46 commits from main. Conflict resolutions (branch structure wins, main
semantics grafted):
- pending-backlog cap (#7630): main's capPendingPtyData/droppedBacklog
2MB tail-trim EXCISED — this branch's droppedOutput sentinel mechanism
(O(1) drop + query salvage + settings-scaled cap + restore marker)
already bounds the unsent backlog and strictly supersedes it; carrying
both would race two cap policies over one buffer. Kept main's
makePtyDataPayload helper and exit-time pending flush (adapted to the
sentinel). Main's duplicate never-ACK cap test removed (covered by the
existing sentinel cap tests); its reload-gate tests kept with the
runtime mock extended.
- replay guard (#7661): main's blind REPLAY_GUARD_RELEASE_FALLBACK_MS
release dropped — this branch's probe-certified stall release covers
the same cold-restore reattach lockout without the auto-reply leak a
timed release can cause in agent TUIs. Main's three regression tests
KEPT, adapted to probe timing (explicit stallCheckMs).
- hidden-pressure scenario: kept this branch's STRICT 1500ms restore
budget (the background keep-tail global budget earns it; main relaxed
to 4s for CI drain overhead) + grafted main's timer-drift gate const.
- ssh-docker-relay-perf: kept this branch's ACK-stalled background PTY
test AND grafted main's new file-streams+git-churn test (4 tests).
- preload/renderer: droppedBacklog threading excised with the mechanism;
main's unrelated changes (ssh importConfig reAdopt, etc.) kept.
Gates: typecheck clean; ipc+daemon+terminal-pane+pane-manager suites
4,396 passed / 14 skipped.
Co-authored-by: Orca <help@stably.ai>
oxlint already fails any file over max-lines that is not suppressed, so the
only way to grow past the budget is to add an eslint/oxlint-disable max-lines
comment or a per-file max-lines bump in mobile/.oxlintrc.json. This adds a CI
gate that freezes the current set of suppressions (config/max-lines-baseline.txt,
355 grandfathered entries) and fails the build when a NEW one appears — with a
loud, actionable message pointing at 'split the file'. Existing oversized files
are untouched; the baseline may only shrink (pnpm check:max-lines-ratchet --prune).
Wired into the root lint script and as a dedicated pr.yml step. Unit-tested
(15 cases) and verified against all three failure paths + clean-tree pass.
Co-authored-by: Orca <help@stably.ai>
* Revert "Preload the daemon windowsHide shim via --require; wrap promisify custom (#7499)"
This reverts commit 8f396badaf.
* Revert "Hide console windows for children of the node.exe-hosted daemon (#7486)"
This reverts commit f0fdd3a716.
* Revert "fix(daemon): relocate daemon host image out of the install-dir kill zone (#7473)"
This reverts commit f4faafa987.
* Revert "fix(pty): keep runtime dirs a surviving daemon still uses (#7463)"
This reverts commit 3cd23a13a1.
* Revert "Relocate node-pty ConPTY runtime outside the Windows install dir (fixes update-time terminal loss) (#7421)"
This reverts commit 509c41e2bf.
Conflict: src/renderer/src/lib/github-links.ts (parsing core lives in
src/shared/github-links.ts on this branch). Kept our shared-module
structure; grafted main #7371 semantics into it: exported the named
GitHubIssueOrPRLink type from shared, and the renderer wrapper keeps
normalizeGitHubLinkQuery with the stricter HTTP_URL_PREFIX_RE check and
the new directLink result field.
Also extracted seeded-test-repo.ts from tests/e2e/helpers/orca-app.ts:
the merged fixture crossed the max-lines cap, and the seeded-repo
helpers were a self-contained concept.
Auto-merged hot files verified: main-side changes are spawn-time CWD
canonicalization (#7334/#7403) and a mobile fit-override rebind hook
(#6596) - not on the delivery/restore path, so no bench required per
the branch guide. Throttled wait-blocked machinery intact.
Validated: typecheck clean; daemon + ipc/pty + terminal-pane + both
fuzz suites + github-links run - all failures are pre-existing
Windows-environment ones (identical on a main-based tree), zero
merge-caused.
Register-PSRepository -Default failed inside the legacy nuget.exe provider
with "Missing option value for: '-source'" on the hosted windows-2022 image,
leaving PSGallery unregistered so the subsequent Set-PSRepository threw
"No repository with the name 'PSGallery'".
Prefer Microsoft.PowerShell.PSResourceGet (bundled with PowerShell 7.4+),
which has PSGallery registered by default and avoids that code path; fall
back to PowerShellGet with an explicit NuGet-provider bootstrap only when
PSResourceGet is unavailable.
Co-authored-by: Orca <help@stably.ai>
Main inlined an OSC 133 parser with new 133;C onCommandStarted support;
our branch parses via the shared scanner so main-side side-effect facts
stay byte-identical. Resolution keeps the shared-scanner architecture and
adds 133;C to it; the foreground-agent tracker hooks into the branch's
single handleCommandFinished policy (bytes and sideEffect facts alike).
Co-authored-by: Orca <help@stably.ai>
The build-identity guard only knew vX.Y.Z and vX.Y.Z-rc.N, so suffixed
perf RCs cut fine but every platform build refused the tag and the
releases published empty.
Co-authored-by: Orca <help@stably.ai>
rc kind can now append an extra prerelease identifier (rc.N.perf):
sorts above its base rc.N but below rc.N+1, so perf-branch RCs are
identifiable by clients without outranking the main RC series.
