mirror of
https://github.com/stablyai/orca.git
synced 2026-11-14 09:57:48 +00:00
e4d07cf93772611d8c3c19faadabd6045965a6bf
171
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  NeilandMatthew Wilkinson
|
f660d8c47d |
feat(plugins): add permissioned desktop appearance publication (#38524)
* feat(plugins): add permissioned desktop appearance publication * docs(plugins): add one-line API comments for appearance provider * chore(plugins): regenerate declarative testing kit for appearance API --------- Co-authored-by: Matthew Wilkinson <wilkinson.m@outlook.com> |
||
|
Neil
|
9bd6272fdf |
refactor(tooling): organize build, CI, and test owners (#38130)
* refactor(tooling): organize test runtime and maintenance owners * test(tooling): preserve relocated runtime fixture dependency edges * refactor(tooling): preserve xterm routing owner checks * ci(tooling): include routing owner in sparse checkout * test(tooling): preserve copied workflow dependency closures * fix(tooling): normalize hashed JSON assets in release parity * fix(tooling): distinguish asset aliases from literal references * fix(tooling): frame normalized asset reference payloads * fix(tooling): normalize decoded JSON asset references * refactor(tooling): organize build, CI and release owners * fix(tooling): align moved generator and workflow path contracts * fix(tooling): update generated plugin bundle owner banners * test(tooling): create relocated mobile verifier fixture directories * test(tooling): copy headless detector dependency closure * test(tooling): align native batch policy fixtures with owner path * fix(tooling): link moved reliability command to historical evidence * fix(tooling): preserve nested sandbox owners and canonical guide source * fix(tooling): target release version owners in checkout fixture |
||
 Jinwoo Hong
|
9658ec48ad |
fix(automations): accept Pi model and thinking extra arguments (#38020)
* fix(automations): accept Pi model and thinking extra arguments * fix(automations): keep Pi provider pins and refuse unpinned inline keys * fix(automations): match Pi value options to its argument parser * fix(automations): refuse Pi model overrides beside unscoped inline keys * test(automations): cover Pi's last-provider-wins key pin * fix(automations): refuse any Pi custom Command text with --api-key * fix(automations): drop the Pi inline-key pin guard Pi already sends an unpinned inline key to the chosen model's provider and warns; the user typed both the key and the model, so Orca does not refuse it. |
||
|
Jinwoo Hong
|
7854cb61b1 |
Delete the legacy orchestration takeover guide (#38013)
* fix(automations): say the run's worktree was deleted; document plain run-use recovery * revert(automations): drop the deleted-worktree wording change (not reproducible) * docs(orchestration): list Tasks on recovery and note run-use drops other Runs * docs(orchestration): delete the legacy takeover guide; keep orchestration docs to the normal flow |
||
|
Jinwoo Hong
|
f138493be3 |
fix(browser): a split tab create joins a browser pane already beside the caller (#38006)
* fix(browser): a split tab create joins a browser pane already beside the caller * fix(browser): the joined page is the pane's visible tab * fix(browser): a split with an unknown caller still splits beside the active pane |
||
 Kelvin Amoaba
|
7f885c19a6 |
fix(skills): rename computer use to orca-computer-use (#37659)
* fix(skills): rename computer use to orca-computer-use * test(skills): resolve rename fixture after main cleanup |
||
 Brennan Benson
|
ec8b2e2055 |
Read one full Linear ticket for planning and plain tickets for queues (#37656)
* docs(linear): use plain ticket reads for queues * docs(linear): preserve selected queue ticket identity |
||
|
Neil
|
3a714906a0 |
plugins: keep status bar plugins' workers running while enabled (#37630)
A plugin with a worker and status bar items is now started when enabled and kept warm, like a plugin with hooks, through one shared resident-worker predicate and warmer. |
||
|
Kelvin Amoaba
|
eb55a5a6d3 |
feat(browser): --expect-url refuses a browser command when the page is at another URL (#37575)
* feat(browser): guard page commands with an expected URL * fix(browser): refuse an empty --expect-url and check it on dialogs and the forwarding desktop * fix(browser): recheck the expected URL right before keys go out * refactor(browser): drop duplicate session type, dialog alias and per-capability sidecar fields * chore(browser): satisfy the changed-code gates for the expected URL guard |
||
|
Brennan Benson
|
34fa209fe1 |
fix(orchestration): native chats get each orchestration message whole instead of a check pointer (#28567)
* fix(orchestration): steer mail notices into a busy native chat's running turn A native-chat coordinator's mail notice always queued as a card until the whole turn ended, so a coordinator busy in a long command never saw its workers' reports. Agents that take a message mid-turn (Claude, Codex, Pi) now get the notice at once; agents that would cancel their turn for it (ACP) still queue it. * fix(orchestration): drain mail that arrives while a notice is pending * fix(orchestration): native chats get each orchestration message whole instead of a check pointer Each mail message is sent to a native-chat agent as its own chat message, with the sender, type, subject, body, payload and exact reply command, and is marked read once the chat accepts it. Heartbeats are marked read, never sent. Mail an unacknowledged check batch holds stays with that batch. * fix(orchestration): keep the at-most-once gate's mail-lane assertions, exhaustive sender switch * Preserve native mail compatibility and drain delivery backlogs * Drain native mail with a finite ordered pass and scoped operation ownership * Bound mail formatting and honor accepted queue handoffs * Run the native mail tests that open SQLite in the Node runtime project * Preserve live mailbox ownership and recover full reports by id * Use a typed runtime client in inbox compatibility test * Preserve historical mail evidence and scope the test clock * Map historical structured-send evidence to the current test command * fix(orchestration): settle mail handoffs per message and recover interrupted consumers * Hold native chat mail until the chat is idle, as terminal mail waits A mail send admitted into a running turn cancels that turn for agents that cannot take a message mid-turn (ACP: Grok, OpenCode, OMP, Antigravity): the second of two reports cancelled the first before the agent saw it, and the first report cut off the turn carrying the person's answer. Mail now waits while the chat is working or a prompt waits on the person, for every agent, and goes out at the idle edge, one message per turn, oldest first. * test: cover idle orchestration report turns * fix: preserve independent mail authorization through grouped delivery * fix: preserve routed mail identity and private inbox state * test: bound mailbox query work on repeated delivery * fix(orchestration): consolidate terminal mail imports * Validate mailbox query rows and type delivery fixtures * Keep host forwarders typed and inline single-use mail evidence reader * Declare the mail handoff store method boundary * Preserve mailbox contracts across typed boundaries * Retain existing main cleanup row boundaries * Fix mailbox handoff fixtures and helper mail transfer * Name the mailbox fixture constructor type * test: complete mailbox dialog pane identity * Keep structured mail ordering and ownership current at claim * Bound mailbox preparation and immutable cohort selection * Consolidate structured mail contract fixtures * Consolidate duplicate mailbox imports * Fix mail handoff type contracts and deterministic test fixtures * Repair journal forwarding and align mail contract fixtures * Fix mailbox corpus message type inference * Correct personal provenance in ACP backlog fixtures * Correct ACP mail contract measurement and epoch wake fixtures * Retain full ACP contract diagnostic arguments * Restore reliability gate coverage and consolidate mail fixtures * Preserve unknown alias release coverage * Route native reports through the durable chat queue * Preserve exact legacy mail holds in queue lineage proof * Use ordinary queued messages for worker reports * Use semantic queue and check completion for report delivery * Record bounded queue recovery work and request cleanup proofs * Preserve report creation evidence and bounded source wakes * Preserve report source work and check ownership * Use ordinary report acceptance and incremental original history * Retire completed mail opportunities with their current owner * Retire routed source debt and complete joined mail contracts * Exercise Run typed peek through the command transport * Require the queued report submission in creator coverage * Restore database callback API and align queue contract fixtures * Fix empty legacy tab selection in restart fixtures * Keep relation heading assertions scoped to each report * Native chats receive each orchestration message whole, through the chat's own queue Each orchestration message to a chat session becomes one ordinary chat message carrying the whole message, sent with the chat's queue like a person's message: it waits behind running work or a question and the agent is handed one per turn. A per-message record keeps the send's operation id, so a restart finds the card instead of sending twice; the message is marked read once the agent is handed it, and a check that takes it first deletes the waiting card. A message too large for one chat message keeps today's pointer to check. Terminals are unchanged. * Test that chats get each message whole, queued like a person's message * Repeat a report the agent may not have taken only after a later turn or /clear A send the agent rejected or left unanswered stays unread for check and is handed over again only once a later turn ran or a /clear replaced its context, so