mirror of
https://github.com/stablyai/orca.git
synced 2026-11-14 09:57:48 +00:00
e4d07cf93772611d8c3c19faadabd6045965a6bf
211
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Neil
|
18bab90efa |
refactor(main): group client RPC pairing and host runtime owners (#38584)
* refactor(main): group client RPC pairing and host runtime owners * test: target concrete mobile notification owner in headless fixture * test: retarget dynamic quit mocks to runtime metadata owner |
||
|
Neil
|
1f3648cc95 |
refactor(runtime): group workspace creation and lifecycle owners (#38534)
* refactor(runtime): group workspace lifecycle and creation owners * refactor(runtime): consolidate relocated test imports |
||
|
Neil
|
87788aeae5 |
refactor(runtime): group terminal execution owners (#38517)
* refactor(runtime): group terminal execution owners * fix(tooling): retarget terminal ANSI consumer owner |
||
|
Neil
|
6bb2e13c35 |
refactor(tooling): organize remaining scripts by domain owners (#38407)
* refactor(tooling): group remaining scripts by concrete domain owners * fix(tooling): preserve relocated launcher resource roots |
||
 Brennan Benson
|
318f543293 |
fix(agents): paired-host agent tabs use the host's launch settings (#38301)
* fix(agents): paired-host agent tabs use the host's launch settings Agent tabs opened on a paired host were replacing that host's permissions and Arguments with the desktop's settings. Let the host plan fresh launches, carry the user's choices separately, and preserve existing prepared launches when an older host cannot express them. Action Arguments replace configured Arguments while inheriting the host's permission settings; resumed sessions keep their recorded recipe. * fix(agents): paired-host agent tabs use the host's launch settings Preserve per-launch permissions on older paired hosts by compiling picks they cannot apply from their own settings. Keep authored Arguments separate from saved model defaults so a command's pinned model wins. Use the host's reported shell and execution platform for argument quoting, and remove unused prompt-delivery wrappers. * fix(agents): paired-host agent tabs use the host's launch settings Replace recognized permission flags from older paired hosts when a launch picks another permission, while preserving unrelated Arguments and ambiguous prepared launches. Keep multiline drafts working on Command Prompt hosts and omit chat-only permissions from terminal requests. * fix(agents): paired-host agent tabs use the host's launch settings Preserve per-launch permission choices that suppress the paired host's Full access flag even when the choice emits no flag itself. Compile these choices from the host snapshot when older launch preferences cannot carry them, while keeping unsupported OpenCode terminal permissions filtered out. * test: merge duplicate imports in paired launch options test * test: drop type assertions in paired launch options test * chore: lower focus-read ratchet baseline after removing creation wrappers * fix(agents): paired-host agent tabs use the host's launch settings Keep accepted inline fork drafts delivered when their mirrored tab is unavailable, and cancel launches whose pairing changes during negotiation. Keep action Arguments metadata on the tab route so injected workspace launch callbacks retain their contract. Update consumer fixtures to run lazy compatibility preparation and verify the final launch inputs and cancellation boundary. * fix(agents): paired-host agent tabs use the host's launch settings Keep pairing changes during legacy launch preparation silent and preserve the prompt for retry. Make picker tests exercise structured model picks on modern hosts while retaining prepared-command coverage for older hosts. * fix(agents): paired-host agent tabs use the host's launch settings A permission pick on an older paired host could turn desktop-configured Arguments into a launch override, including the desktop's model. Keep settings-seeded text out of the paired picker request so the host snapshot supplies defaults, while preserving explicitly edited launch Arguments. * fix(agents): paired-host agent tabs use the host's launch settings Keep permission-control choices separate from Arguments the user edited. Fresh paired terminal launches now share that ownership projection in the new-tab picker and continuation dialog, so a control change preserves the host's executable and environment settings. Explicit Arguments edits, including clearing the field, keep their existing launch behavior. Cover old-host and modern requests, explicit terminal/chat edits, and the continuation Start handler. Workspace creation keeps its existing path. * fix(agents): paired-host agent tabs use the host's launch settings Older paired hosts could inherit the desktop's model and permission defaults when the launch picker was configured or reopened. Read picker defaults and prepared launch recipes from the executing host, and compile edited Arguments using its settings. Preserve explicit empty edits, narrower permissions and draft prompts. Keep inherited choices neutral while host settings are unavailable, retaining the existing compatibility launch when no usable host recipe exists. * chore: merge duplicate type import and drop dead test branch * fix(agents): paired-host agent tabs use the host's launch settings Actions with explicit permission choices could unnecessarily read host settings and fall back to desktop preparation when those reads failed. Keep representable action Arguments on the host's authoritative launch path, and read inherited permissions only when the action needs them. Cover an explicit empty Arguments override and Ask with unavailable settings, preserving the host executable and environment without a permission bypass. * fix(agents): paired-host agent tabs use the host's launch settings Supply the paired host's default agent in the shortcut test instead of assuming the desktop's default applies. Keep a conflicting desktop default so the shortcut continues to verify the paired host owns its selection. |
||
|
Neil
|
9bd6272fdf |
refactor(tooling): organize build, CI, and test owners (#38130)
* refactor(tooling): organize test runtime and maintenance owners * test(tooling): preserve relocated runtime fixture dependency edges * refactor(tooling): preserve xterm routing owner checks * ci(tooling): include routing owner in sparse checkout * test(tooling): preserve copied workflow dependency closures * fix(tooling): normalize hashed JSON assets in release parity * fix(tooling): distinguish asset aliases from literal references * fix(tooling): frame normalized asset reference payloads * fix(tooling): normalize decoded JSON asset references * refactor(tooling): organize build, CI and release owners * fix(tooling): align moved generator and workflow path contracts * fix(tooling): update generated plugin bundle owner banners * test(tooling): create relocated mobile verifier fixture directories * test(tooling): copy headless detector dependency closure * test(tooling): align native batch policy fixtures with owner path * fix(tooling): link moved reliability command to historical evidence * fix(tooling): preserve nested sandbox owners and canonical guide source * fix(tooling): target release version owners in checkout fixture |
||
 Kelvin Amoaba
|
5231abe592 |
test(cross-version): accept the moved terminal stream protocol in release checkouts (#38270)
v1.4.249 is the first release with the reorganized src/shared layout, so the checkout wire-surface check rejected it and every baseline suite failed to extract. Module imports already resolve moved files by name. |
||
  
|
8de79e7ba0 |
Use the shared agent picker for Automations (#37941)
* Use the shared agent picker for Automations Preserve sparse authored launch settings and full Arguments through the existing Automation owner, copies, and host launch compiler. Keep legacy writers and supported mixed-version launch routes intact. Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com> Co-authored-by: Andy Zhang <hiandyzhang@gmail.com> * Align the new launch-settings translations with the catalog * Preserve automation launch choices through editor changes * Use supported legacy arguments in the editor regression * Keep automation edits controlled until Save * Compose automation launch edits by their authored sources Preserve controlled raw input, cumulative source retirements and agent reset intent through destination changes and Save. Merge only the authored extent into the latest automation. Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com> Co-authored-by: Andy Zhang <hiandyzhang@gmail.com> * Preserve pending automation arguments across agent changes Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com> Co-authored-by: Andy Zhang <hiandyzhang@gmail.com> * Preserve automation source order and unchanged picker rows Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com> Co-authored-by: Andy Zhang <hiandyzhang@gmail.com> * Keep picker Arguments stable until acceptance * Preserve Chat import and capability regression inputs * Exercise explicit picker acceptance in retained form tests * fix: preserve legacy-only automation copies across host changes * Use canonical automation validation and one host capability observation --------- Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Courtenay <1909814+hdsheena@users.noreply.github.com> Co-authored-by: Andy Zhang <hiandyzhang@gmail.com> |
||
|
Brennan Benson
|
974bb4a7ca |
Preserve chat inputs through uncertain delivery and Stop (#32267)