Co-authored-by: Orca <help@stably.ai>
* Verify Windows app executable signing
* Isolate Windows signing verifier tests
* Handle direct Windows installer extraction
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(terminal): converge post-spawn PTY size reconcile to fix split-mount column desync
Follow-up to #6644/#6649. Those added a post-spawn PTY reconcile but capped
it at a FIXED 12 requestAnimationFrames whose counter advanced even on frames
where the pane was unmeasurable or the split layout had not yet equalized. When
a tab MOUNTS with a split layout already present (a new worktree opened with the
side split panel on), the real narrow split width settles AFTER frame 12, so the
reconcile gave up while xterm had reflowed narrow and the PTY stayed pinned at
the wide spawn width. The corrective xterm onResize is dropped during the hidden
mount window (isRendererPtyResizeAuthoritative() is false), so process.stdout.columns
stayed wide and interactive TUIs (Claude Code) rendered garbled until a manual resize.
Extract the reconcile into pty-size-reconcile.ts with an authoritative-gated
convergence loop instead of a fixed frame budget:
- While the pane is hidden (onResize dropped), the reconcile is the SOLE corrector:
it keeps polling and forwarding every grid change (its transport.resize bypasses
the visibility gate). Hidden frames never advance the settle counter.
- Once visible AND stable for SETTLE_FRAMES, it hands off to the live
onResize/ResizeObserver path, which reliably catches any later reflow.
- Hard cap (MAX_FRAMES) guarantees termination; mobile-fit/locked frames are
skipped; the reconcile handle is cancelled on dispose.
Harness: pty-size-reconcile.test.ts (14 tests) drives the loop with a deterministic
frame scheduler; the desync-repro tests fail against the old 12-frame logic and
pass on the fix. Adds an e2e "MOUNTS with a split layout present" test.
Caveat: headless Electron does not reproduce this layout-settle-after-rAF race
(the existing golden e2e passes even against the old buggy logic), which is why
#6644/#6649 merged with green e2e yet the bug persisted. The unit test is the
real regression harness; the e2e tests are integration smoke.
Made with [Orca](https://github.com/stablyai/orca)
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): re-assert PTY size on visibility resume to heal stubborn column desync
Follow-up within the same fix: the user reported "sometimes even resizing
doesn't fix it." Root cause beyond the mount-timing race — the renderer forwards
resizes fire-and-forget and dedupes on the size it THINKS it sent, but never
learns the PTY's actual size. A resize dropped main-side (the pane was hidden,
a mobile take-back resize-suppression window, or a provider no-op) leaves xterm
and the PTY silently diverged; a later same-cols layout fires no onResize, so it
never self-corrects.
Expose the PTY's last-APPLIED size to the renderer and re-assert on show:
- New read-only IPC pty:getSize -> ptySizes.get(id) (the size written only when
a resize actually lands or at spawn — the authoritative "what the PTY believes
it is"). Wired through preload (window.api.pty.getSize) + api-types.
- On visibility resume (noteVisibilityResume), the pane re-fits, reads the PTY's
real size, and re-asserts via forwardPtyResize ONLY on genuine drift — so no
spurious SIGWINCH on an already-synced resume (which would jar alt-screen TUIs).
Routed through forwardPtyResize so the authoritative/mobile gates are
re-checked at send time; remote-runtime PTYs (separate viewport channel) are
skipped; overlapping resumes coalesce to one query.
Also register pty:getSize in the registerPtyHandlers removeHandler cleanup block
so re-registration (macOS re-activate / new window) doesn't throw on a duplicate
ipcMain.handle, and make the pty IPC test mock throw on duplicate channels like
real Electron so this class of omission is caught going forward.
Tests: 7 resume-reassert cases (drift / match / null / remote-skip /
mobile-fit-skip / hide-during-hop / overlap-coalesce), all non-vacuous. Full
terminal-pane + pty IPC suites green (1494 tests); typecheck (web+node) + oxlint
clean; e2e desync specs pass against a fresh build.
Made with [Orca](https://github.com/stablyai/orca)
Co-authored-by: Orca <help@stably.ai>
* Stub PTY getSize API and skip redundant Wayland GPU sandbox tests
- Implement PTY `getSize` stub in `web-preload-api.ts` to satisfy API
requirements for the web-preload environment.
- Skip the unfixed Wayland GPU sandbox negative control test if the
target base branch already contains the sandbox workaround.
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Splits the combined Mobile Release workflow into mobile-ios-release.yml (mobile-ios-v* tags) and mobile-android-release.yml (mobile-android-v* tags) so iOS App Store review no longer gates Android. Also fixes iOS signing by passing the App Store Connect API key to build_app so xcodebuild can provision via -allowProvisioningUpdates.
Merged with --admin: the only failing check is the repo-wide pr.yml '@/lib/utils' vitest break affecting all PRs, unrelated to this change.
Adds an ios-build job to the Mobile Release workflow (build + sign + TestFlight upload on a macOS runner via fastlane + App Store Connect API key), and fixes a pre-existing Mobile Checks bug where the mobile typecheck needed root deps for ../src imports.
Merged with --admin: the only failing check is the repo-wide pr.yml '@/lib/utils' vitest resolution break affecting all open PRs, unrelated to this change.
Jinwoo-HandOrca
NeilandOrca
Jinwoo Hong
OrcaWinandNeil