edges alone never restart an agent that fails on every start. A send whose record a rewind dropped is sent again, and a send that throws is retried on the session's next journal edge. Tests follow chats getting each message whole. * Hand a chat orchestration mail only while it is still owed A queued mail card now runs only while its message is unread in its mailbox and that mailbox still belongs to the chat: the queue asks at handover and drops a stale card without a turn (abandoned or settled Dispatch, Run taken over by another chat, mail a check or reset took). Cleanup after check, moves, run-use, abandon, reset and worker release deletes those cards visibly and never holds the action up; mail still owed goes to the mailbox's current owner, and Orca's own deletion is never read as the person's. A send that may have reached the agent is never sent again; check keeps it. A send the agent proved it never got is sent once more, under a new id, only after a later turn or /clear ordered after that failure. A send recorded but never admitted is admitted under its own id. Each outstanding send is read by key, never by scanning the chat's history. A refusal no longer loses its retry when an edge arrives mid-send, and a coordinator refused for queue room gets its mail when the queue frees room. A chat worker's follow-up now takes its short Task first and then each moved message whole, with no check needed. The guide says a working worker gets mail when its turn ends. * Let the chat's host answer what became of each mail send, and let the person's cards pass mail Orca cannot decide on The chat's host now answers for each send by its id: the card first, then the send itself, then a gone card's handoff found by key, and only then the admission receipt, which alone can prove nothing was admitted. A receipt whose journal detail is gone is in doubt however old its id, so a renewed id can no longer send the same message twice. A rejected send is repeated once only after a different turn was actually handed over and accepted, or a /clear was made, after the rejection; the queue's admission cursor no longer stands in for that. No answer walks the conversation's history. The mailbox reserves each send and stamps the message delivered in one write before the host call, so a crash after admission never leaves it selectable again. A refusal before admission releases that exact reservation; every retirement and release is checked against the current attempt, and a record an older build saved without a stamp is repaired as it retires. A person's Delete consumes an oversized pointer's mail too. Who holds a mailbox is read from durable facts: a Run moved to a terminal, a released worker, another host or an ended chat makes a waiting card stale, so it is withdrawn without a turn and its mail released for the real owner. Only a fact that cannot be read holds a card; the person's own cards behind it go on, later mail stays behind it, and selection and the handover check use the same rule. When the owner can be read again the queue is woken. A Task or a person's edited card never opens the mail database. An explicit Send of such a card now says what happened. Parked mail is indexed by chat, wakes only that chat's mail, ignores streamed tokens, and drops the chat's journal watch with its last mailbox. Canonical session identity is reused per session store revision instead of rebuilt from every record on each check. Main's account-switch worker test now reads "unread and still owed". * Let the queue alone decide which card goes next, and wake a terminal given back its mail The queue now owns one rule for what can be handed over next, installed once on each chat's queue and read by the drain, the final handover check, queue publication and scheduling alike. Mail whose owner cannot be read keeps its place; the first of the person's own cards behind it goes instead. Held cards stay held, a returned, paused or edited card behind it still stops the queue, and later mail, from any mailbox, stays behind it. The rule walks only the queue's live cards, never its history. When nothing can be handed over nothing is published as next, so the chat reads as idle and /clear works; when the owner becomes readable again the queue is published and looked at again. Choosing and publishing the next card only reads custody; settling a stale card stays with the handover. Mail a chat gives back after its Run or worker moved goes through the runtime's own delivery, so a terminal owner is pointed at it. A chat's journal watch now lasts as long as it has mail parked, through its own redrives, so a publication that changes nothing the mail waits on starts no pass. Session identity is cached until a record joins, leaves or is cleared, not rebuilt after every admission. An explicit Send of mail whose owner cannot be read says Orca couldn't read the chat's saved state rather than that it restarted. * Find the person's next card past undecidable mail by walking only as far as it must, and ask mail authority only once nothing else stops a send * Say plainly when Orca can't confirm queued mail is still this chat's, and that the person can try again * Let parked mail's own watch be the only journal subscription for mail, and stop saving a send fence nothing reads * Count the queue's order reads with plain index getters instead of a reflected proxy * Read saved mail sends column by column, and build test fixtures as the types they stand for * Keep main's words for every other refused queued Send; only undecidable mail says its message wasn't sent * Let replay read the queue's handoff links, keep the host's last mail answer where the type can see it, and drop the removed test from the send gate * Keep the queue's possible next cards in order as each one changes, reuse the last pick until the queue moves, and look up a send by its id * Ask whether one chat's tab closed instead of listing every open tab to find it * Settle a mailbox's earlier mail only when something it waits on moved, republish a chat once per pass, clean up only the mail a check, abandon or move touched, and act on a chat's status only when it changes * Date the scaling test's extra tabs by the coordinator's recorded lease instead of the wall clock * Keep nothing in memory for a mailbox a cleanup finds with no owner and no send left, unless a pass on it is still running * Ask about a report whose send threw before handing over newer mail, under the id it was reserved with |
||
|
Neil
|
36f17a04a7 |
plugins: Box layout container for components panels (catalog 4) (#37420)
- Box (ui.catalog 4, since 1.4.248): direction, gap/padding/paddingX/ paddingY/margin on the gap scale, align, justify, wrap, grow, shrink, width/height/min/max (px up to 4096 or whole percents), columns, scroll, border (true or a tone), radius, background (theme surfaces or tone tints). Strict props: hex colours, CSS lengths and unknown props are dropped with a warning like other components. - Renderer maps props to theme tokens through data attributes; sizes reach inline style only as validated px or percents. - Typings, docs, skill references, gallery Layout tab; orca/testing finds Boxes and summarizes danger or warning Boxes. |
||
|
Neil
|
cb031c4517 |
fix(plugins): merge disk writes into a custom editor's unsaved edits (#37343)
* fix(plugins): merge disk writes into a custom editor's unsaved edits A write to the file on disk while a custom editor tab had unsaved edits never reached the editor: the buffer kept the edits, Orca showed its Reload/Overwrite banner, and the session's merge never ran. Now a frame whose document session has merge announces it (editor.merges), and Orca sends it the new disk text with the text the edits started from (editor.document with ancestor). The session merges, posts the result, and the tab stays unsaved with it; the banner is skipped. Without merge the banner decides as before. * test(editor): an explicit save under the changed-on-disk banner keeps the edits * fix(plugins): make the outside merge exact, and narrow it to where it is - The host settles a merge only on the session's edit made against the merge's own document version, and always commits that result to the buffer (even when it equals the disk text); silence past the 1 s flush deadline, a remount or a throwing merge leave the banner and the suspended autosave in place. - Orca stamps exactly the disk snapshot the acknowledged merge used and records it as the next ancestor; a write that landed meanwhile puts the conflict back for its own merge. - The ancestor is the tab's disk text recorded while clean and advanced on acknowledged merges, and must match the tab's disk baseline. - Only a local file in one merging editor view, with no other tab on its buffer, takes this path; anything else gets the banner. - Frame events keep reaching their handlers after the merge capability. * fix(plugins): move nothing on a failed disk merge; advance the saved text on success A merge that throws now leaves the session's document, baseline and version untouched, so the user's next edit goes out against the old version: Orca refuses it and keeps the banner instead of taking it as the merge's acknowledgement. After an acknowledged merge the tab's saved text moves to the disk text it used, so typing back to the old ancestor no longer looks clean. * chore(plugins): regenerate the testing bundle on main |
||
 NeilandClaude
|
5846caf2ba |
plugins: editor.save.before hook (format on save, or refuse the save) (#37347)