* Give unconfirmed chat messages explicit recovery actions * Resolve receipt settlement code quality findings * Complete recovery copy localization and callback types * Align send lifecycle contracts with explicit recovery actions * Include the unconfirmed opener in the restart fixture type * fix(chat): preserve recovery ownership across lifecycle boundaries * Preserve send ownership across context replacement and recovery * Separate history ingestion from live send settlement * Preserve original send truth and reconcile acquired history * Use summary-shaped history responses in acquisition coverage * Preserve queued image recovery for released readers * Prove independent late receipt recovery across reopen * Preserve queued image sources in bounded catch-up projection * Keep queued input and explicit chat retries in their original domains * Preserve reader lifetime across main session interfaces * Fix static checks after main integration * Migrate retained recovery Stop contracts to current lifecycle * test: use typed access for journal population counters * fix: consolidate history page bounds type imports * test: exercise legacy snapshot reuse through selected handoff * Fix attachment draft typing and document test boundary casts * Repair current journal integration types and contract fixtures * Keep uncertain send recovery in queue reorder reopen contract * Repair mobile contract boundaries and exact queue lookup * Align input finalization contracts with current Stop ordering * Keep recovery copies independent of queued message barriers * Reconcile Stop and replay contracts with current lifecycle * Update recovery tests for current module and draft APIs * Align Stop recovery contracts with independent queue policy * Expose independent recoveries to current queue controls * Cover sending-only queue Resume visibility * Adapt recovery contracts to shared queue projection * Use current history and failure-word contracts in recovery tests * test: retain released reader source contracts through queue settlement * Keep uncertain sends in ordinary history and preserve saved queue choices * test: prove mobile draft leaf subscription isolation * Use typed operation instrumentation in mobile recovery test * Align lifecycle test boundary typing with static rules * Repair test module typing and retained runtime copy catalog * Remove unused chat delivery notice translations * test(chat): retain legacy handback without uncertainty notice * fix(chat): omit saved uncertainty card captions * test: bind released readers to exact queue wire and proof * Replace archived reader evaluator with exact recorded contracts * Mark queued edit test hook import as type-only * Isolate queued card tests from native inline composer imports * Complete structured mobile resolution in queued edit test * Align mobile attachment cleanup lifetime test with send outcomes * fix: restore journal prototype delegation methods * Keep uncertain sends as ordinary messages in memory * Release notes admission after uncertain opening completes * fix: end opening selection operations at uncertain completion * fix: derive selection admission from live requests and repair integration tests * test: consolidate send imports and use a supported locale * Fix CI test types and synchronize retired delivery catalogs * Type exported test fixture mocks through the public Vitest API * test: align selection and journal verification contracts * Reconcile acquired history before journal projection * Preserve saved invocation facts during history catch-up * Repair journal recovery consumers and CI contracts * Keep failed legacy import displays serializable and bounded * Preserve journal owner boundaries in CI import cleanup * Fix typed test fixtures for session recovery contracts * fix: align history and recovery contract types * test: verify logical rewind across released chats * Bound retained queue and status reads * Bound Stop and delivery reads to relevant journal inputs * Bound subscriber catch-up and stopped-history reads * test: align journal read fixtures and operation counts * Bound automatic chat reads to current input evidence * fix: align journal reader contracts and test fixtures * test: type historical dispatch rejection fixtures * fix: restore merged session projection and fixture types * fix: preserve resumed queues across logical fork rewind * Preserve queue pause chronology across logical rewinds Keep original Stop and Resume coordinates while retaining matching warm failure evidence in the journal owner. Keep historical fixture authoring separate from current production writes. * End historical fixture authoring before current queue actions * Keep answer operations separate from retained messages * Fix resting chat attention context * Fix attention regression fixture provenance * Validate retained RPC test frame reads * Fix retained attention and RPC contract fixtures * Keep send observations on canonical delivery evidence |
||
|
Neil
|
7bf0377072 | refactor: place terminal and workspace contracts with concrete owners (#38061) | ||
|
Neil
|
f33197523d | refactor: group Codex transport trust and journal owners (#38023) | ||
|
Neil
|
d09519f0f1 | refactor: group workspace and runtime contracts by defining owner (#38018) | ||
 Kelvin AmoabaandPr1p
|
2e3c8fb530 |
fix(notifications): clear acknowledged desktop alerts (#37974)
Explicit worktree reads and session acknowledgements share the existing desktop dismissal authority. Desktop and phone copies preserve transport, physical workspace and session/cursor identity; Linux retains dismissible notification handles after banners expire. Mailbox consumption keeps its existing semantics. Fixes #37328 STA-13409 Co-authored-by: Pr1p <zwq19980411@gmail.com> |
||
|
Neil
|
926f8bad13 | refactor: organize terminal and runtime contract owners (#38011) | ||
  OrcaWinandOrcaWin
|
c3c24a5784 |
test: reconcile low-value test removals with current main (#37991)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
2c03c4b989 | refactor: organize agent status and lifecycle owners (#37961) | ||
|
Brennan Benson
|
c46e84bcc4 |
test: fix historical compatibility setup reliability (#37905)
Prepare requested immutable historical snapshots before timed extraction and direct reads, using the existing acquisition/process helpers and local-only consumers. Move four suites' historical module setup into per-pin hooks without changing pins, compatibility assertions, workers, extraction/assertion deadlines or publication ownership. Independent reviews and the binding design settlement passed. The cold comparison and normal uninstrumented final-head CI each passed49files197tests; normal Checkout62s/job276s. All temporary probes removed; brennan-ready READY. Tracked in STA-13683. Outer-hook failure attribution limitation tracked in STA-13703. No application, saved-data or wire behavior change. |
||
|
Neil
|
d5f2a17cd2 | refactor: group agent launch contracts under concrete owners (#37915) | ||
|
OrcaWinandOrcaWin
|
b10e0bde3b |
test: remove 11 low-value declarations and batch historical checkout fetches (#37894)
* test: remove 11 low-value test declarations * ci: serialize historical compatibility checkouts * test: batch missing historical blobs before checkout extraction * test: keep release checkout extraction modules within file limits * test: keep release checkout extraction modules within file limits --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandNeil
|
c0cb95d62e |
test: remove 131 low-value harness, main, and renderer tests (#37825)
* test: remove 20 low-value harness and client tests * test: retire fake-agent and layout-oracle self-tests * test: retire source route for removed usage smoke * test: include 21 further low-value tests and remove unused fixture helper --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> |
||
|
OrcaWin
|
6c1a82bbd8 |
test: remove 30 low-value web and compatibility tests (#37814)
* test: remove 30 low-value web and compatibility tests * test: retire obsolete browser schema evidence from active gate |
||
|
Kelvin Amoaba
|
ee532e571c |
fix(chat): show device names on answer receipts (#37776)
* fix(chat): show device names on answer receipts * fix(chat): resolve receipt names across local and remote hosts * test(chat): type receipt boundary test dependencies * fix(chat): keep receipt labels within history frame budgets * test(chat): return complete compatibility attach replies |
||
|
Neil
|
c6b829ecf1 | refactor(main): group WSL host and orcad lifecycle owners (#37728) | ||
|
Brennan Benson
|
255401c2a5 |
Continue chats automatically when a usage limit resets (#36873)
* fix(native-chat): an open chat moves to the account you switch to before its next message A running chat's agent read its account only when it started, and nothing compared it with the account a start would use now, so open chats kept answering on the old account after a switch. The agent a chat runs now records the account its launch used, and the host's replace-before-the- next-send check replaces an idle one whose account is no longer what a start would use. A chat mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the account they were created on are never compared. A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer writes its new account's list under its first account (STA-11281). Tracked in STA-11211. * fix(native-chat): declare the launch-account read for the runtime layer that wires the host * fix(claude): find custom chat history before managed-account resume * test(claude): assign the complete custom account home * feat(native-chat): offer account switching and hand-off at usage limits * fix: track the provider in account-list reload effects * fix(native-chat): target recovery actions at the chat host and transcript * fix(native-chat): verify account recovery for each chat on its host * refactor(native-chat): retain the existing image-support result * fix(native-chat): withdraw account recovery after failed eligibility reads * fix(native-chat): leave unavailable recovery facts absent * Align Japanese usage-limit recovery copy with catalog convention * Preserve complete chat context through usage-limit recovery * Keep Continue callback focus optional * Keep recovery fixtures and account effects type safe * Keep chat recovery on native sources and native accounts * Validate native recovery files after path admission * Use the optional cursor shape in recovery fixture * fix(native-chat): exclude source CLI family from limit handoff * Resolve recovery context in the owning workspace directory * Add the continue-at-usage-limit-reset setting and its chat row lines * Continue chats automatically after usage limits reset * Fix automatic continuation fairness, lifecycle and host settings * fix: bind automatic continuation withdrawal to accepted actions * fix: withdraw source auto continuation after handoff starts * Read unopened chats with the saved-record reader for usage-limit continue Unopened chats were read through the raw-row replay, which no longer sees chats saved as keyed records, so a usage-limited chat that was not open was never continued after its reset. Read them the way the rest of the app reads a chat without opening it. Also