It flaked on loaded CI shards when a single write never reached the watcher. Files are now rewritten until seen, readiness is proven before the storm, and a sentinel written after the storm replaces the 300 ms debounce sleep. Disabling the ignores still fails it.
The legacy relay bridge counted viewers per PTY id and released them by PTY id. A pane whose
attach answered after it left (or after a reconnect replaced the bridge) handed its viewer back
by PTY id, so the release landed on the current bridge and dropped a successor pane's viewer:
that pane stopped receiving output. Each attach now returns an acquisition id (in-app IPC only;
the relay wire is unchanged) and detach releases exactly that acquisition.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ci: ratchet src/ path literals in CI config, workflows and e2e code that name no file
* ci(path-literal): resolve relative imports exactly
* ci(path-literal): resolve against tracked files only; read ./src imports
* ci(path-literal): scan src/packages and src/types references too
* ci(path-literal): skip paths quoted in comments
* ci(path-literal): keep a recursive glob's boundary
* ci(path-literal): strip comments with a string-aware scan; any import occurrence is exact
* ci(path-literal): imports need a module or index; relative globs and folders stay prefixes
src/main/ipc/worktree-path-comparison.ts kept its own areWorktreePathsEqual and
dedupeWorktreesByPath. Its Windows branch lowercased a WSL UNC path's ext4 tail, so two
case-twin WSL checkouts merged into one row in removal safety, folder-upgrade dedupe and
the SSH listing fallback. Every caller now uses git/worktree-path-comparison, which gains
the macOS /private/tmp fold the ipc copy had. worktreePathComparisonKey keeps its exact
bytes (retirement namespace keys persist it) in worktree-path-comparison-key.ts, and the
worktree-logic re-export goes.
Removes modules with no importers on main (and their tests), the unused
RELAY_DEPLOY_TEARDOWN_TIMEOUT_MS constant, and the ssh-connection-utils
re-export of ssh-auth-resolution that only its own test used.
No released build ever passed a certificate to WebSocketTransport or set the pairing TLS
fingerprint; only ws-transport's own tests used tls-certificate.ts. The tests now run over ws://.
worktreeIdComparisonKey (nullable '::' key), runtimeWorktreeIdentityKey ('\0' key) and
runtimeWorktreeLookupKey (JSON tuple) all folded the same path spelling. They become one total
key in shared/worktree/id.ts; a malformed id keys as itself. Also fixes id.test.ts literals that
were missing a colon, which made the WSL/UNC parity assertions compare null to null.
The nudge request parsed and stored a rollout block, but no build ever read a flag from it.
Drops the module, its call site, its tests, and the e2e env that fed it.
With the layout-owner switch on, the session-tabs projection and the windowless host's editor
projection matched an editor tab to its file by path only, so tabs under an owned id got no row
(or lost their tab id, color and pin). Both now use the shared editorTabShowsFile matcher, which
is path equality with the switch off.
* fix(layout): a folder spanning local and SSH repos routes to local and never stops layout frames (dark, layout-owner build only)
In a layout-owner build, main's router threw folder_workspace_connection_ambiguous for a
folder workspace whose project group mixes local and SSH repos. layout.apply for it was
rejected, and the same throw inside the layout stream failed the whole projection, so no
workspace got frames.
- Router (layout-owner build): a folder routes by its stamp, then its group's stamp (the
window's save rule), else the shared resolveFolderWorkspaceHost; ambiguous maps to local,
where the window already saves it. Terminal starts still refuse the ambiguity.
- Stream (layout-owner build): a workspace the router throws on is left out and logged once;
every other workspace keeps its frames.
Window-owned builds are unchanged: the switch folds both branches away.
* refactor(folder-workspaces): move the window's folder host rule to shared (move only)
getFolderWorkspaceHostId moves unchanged from the renderer's folder catalog to src/shared/folder-workspace-execution-host.ts so main can route by the same rule. Its one renderer dependency, getProjectGroupHostId, is a direct alias of getRepoExecutionHostId, which the shared copy calls instead.
* fix(layout): main routes folders by the window's host rule and keeps a workspace's frame when routing fails (dark, layout-owner build only)
- Router: a layout-owner build routes a folder with the window's own rule (its stamp, its SSH
target, then its group's host), shared since the previous commit. It reads no repos, so it
cannot throw, and an SSH group holding a local repo now routes to SSH, where the window saves it.
- Stream: a workspace whose routing throws keeps its last published layout instead of being sent
as removed, which would make the window drop its tabs.
- Stream: routing failures have their own logged-once flag, so they never hide a later
projection or listener failure.
- One table of folder kinds is checked against both main's router and the window's save.
* fix(layout): refuse a layout change on a workspace a WSL move has paused, and say why (dark, layout-owner build only)
* fix(layout): refuse without a toast; keep the move message in main
Reverts #30185 so the separate installer project can proceed. The restored shared command already pins skills@1.7.2 for CLI, desktop updates, and setup commands.
A restored tab re-owned inside its own workspace now tells main through
renameEditorFiles with the file's new record; main skips it for paired servers.
Main's load, save, close and tab-host read an editor tab's file by its owned id
as well as its path, behind the layout-owner switch.