* plugins: editor.save.before hook (format on save, or refuse the save) Explicit saves of text files from an editor tab run plugins' editor.save.before in main before the write (local, SSH, WSL and folder workspaces all save through that one renderer path). A plugin can return changed text or deny with a reason, shown in the save error. The buffer takes the hook's text only if it is unchanged since the hook started; edits made meanwhile stay dirty. Autosave, restart saves and bytes documents are not hooked, and with no live plugin listing the hook the save path adds no await. Co-Authored-By: Claude <noreply@anthropic.com> * test(plugins): editor.save.before text reaches the visible Monaco model The hook writes its text into the tab's draft, which reaches the model through the same content-sync bridge as Reload from disk. A model-level test covers the formatted text showing, the next keystroke editing it, and edits typed during the hook staying in the model. Co-Authored-By: Claude <noreply@anthropic.com> * plugins: editor.save.before review fixes: flush held typing, update the surviving view, keep the denial - After the hook answers, pending view text (rich Markdown's serialize timer) is flushed before deciding whether the buffer still holds the hook's input. - The hook's text goes to whichever view of the buffer record is still open, so closing the saving view keeps a sibling view in step with disk. - The save-request bridge passes Errors through whole, so the toast shows the plugin and its reason instead of a generic failure. Co-Authored-By: Claude <noreply@anthropic.com> * chore(plugins): regenerate after rebasing the save hook on main --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Neil
|
999160b3db |
feat(plugins): commands[].replaces lets a mod take over a built-in action (#37316)
* plugins: commands[].replaces lets a worker command take over a built-in action A worker command with replaces: <action> (the declarative action list, engines >=1.4.248, needs main) runs in place of that built-in from its shortcut, plugin aliases and the sidebar menus; a failed or silent (2 s) worker falls back to Orca's own. The install screen names each replacement, the plugin page has a per-action switch (settings.pluginReplacementsOff), and when two plugins replace one action the one installed first wins and the other's log says so. Update review counts replaces as new access. * fix(plugins): narrow replaced action ids before looking up their titles * plugins: harden command replaces after review - Consent includes the replaced actions, so adding replaces to a dev folder needs a new approval; CLI approval and update review name each takeover. - Shortcuts main intercepts (Tasks, Workspace Board, history), search with a selection and floating maximize now go through the replacement too. - A worker that only starts after the 2 s fallback no longer runs the command as well: main refuses to start it past the deadline. - A workspace-only command does not replace an action without a workspace. - An update keeps the plugin's first install time, so it keeps its takeover. - Drop the commands.run promise until Orca offers it. * plugins: commands.run always runs the built-in, never a replacement A5b's commands.run dispatches with the 'plugin-host' source; the app dispatcher now builds handlers that run Orca's own action for it, so a plugin that replaces an action and calls commands.run cannot loop. Docs and schema describe wrapping the built-in with commands.run; regenerated. |
||
|
Neil
|
3e52963a9a |
docs(plugins): fix custom-editor authoring papercuts from dogfood (#37337)
- shot --act: say edits only dirty the tab; end with Cmd/Ctrl+S to save - manifest: compound suffixes like .sketch.json open by default - cli.md: list plugin check's exit codes, including plugin_check_failed - workflow: how to run and stop the dev app from a source checkout - plugin create --help: real descriptions for --template/--publisher/--id/--name - recipes: declaration file for vendored ESM libraries |
||
|
NeilandClaude
|
2fb3a0975e |
feat(plugins): workers can open files and run built-in actions (#37323)
* feat(plugins): add editor.open and commands.run for full-access workers Both ride the existing plugin view request channel (the one plugin open and plugin shot use) to the one main window's renderer; headless serve and a missing window answer unavailable. editor.open takes a path that stays inside the workspace (Git worktrees and folders) and opens it as a tab without switching what the person sees. commands.run takes only the built-in contributes.commands action list and dispatches Orca's own handler, never a plugin replacement. Both need workspace:write. workspace.list now also lists project-group folder workspaces. * fix(plugins): open folder workspaces and host-naming ids through Orca's window workspace.open of a project-group folder asks the window to show it (setActiveFolderWorkspace), since the runtime activates Git worktrees only. editor.open resolves the identity: ids workspace.list now returns. commands.run documents that it must call the raw built-in, never a replacement wrapper. * plugins: regenerate the testing bundle and skill guides on the rebased host actions Generated files only (lint-staged's oxlint refuses a commit with no lintable files). Co-Authored-By: Claude <noreply@anthropic.com> * chore(plugins): regenerate the testing bundle on main --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
NeilandClaude
|
544577fe02 |
feat(plugins): workers can list and open workspaces, create and read terminals, launch agents (#37312)
* feat(plugins): let full-access workers act on workspaces, terminals and agents Host API minor 3 adds worker-only rows: workspace.list (workspace:read), workspace.open (workspace:write), terminal.create (terminal:send), terminal.read (terminal:read, at most 2,000 lines) and agent.launch (agent:launch). Each dispatches the runtime RPC method the orca CLI calls, in process with the CLI's identity, so it runs on the host that owns the workspace (local, WSL or SSH) and covers folder workspaces. The new capabilities arrive in 1.4.248; typings, docs and skill references are generated from the table. * fix(plugins): make workspace host actions safe to revoke, cancel and target - Each runtime effect re-checks the plugin's approval right before the runtime acts (a dispatcher beforeInvoke hook, after its own waits), and a worker's cancel or exit now aborts the call's signal through to the runtime. - agent.launch starts the agent's CLI in a background terminal and returns its handle at once; a prompt is delivered afterwards through the runtime's own reuse-terminal path, so the host call never waits for the composer. - workspace.list adds project-group folder workspaces and returns ids that name their host (identity: keys), so twins on two hosts are never ambiguous. - terminal.create passes presentation background; terminal.read counts a runtime-limited read as truncated. workspace.open refuses folders as unavailable until a window-side open lands. * plugins: keep both API extensions and host-call tracking under the line limits after rebasing on the hooks Worker-only status bar and workspace methods spread into PLUGIN_HOST_API through one module, the in-flight host call map moves into PluginWorkerHostCalls, and bindPluginRuntime builds the runtime RPC so main-process-plugins.ts keeps its size; regenerated docs and typings. Co-Authored-By: Claude <noreply@anthropic.com> * chore(plugins): regenerate after rebasing on the editor recipe and shots * chore(plugins): regenerate after rebasing on the plugin shot recipe --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Neil
|
3b5eed8ca4 | docs(plugins): point the editor and status bar recipes at plugin shot (#37332) | ||
|
Neil
|
f908d2f40a |
feat(plugins): plugin shot --editor to screenshot and drive custom editors (#37302)
* plugins: orca plugin shot --editor, and plugin open --editor opens the file's folder plugin open --editor now opens the file in the workspace that holds it, matching its real path too (/tmp vs /private/tmp), and otherwise adds the file's folder as a folder workspace instead of failing with no_workspace. plugin shot <dir|key> --editor <file> [--theme] [--width --height] [--act] loads the editor afresh in a hidden tab, waits for it to get its document and ask for it (a new editor.subscribed frame event), captures the editor's guest with the panel shot's capture path, and sends --act clicks, drags and keys as real input via sendInputEvent. It exits 1 with the frame's errors when the editor throws, is blocked by its content policy, or never asks for its document within 5s; theme and size are put back. New RPC method plugins.shotEditor so older hosts fail cleanly. * plugins: shot --editor never changes the author's file With --act the shot copies the file into a temporary folder, shoots the copy in a temporary folder workspace, then closes its tab and removes the workspace and folder; --in-place acts on the file itself. Without --act it opens the real file, leaves its buffer alone and closes the tab if the shot opened it. Afterwards Orca shows the workspace it showed before. Regenerates the skill's CLI reference. * plugins: fix editor shot typecheck (refusal next step, RPC test mock) * plugins: editor shot targets its own guest, flushes before reload, scopes cleanup per capture - Main captures the exact guest WebContents the shot's tab mounted, not the first with its URL. - An open editor's pending edits are flushed before the shot reloads it; the shot fails if not. - --act --in-place keeps the acted tab and its unsaved edits. - end-capture undoes only its own capture (per-capture id), so overlapping shots don't clash. - The file's workspace lookup includes local folder workspaces. * plugins: shot --status-bar/--window, key acts focus the editor guest, panel shot selects a workspace - Editor --act keys first give the guest's <webview> DOM focus and refocus its target, so a canvas that keeps focus no longer drops later keys; never webContents.focus(), which focuses the window. - orca plugin shot <dir|key> --status-bar | --window [--theme]: captures Orca's status bar or the whole hidden window (plugins.shotChrome) with the existing capture helpers. - With no workspace showing, a panel shot selects this machine's most recent workspace in the hidden window instead of failing. * plugins: a shot's end restores only its own capture overrides * plugins: regenerate the testing runtime with the editor subscribed signal * plugins: editor capture refusals go through one CLI-message helper * fix(plugins): give the chrome shot refusal a next step |