use the shared visible-tab check, keep the ordinary rewind result without a sequence as main does, and adapt two tests to the current queued-message and saved-status behavior. * Keep a usage-limited turn idle after any rewind restores it Rewind completion read the resulting conversation through the raw-row replay, which no longer sees chats saved as keyed records, and a forked rewind wrote its completion before the new history's records. So a limited turn that a rewind brought back was continued automatically after its reset. The completion now reads the saved result the way the app reopens a chat, and the forked rewind writes its completion after the new history in the same transaction. * Type the usage-limit auto-continue test mock without an assertion * Fix type errors from main's settings, failure-wording and refusal changes * Keep ordinary settings replies when the paired host changes mid-call, and list the cancel method in wire contracts Settings reads and writes that don't carry the automatic-continue choice go through the common runtime call again, so a reply that completes after the paired host is removed still merges, as before this change. Only a write of that choice stays pinned to the host it was made for. The structured method count and the cross-version method manifest now include the cancel method. * Keep a stopped turn's automatic continue withdrawn when its usage limit arrives later A person could Stop a running Codex turn, have the turn then end with a usage-limit failure, and still get an automatic "Continue where you left off." after the reset, because Stop had nothing to cancel yet. The journal write that first reveals a limited turn the latest personal Stop owns now saves the same exact cancellation in that transaction, and a Stop accepted just after the limit landed withdraws it too. Resume, deleting a queued card and restarting keep it withdrawn; manual Continue and later turns are unaffected. * Bound the automatic-continue sweep and keep notice rows from re-rendering The 10-second sweep now does nothing while the setting is off, republishes only chats with a scheduled continuation, reads at most three unopened chats per pass, and keeps going when one chat's saved history can't be read (that chat is retried after the others instead of stopping every chat on the host). Settings writes republish only when the switch changes. Working out the usage-limit cut no longer indexes the whole conversation on every streamed row. The chat's notice rows no longer re-render for status changes they don't show. Adds operation-count and render-count tests for these bounds. * Test that streamed journal commits after a Stop scan no history and build no command index Drives real Codex rows through the host at 20 and 200 history rows: each streamed commit runs the Stop's commit hook and the status projection's cut reader with no newest-turn scan, no render and no full command index; the next turn end scans once and renders nothing. * Leave a usage limit manual once its reset passed more than a day ago Turning automatic continue on later no longer sends into chats whose limit reset days ago. Eligibility, which the row's summary, the sweep and the pre-send recheck all read, now requires the reset to be within the last 24 hours; older limits show the usual manual actions and are never continued unasked. * Show only manual actions for a usage limit Orca can never continue A limit more than a day past its reset is never continued, but its row still showed the setting link, inviting people to turn on a switch that could not help that chat. One shared check now decides whether a cut can ever be scheduled; the status summary and the sweep's eligibility both use it, so past the bound the row keeps only Continue Now, Hand Off and Add Account. A row already on screen when the day passes drops the line on the shared minute clock; the host alone decides sends. * List every journal row kind in the Stop cut filter The type-aware lint requires exhaustive switches; epoch, tombstone, submission and queue rows still cannot reveal a cut. * Type the status-subscription mock instead of casting its handler The changed-code casting gate rejects type assertions; the mock now carries the real subscription signature, so the recorded handler is typed. * Open store-less conversations without the Stop withdrawal hook Acquisition-only opens have no record store, so a person's Stop followed by a limited turn end made the journal commit throw and drop the turn end. Install the withdrawal only when a store exists; without one there is no continuation to withdraw. Also narrow the status summary before reading it and type the sweep test's send mock. |
||
|
OrcaWinandOrcaWin
|
1a816faefd |
test: remove 43 low-value cross-version test cases (#37317)
* test: remove 43 low-value test declarations * test: update catalog scaling conversation view import --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
8d1453fba9 |
test: remove 17 low-value test declarations (#37327)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
9b39188021 | refactor: organize session option and conversation owners (#37289) | ||
|
Neil
|
bdd997f71f |
test(cross-version): load moved modules from wherever each release defines them (#37297)
* test(cross-version): load moved modules from wherever each release defines them v1.4.246 is the first release cut after #36909, #36979, #37036 and #37070 moved the agent-session modules, so suites that imported the old paths from the newest release failed with ERR_MODULE_NOT_FOUND for every PR running cross-version wire. importReleaseCheckoutModule now resolves a moved module to the path the checked-out release ships, from one table of current and earlier locations, so both the rolling baseline and older pinned refs load. The released-chat writers drop their own per-module existsSync fallbacks for it. v1.4.246 also ships outcome storage, so it reads chats this build writes and closes its own rows with the outcomes marker. The downgrade test pins its refusing window to the two releases before outcome storage, and the upgrade test leaves the marker to the outcome reader, which restoreJournal checks. * test(cross-version): find a moved module by name in the release instead of a path table A table of earlier paths is a list of stale src literals the path-literal ratchet rightly refuses, and needs an entry for every future move. The release checkout itself says where it ships each module: the one file with that name under the same source root. Prunes the three released-chat-writers entries the ratchet baseline grandfathered. * test(cross-version): pin the chat-upgrade writers to the releases before outcome storage v1.4.246 keeps a chat in outcome tables, so its rows hold only the marker and there is no row upgrade to carry on; the newest release stays the reader this build must match. |
||
|
Neil
|
a82538c3be | refactor(runtime): organize session records and runtime modules (#37070) | ||
|
Kelvin Amoaba
|
d95e2324dc | fix(notifications): announce finished only when the agent is fully done (#36992) | ||
|
Neil
|
b29e7f5316 | refactor: group Claude structured session owners (#37036) | ||
|
OrcaWinandOrcaWin
|
70256eab83 |
test: remove 181 low-value tests and 2 suites (#37024)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
89f9ce08de |
refactor(shared): organize session contracts and projections (#36979)
* refactor(shared): organize session contracts and projections * chore: tighten dropped-path flaky pattern allowance * docs: preserve current agent instructions with valid formatting |
||
|
Neil
|
57454e6d7e | refactor(agent-session): group lifecycle records and direct owners (#36909) | ||
|
Neil
|
c1c04700bc |
refactor(agent-session): group failure modules and use direct owner imports (#36906)
* refactor(agent-session): organize failure owners and direct imports * test: retain historical release paths in literal baseline |
||
|
Neil
|
7d76028a5c | refactor: group agent session journal and request modules (#36882) | ||
|
Neil
|
5913a1c663 | refactor: group shared agent-session options and catalogs (#36878) | ||
|
Brennan Benson
|
7e2f29aaf1 |
Open native chats on the phone in place (#36315)
* Open native chats on the phone in place * Preserve desktop host and agent when opening chats * Preserve chat opening and captured lifecycle contracts * test: cover sender focus and unconfirmed chat close outcomes * test: exercise structured worker CLI lifecycle through runtime socket * test: use checked parked mail observation in CLI integration * test: validate provider notification correlation identities * test: construct checked lifecycle and navigation fixtures * Keep cross-program session proofs in their test program * Localize mobile chat opening feedback and complete runtime contracts * Use the mocked text component identity in History feedback proof * Temporarily expose grown E2E type diagnostics * Keep E2E timer and fetch fixtures in their runtime domains * Reconcile decreased E2E wait pattern counts * Preserve live test clocks and expose remaining type diagnostics * Keep mobile session data types independent of native views * Complete structured session wire surface fixtures * Expose existing grown E2E type diagnostics temporarily * Preserve checked wire fixture tab mock signatures * Preserve worker redrive when automatic close is refused * Honor automatic close admission before settlement and retirement * test: retain History reveal and close publication race * Match automation reveal callback to activation result * Align CLI integration fixture with current settings and output * Prevent retained chats from reopening removed workspaces * Import notification types directly from their owner * Unify local removal fences for accepted worktree aliases * Keep cross-surface authority tests in the combined test project * Initialize coordinator mail test workspace ownership * Register the retained automation chat test workspace * Use checked inputs in worker start failure test * Preserve the automation test repository host literal |
||
 Brennan BensonandClaude Fable 5.1
|
002e975e96 |
Open chats move to the account you switch to, before their next message (#30955)
