The rate-limit quota poller fetches Codex usage on app start, window
focus, and every poll. Unlike the Claude and Gemini fetchers (which read
credentials from files/keychain and hit an HTTP endpoint), the Codex
fetcher always spawns the real codex binary — 'codex app-server' over
RPC, and on RPC failure an interactive codex PTY running /status.
For users who have Codex installed but never signed in, this surfaces as
an unexpected Codex process starting in the background even though they
never launched Codex. The spawn can only fail without auth.
Gate the fetch on the presence of Codex auth (auth.json under the
resolved CODEX_HOME / managed-account home). When absent, return
status 'unavailable' without spawning anything, mirroring how the other
providers stay quiet until configured. Signed-in users are unaffected.
Adds configurable macOS shortcuts for renaming the active terminal tab and active workspace, with review follow-up fixes for conflict detection, sidebar reveal, lineage child rename surfaces, and floating workspace focus scoping.
Avoid Electron 42.3.x's broken bulk UTF-8 conversion when persisting stats JSON. The crash loop reproduced when sparse non-ASCII strings in orca-stats.json were rewritten after restored terminal activity triggered a debounced stats save.
Add regression coverage for the sparse non-ASCII payload and surrogate-pair boundary handling.
* fix: write stats file in chunks to avoid Electron UTF-8 abort
orca-stats.json gains an event on every agent start/stop. After about a
month of use mine had grown to ~3.6k events / ~608 KB, and the app started
hard-crashing a few seconds after every launch (SIGTRAP, no catchable JS
stack):
Assertion failed: (length + 1) <= (capacity())
node::MaybeStackBuffer<char>::SetLengthAndZeroTerminate <- node::Utf8Value
The crash is in StatsCollector.writeToDiskSync(), which saves the whole
file in one writeFileSync(JSON.stringify(data)). Electron 42.3.2's bundled
Node aborts when encoding a string that large to UTF-8 in a single write;
stock Node 24 handles the same file fine and the data is well-formed, so
it's an Electron/Node encoding limit, not bad data. The save runs on a
debounce after agent_start, which restored agents fire on launch -- so it
crashed right after opening.
Write the JSON in 64 KB slices through one fd instead (never splitting a
surrogate pair), and lower MAX_EVENTS 10k -> 1k so the file can't grow back
this large. Lifetime aggregates are unaffected.
Verified by reproducing the abort standalone with the real 608 KB file
under ELECTRON_RUN_AS_NODE, confirming the chunked writer round-trips it
byte-for-byte with no crash, and running a patched build that loads the
file without crashing. The underlying encode abort is an Electron/Node bug
to report upstream.
* fix: harden stats JSON writes
* fix: chunk app state UTF-8 writes
* fix: stabilize status and terminal polling
---------
Co-authored-by: thiagomsoares <5190162+thiagomsoares@users.noreply.github.com>
* fix: write stats file in chunks to avoid Electron UTF-8 abort
orca-stats.json gains an event on every agent start/stop. After about a
month of use mine had grown to ~3.6k events / ~608 KB, and the app started
hard-crashing a few seconds after every launch (SIGTRAP, no catchable JS
stack):
Assertion failed: (length + 1) <= (capacity())
node::MaybeStackBuffer<char>::SetLengthAndZeroTerminate <- node::Utf8Value
The crash is in StatsCollector.writeToDiskSync(), which saves the whole
file in one writeFileSync(JSON.stringify(data)). Electron 42.3.2's bundled
Node aborts when encoding a string that large to UTF-8 in a single write;
stock Node 24 handles the same file fine and the data is well-formed, so
it's an Electron/Node encoding limit, not bad data. The save runs on a
debounce after agent_start, which restored agents fire on launch -- so it
crashed right after opening.
Write the JSON in 64 KB slices through one fd instead (never splitting a
surrogate pair), and lower MAX_EVENTS 10k -> 1k so the file can't grow back
this large. Lifetime aggregates are unaffected.