||
|
Neil
|
591f2acbc8 |
docs(plugins): add a rich-editor recipe and list frame theme variables in the skill (#37306)
recipes.md gains "A rich editor with a library" beside the hooks and status bar recipes: an isolated-frame custom editor that vendors its library behind an import map, syncs through orca.document.session with a merge by id, and tests that sync with mockEditorHost. host-api.md lists every --orca-* frame variable and what it paints, generated from the frame token allowlist. |
||
|
Neil
|
fa7c3f95fe |
feat(plugins): check custom editors and test them with mockEditorHost (#37293)
* feat(plugins): check custom editors statically and add mockEditorHost orca plugin check now follows each custom editor entry (local script src, inline module scripts, relative imports), transpiled and resolved as the frame loader does, and fails at file:line:column on syntax errors, missing files, refused imports, string eval/Function and files over their size cap, with no running Orca. The check ships in the test hooks bundle. orca/testing gains mockEditorHost: it runs the frame shell's real window.orca (document API and session) over an in-memory text or bytes file, with edits, replace, conflictNext, flush, setTheme and dispose. Typings, docs and the skill guide cover both. * feat(plugins): warn on editor eval and check editors in dev watch editor_eval comes from a lexical scan that can misread rare code, so it is now a warning that does not fail orca plugin check. dev watch --check runs the editor check beside the panel check and reports it under editors. * fix(plugins): check editors by the frame protocol's rules; mock blocks lost saves The static editor check now reads files through the loader's contained reader (symlinks out of the plugin are refused), runs only JavaScript script types, honors the page's import map for native modules, classifies files by the protocol's content types (JSON imports, extensionless HTML entries), decodes escaped script URLs, and uses the protocol's caps: 10 MiB entry, 1 MiB transpiled module, 16 MiB checked dependency. mockEditorHost refuses an oversized edit before reading it and then rejects flush() until a later edit lands, as Orca blocks the save. * test(plugins): type mockEditorHost's frame API instead of reflecting on it * fix(plugins): keep main's case-spelling check and hook typings through the rebase The rebase onto main resolved plugin-artifact-validation.ts and orca-testing.d.ts to B4's side; this puts back main's exact-path-spelling check and hooks typings beside B4's contained reader and mockEditorHost types, and regenerates the testing bundle. |
||
|
NeilandClaude
|
7989c05ad3 |
feat(plugins): agent tool-call hooks (Claude Code can block or rewrite) (#37303)
* plugins: agent.tool.before and agent.tool.after hooks; Claude Code PreToolUse blocks
The hook server runs plugins' tool hooks after recording status. Claude Code's
POSIX hook script now asks for an answer on PreToolUse (X-Orca-Hook-Decision),
waits at most 8 s (Orca answers within 6 s) and prints the decision: a deny
with the plugin's reason, or updatedInput without approving it. Timeouts,
errors and an unreachable Orca print {}, so the call proceeds. Other events
still print {} before posting. Every other agent, Windows scripts and SSH/WSL
relays only observe or are not hooked yet (per-agent table in the
agent-hooks README).
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: verify PreToolUse answers against the real Claude CLI; 204 at once when no tool hook listens
A real-CLI test (ORCA_REAL_CLAUDE_CLI_TEST=1) shows Claude Code 2.1.316 runs
updatedInput sent without permissionDecision, still asks for approval of the
rewritten call, and refuses a deny. With no plugin listing a tool hook, the
server answers 204 before any await and runs no chain.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(claude): type the real-CLI PreToolUse answer
* plugins: harden agent tool hooks (partial replies, fenced posts, OpenClaude, Amp/Copilot/Cursor)
- Drop a failed curl's partial body and print only a complete PreToolUse decision.
- Run tool plugins only for posts status ingestion accepted; name the owner's terminal.
- Enable PreToolUse decision mode only for Claude Code, not CLIs reusing its script.
- Decode Amp tool.call/tool.result, Copilot envelope/implied events and Cursor shell/MCP calls.
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: regenerate the testing bundle on the rebased tool hooks
Generated file only (lint-staged's oxlint refuses a commit with no lintable files).
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
|
||
|
NeilandClaude
|
60d262ebee |
feat(plugins): hooks for agent launches and prompts, plus plugin dev hook (#37295)
* plugins: agent.launch.before and agent.prompt.before hooks; orca plugin dev hook agent.launch.before runs at the PTY spawn every agent terminal goes through (window tabs, runtime/CLI agent launch, automations, orchestration), before dispatch to its host: change the command line, add env (Orca's own ORCA_* variables and the agent's environment stay hidden), or deny. Restores and resumes are not hooked. agent.prompt.before runs in sendTerminalAgentPrompt (launch prompts, orchestration dispatch, terminal send to an agent) with the agent named: rewrite or deny. The terminal hooks move into one runtime layer. orca plugin dev hook runs a hook through one dev plugin and prints the decision. Co-Authored-By: Claude <noreply@anthropic.com> * plugins: recheck rewritten launch commands, forward hook env to WSL, keep prompt delivery outside the hook order - A command agent.launch.before rewrote passes the AI Vault resume check again on both spawn paths. - Variables a hook adds are named in WSLENV on Windows so WSL agents get them. - agent.prompt.before holds the terminal's order only while it decides; a delivery waiting on a permission answer no longer blocks later input. Co-Authored-By: Claude <noreply@anthropic.com> * plugins: plugin dev hook honours onError: deny Co-Authored-By: Claude <noreply@anthropic.com> * plugins: regenerate the testing bundle and skill guides on the rebased hooks Generated files only (lint-staged's oxlint refuses a commit with no lintable files). Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
NeilandClaude
|
ac8c1125f0 |
feat(plugins): hooks that can change or block terminal sends and workspace creation (#37287)
* plugins: contributes.hooks runtime with terminal.send and workspace.create hooks
Workers register orca.hooks.on(hook, (event, next) => ...). Orca runs listed
plugins in order before it acts: next(event) continues with allowed fields
changed, { deny } stops, nothing passes. A plugin past its 2 s deadline, or
one that throws, crashes or is disabled, counts as passing and is logged with
plugin, hook and duration. First hooks: terminal.send (runtime sendTerminal),
workspace.create.before (IPC and runtime creates, folders included) and
observe-only workspace.create.after. orca/testing mountWorker gains
hooks.fire. Needs main + trusted-worker and engines.orca >=1.4.248.
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: keep hook plugins' workers started; bound start-up separately from the hook deadline
Workers of enabled plugins that list hooks start as soon as they are approved
and are never idle-reaped; crash restarts follow the manager's policy. A hook
waits up to the worker ready timeout for start-up, then gives the handler its
full 2 s, so a cold worker no longer lets the first hooked action through.
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: give hook workers their own soft cap instead of the active-worker cap
Always-running hook workers no longer hold slots of the shared 5-worker cap, so
many hook plugins cannot starve the rest. They have a soft cap of 16; past it a
hook worker waits for another to stop, logged once.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(plugins): type the hook warmer's ensureWorker mock
* plugins: address hook review: ordering, human input, overflow, revalidation, folder creates
- Hook workers past the soft cap start as overflow (logged once) instead of
waiting, so reconciliation, disable and uninstall never hang.
- Writes to one terminal stay in order while terminal.send decides, so a later
Enter cannot submit the previous line.
- terminal.send runs only for programmatic sends (main, plugins, the CLI);
desktop, mobile and legacy client input is a person's typing.
- Text a hook rewrote passes the AI Vault resume check again.
- Project-group folder workspace creates (RPC, agent launch, window) run the
workspace.create hooks through one boundary.
- A decision from a plugin disabled or changed while it ran is discarded.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(plugins): drive hook start-up timing with fake-timer deferreds, no real sleeps
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: only the hook decision holds a terminal's write order
A delivery that waits (a permission prompt, the launch composer) no longer
blocks later writes, and a person's input, interrupts and query replies never
wait behind a pending decision.
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: hook DX: onError deny, denied_by_plugin, a Hooks reference, --template hook
- contributes.hooks[].onError: "deny" makes a throw, timeout, crash or bad
answer refuse the action, naming the plugin; the default still passes.
orca/testing mountWorker honours it, and mockHost answers fire-and-forget
methods (result { ok: true }) with success by default.
- A plugin denial reaches RPC clients as denied_by_plugin with the plugin and
reason, and the CLI no longer suggests a retry for it.