* fix(native-chat): an open chat moves to the account you switch to before its next message A running chat's agent read its account only when it started, and nothing compared it with the account a start would use now, so open chats kept answering on the old account after a switch. The agent a chat runs now records the account its launch used, and the host's replace-before-the- next-send check replaces an idle one whose account is no longer what a start would use. A chat mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the account they were created on are never compared. A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer writes its new account's list under its first account (STA-11281). Tracked in STA-11211. * fix(native-chat): declare the launch-account read for the runtime layer that wires the host * fix(claude): find custom chat history before managed-account resume * test(claude): assign the complete custom account home * Preserve unknown account model facts and legacy option replay * Clarify terminal account-switch feedback in translated locales * Keep option mutation plans checked against their contract * Cover unknown model choices across chat consumers * Keep consumer fixtures aligned with canonical types * Match the mobile picker label in its consumer test * fix: clarify terminal scope in translated Claude account settings * Update integration tests for current session and remote client contracts * Keep native worker replies on their receiving account * Preserve receiving accounts across cold starts and nested reports * Preserve the delivery receiver when reading chat commands * Clarify native reply matching and consolidate imports * Resolve catalog scope without re-entering conversation queues Give owned option mutations and delivery settlement a resolved catalog input while external reads acquire scope once. Preserve account routing, catalog lifetime and current response obligations. * Align catalog and mobile test fixtures with current contracts Explain the existing timeout budgets and provide the idle turn identity and truthful model-only picker label in the mobile fixture. * Align receiving-account readers and fixtures with typed contracts * Repair account-switch fixtures and measure receiving work * Use the checked account-home path in catalog tests * Restore executed-option recorder context * Control receiving catalog deadline test clock * Align unknown-model consumer fixtures with send capture * Consolidate session host type imports * Align cross-version catalog fixtures with host read contracts * test(native-chat): bind Runs through the current start authority in receiving fixtures Main now resolves a worker start lazily through bindRun with objective and task references, and creating a Run no longer unbinds a coordinator's earlier Runs; run-use does. The receiving fixtures follow the same production owners so every original scenario, input and bound is exercised unchanged. The receiving runtime subclass moves verbatim into its own support module. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(native-chat): follow the selected account before its folder exists A live Claude chat compared its account against the selected one only after that account's folder passed an availability check, so an account still being set up (or whose setup failed) left the chat silently answering on the previous account, and a resting chat refused its start before preparation could run. The retirement comparison and the start pre-read now ask the router for the selected route as identity, through the existing resolver purposes; catalog, create and probe reads keep checking availability. Preparation, typed launch failure and parking are unchanged. Session History details show the account a chat was last launched under when the host recorded one, else its founding home. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(ai-vault): build the stale acquisition receipt without a type assertion The History account case now reads the fixture receipt through the typed acquisition reader instead of spreading the record field through a cast; the three assertions and their inputs are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): narrow the rig acquisition link before relinking it The account-setup cases spread an optional link, which typed its id as possibly undefined; the rig always links a handle, so a guard that cannot fire narrows it. No assertion or input changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): follow main's chat admission in fixtures and bound the History account projection Chat admission no longer reads an experimental host setting, so the continuation-context test drops the spy main dropped in its own fixtures. The two History consumers that install a minimal chat host give their fake store the record accessor and host id the real store has, since the projection now reads the acquisition receipt. An operation-count contract holds the production History projection to one roster read and one record lookup per owned row at 10 and 100 rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): give the declared-effort catalog fake its capture port The declared-effort fixture builds a catalog service without the capture member the options reader asks every catalog for, which failed its desktop, catalog and phone consumers; it now supplies the inert test operation like the other fakes. The History projection contract also drops an unused map parameter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Consume main's outcome change feed in the receiving-account index Main's keyed journal records deliver each change after an epoch's frozen prefix as an outcome sequence naming touched keys instead of typed rows. The receiving-account index now re-reads those keys at their current values: queue cards by id, a deleted submission retires its exact notice, and a deleted item drives the existing recovery rebuild, with Stop marks still excluded. The in-process read row exposes the already-persisted queue.cards keys and per-key deletion facts; itemIds and submissionIds keep listing every touched key. The mobile unknown-consumer test mocks MobileSwitch as main's picker test does. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> |
||
 Brennan BensonandCodex
|
2cc33b8d89 |
fix(native-chat): save each chat change as keyed records and reopen from the newest (#36024)
* Save native chat state and restore only its journal tail Publish versioned reducer checkpoints atomically, checkpoint through the chat write queue, and backfill closed chats without retiring journal rows. Co-Authored-By: Codex <noreply@openai.com> * Keep checkpoint recovery durable and skip unchanged captures * Keep journal timer and restart fixtures compatible with checkpoints * Keep checkpoint performance tests focused on operation contracts * Remove unused benchmark import * Restore journal append interception and control Stop fixture time * Compare saved reducer state without a key assertion * Supply thread scope in checkpoint test appends * Prove restored journal consumer paths * test: exercise restored consumer backward pagination * fix: pace journal backfill with a monotonic clock * refactor: keep journal opening cursor checks together * refactor: project chat journal state in the append transaction Track isolated reducer mutations and persist keyed changes under a savepoint before adopting committed state. Keep appends working through projection lag and repair coverage on the write lane, including legacy bootstrap. Co-Authored-By: Codex <noreply@openai.com> * fix: keep reducer objects live across journal commits The draft isolates every write until COMMIT, then writes each dirty copy back onto its original, so submissions, items and queue cards handed out before a commit keep reading current values as they did with in-place folding. A failed COMMIT still leaves live state untouched. Also replaces banned Reflect.get uses and adds braces the lint rule requires. * fix: bound projection repair and check the invariant after notification Failed publications and savepoints back off from 1 s up to an hour, reset by a healthy incremental write or a reopen. open() no longer waits for a legacy chat's publication; the scheduled repair publishes it on the write lane. A failed open closes its handle. The equality check runs after commit notification, only when projection tests opt in or, log-only and sampled, in development, and it requires the saved coverage to match. Removes the unused streamed commit argument. * fix: keep the background projection pass proportional to chats The orphan sweep reads one state row per chat and clears orphans by session key. A chat whose fold cannot publish stops at its first damage and is skipped until its epoch or newest row changes. * fix: version the keyed projection layout as codec 2 This branch's earlier whole-state layout used version 1; it now decodes to null and the chat replays. * test: follow the append-with-fold contract and deferred publication A submission whose fold throws now rolls back with its receipt before any dispatch, so those sends are refused and nothing is recorded. The unconfirmed continuation outcome is pinned through its real cause: the agent admits the message and no delivery proof arrives. Tests that need saved state right after a chat opens publish it explicitly, the history reload clears the saved state covering its edited row, and the codex stream bound matches its capture. * test: pin projection repair backoff, background pass and N/10N costs Covers the production repair timer under a persistent failure, a legacy open that publishes after it resolves, a failed open leaving no timer, a damaged closed chat skipped until a new row, and equal per-write, reopen, sweep and closed-chat publication work at N and 10N. Projection tests opt into the per-commit equality check. * refactor: inline draft write-back helpers The repo lint bans object-typed parameters; the copy and write-back now run in the closure that already holds the wrapped value. * fix: write a new epoch's saved state in its own transaction New chats, rollovers and rewinds publish the new epoch's projection beside its rows, inside the same statement-only savepoint the append path uses, so they start covered instead of waiting a second for a repair. A projection failure there still keeps the epoch and leaves the scheduled repair to publish it. * fix: keep the sampled development check log-only on any failure A read failing inside the check must not reject an append that already committed and notified. * fix: typecheck the draft copy without closure narrowing Assign the lazily created copy through a local so strict programs that do not narrow a captured variable after ??