* feat(layout): main records a workspace's default-tabs mark from the window (dark, layout-owner build only)
* fix(layout): record the default-tabs mark after the tab creates it covers (dark, layout-owner build only)
* test(e2e): strict default-tabs mark and exact tab count across a crash (dark, layout-owner build only)
* fix(layout-owner): main repairs a terminal stored in two panes once at startup, after moving the dropped pane's owners (dark, layout-owner build only)
* fix(layout-owner): the load repair moves the dropped pane's records and skips the write when an owner move fails (dark, layout-owner build only)
* fix(layout-owner): the load repair leaves a paused WSL move's workspace untouched (dark, layout-owner build only)
* fix(layout): a reopen that rewrites an open tab's file record reaches main (dark, layout-owner build only)
* fix(layout): compare reopened editor records without a new renderer import
* fix(startup): shell PATH probe falls back and retries when the shell cannot launch
* chore: drop hydrate-shell-path from the process-host direct-import baseline
* security: ship a locked skills installer instead of running npx
* chore: remove retired skills process import exception
* test: include the locked installer in packaged layout fixtures
* test: reuse the real installer builder for package fixtures
* perf(typecheck): pnpm tc uses the pinned Bun checker when available
bun check (Bun 1.4.3, TypeScript 7.0.2 parity, already used by CI) checks the
node project in ~29 CPU-s / ~2 GB peak vs tsc's ~98 CPU-s / ~16.6 GB. tsc's
incremental cache rarely helps agents: noEmit builds store no declaration
signatures, so the first edit to any file after a cold check re-checks every
transitive importer (a comment in src/shared/constants.ts re-checks all 18k files).
pnpm tc / tc:node / tc:web / tc:cli now pick the Bun from config/.bun-version when
it is on PATH and fall back to tsc with a one-line hint otherwise;
--compiler=native forces tsc. The pinned-Bun probe is shared with the
localization extraction check.
* build: pin Bun as a devDependency and make it the only default checker
The PATH probe left anyone without the exact pinned Bun (including a 1.4.2
global) on tsc's expensive path. bun@1.4.3 is now a devDependency, its
postinstall is allowed, and pnpm tc / typecheck:ci run that binary. A missing
binary is an error pointing at pnpm install rather than a silent fallback;
--compiler=native still selects tsc. A test keeps the devDependency equal to
config/.bun-version.
* ci: link the pinned Bun after the script-free install
--ignore-scripts leaves node_modules/.bin/bun as bun's postinstall stub, so the
typecheck runner found no binary and any pnpm-run script calling bun would hit
the stub before setup-bun's copy. pnpm rebuild bun runs only that allowed build.
* fix(ssh): move the open workspace to the server's linked project when joining an existing server
* fix(ssh): follow the active repo and detected checkouts when rehoming a linked workspace
* fix(ssh): treat a missing server row as unknown, and keep watching for it
* fix(worktrees): keep a CLI-created worktree out of listings until its metadata is saved
A watcher-driven listing during `git worktree add` surfaced the new checkout as a bare
external row. The host's default-terminal request then made that stale row active, so it
slipped past Hide sleeping and Hide CLI-created until the next refresh hid it (~1s flash).
* fix(worktrees): hold canonical checkout paths during creation
worktree.detectedList built its rows from the raw Git scan, so a folder project upgraded to Git
was published under Git's spelling (C:/x) while the host keyed its metadata and terminals by the
folder's (C:\x). Apply preserveFolderUpgradeWorktreePath at the runtime listing scan every
runtime listing reads.
Fixes#30150
A managed SSH or paired-server workspace has no SSH connection id, so the
notebook read it as local and ran its cells in the desktop's own Python
against a same-named local file. Derive the execution host from resolveOwner;
refuse remote, ambiguous and unloaded owners.
* feat(layout): main drops the layout of workspaces the catalog no longer validates (dark, layout-owner build only)
* rename the paired-host check so the switch-off bundle keeps its names
* a repo id two hosts register skips the listing purge
The chat, simulator, and browser tab recorders each computed where the window
drew a just-opened tab with the same lines. They now share drawnTabPlacement.
* feat(sidebar): main produces the local workspace rows, checked against the window (dark)
* fix(sidebar): workspace rows invalidate the listing only on metadata saves; prove it on the real cache
* fix(sidebar): workspace rows merge the listing fresh instead of invalidating the shared cache
* chore(sidebar): workspace rows comments say what the fresh merge reads
Sessions saved before #29930 can hold a moved editor tab whose
worktree id still names the workspace it came from. Pin that the
saver writes the workspace's own id and that the window's tab carries
it after main's first snapshot. Tests only.
* fix(tasks): bound GitLab all-projects fan-out to avoid runtime queue overflow
The GitLab Tasks list started one listIssues/listMRs runtime RPC per selected repo at once. With 150+ projects this, combined with other callers on the same selector, overflowed the runtime RPC call queue and surfaced "Remote runtime call queue is full".
Fetch per-repo lists through mapSettledWithConcurrency with a limit of 6 (below the queue's foreground concurrency of 8), and stop starting new calls once the selection goes stale.
Fixes#30133
* test(tasks): assert merged GitLab rows without a type assertion
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(sidebar): main takes its row baseline from the session's catalog and skips unchanged listings
* fix(sidebar): read catalog listings the way the window's merge does
* fix(sidebar): a seeding listing re-samples, and listings compare with the window's equality
* refactor(shared): move the pane title sanitizer to shared, unchanged
So main's layout Loader can apply the same rule the window applies on load.
* fix(layout): pane titles stay layout in a layout-owner build (dark)
The window stops writing a revealed terminal's tab name as its pane title,
and main's Loader drops a lone pane title that only repeats the tab's name,
as the window's load does. Both behind ORCA_LAYOUT_OWNER_IS_MAIN.
* fix(layout): the Loader compares a lone pane title with the tab bar's quick command label too (dark)
As the window's row hydration does when the row has no label.
* fix(layout): the Loader compares a lone pane title with the tab bar label, the live title (dark)
Neil
Jinwoo Hong
Max HsuandNeil