- The skill's host-api reference gains a generated Hooks section (event, what
next may change, stop result); the recipe passes sends through unchanged and
warns against awaiting other calls before deciding.
- orca plugin create --template hook: a worker-only terminal.send guard that
fails closed, with a test.
Co-Authored-By: Claude <noreply@anthropic.com>
* plugins: regenerate hook docs on main; bind the plugin runtime and its hook runner in one call
Keeps main-process-plugins.ts under 300 lines now that status bar items landed.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
|
||
|
Neil
|
a9b1041ecc |
feat(plugins): status bar items plugins can update live (#37291)
* plugins: contributes.statusBarItems with worker updates (statusBar.update)
A plugin declares status bar items { id, text?, icon?, tone?, tooltip?,
command? } (declarative profile, engines >=1.4.247); pressing one runs
its own command. A trusted worker changes them with the new worker-only
host method statusBar.update; main keeps the session's changes and
pushes snapshots to desktop windows over plugins:statusBarChanged.
Regenerates schemas, references, typings and the authoring skill.
* plugins: statusBarItems ship in 1.4.248, beside contributes.hooks
* plugins: clear a plugin's status bar changes when it is disabled, removed or updated
* plugins: list status bar items in the plugin page's Adds section
* plugins: count statusBarItems' since in the host's newest readable version
* i18n: add the plugin page's status bar row label to en.json
* plugins: status bar items respect workspace commands, dev reloads and catalog summaries
- An item whose command needs a workspace is disabled with no open workspace.
- A dev code edit (new devRevision) drops the old worker's status bar changes.
- Catalog summaries list status bar items, and marketplace details show them.
* plugins: authoring skill lists status bar items as buildable; approval lists them
The skill no longer calls status bar items reserved and gains a row for them. The
dev-load/inspect approval already lists them via the contribution summary; a test pins
that and the fingerprint binding.
* chore(plugins): regenerate the testing bundle after rebasing on main
|
||
|
Neil
|
4a0ee07bd2 |
feat(plugins): orca.document.session() for custom editors (#37285)
* feat(plugins): add orca.document.session() for custom editors One call replaces the document sync every editor rebuilds: decode/encode (plain text by default), optional merge, debounce. One edit in flight with later changes coalesced; the baseline moves only on accept; a refused edit keeps the draft and rejects flush(); own accepted edits never reach onReplace; a conflict merges once against the last accepted value and resubmits, or keeps the draft without merge. The session answers editor.flush itself and resolves after hello and the first document. The --template editor now uses it. Docs and typings state the session and the undo model (the editor owns undo). * fix(plugins): let the outside document win a session conflict without merge Agents write files while people edit them, so keeping the draft lost the agent's write on the next keystroke. Without merge the session now drops the draft, fires onReplace with the outside value and rejects flush() with conflict; editors that want both sides pass merge. * fix(plugins): serialize session edits through saves and settle before answering - One edit in flight at all times, saves included; editor.flush is answered only once every change is accepted or refused with nothing newer to send. - The editor host commits a held edit when a save starts and admits edits during the save at once, so waiting fits the 1 s deadline. - A change generation replaces identity checks, and sent bytes are snapshotted, so a reused buffer is never mistaken for an accepted edit. - A waiting flush keeps its conflict rejection when the outside document wins, and nothing merges or sends after dispose. * test(plugins): read session test edits through typed helpers * fix(plugins): drain session flushes, reject dropped drafts, snapshot the baseline - flush() keeps going until no change made during it is left unsent. - A waiting flush rejects with conflict whenever the outside document replaced a draft, newer ones included. - The accepted baseline is decoded from the sent snapshot, so a reused value buffer cannot change merge's base. * test(plugins): name the session test option and message types |
||
|
Neil
|
51f302167e |
feat(plugins): let a custom editor require the desktop app's isolated frame (#37298)
* feat(plugins): let a custom editor require isolated frames customEditors[].frame: "isolated" | "any" (default any, since 1.4.248). An isolated-only editor never runs in the srcdoc fallback: main serves its fallback shell without the entry, and when this window has no isolated guest (browser clients, or desktop with isolated frames off) the file opens in Source with "This editor needs the Orca desktop app". Picking the editor shows the same notice with an Open Source button. * i18n: add the needs-desktop editor notice strings * plugins: refresh frame isolation when its setting changes; browser clients open Source - The learned isolated-frames answer is tied to the setting it was learned under, so turning isolated frames back on lets isolated-only editors open by default again. - A browser client's plugin bridge has no list, so the plugin store settles on no plugins instead of erroring and retrying; files open in Source. |
||
|
Brennan Benson
|
54b496cef1 |
fix(cli): open ordinary directories as folder projects (#37232)
* fix(cli): open ordinary directories as folder projects * fix(cli): explain the non-Git layout in the repo add next step |
||
|
Neil
|
5e33efa36a |
fix(plugins): keep custom editor documents in step with accepted edits (#37277)
* fix(plugins): keep custom editor document in step with accepted edits - orca.document.get() returns the content of an accepted applyEdit at the same version, without firing onDidChange; a newer document wins. - onDidChange skips its replay for a subscription disposed before it runs. - The --template editor keeps unaccepted typing when the file changes outside, and shows a refused edit in the frame instead of only logging. - Extract the srcdoc shell mount into a shared test fixture. * fix(plugins): acknowledge custom editor edits only once committed - The host answers a superseded held edit with the answer of the edit that replaced it, and keeps a held edit when an oversized one follows (the save stays blocked), so success always means the buffer has it. - The frame shell copies accepted bytes so a reused buffer cannot change what get() returns. - The editor template settles dirty and its notice only on the newest input's answer. * test(plugins): annotate the frame shell mount fixture's types |
||
|
Kelvin Amoaba
|
245de319d3 |
fix(emulator): report when Xcode Device Hub blocks iOS simulator input instead of a silent ok (#37140)
* fix(emulator): report Device Hub blocking iOS simulator input instead of a silent success * fix(emulator): keep the session backend so the pane input check sees iOS sessions * test(emulator): pin the pane input check to active iOS sessions * fix(emulator): probe Device Hub via process-host and recheck on pane keyboard input * refactor(emulator): use the shared RPC error-code predicate in the pane input check * fix(emulator): key the pane input check on the live stream after the session hook stopped returning session Main's session hook no longer returns session and sits at its line cap, so the pane keys the check on the live preview URL. The iOS-only session check moves into its own module to keep the runtime commands under the cap. |
||
 Brennan BensonandOrca QA
|
c18c358fce |
Keep child-worktree creation in the caller’s project (#35787)
* fix(cli): keep inferred worktree creation in the caller project * Fix caller checkout ranking and creation guidance * Share caller-host containment preparation across CLI selections * Correct Windows CLI fixture syntax and snapshot command * Match worktree fixture output to typed execution hosts * Regenerate bundled workspace placement guidance * Refuse ambiguous workspace ownership and preserve launch replay * Scope runtime filesystem mocks to their aggregate tests * Preserve launch proof semantics under strict test diagnostics * Keep launch proof imports within their compiler project boundary * Consolidate journal cleanup test imports * Adapt launch fixtures to the current host settings contract * Keep the CLI error formatter under the file-size limit Move the selector-ambiguity workspace-choice check into selector-ambiguity-recovery.ts, which already owns that error's recovery text. Behavior is unchanged. * Expect main's concise orchestration output in the workspace-choice CLI tests Orchestration commands now print the one-line failure on stderr and the workspace choices and next steps on stdout (or compact JSON plus the stderr line with --json), and print concise success fields. --------- Co-authored-by: Orca QA <orca-qa@users.noreply.github.com> |
||
|
Kelvin Amoaba
|
ac99f1cb39 |
fix(emulator): list only the worktree's attached emulators, iOS and Android (#37127)
* fix(emulator): scope emulator list to the worktree's sessions emulator list ignored --worktree and returned serve-sim's global iOS helper list. It now lists the session registry's attached sessions (iOS and Android) for the selected worktree, or every worktree's for --worktree all. * fix(emulator): drop stopped devices before listing sessions * fix(emulator): point the no-active hint at emulator devices * test(emulator): assert list results, not serve-sim calls * refactor(emulator): prune stopped devices inside the registry listing |