= still see an object. * test: catch whole-table sweeps and an undecodable projection The sweep contract now records exec statements too and pins its exact keyed statement list, so a NOT EXISTS scan through exec fails it. A projection whose item stops decoding fails the per-commit check on coverage although a full replay still matches. Also fixes two test lint findings. * refactor: drop draft casts the types can carry Overlay maps and sets finish from their own typed touched keys, and present map entries are read through one helper. The two remaining generic boundaries, a draft standing for its object and finishing back to it, carry the repo's SAFETY directive. * test: show a parked damaged chat publishes after a clean epoch replaces it The replacement ends at the parked chat's newest sequence, so only the epoch in the skip key re-arms it. * test: give the seeded queued card its enqueue cursor Production records queuedAt as the cursor before the queue row; the fixture now does too. * fix: catch lagging saved chat state up in atomic pages Repair of a legacy, lagging or undecodable chat, open or closed, no longer republishes the whole chat. One runner folds the rows after the saved coverage onto a private copy of the saved prefix, at most 32 rows or about 1 MiB of row text per page, and commits each page's changed entries with the new coverage in one FULL transaction. That transaction first checks the chat's epoch and the exact saved row the page was folded from, so a page from a retired epoch or a stale base writes nothing. Pages rest between slices, and the saved prefix is decoded in pages too. An open chat runs the pages on its write lane; sends keep committing between them and skip the projection until coverage reaches the tip, then project incrementally again. The background pass hands a chat over to its open owner at a page boundary. Damage parks the chat after the pages before it, and a failed page keeps the committed ones and retries from them on the existing backoff. Whole-chat publication now runs only inside epoch transactions. * test: pin the draft layer's tracked nodes per streamed revision and acceptance A transition now reports how many objects and collections its fold reached. The scaling chat gains accepted sends (receipts and aliases) and waiting, dispatched and returned queue cards at N and 10N. A streamed revision's only growing term is the card scan, one node per card plus each returned card's body; an echo also reads every item with its body and every submission. * test: append the between-pages send by item identity appendItem takes the provider identity, not its key. * test: check every catch-up prefix of the recorded Claude and Codex streams A runner can page single rows, so the recorded streams' aliases, Stop settlement and per-row timestamps are each checked at a committed prefix against a full replay. * test: measure each backfill pass's row reads on its own The parked-chat test counted its own replay checks: 64 pass rows plus 68, 68 and 100 oracle rows made the 300 CI saw. Each timer window is now measured alone, and coverage is read from its saved row, so the unchanged pass reads 0 rows and the re-armed one reads one page. * fix: bound catch-up reads, release the finished prefix, and keep unreadable views - A catch-up page now stops reading rows at the row whose text reaches about 1 MiB, so rows past the budget are never fetched and fetched again; saved-view item and entry pages use the same budget. - An open chat drops its private prefix once coverage reaches the tip and keeps it only across a failed or parked page. - A present current-epoch view this build cannot read (another codec version or corrupt content) is no longer cleared by the first page. Its whole history must fold cleanly through the tip first; otherwise it parks untouched. A storage error while reading the view fails with backoff instead of reading as a missing view. - The pace charges only the runner's own work units, so time spent waiting on an open chat's catch-up or the write lane no longer lengthens the next rest. * test: cover takeover, epoch replacement and stop in the middle of a pass A chat opened while the pass rests is caught up by its own runner from the committed page; the pass pages it no further and does not charge the wait to its pace. A replacement leaves its new view untouched, and a stopped pass resumes after its last committed page. * test: fail the takeover test without the handover break, and the replacement test without the stale-runner guard The takeover test asserts the pass asks the open owner only twice for the handed-over chat, and pins performance.now so the open runner's pace never waits on a fake timer. The replacement now lands while the open runner is resting in its saved-view decode, so its page reaches the lane after the replacement; the test asserts no transaction opens. * test: read saved-view pages with the page budget, and await database closes The paged-decode round trip passes the row-and-text budget and checks the view decoded. Projection, scaling and ACP launch tests await the now-async test database close, so a closing checkpoint worker cannot close the next test's database. * Persist native chat outcomes with a rebuildable cache Store immutable keyed transition results with canonical ordering, fence outcome epochs, and convert legacy inputs through paced invisible generations. Rebuild disposable caches from validated outcomes and read sparse logical sequence groups without changing the wire. Co-Authored-By: Codex <noreply@openai.com> * test: repair the split suites so they parse, lint clean and find their setup Restores the describe blocks the split truncated, the loop variable it renamed, the fixture references and imports it dropped, and a stray argument pair. Moves the grandfathered flaky-pattern counts with the code that moved. * test: read outcome epochs as outcomes where the adapted assertions read input rows A replaced epoch restates its Stop in the saved pause marks, the sparse-group batch test needs an outcome epoch rather than the input-format fixture, and a revised item keeps its first place, so the held-write order is read from the replayed groups. * test: expect saved queue cards as whole values in the queue-history assertions The adapted helpers read card outcomes, which store each card's whole state, so an import or refusal shows as the card's own state change rather than as an input row. * style: format the files this PR changed * test: import each module once in two journal suites * fix: decode saved outcomes with a frozen format-1 schema, independent of the cache codec Outcome values decode through a versioned format-1 schema that never follows the live reducer type; an unknown field reads as saved by a newer Orca, and the cache codec only delegates to it, so a codec bump rebuilds the cache and nothing else. * fix: key outcomes by an integer generation and keep the cache stamp in its state row Each outcome row names its generation, the attempt's id, instead of repeating the chat id, epoch and a UUID; the cache stamp is a column of the cache's own state row, so there is one stamp to keep in step; cache ordinals are text like the outcomes they copy. Orphaned caches are swept from the per-chat state row with indexed per-chat deletes. The WSL census lists both schema files. * fix: finalize queue ownership before publishing a new epoch, and reject unreadable outcome rows Epoch replacement and rollover adopt the committed state, keep attachment claims and finalize the queue receipt before the fallible publication step, as before outcomes. Every persisted outcome row is read back through the row reader, so a row it rejects fails as journal_row_rejected. Publishing an epoch checks the epoch it replaces is still current. A key deleted and re-created in one write moves to the end of the pending changes, matching its new ordinal. * fix: open a chat synchronously and unpaced, and classify read failures by cause A user's open reads the cache or rebuilds from outcomes in one synchronous pass, like replay on main, so no background rebuild can interleave with it and nothing paces or bills it. Only an outcome decode failure is damage; a value from a newer format is refused as newer; storage errors propagate as unavailable. Writes derive cache currency from the stamp instead of a latch and ask the maintenance runner when it lags. * fix: run all journal maintenance through one paced runner per database One runner serves requested chats first, then lagging ones, one catch-up at a time, open or closed, so an open chat keeps its conversion's progress. A busy or replaced chat is skipped and the pass continues; content that cannot convert parks until the chat's rows change; storage failures back off. Background work alone pays the duty cycle. Conversion verifies the whole input once, then only the outcome tail; cache rebuilds copy outcome pages to the moving tip and stamp from the scalar outcomes. * test: adapt journal suites to generation-keyed outcomes, the merged cache stamp and the publication order Queries read outcomes by generation; the bootstrap test expects the queue receipt to finalize before publication; queue-import-scaling states the reopen's constant two key visits when it retries a failed import; append-delivery reads the outcome change index's item ids. * test: pin outcome format 1 with checked-in rows, and cover open consistency, transient reads and re-created keys A golden fixture of format-1 outcome rows covering every field and scalar must restore to the pinned chat; a cache codec bump only rebuilds the cache; an unknown field reads as newer. An open between two pages of a cache rebuild reads the whole chat from outcomes. A transient read error during open is unavailable, not damage, and the next open loads the chat. A key deleted and re-created around a new key in one row keeps live order, written or converted. * refactor: check a converting chat's epoch once, in the catch-up step that runs each page The catch-up reads the chat's epoch in the same synchronous step as the page's transaction, for conversion and cache rebuild alike, so the conversion's second copy of the check is dropped. * test: drive the maintenance runner over a real database, each guard killed by a mutation Startup sweeps, closed chats converted one at a time with a busy chat skipped, an open chat writing between conversion pages, a stop between pages, an epoch replaced mid-conversion, content parked until the chat writes again and then delivered, and a storage failure backed off rather than parked. * test: N/10N contracts for outcome appends, opens, conversion, publication, idle passes, sweeps, tail verify and wire catch-up Each counts statements through prepare and exec, rows read per table and rows and bytes written, never time, and requires the same work for a chat ten times larger: a streamed revision, a Codex plan update and an acceptance; a cached open reads no outcome; a conversion page reads one page of input and publication none; an idle background pass reads no history; a retired generation and an orphaned cache are deleted one indexed page at a time; a second verify reads only the new outcomes; a wire catch-up reads only the groups asked for. * test: shipped builds keep a new or converted outcome chat untouched The newest release refuses the chat as a newer Orca's and leaves every byte of the database as it was; a build from before that reason opens it read-only with nothing shown, refuses writes, and changes no saved row. * test: an epoch publication over an epoch the caller did not see is refused, and damage at row 1 still yields to a newer row Publishing a new epoch checks, inside its transaction, the epoch the caller last saw, and writes nothing when it changed. A chat whose first row is unreadable keeps reading for a newer build's row, as main does, and is refused as a newer Orca's. * test: old-build probes fold input rows only, and the interrupted-call probe writes inputs * test: import the state layout once in the cache test support * fix: type the tail verify's live lookups per collection, and two test call shapes The tail verify looked keys parsed from stored JSON up in a union of live maps, which does not typecheck; each format-1 collection now has a typed lookup that narrows the parsed key first, and the table is checked complete against the format's collection list. * fix: wake the maintenance runner for a request or a due retry ahead of the periodic pass One timer now wakes the runner at the earlier of the next periodic pass and the first due request or storage retry, re-derived from the waiting chats after each pass, so a request after the first pass is served within a second and a backoff retry is no longer replaced by the six-hour pass. A chat whose load swept a retired page keeps its turn instead of waiting for the next pass. Tests drive start(), requests and timers on fake time. * test: pin the draft's tracked nodes per streamed revision and acceptance at N and 10N The scaling chat gains dispatched and returned queue cards. A streamed revision's only growing term is the queue card scan, one node per card plus each returned card's body; an acceptance echo also reads every item with its body and every submission. Main's reducer makes the same scans on these rows; the draft adds one node per value reached. * test: cross-version probes read a new chat's turn end as one outcome sequence, and the kept-card downgrade uses an unconverted chat * fix: store every new write as format-tagged outcome records after an existing chat's rows, with no conversion An existing chat keeps its input rows byte for byte; its first write appends one marker row that shipped builds refuse, and its records follow. New chats hold only their marker and records. Each record carries its own format and the epoch keeps the highest format it holds, checked before a cache is used or anything is written. Opening a chat with an input prefix folds the prefix as main does and applies the records over it, deletions included, keeping prefix keys in place; catch-up pages the prefix rows, then the record groups. Background conversion and its attempts, staging, verification and publication are gone; the maintenance runner rebuilds only caches of chats without a prefix, parks a rebuild on its epoch's records rather than the newest sequence, and looks a requested chat up by its key. * test: pin the marker, prefix-plus-records reopen, record admission before the cache, cache-only runner parking and N/10N work Input fixtures stand for a chat an older build wrote: their input epoch keeps taking input rows, so the input reader still meets writer-made rows; epochs this build founds are written as it writes them. Conversion tests give way to a mixed chat whose prefix keys are deleted, recreated and updated in place, the runner's rebuild parking that later writes never re-arm, and contracts for writing to, opening and rebuilding chats at N and 10N. * fix: refuse a chat whose outcome marker is a newer version as a newer Orca's, not as damage * test: shipped builds refuse an existing chat at its appended marker, its input rows unchanged, and this build reads it whole again The probe writes three items as input rows the way an older build did, then this build's writes append one marker and outcome records; the newest release refuses the chat as a newer Orca's with every byte unchanged, the writable baseline latches read-only at the marker, and the re-upgraded build reads all six items with the prefix rows as they were. * test: read the runner's rebuild instances as rebuilds, so the parked-chat test typechecks * fix: admit saved outcome records and the cache only through a strict storage schema A saved record or cached value holding a key or union tag this build does not declare, at any depth, now refuses the chat as a newer Orca's before the cache is used or anything is written. The storage schema reuses the wire's shared definitions, completes the keys they leave out (failure facts, senders, edit patches and the rest), and closes every object and open union; string vocabularies and opaque payloads keep the wire's meaning. A compile-time check fails CI when a persisted type gains a key storage does not declare, and a checked-in corpus of every declared shape replaces the schema fingerprint, so an added optional key needs no new format. * fix: refuse an input row or legacy card holding a key this build does not declare before folding it Restating a chat on a new epoch is safe only if the open chat holds nothing this build half understands. An input row of a known kind (an existing chat's frozen prefix, with or without outcome records after it) is now checked key by key against what this build declares before main's reader normalizes it, and refuses the chat as a newer Orca's; values keep main's checks and execution options their legacy meaning. A legacy queued card whose saved body holds an undeclared key stays on disk, unadopted, as an unreadable card does. Client sends already arrive through strict request schemas, and their options through a reader that drops choices this build does not use. Main's tests that kept a newer build's unknown body kind, subject or key readable and writable now expect the refusal; the three that drove a newer Orca's approval or item through this build's own writers are removed, since this build can no longer hold one. A checked-in input prefix pins how this build folds older rows, and every value it folds into is one storage admits. * test: a persisted type holding a key storage does not declare, nested included, fails to compile * test: this build refuses a newer build's body or subject kind as a newer Orca's, keeping the row an older build deletes * fix: fold each outcome write from the row a reload reads, so an annotation the reader drops never fails the strict record write An ACP usage report with size 0 (allowed by the protocol) reached the model as an unusable window, the strict encoder refused it, and the agent was stopped mid-turn. Main writes that row and drops the annotation on reload; folding the read-back row keeps live state equal to that reload for every annotation the reader drops. * test: an echo declared without a known original is stored as null, the shape a reload reads * test: probe the downgrade refusal on both releases in the downgrade window, not only the newest * test: both releases in the downgrade window write a Claude and a Codex chat through their own writers, and this build admits every row and opens the chat as that release had it * test: rewind, replacement and rollover of a chat holding old rows, the marker and records keep what the user kept and delete the retired epoch whole * test: phone and paired catch-up over a chat holding old rows then records, from a cursor inside the old rows, draws as the clients render it * test: ACP launch decisions read an outcome chat from its cache and from its records alone, and a newer one as unreadable * Open new and mixed chats from each key's newest record and drop the saved-state cache The cache copied each key's newest record into a second set of tables and needed stamps, a paced rebuild, a savepoint fallback and a repair runner to stay usable. The records' key index already answers the same read: an open seeks from one key to the next, taking each key's newest record (deletions included) and never reading superseded revisions. A mixed chat still folds its frozen input prefix first. A send now writes only its records, the epoch's coverage and its receipt, so any failure among them refuses the send as main's row insert does. The background runner keeps only the paced sweep of retired generations, its one remaining job. The cache tables are no longer created; they never shipped. * Derive an outcome chat's last sequence from its coverage instead of recording it Every write recorded the sequence scalar beside its own records, about half the records on streamed paths. The epoch's coverage already holds it, so a read supplies it from there and a write no longer stores it. Records an earlier build stored still decode. * test: count strict admission per open, catch-up page and write of an existing chat at N and 10N Admission walks each input row it reads once (on top of main's parse), and each outcome record it reads or writes once: the open of a mixed chat walks exactly its prefix rows and admits one record per key, a catch-up page walks one row per input row it returns, and a write walks its row's read-back and admits each record it inserts. Linear in what is read, with