only the current query; the per-pty scan cache
(keyed by foreground name) keeps repeat queries cheap. Concurrent queries
share one in-flight identify, and the version-name match is anchored.
* fix(runtime): keep scanned identity out of background refresh; null for disconnected panes
- load() matches main again; only identify() consults the confirm-scan cache
- disconnected/unreadable panes answer null so the tail path still answers; only timeout is unknown
- check pane ownership before projecting the screen
- cache only recognized agents, so a not-an-agent verdict is rescanned
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): drop a titleless identity read if the pane rebinds; trim tautological tests
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(agent-status): show Claude/Codex panes waiting on the folder-trust dialog
Hooks only start after a folder is trusted, so a pane parked on Claude's or
Codex's trust dialog had no sidebar row (or an idle one) even though
agentWait already reported agent-trust-workspace. Main's headless-screen
observer now runs the same blocked-text detector on the screen and projects
a waiting row while the dialog shows, settling it with a session-boundary
done once the dialog leaves. The row is not first-party evidence: it skips
the prompt lifecycle and lastExplicitAgentStatus.
Refs #25854
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): match the live trust dialog's structure and settle on agent exit
Require the dialog's key footer and trust choice so quoted wording in a reply
cannot raise a waiting row, settle the row once a killed agent's pane is back
at a shell, and cover dismissal with a Codex 0.164 recording.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): settle the trust-dialog row only on positive evidence
ASCII-escape the dialog regexes for the orcad build, settle only after a quiet
settled screen without the dialog or a proven shell foreground (readLaunchedAgentForeground,
which is the only shell-alone proof on Windows), so a resize repaint split across
reads no longer flips the row and re-notifies.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(agent-status): move trust-dialog status projection out of headless hydration
Keeps headless-terminal-hydration.ts under the max-lines lint limit.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agent-status): drive the trust-dialog settle window with fake timers
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agent-status): drop the Codex dismissal capture the serializer fuzz rejects
Its replay trips known serialize I2 diffs; cover Codex dismissal with a composer
repaint over the existing 0.158 capture, and compare only appearance/absence.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(agent-status): track trust-dialog rows per PTY and clear on debounced screen reads
Keys state by ptyId so an emulator swap no longer strands the row, owns the
row by its receipt stamp instead of a toolInput tag, drops tracking as soon as
another writer replaces the row, and clears after two debounced reads without
the dialog instead of 3 s of total quiet.
* fix(runtime): clear the trust-dialog read timer when a screen read throws
---------
Co-authored-by: Claude <noreply@anthropic.com>
Claude background-job workers, and the `codex exec` runs they spawn,
inherit the dispatching pane's ORCA_* env, so the Codex hook posted
events against a pane the run never lived in. The Codex hook now exits
when CLAUDE_JOB_DIR is set, like the Claude hook already does.
The guard moves into agent-hooks/claude-background-job-guard.ts and is
shared by the Claude hook, Claude statusline, Windows Claude entry and
Codex hook. POSIX exits after stdin capture; Windows exits before
owning stdin so an abandoned stdin cannot hang the drain.
Pane spawns now drop an inherited CLAUDE_JOB_DIR so an Orca launched
from a Claude background job does not silence its panes' hooks.
Fixes#24516
Co-authored-by: Neil <neil@stably.ai>
When the SSH session itself could not open (key rejected, port refused,
host not answering, host key not trusted), Connect on a host Orca had not
set up yet said "Orca couldn't start its server on this host" and offered
a plain SSH terminal that could not work either. Errors from opening the
SSH session are now marked where they are dialed, and a setup that fails
on one ends the connect with SSH's own reason. A held move keeps its
status. The connect-failure toast also drops Electron's IPC prefix.
cmd /c strips the first and last quote of a line that starts with a quote
unless exactly one quoted, paren-free executable path is present. A spaced
.cmd launcher plus any quoted argument (or a Program Files (x86) launcher)
was cut at its first space and the spawn silently failed. Prefix the batch
invocation with `@` so the line never starts with a quote, in both the
waiting and detached start /B forms.
Add a real cmd.exe round trip in the Windows CI lane.
Co-authored-by: Neil <neil@stably.ai>
Agents that leave their OSC title behind on exit (grok, codex) never trip
the title-based exit, so ChatView stayed on top of the returned shell.
onConfirmedShellForeground now notifies onAgentExitedRef, except for
Orca's own hibernation stop, which keeps its chat surface.
Fixes#30613
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(terminal): skip an escape tail an abandoned hidden-output restore would print (#33766)
Main drops a hidden pane's renderer delivery after its model ingests the
bytes, so the first chunk sent on reveal can begin inside an escape whose
start was dropped. When the restore is abandoned, the renderer resets its
parser and writes the queued chunks, and xterm printed the tail (';242m',
the rest of a Codex OSC title).
Main tracks each PTY's escape state over every accepted payload and labels
the first delivery after a hidden or pending-cap drop with the escape it
resumes inside (gapEscapeState). Only the abandon path strips that
continuation; a successful restore keeps every byte so the snapshot's
pending escape tail can complete. No label means no change.
* fix(terminal): make the escape-continuation scan's switch exhaustive (#33766)
Yunqian FanandNeil
Kelvin Amoaba
BAEKSEUNGHYEONandNeil
Jinwoo Hong
Yoshito Ohata (sheat)andNeil
monemandNeil
ka2umaz
Brennan Benson
Jason Brashear
Nikolas SapalidisandNeil
Serhii SavenkoandNeil
José Antonio Muriano CriadoandNeil
Aashish MahatoandNeil
grboy6770andNeil
YEONGUK LEEandNeil
Jinjing
Noah Rijkaard
Kaynan Sampaio de Camargo
den4ikandNeil
EvgeniiandNeil
Trevor SmithandNeil
Naveen ChatlapalliandNeil
arookieofc
JunandNeil
CIS2042andNeil
MeapriandNeil
Wooseong Kim
Jacob HonoréandNeil
Konstantin StasenkoandNeil
Tae Hyeong, SonandNeil
zhangxaochenandNeil