Verified by reproducing the abort standalone with the real 608 KB file
under ELECTRON_RUN_AS_NODE, confirming the chunked writer round-trips it
byte-for-byte with no crash, and running a patched build that loads the
file without crashing. The underlying encode abort is an Electron/Node bug
to report upstream.
* fix: harden stats JSON writes
---------
Co-authored-by: thiagomsoares <5190162+thiagomsoares@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(tabs): make the active tab clearly stand out
The active tab was marked only by a 1px dark-navy line on its top edge,
which read as just another border and was easy to lose in a long, busy
tab strip.
Replace it with a 2px `primary` bar on the bottom edge (bridging the tab
into the panel it controls), a subtle theme-uniform background lift, and
brighter text. The bar leads in both light and dark; the lift uses a
color-mix wash instead of `accent`, whose contrast against `card` is
near-zero in light mode but heavy in dark, so the two themes no longer
lead with different cues. Applies across terminal, browser, and editor
file tabs via the shared indicator constant and wrapper styling.
* fix(tabs): centralize active tab styling
Co-authored-by: Orca <help@stably.ai>
* fix(git): cache missing upstream status probes
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): defer sustained ANSI redraw bursts
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
## Summary
- stop the macOS helper from unlinking caller-supplied socket and token paths
- keep parent-owned token cleanup tied to the helper startup that created it
- fail closed for non-socket socket-path collisions and cover helper cleanup races with regression tests
## Verification
- swift test --package-path native/computer-use-macos
- pnpm exec vitest run --config config/vitest.config.ts src/main/computer/macos-native-provider-client.test.ts
- pnpm run typecheck:node
- pnpm lint
- pnpm run build:computer-macos
- Electron/helper startup smoke validation
- Remove the Groups nav rail; filter shortcuts by search + status only
- Fold keybindings.json path into the subsection subtitle and move the
Edit File in Orca action into the header
- Replace the floating hover-card action popover with an inline recorder:
keycaps (or an Add shortcut placeholder) click to record in place, and
Reset/Disable reveal on row hover/focus
- Fix a grid align-content stretch bug that opened a large gap between
shortcut groups in the scroll area
Co-authored-by: Orca <help@stably.ai>
* Track explicitly slept worktrees in session state
- Persist user sleep intent separately from inactive terminal/browser state
- Use slept markers for sidebar, jump palette, kanban, and activation deferral
- Preserve slept markers across local, web, and remote workspace sessions
* Preserve slept worktree state across remote sync
- Merge remote sleep/default-terminal markers by target workspace so remote
hydration does not discard local markers
- Let Sleep run for selected worktrees even when they only have preserved
wake hints, while avoiding reconnects for explicitly slept legacy sessions
* Allow session snapshots without slept worktree ids
* Default repo avatars to the GitHub upstream owner and flag forks
Make the GitHub owner avatar the default repo icon and surface it as the
primary choice in the icon picker (the "Image" tab becomes "Avatar",
moves first, and opens by default). For forks, resolve the upstream/
parent owner so the avatar reflects the source repo instead of the
personal fork, and show a fork indicator (GitFork glyph + "Fork of
owner/repo" tooltip) next to the repo in the sidebar and settings.
Fork detection prefers the offline `upstream` remote, falling back to a
`gh repo view --json isFork,parent` lookup; the resolved upstream is
stored on the repo. Existing repos self-correct via a one-time startup
backfill (local repos) and a lazy backfill when their icon settings open
(SSH repos); new repos resolve at add-time. Reset now restores the
default (re-detecting the upstream) instead of clearing to the Folder
icon.
* Harden repo upstream avatar handling
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
The Pinned section mixes worktrees from every repo, yet cards identified
their repo only by a color dot — and showed no repo cue at all when the
sidebar was grouped by repo (hideRepoBadge). Render each repo's configured
icon (lucide/emoji/image) as a leading glyph on pinned cards regardless of
grouping, so a mixed-repo pinned list is scannable at a glance.
Extract a shared RepoIdentityChip so the pinned icon and the compact inline
badge use one chip + tooltip shell.
Neil
Brennan BensonandOrca
Benny Jiang
Andrii Valenia
Jinwoo HongandOrca
Jinjing