a constant of one. * Keep a record that updated a prefix key when a later prefix fold no longer yields that key A tail record with the prefix ordinal is the key's newest value. If a later build's reducer reads the old rows differently and no longer produces that key, the value is appended instead of refusing the whole chat as damaged; only that key's place can change. * Resume each sweep page at the generation it is deleting After a page of records the sweep went back to its start position, so every later page rescanned every live chat's generation numbered below the retired one. It now resumes at that generation; a contract at N and 10N live chats pins that only a pass's first page walks them. * test: the sweeper rests nine times each page's work * Start the retired-record sweep from the chat database the attachments already take The sweep was wired through an optional parameter, so dropping it at the one production caller would have left retired records forever with every test passing. It now runs on the required journal database, and a wiring test checks that installing starts it and stopping ends it. * test: an existing chat whose first write fails keeps no marker, and the newest release still opens and writes it * test: chats the window's releases and the oldest release with this chat database wrote are edited, sent to and rewound by this build as the newest release does Each release writes a Claude and a Codex chat through its own writers. This build opens it, edits a card the old rows hold (its first write: the marker and an in-place update), sends, rewinds (every kept message and card saved again through the strict encoder) and reopens, with every commit restoring to the live chat. The result equals the newest release's after the same steps. The oldest release is resolved from tags, as the window is. * test: the released-chat writer resumes the queue after every Stop it records, and the probe reads each step's result once * test: the released-chat probe checks this build's edit, send and rewind on its own result Comparing the carried chat with the newest release's would fail the required cross-version check for any legitimate main change to those flows until the next release ships. The probe still admits every released row, opens the chat as the release and the newest release do, keeps the release's rows byte for byte with one marker, and restores to live after every commit; after that it checks the edited card, the accepted send and the rewind's survivors. The oldest release with the per-host database is named directly: it never changes. * test: the golden input prefix holds data in every keyed collection Six collections folded empty, so a change to how old rows derive their keys went unnoticed there. Eight rows v1.4.245 wrote through its own journal (an item with an execution owner, a declared echo, a removed turn, and a queued card handed over with carried history, then cancelled in doubt) follow the existing rows unchanged, and the test now requires every collection to be non-empty. * Say once, beside the marker version, that the reading of old rows under it is frozen The fold comment claimed an unheld prefix-ordinal value only moves that key; a prefix read differently can also show a key twice or bring back one the tail deleted. The marker version now states the rule: a build that reads old rows into different keys or values keys that reading off a new marker version, and duplication or resurrection is never intended. * test: the released-chat probe compares what the release wrote, not fields this build adds The open check compared whole snapshots, so a field main starts setting would fail the required cross-version job until a release ships it. It now compares the release's items, sends and cards, in order and by value, allowing added fields; the byte-identity and restore-equals-live checks are unchanged. * test: say why the first-write-failure downgrade test needs a longer timeout * Type the open-union fallback check by schema, not a bare object * Check each outcome-format key set separately so no check reads as a redundant union member * Read an open or branded string as a value in the storage key check, not as an object * Decode each newest outcome record from the value admission parsed, without parsing or walking it again or keeping its text * Match each encoded record to its change by position, so a settlement batch's encode stays linear in its mutations * Encode each changed value as the draft holds it, without reading it through the draft's tracking * test: rewind, replacement and rollover restate a chat with fixed statements and work linear in what they restate --------- Co-authored-by: Codex <noreply@openai.com> |
||
|
Brennan Benson
|
76cf164cf9 |
Chat UI leaves Experimental: each agent's Chat or CLI choice decides what opens (#36110)
* Chat UI leaves Experimental: each agent's Chat | CLI choice decides launches Remove the experimentalNativeChat switch and every gate on it. The Chat settings page, Default Agent Chat | CLI choice, + menu Chat/CLI rows, source-control surface choice, Antigravity chat section and orchestration chat-error switch are always present. What a new launch opens comes only from the per-agent choice (no saved choice opens a chat) plus the existing support checks. - One lookup, nativeChatPreferenceFor, keyed by agent id so host-registered agents read the same way; unreadable settings still open a terminal. - A relayed desktop stamp (nativeChatDefault) maps onto the launched agent; an explicit surface still wins. Old phones' createSupport keeps admitting by the host's per-agent choice. - settings.get stops publishing the retired switch keys; nothing in the repo reads them from a host. - Startup chat sync and hydration run when some agent can open as a chat or the machine already holds chats. - The retired key is stripped on load. The one-time upgrade tip from the chat upgrade is retired with its audience record; a new record, captured once from the raw profile, marks which existing profiles had Chat UI off. - The window-side AI-button tab path, which only ran with the switch off, is deleted. * Keep profiles that had Chat UI off on the terminal Existing users who never turned Chat UI on would otherwise see new agent launches open as chats, since an agent without a saved choice now opens as a chat. The one-time load step that records the new audience also sets every known agent to CLI for those profiles, in the same save and only when the record was absent, overwriting saved chat choices the old switch masked. Profiles that had Chat UI on and new profiles are untouched. Browser profiles keep their own settings, so the web client does the same once: a stored switch that is not on seeds CLI choices, and dropping the key marks the step done. Agents first seen after this step open as chats. * Agents without a saved Chat | CLI choice open as their CLI An agent with no saved choice now opens in the terminal for everyone, including fresh installs and agents first seen later. The one-time load step carries what launches opened while Chat UI was experimental: with the switch on, every known agent without a saved choice is saved as chat; with it off, chat choices the switch masked are saved as CLI. Existing profiles join the launch tip audience whether the switch was on or off. Browser profiles get the same carry from their saved key. The startup chat restore and host agent list now run only when some agent is saved as chat or the runtime holds chats. * Preserve owned terminal launches and local chat choices * Clarify chat and terminal support * Explain worker CLI integration timeout budget * Use checked annotations for chat graduation test fixtures * Store agent surface default separately from per-agent overrides * Preserve explicit Chat intent across default changes * Preserve current browser settings during host replies * Correct browser settings factory and regression types * Name exported launch fixture mock types and clarify agent defaults * Preserve settings fallbacks and complete launch test lifecycles * Check allocated tab identity before launch fixture interpolation * Register combined integration project for compiler parity probes * Use checked settings in the launch test fixture * Preserve retired Chat preference data privately * Align chat E2E fixtures and capture pane lifecycle evidence * Use typed raw settings in retention contracts * Consolidate transcript diagnostic imports * test: align chat fixtures with live pane and native menu contracts * test: capture relay tab selection loss diagnostics * test: wait for owned shells before synthetic chat fixtures * test: preserve all-host visibility in SSH observer * test: bind synthetic transcript fixtures before provider seeding * test: assert selected chat owner after narrow image preview * ci: allow fifth compiler project to complete comparison * Type the web-terminal fixture's chat map without an assertion * Right-click the selection itself in the chat copy spec |
||
|
Brennan Benson
|
12edee3ac6 |
Choose default models and effort for agents (#36210)
* Add host-owned model and effort defaults to agent settings * Unify terminal defaults and raw argument precedence * Keep agent model defaults typed through creation * Preserve quick-create prompt through preparation * fix: complete execution-host preference boundary and CI contracts * Preserve raw options until a replacement is emitted * Complete launch choice ownership and consumer contracts * Align launch contracts with compiler boundaries and consolidate proof * Name exported fixture mocks and verify ordered chip removal * Preserve typed choices across compound legacy publication edits * Preserve non-emitted composed launch choices through legacy edits * Preserve rollback omissions and settle agent launches before success * Carry terminal draft ownership through launch completion * Keep inline draft delivery independent of terminal projection * test: consolidate launch ownership contracts * test: check web launch fixture array types * test: align launch fixtures and conformity records * test: import the shell-ready marker from its declaring module * test: give caller routing the web host tab's completion contract |
||
|
Brennan Benson
|
527e7082b6 |
Reduce whole-app hitches when many chats are running (#35624)
