mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 10:27:33 +00:00
ee44140fb9b9bb184e25bfaa4adc97b3c0c7e2ed
4269
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Neil
|
ee44140fb9 | fix(terminal): scope terminal color overrides to their light/dark theme slot (#36581) | ||
 OrcaWin
|
19d6957127 | test: remove 272 low-value tests (#36750) | ||
 Jinjing
|
474e48a306 |
fix(shortcuts): avoid Plugins strikethrough shortcut conflict (#36741)
* Change Plugins shortcut defaults by platform * Test Plugins shortcut matching on all platforms * Test current Plugins default in browser shortcut forwarding |
||
 Brennan Benson
|
cca9ed5a7a |
fix(github): make Checks refresh start a new PR read (#36651)
* fix(github): start explicit Checks refreshes after the action * fix(github): give explicit Checks refreshes fresh checks and comments The same Refresh or Link click that now reads PR metadata after the action also reads checks and comments after it: an explicit request no longer joins or waits on a read begun before the click, in the renderer or (for checks) the host coalescer. A superseded read's callers show the owner's answer, so a late pre-click reply cannot repaint the panel, and comments posted during either read are kept. A lost IPC/RPC reply is reported only to the click that asked; polls stay silent as before, and a later answer clears a failure older than itself. The manual hook takes its verdict from its own lookup, the link flow's card-read failure no longer skips checks, and the web shim forwards the intent. * fix(github): land the older Checks reply when a newer explicit read fails When a click's checks or comments read fails while the read it replaced succeeds, the click's read now lands that older reply through its owner path instead of leaving the cache behind it. Post-write comments refreshes (mutation events, bulk resolve) carry the explicit intent so they cannot be answered by a read begun before the write. * test(github): drop type assertions from the explicit-refresh tests The RPC tests call the handlers with a real runtime service and spies, and the panel test passes typed fixtures straight to the hooks. * test(github): type the Checks panel fixtures for the renderer project The renderer tests build their PR fixture locally instead of importing a main-process harness, and the panel setter mocks take the hooks' SetStateAction form. |
||
|
Neil
|
df9ad9da84 | refactor(shared): colocate session failure detail readers (#36727) | ||
|
Neil
|
24d1d10da8 | refactor(shared): colocate session thread-goal contracts (#36720) | ||
|
Brennan Benson
|
c64e1f615a |
Preserve queued command and card order through recovery (#36430)
* Advertise mid-turn queueing as queued-messages.v2 Released clients read the v1 name with an unfinished queue UI; they never see v2 and keep sending immediately. * Let each desktop send choose queue or steer while the agent works The follow-up choice is now a Queue / Steer setting saved under nativeChatFollowUpBehavior, Steer by default; the old nativeChatQueueFollowUps switch, which every install saved as true while queueing was dark, is retired on load. Every reader goes through native-chat-follow-up-behavior. While the agent works, Enter follows the setting and Cmd/Ctrl+Enter sends the draft the other way; the alternate flips the setting before the queue's own rules (a waiting command still queues, prompts no one here can answer still send now) and never applies while Stopping. Cmd/Ctrl+Shift+Enter steers the head card only and leaves the draft. An idle agent's card reads Send, and the card menu no longer offers "Turn off queueing". * Hold Send on the phone to queue or steer a message mid-turn While the agent works on a host that queues, holding Send opens a Queue / Steer sheet; a choice other than the host's setting sends the alternate, resolved against the chat as it is when it lands, by the desktop's rule. Release and dismiss send nothing. The phone reads the host's new follow-up setting (absent reads as Steer), and an idle agent's card reads Send. * Read the follow-up default from one place on desktop and phone * Keep phone follow-up choices aligned with live host state * Update stream and wire fixtures for live follow-up preferences * Document minimal runtime test fixture assertions * Keep mobile preference tests in the mobile compiler project * Preserve queued input order through handover and recovery * Consolidate input selection type imports * Keep queue request capability types in the shared compiler graph * Preserve reopen admission context and bound queue projection work * feat(native-chat): queue follow-ups by default with a toggle * fix(tests): preserve projection contracts in the node compiler * fix(native-chat): retain receipt lookup after journal replacement * test(mobile): assert shared preference renders on real changes * Remove obsolete follow-up option translations * Preserve input places across journal recovery without predecessor snapshots * Keep recovered card placement tied to the exact handoff * Preserve replay source types and correct verification fixtures * Complete indexed queue selection and recovery ordering * Preserve queued input order across recovery and source replay * Fix legacy queue recovery fixture types * Use a specific name for queue pause inputs * Preserve fallback queue identity across journal recovery * Place nested storage negative directive on its constrained call * Constrain journal draft property type parameter * Remove journal input order import cycle * Preserve lazy journal counter reads within line limit * test: preserve legacy conversion and display work contracts * test: align journal refusal and restore accounting contracts |