||
|
Brennan Benson
|
d1665d1b40 |
Add run and skip setup choices to the automation CLI (#36543)
* Allow automation CLI setup choices for new workspaces * Explain automation --setup refusals and read back the saved choice Name why --setup is refused and what to pass, show the setup choice in text output, document --setup in the CLI guide, fail when a host drops the choice, and cover the app-open Terminal dispatch. * Refuse automation --setup on hosts that can't keep it, and fence the edit's mode Explicit --setup now needs the host's new setup-choice capability, checked before any write; commands without --setup are unchanged. An edit whose setup choice relies on the current new-per-run mode sends a mode precondition the store checks against the saved record, so a concurrent switch to an existing worktree refuses the whole edit. Text output shows the saved choice or "not set", the existing-workspace refusal offers a remedy that works for every input, and the after-write readback is gone. * Make the too-old --setup message true for edit and cover a saved setup edit Omitting --setup on edit keeps the saved choice, so the refusal now says to run the command without --setup. A new test saves a --setup run edit through the controller into the store and reads it back after reload. |
||
 Kelvin Amoabaands546126
|
5ea047e34e |
fix(emulator): detect Android devices when only adb is installed (#37128)
* fix(emulator): detect Android devices with only adb installed SDK discovery required both adb and the emulator binary under an SDK root, so hosts with platform-tools only, or a standalone adb such as a distro android-tools package, saw no Android devices at all. Discovery now needs only adb, falls back to adb on PATH, and AVD listing and boot are skipped when the emulator package is missing. Fixes #32126 Co-authored-by: s546126 <268420947+s546126@users.noreply.github.com> * test(emulator): drop type assertion in adb-only inventory test --------- Co-authored-by: s546126 <268420947+s546126@users.noreply.github.com> |
||
|
Neil
|
af6dabd70b |
feat(plugins): orca plugin shot --scenario replays a check scenario; dev watch shot pendingRequests (#37090)
- shot <key|dir> --scenario <name> renders the panel in that check scenario through the check runner (a separate Node process on a mock host and mounted worker), sends the validated drawn tree to a new plugins.shotReplay, and captures it in a throwaway preview surface: no guest, no live host, no real storage or settings, no real worker, images as placeholders. Window hidden or minimized only; --act, --environment and bridged shells refused; an older host answers method_not_found (runtime_unsupported) rather than doing a live shot. - dev watch's shot event carries pendingRequests. |
||
|
Jinwoo Hong
|
225db8cfb2 | Hide no-action attention in concise worker views; say kept-open workers stay open (#36963) | ||
|
Neil
|
dfbaa2fc29 |
Plugin shots wait for the worker and restore after --act; terminal approval prompt (#37066)
* feat(plugins): dev watch asks for first-load approval in a terminal; acronym-aware names
- In an interactive terminal without --json, a first dev watch load that needs approval shows
the grants (as plugin inspect prints them) and asks Approve and load? [y/N]; yes reloads with
the host's fingerprint and keeps watching. --json and non-TTY runs keep the exit-3 flow.
- create keeps known acronyms uppercase when it derives a name from the id (pr-queue → PR Queue).
* fix(plugins): a declined dev watch approval prints only the re-run command
The person just read the grants in the prompt, so the exit-3 error no longer repeats them:
Not approved. To approve later, run: <command>.
* feat(plugins): shots wait for the worker; --act restores the panel; Table and Tree acts
- A shot settles once the panel has no plugin.request or host call in flight and no new tree for
a quiet spell (capped at 3 s), so a cold worker's skeleton is not captured; pendingRequests
reports what was still pending.
- After --act and the capture, the guest restores every plugin-written atom it had before (new
ui.snapshot/ui.restore; persisted atoms re-persist) and Orca remounts its drawn controls;
restored: true|false. Worker-side effects are not rolled back.
- --act gains the kit's slide, sort, selectRows, activateRow, loadMore, expand, collapse,
selectItem and activateItem.
- Docs: the dev watch first-load prompt; shot settle, restore and the new verbs.
* fix(plugins): a shot waits for the theme repaint and retries a bare capture
Linux CI captured a dark --theme shot as a bare background (2 colors). The renderer now waits
until the document shows the asked color scheme and paints, adds a frame after a --width
resize, and main recaptures a panel image that is still a background and a border (two colors
or fewer) up to 8 times, 150 ms apart, before returning it. Html panels keep their guest
composite.
* fix(plugins): capture the main window with stayHidden
webContents.capturePage(rect, { stayHidden: true }) keeps a hidden window rendering for the
capture, as the components gallery screenshots do. The repaint wait stays, and the bare-capture
retry stays as a fallback.
|
||
|
Neil
|
ce8ea081c0 |
Plugin check shows what drew; responsive Table columns; quieter Table and Stack (#37062)
* plugins: check shows what drew; responsive Table columns; quieter Table and Stack
- orca plugin check: each scenario result carries a summary (headings,
callouts, empty states, table and tree sizes, the selected tab, loading
placeholders, danger/warning text), printed under its line, and --json
adds the drawn tree. dev watch's check event keeps only the summary.
orca/testing gains panel.summary().
- Table columns take minWidth (floor for an auto column) and hideBelow
('sm' 360px, 'md' 480px), measured on the table itself; at least one
column stays. Cut-off cells and headers show their text on hover. The
kit's columnsOf(table, { width }) answers which columns fit.
- The active-row ring shows only while the grid has keyboard focus.
- A Stack with no align keeps buttons at their own width while fields,
tables and cards still fill it; align='stretch' stretches everything.
- Typings, docs, the skill's workflow reference, regenerated references;
the gallery's Kind column drops out in a narrow sidebar.
* plugins: check can render one scenario and return its drawn tree
For orca plugin shot --scenario (tree replay): checkPluginPanels takes
{ panel, scenario, drawnTree }, and with drawnTree returns each render's
validated tree exactly as Orca draws it (handlers as { $callback }),
re-validated on the CLI side. An unknown scenario is reported as an issue.
readPluginCheckScenarioNames(dir, entry) lists a panel's scenarios by
loading its .check file without mounting anything.
|
||
|
Neil
|
459745d9a4 |
fix(plugins): workspace.changed replays the current context on subscribe (#37044)
A panel that loaded before Orca focused a workspace showed nothing until the next change, and a
subscription made before the panel's push channel opened was never told at all. Now each new
subscriber gets the current context first: the panel bridge replays it once the channel is
open (or right away), and a worker's events.on('workspace.changed') reads it through
workspace.readContext. Unit tests for both, and the agents e2e checks the first event arrives
with no change happening.
|
||
|
Neil
|
2666bbddbe |
Plugin dev loop: dev request, shot --act, worker-panel template, output polish (#37049)
* feat(plugins): orca plugin dev request; --template worker-panel - orca plugin dev request <dir|key> <name> [--data] [--panel] [--timeout-ms] calls a dev plugin's orca.panels.handle handler through the real panel bridge (plugins.devRequest) and prints the answer; handler errors become plugin_request_failed with the worker's code. - orca plugin create --template worker-panel scaffolds a build-less trusted-worker plugin: a components panel, src/worker.ts, a shared src/protocol.ts contract, and panel and worker tests that pass under orca plugin test and type-check with tsc. * feat(plugins): shot --act, shots in the plugin folder, quieter logs - orca plugin shot --act '<json>' presses, types, selects and toggles in the live components panel (the test kit's queries and acts, through Orca's own controls and onEvent) before the capture, waiting for each to settle. Only that plugin's panel, only with Orca's window hidden or minimized; html panels refused; acts are not user gestures. Results in actions[]. - shot run inside a plugin folder defaults to its .orca/shots, like dev watch --shot. - dev watch prints identical [frame] lines once per reload with a count; logged stacks drop <anonymous>/native frames; the floating workspace button hides during a capture. - Skill: worker-panel template in the decision table, dev request, shot --act, and a gotcha that a worker save drops its in-memory state. |
||
|
Neil
|
8503ecda71 |
plugins: check runs the worker and scenarios; RelativeTime (#37047)
- orca plugin check mounts the plugin's worker (main) on the same mock host
as each panel, so plugin.request reaches its orca.panels.handle handlers
as in Orca; a worker that fails to activate or deactivate is an issue
named after its file. In orca/testing, a worker mounted on a host answers
that host's panel requests unless `requests` stubs the name.
- Check scenarios: <entry>.check.ts (e.g. src/panel.check.ts) exports
defineCheck({ name: { ...mockHost options, persisted, theme, events } });
check renders the panel once per scenario and labels each result.