* Move chat journal checkpoints off the host thread * Apply checkpoint lifecycle style and teardown test checks * Wake journal checkpoints for cleanup writes and retire fixture owners * Use fixed time in attachment checkpoint fixture * Derive checkpoint timer handles and check unref capability * Preserve journal test close completion and event typing * test: await journal close before fixture reuse and cleanup * test: await registered journal fixture cleanup * test: integrate goal sweep fixture with journal ownership * Simplify journal checkpoint worker lifecycle |
||
|
Brennan Benson
|
70209b9b11 |
Keep chats stopped by a delivered kill readable after downgrading (#36142)
* fix(native-chat): keep chats stopped by a delivered kill readable after a downgrade v1.4.244 accepts only three death kinds and sets aside any other record, so a chat Stop force-killed (exit never observed) vanished after a downgrade. Store the delivered kill as the absent pid an older build's restart probe would itself record, plus an exact marker this build reads back; in-memory code still sees kill-delivered. * test(native-chat): explain release-checkout timeout * test(native-chat): cover downgrade recovery and workspace rekeying * test(native-chat): preserve checked record types at test boundaries |
||
|
Brennan Benson
|
f87d68b4a4 |
Chat runs launcher Commands like op run -- codex for every agent (#35592)
* Support launcher command prefixes for all chat agents * Preserve launcher path arguments and copy routing checks * Match Japanese command guidance to the Agent settings label * test(pi): expect version probe termination barrier * test(chat): expect current command refusal guidance * fix(acp): refuse copy arguments before launch preparation |
||
|
641e4792b9 |
Startup shows chats as Interrupted or Done without reading their history (#32146)
* feat(agent-session-journal): save each chat's open root turn beside its epoch A restart could only tell whether a chat was cut mid-turn by replaying its whole journal. journal_sessions now keeps the open root turn (open_turn_id, open_turn_since), set by the row that opens a turn and cleared only by a finish the provider reported, in that row's own transaction. A turn a quit, crash or Stop cut short stays open, which is what the next launch reads as Interrupted. Journal schema version 5 adds the two nullable columns with a forward migration; a new epoch starts with no turn open. * fix(native-chat): restore chat tabs at startup without replaying any history Startup opened every chat in the saved tab index and replayed its whole journal into the main process to learn its status. With hundreds of tabs and gigabytes of history, Orca froze in GC on every launch. Startup now lists each restored chat from its record and publishes its row as Interrupted (a turn was open when its host stopped, or the last quit's resume offer lists it) or Done, through the status stream and the agent-status sink, reading only each chat's journal_sessions row and its newest row's time. A chat's history is read when something opens it; that open settles what the gone generation left running and publishes the journal's own row over the restored one. No other startup path replays chats: restart offers list from their markers without opening chats, and orchestration mail opens the chats it must read one at a time. Opened chats are capped at 24 resident folds; opening one past the cap closes the least recently active folds that are only a cache, with the idle sweep's own close test. * Fix lazy chat restoration and cache ownership * Restore saved chat work across runtime restarts * Wait for committed structural progress in migration fixture * Correct restored ownership and bounded journal recovery * Preserve bounded work selection during legacy recovery * Complete deferred restart status publication * Fix restart recovery test fixtures * Use legal legacy recovery fixtures * Correct population delete observation * Bound legacy journal replay in a readonly worker * Repair legacy worker proof oracles * Reduce legacy scratch key serialization cost * Decode population meter namespaces with scratch UTF-16 encoding * Consolidate structured session imports for CI * Remove redundant casts and document checked type exceptions * Correct compiler contracts and retain journal fixture invariants * Fix checked test fixture contracts after compiler validation * Name population fixture identity type in exported signature * Preserve historical quit presentation after rewind * Fix structured session retry and remote worker delivery * Preserve settlement and restored status contracts * Enable legacy chat readiness on standalone hosts * Repair structured session static checks * Verify retained submission identity across rewinds * Show saved chat status without replaying history at startup * Keep chats closed when startup status finishes loading * Keep startup owner recovery independent of history loading * Preserve intentional quit verdicts in saved chat status * Use a checked host fixture in startup restoration tests * Group saved startup roster publication and verify scoped status work * Use checked array access in status cut counters * Complete checked saved status fixture typing * Declare portable roster counter contract * Use current saved chat startup APIs in contracts * Preserve complete chat tab authority across startup * Repair checked startup restoration test consumers * Keep authority fixture module mocks in test entries * Consolidate authority test fixture imports * Check restore fixture contracts and recorded queue recovery --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> |
||
|
Brennan Benson
|
78ad9f4255 |
fix: keep chat option actions independent of inventory (#31927)
* fix: separate chat option input from inventory observations * fix: preserve scoped chat choices and publication ownership * fix: complete scoped catalog and applied control ownership * test: make catalog fixture dependency boundaries explicit * test: request catalog discovery explicitly in demand contracts * fix(chat): preserve option observations and operation boundaries * fix(chat): finish pending option and catalog lifetimes * fix(chat): project saved permissions without launch preparation * fix(chat): correct option rejection and catalog retirement * Preserve Claude effort validation advice through chat rejection * test: align refresh mocks and preserve fixture type evidence * fix: share catalog claims only across equivalent owners * test: use typed catalog corpus instrumentation * fix: consolidate structured launch imports * Validate SDK queue regression envelopes without assertions * fix: complete catalog runtime and fixture type contracts * Align native option fixtures with explicit discovery and applied facts * Keep initial compatibility catalog reads on held memory * Complete the installed catalog fixture envelope * Observe learned defaults after asynchronous projection settles * Consolidate host fixture journal type imports * test(native-chat): align goal and seed fixtures with applied inputs * fix(codex): retain applied proof when goal settings skip a write * test: load rejection wording before timed queue regression * Fix catalog fixtures and queued option snapshot typing * Align permission publication fixture with passive option reads * Separate startup config from held turn permission fixture * Align input lifecycle fixtures with sparse applied choices * Simplify scoped catalog refresh ownership and coalesce cache snapshots * Load catalog persistence real-module fixture during collection * Compose catalog availability fixtures from valid session records * Align catalog and startup fixtures with current option contracts * Fix permission read types and separate catalog fixture preparation * Align option and restart fixtures with current lifecycle owners * test(mobile): retain reported model alongside discovery * test(mobile): recalibrate the measured route script envelope * test: let the preflight shell-capture mock run its detection callback |
||
 Agustin VarelaandNeil
|
d20791e522 |
fix(session-search): read --since as an instant, whatever offset it carries (#28329)
Hosts filter with `updated_at >= ?`, comparing text against UTC toISOString() values, so a `+08:00` cutoff was read as if UTC and a whole-second `...00Z` cutoff dropped sessions in that same second (`Z` sorts after `.`). The cursor key also hashed the raw spelling. Normalize `since` to toISOString() in AiVaultSearchFiltersSchema. Every client and host path parses this schema, so new clients send a cutoff older hosts already compare correctly, and new hosts normalize whatever older clients send before filtering or building the cursor key. `Date` keeps milliseconds only, so a cutoff like `...00.0005Z` rounds up to the next millisecond rather than letting in a session from before it. Fixes #28253 Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> |
||
|
Neil
|
bd9455b616 |
test(wsl): cover a WSL-host orcad and the desktop at different versions (#34792)
* test(wsl): cover a WSL-host orcad and the desktop at different versions The desktop and a WSL distro's orcad update independently, and nothing pinned how they meet. - wsl-orcad-update-admission.test.ts: an older desktop keeps the newer orcad another desktop deployed serving, with no Update hint, and deploys over it only on Force; a policy refusal over that host carries orcad_host_newer. A newer desktop updates an older orcad on connect, keeps it serving with a Force hint after a failed update, and treats an orcad from before app provenance as updatable. - cross-version-wire/wsl-host-desktop-downgrade: against the baseline release, a newer desktop withholds the agent-session account env from a WSL orcad that never advertised it (the release's strict schema accepts the call), sends agent.launch's account env the release accepts, and reads the release's errors with no drive refusal; an older desktop reads the Windows-drive refusal as the readable runtime_error it already shows. * test(wsl): type the unused Claude preparation, and read the older orcad's error with the newer desktop's unwrap |
||
|
Brennan Benson
|
e71d4358c1 |
Native chat tabs can hand off work from their right-click menu (#34504)
* Add native chat hand-off menu on main * Fix saved chat hand-off observations and RPC exports * Reuse indexed chat tabs for hand-off subscriptions * Match saved-chat clear fixture to current journal API |