- RelativeTime (catalog 3, since 1.4.247) and { type: 'relative', at } Table
cells: Orca ticks them (each second under a minute, then less often), so
plugins never poll. Inline inside Text; test kit reads them as drawn.
- Typings, docs, skill guide, generated references; gallery shows it.
|
||
|
Neil
|
a37a5b3e2d |
Plugin dev emit reaches panels; trim the plugin authoring skill (#37026)
* feat(plugins): dev emit also reaches the plugin's open panels orca plugin dev emit now publishes through the panel bridge to that dev plugin's open panels that subscribed with orca.on, under the same approval and capability rules as the worker, and reports delivered.panels. The bridge's publishEvent takes an optional pluginKey filter and returns how many panels heard it. A panel-only plugin no longer needs a worker; an event nothing listens for is refused. * docs(skills): trim the plugin authoring guide; details move to references The main guide drops from 299 to 121 lines: the decision table, build-less rules, core loop (create → dev watch --check --shot → read the PNG → test → check → release-entry), approval and top gotchas. Test/check and orca/testing (panels and workers), dev watch events, shot, open and dev emit move to a hand-written references/workflow.md; the panel/worker/data and agent status recipes to references/recipes.md, each with a read-when row. The guide test now also scans hand-written references for commands and caps the main guide at 150 lines. |
||
|
Neil
|
e5b87cb8e6 |
Components catalog 2 and worker tests: forms, tabs, table, tree, markdown, code, images (#36997)
* plugins: components catalog 2 (forms, tabs, table, tree, markdown, code, images)
Adds 18 components to TSX components panels, drawn with Orca's own
primitives and gated by ui.catalog 2 / ui.has() (Orca 1.4.247):
Textarea, Checkbox, RadioGroup, Slider, Field, Tabs/Tab, Collapsible,
Toolbar, Grid, a virtualized Table with sort, selection and pull-based
paging, a keyboard Tree with lazy children, Markdown (sanitized, links
through the checked open path), CodeView (Orca's highlighter), Image
(header-checked plugin files read by main), KeyValue, Callout and
Skeleton, plus a tooltip prop on Button and IconButton.
Value controls share the edit protocol; handlers get plain JSON event
args, including small objects ({ keys }, { key, expanded }). The test kit
gains matching actions and hides unselected tabs and closed collapsibles;
a components-gallery example and e2e cover the catalog end to end.
* plugins: worker test harness, host refusals in tests and check
- orca/testing gains mountWorker(main, { host, events, commands }): it calls
the default-exported activate(orca) with the orca object Orca itself builds
(createPluginWorkerOrcaApi, moved to shared so the kit reuses it), backed by
mockHost. emit() checks payloads against Orca's event schemas and only
delivers subscribed events; command(), request() (the worker's
orca.panels.handle, as a panel's plugin.request), posts, logs, refusals and
deactivate(). Storage and settings share the mock host's in-memory store.
- orca plugin test loads a worker main's module graph as Orca's worker host
does (.ts/.mts transform, Node resolution, no runtime orca import).
- mockHost records refusals (capability_denied, not_permitted, ...) even
when plugin code catches them; panel.refusals exposes them and
orca plugin check reports them as warnings. Check dedupes repeated issues.
- Typings, docs and a generated references/testing.md skill reference; the
reference generator reads the split orca typings.
|
||
|
Neil
|
1392c8e894 |
Plugin dev loop: orca plugin open/shot, dev emit, and dogfood fixes (#37008)
* feat(plugins): orca plugin open and shot; dev watch --shot - orca plugin open <key> [--panel|--editor] shows a panel in the right sidebar or a file in the plugin's custom editor, by changing renderer state only (no focus or window raise). - orca plugin shot <key> [--panel] [--theme] [--width] [--out] [--json] waits for the panel's current code to draw, then crops webContents.capturePage to the panel (html guests included), with background throttling off while hidden. --width and --theme are temporary in-memory overrides; the PNG returns base64 (5 MiB cap), so --environment works. - dev watch --shot <dir> writes a PNG per panel after the load and each good reload. - The authoring skill's loop is now dev watch --check --shot → read the PNG → plugin test. * fix(plugins): shots never disturb a visible Orca - shot --theme is skipped while the Orca window is on screen (themeApplied: false with a themeReason); the override applies only to a hidden or minimized window. - dev watch --shot opens the first panel (or --shot-panel <id>) once, then shoots it with ifShown: if the user moved the sidebar away it emits one shot_skipped instead of switching. * fix(plugins): dev loop dogfood fixes; orca plugin dev emit - dev watch: approval re-run command drops watch-only flags and old --approve; a folder added by a refused load is owned by the next approved load (Ctrl-C unloads it); check events carry the plugin's status (no green while pending/errored); reloaded prints before that reload's logs; --json errors are one NDJSON line. - Errors: log, banner and check share source-mapped positions (a line-1 prelude hands sucrase mappings to the components runtime); check dedupes issues and locates syntax errors; Orca runtime frames and the error module's bogus location are dropped from logs. - .orca/types tsconfig sets preserveSymlinks (tsc 7 loaded typings twice under /tmp). - Templates' READMEs use dev watch. - orca plugin dev emit <dir|key> <event> [--data] sends a test event to a dev plugin's worker through the real delivery rules (plugins.devEmit). * test(plugins): fixed timestamp in the dev emit test * fix(plugins): shot captures an html panel's guest itself On Linux the main window's capturePage leaves a <webview> guest blank. The renderer now reports the guest's rect, and main captures the guest's own webContents and draws it over the window capture at that rect (raw bitmaps, nativeImage only). Components panels are drawn by the host, so the window capture alone stays right for them. * refactor(plugins): keep plugin-service and main-process-plugins under max-lines After rebasing onto #37013 both files crossed 300 lines. The guest log sink moves into the desktop view binding (bindPluginDesktopViews), and plugin-service tightens emitEvent and its event-delivery imports. |
||
|
Neil
|
ec0d3cedd1 |
Plugin panels talk to their worker; panel storage, settings and agent events (#37013)
* feat(plugins): panels talk to their own worker, read storage, settings and events
- plugin.request (host API 1.2): a panel or editor asks its plugin's worker, which answers with
orca.panels.handle(name); the worker pushes with orca.panels.post. Same plugin only, JSON
checked, 1 MiB answers, 256 KiB/200-per-10s posts, a deadline and the panel's lifetime.
- Panels and editors get storage.*, settings.* and secrets.* behind the same capabilities, and
storage/settings onDidChange on every surface; events.subscribe delivers workspace and agent
events to panels that hold the read capability.
- contributes.settings: typed settings (a JSON Schema subset) with defaults and value checks.
- Frames get orca.plugin/storage/settings/secrets; components panels import plugin, storage,
settings, secrets from 'orca', and atom(key, init, { persist: 'storage' }) shares a value with
the worker. Workers get orca.panels/storage/settings/secrets sugar.
- One typed contract: declare module 'orca' { interface PluginRequests / PluginPanelEvents }.
- Desktop push channel per open panel session (plugins:openPanelPush).
* feat(plugins): Orca Settings shows and edits a plugin's contributes.settings
The plugin page lists declared settings with Orca's own controls (switch, picker, text and
number fields, Reset to default). Edits are checked against the declaration in main, written to
the plugin's settings, and reach open panels and the running worker through onDidChange.
* docs(plugins): hello-tsx talks to its worker; authoring guide covers panels, workers and data
The example now uses one of each: plugin.request answered by orca.panels.handle, a worker post
heard with plugin.on, a persist: 'storage' atom the worker watches, two contributes.settings and
agent.status.changed in the panel, all typed by one src/protocol.ts. The build-less TSX e2e
drives the whole loop.
* fix(plugins): typed bridge overloads, panel call budget, settings IPC and catalog keys
- PluginBridgeApi/PanelsApi use overloads: declared names are typed (and complete), any other
name carries JSON; no never-unions for the type-aware lint.
- The per-plugin panel call budget is 120 per 10 s, since a panel loading storage atoms,
settings and its first requests makes a burst; the hostile fixture floods past it.
- Settings IPC builds its host per call; the settings section's strings are in en.json.
* test(plugins): the example's declared settings show under the plugin with the person's value
* refactor(plugins): keep hello-tsx the minimal starter; the bridge demo is hello-worker-panel
hello-tsx goes back to a sandboxed-ui panel with no worker or capabilities. The worker, protocol,
storage atom, settings and events move to examples/plugins/hello-worker-panel, with their own
e2e (plugin-worker-panel) and PR route.
* feat(plugins): test kit covers the panel bridge and plugin data
mockHost keeps the plugin's storage, settings and secrets in memory (seeded with storage,
settings, secrets; read with host.data()) and fakes the worker with requests, so plugin.request,
storage/settings/secrets and persist: 'storage' atoms work under mount(), writes reach
onDidChange, and panel.post(event, payload) is what plugin.on hears. Typed by PluginRequests and
PluginPanelEvents.
* test(plugins): focusInGuest waits for the guest and retries focusing as one step
Under load the custom-editor guest could still be attaching, so executeJavaScript threw
'dom-ready' before the focus poll began. Wait for waitForGuestReady, then retry focusing the
webview and the element together, tolerating a guest that is still attaching or remounts.
* docs(plugins): the authoring skill covers panels, workers and data; persistence leaves the renderer
- skill-guides/orca-plugin-authoring.md gains Panels, workers and data (plugin.request/on,
orca.panels.handle/post, persist: 'storage', contributes.settings, panel events, test kit), and
its generated references read orca-services.d.ts for shell, files, on and the bridge types.
- After the dev-loop rebase, persisted-atom wiring (queue plus storage sync) moves to
createDeclarativePersistence so the renderer stays under max-lines.
* feat(plugins): panels show agents: agents.list, terminal ids on agent events, workspace.changed
- agents.list (agent:read, every surface): the focused workspace's agents with terminalId,
title, agent kind, state and stateStartedAt, from the hook server's store.
- agent.status.changed carries terminalId and title: paneKey mapped through the runtime's
terminal list (tabId:leafId) or the status's terminal handle; looked up only while a plugin
listens, in arrival order.
- workspace.readContext terminals carry title; workspace.changed (workspace:read) fires after
workspace session writes when the focused workspace or its terminals change.
- Event subscriptions are kept per panel session, so one made before the push channel opens
still counts.
- shell.openExternal never prompts on a hidden or minimized window: it settles
{ opened: false, reason: 'consent-unavailable' } and says so in the plugin log, which also
notes 'waiting for the person to confirm' while a prompt is up; the rate budget is spent only
when Orca acts. e2e launches never open a real browser or mail client.
- A worker may export activate as default or by name; docs, typings and the authoring skill
document the entry, the agent events and a live agent status recipe.
* fix(plugins): the plugin page names the workspace.changed subscription
* fix(plugins): workers activate only by default export, and say so when it is named
Orca calls the worker module's default export. A module with a named `activate` and no default
now fails to start with an error naming the fix (`export default function activate(orca)`),
instead of being called by a fallback; docs, typings and the skill say default export.
hello-worker-panel gains a picker setting (suggestionOrder) the worker reads.
|
||
|
Neil
|
b17d408416 |
Plugin dev loop: TS workers, hot reload with state, orca plugin dev watch, authoring skill (#36982)
* feat(plugins): build-less TypeScript workers A worker's main may be .ts/.mts. The plugin host installs module.registerHooks scoped to the plugin folder: .ts files are transpiled with the frames' sucrase options (lines kept, inline source map, source maps on), relative imports fall back to the frames' candidate files, and a value import of the type-only 'orca/worker' fails with a clear error. Needs engines.orca >=1.4.246. * feat(plugins): components panels hot reload with their state - In dev folders a save swaps only the hidden guest: keyed memory atoms are handed to the new guest (ui.retain → ui.hydrate memory), dropped when an atom's version changes. - A save that fails to load keeps the last good render and shows an inline file:line:col error banner; the next good save clears it. A subtle Reloaded mark follows a reload. - Transpile and import errors carry line and column; dev worker restarts keep storage. * feat(plugins): orca plugin dev watch One command for the inner loop: refreshes .orca/types, dev-loads the folder, follows its frame and worker logs (plugins.getLogs gains an optional cursor), prints reloads (optional devChangeCount on list entries) and status changes, and unloads on Ctrl-C. --json streams NDJSON events for agents. * feat(skills): orca-plugin-authoring bundled skill guide A guide for agents to build Orca plugins end to end (decision table, build-less rules, the dev watch loop, test/check, validate, release-entry, approvals, gotchas) with references generated from the component catalog, host API table, event schemas, manifest schema and CLI specs, checked for drift. Fixes the components template's Reset to set(count, 0). * feat(plugins): orca plugin dev watch --check; test kit details in the authoring skill - --check runs orca plugin check after the load and after each reload (one at a time; saves made meanwhile fold into one rerun) and prints each panel's render or errors inline, as a `check` event with --json. Local folders only, since it runs the plugin's code here. - The orca-plugin-authoring guide's Test and check section now documents orca plugin test and check from #36969 exactly (JSON results, exit codes, test placement, the orca/testing kit and its common mistakes), and the loop uses dev watch --check. * refactor(plugins): move the components renderer's timing and helper constants to their own module |
||
|
Neil
|
531658f1d1 |
Plugin test kit: orca/testing, orca plugin test and orca plugin check (#36969)
* feat(plugins): orca/testing kit, `orca plugin test` and `orca plugin check` - `orca/testing` mounts a components panel in plain Node (node:test, vitest, bun) with the real runtime and Orca's own tree validator: find by text/role/label/testId, press/type/submit/toggle/ select that resolve once the panel settles, tree() snapshots, errors (with stacks) and warnings, persisted state (with stored() for migrations), emit/setVisible/rerender, and unmount running setup cleanup. It re-exports node:test and strict assert so tests type-check without @types/node. - mockHost refuses what Orca refuses with the same codes (surface, capability from the manifest, params, a gesture method without a press), checks configured results against the host API, and records calls. - `orca plugin test [dir]` discovers *.test.ts(x) and runs them with node:test through Node module hooks that resolve `orca` like the guest's import map and transpile/resolve sources exactly as Orca's build-less loader, or with the plugin's own vitest via a generated config. - `orca plugin check [dir]` validates, then renders each components panel once and reports what it threw (file:line), layouts Orca would refuse, and props it would drop. - The kit, hooks and register entry ship minified beside orca-runtime.mjs and are unpacked from asar; typings land in .orca/types/orca-testing. The components template and hello-tsx get sample tests. - ui.error carries an optional stack; a new runtime starts every atom from its initial value; the hydration fallback timer is cleared once hydrated. * plugins: run plugin test/check on a system Node or Orca's own, and warn they are unsandboxed * test(plugins): run the shipped example plugin tests from the unit suite |
||
|
Neil
|
4ee788a725 |
Build-less TS/TSX plugins, typings and authoring tools (#36918)
* feat(plugins): build-less TS/TSX plugins, typings and authoring tools - Plugin frames transpile .ts/.tsx/.mts/.jsx on load (sucrase on a shared worker thread with a 2 s budget, cached in main), resolve relative imports to exact files, and refuse bare package imports by name. Components and html panel/editor entries may be .ts/.tsx. - orca plugin types writes typings for the components orca module, window.orca, worker activate(orca), host.call and events into .orca/types, from one host-typings generator. - orca plugin create --template components; templates omit publisher and target 1.4.246. - orca plugin release-entry, dev inspect and restart; validate:plugin checks named files. - Guest console errors reach orca plugin logs; dev workers restart on edits; the dev watcher ignores .git, .orca and node_modules; Git and folder installs cannot replace catalog installs. - examples/plugins/hello-tsx, docs, and the plugin-buildless-tsx e2e spec. * ci: run the Windows parity probes with one tsgo checker tsconfig.node peaks near 22 GB with tsgo's default four checkers (each holds its own types) and about 16 GB with one; the 16 GB Windows runner paged the native probe past its 900 s timeout once this branch's package.json change triggered the job. One checker gives the same diagnostics (verified locally with --parity-only); the timing benchmark is unchanged. |
||
|
Jinwoo Hong
|
0668ba1a33 | Orchestration: fix agent instructions that misdirect workers and coordinators (#36803) | ||
 NeilandJustas Brazauskas
|
5913998402 |
fix(plugins): wire the plugin service on a headless serve, and turn plugins on from the CLI (#36838)
* fix(plugins): wire the plugin service on a headless serve, and turn plugins on from the CLI * test(plugins): build the switch test's RPC context inline after main dropped the shared helper --------- Co-authored-by: Justas Brazauskas <brazauskasjustas@gmail.com> |