||
|
Brennan Benson
|
de192f1e96 |
Native chat: Stop turns into Send while you type a follow-up, with a shortcut hint (#36655)
* Turn Stop into Send while the agent works and a draft has text While the agent works, the desktop composer's Stop button becomes the ordinary Send button once the draft holds text or images, and returns to Stop when the draft is empty. It sends like Enter, so it follows the queue setting; Esc still stops. Its tooltip names what Cmd/Ctrl+Enter does instead (steer when queueing is on, queue when it is off), read from the same resolver the send uses, so it is absent wherever the shortcut would send no differently. The Send/Stop decision moves into native-chat-composer-send-state so the pane stays within its size limit. * Tie alternate delivery hints to the composer submission * Combine duplicate composer test imports * Return snapshot results from composer option fixture |
||
|
Neil
|
4365547899 | refactor(shared): colocate legacy session child-work projection (#36711) | ||
|
Neil
|
893152fa0c | refactor(shared): colocate structured session event coalescer (#36708) | ||
|
OrcaWin
|
fe4595d6d6 |
test: remove 11 low-value suites and 157 individual cases (#36703)
* test: remove low-value suites and cases * test: preserve historical reliability gate evidence |
||
|
Neil
|
de53032ea4 | refactor: group journal body-admission and producer tests (#36682) | ||
 Brennan BensonandClaude Fable 5.1
|
002e975e96 |
Open chats move to the account you switch to, before their next message (#30955)
* fix(native-chat): an open chat moves to the account you switch to before its next message A running chat's agent read its account only when it started, and nothing compared it with the account a start would use now, so open chats kept answering on the old account after a switch. The agent a chat runs now records the account its launch used, and the host's replace-before-the- next-send check replaces an idle one whose account is no longer what a start would use. A chat mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the account they were created on are never compared. A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer writes its new account's list under its first account (STA-11281). Tracked in STA-11211. * fix(native-chat): declare the launch-account read for the runtime layer that wires the host * fix(claude): find custom chat history before managed-account resume * test(claude): assign the complete custom account home * Preserve unknown account model facts and legacy option replay * Clarify terminal account-switch feedback in translated locales * Keep option mutation plans checked against their contract * Cover unknown model choices across chat consumers * Keep consumer fixtures aligned with canonical types * Match the mobile picker label in its consumer test * fix: clarify terminal scope in translated Claude account settings * Update integration tests for current session and remote client contracts * Keep native worker replies on their receiving account * Preserve receiving accounts across cold starts and nested reports * Preserve the delivery receiver when reading chat commands * Clarify native reply matching and consolidate imports * Resolve catalog scope without re-entering conversation queues Give owned option mutations and delivery settlement a resolved catalog input while external reads acquire scope once. Preserve account routing, catalog lifetime and current response obligations. * Align catalog and mobile test fixtures with current contracts Explain the existing timeout budgets and provide the idle turn identity and truthful model-only picker label in the mobile fixture. * Align receiving-account readers and fixtures with typed contracts * Repair account-switch fixtures and measure receiving work * Use the checked account-home path in catalog tests * Restore executed-option recorder context * Control receiving catalog deadline test clock * Align unknown-model consumer fixtures with send capture * Consolidate session host type imports * Align cross-version catalog fixtures with host read contracts * test(native-chat): bind Runs through the current start authority in receiving fixtures Main now resolves a worker start lazily through bindRun with objective and task references, and creating a Run no longer unbinds a coordinator's earlier Runs; run-use does. The receiving fixtures follow the same production owners so every original scenario, input and bound is exercised unchanged. The receiving runtime subclass moves verbatim into its own support module. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(native-chat): follow the selected account before its folder exists A live Claude chat compared its account against the selected one only after that account's folder passed an availability check, so an account still being set up (or whose setup failed) left the chat silently answering on the previous account, and a resting chat refused its start before preparation could run. The retirement comparison and the start pre-read now ask the router for the selected route as identity, through the existing resolver purposes; catalog, create and probe reads keep checking availability. Preparation, typed launch failure and parking are unchanged. Session History details show the account a chat was last launched under when the host recorded one, else its founding home. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(ai-vault): build the stale acquisition receipt without a type assertion The History account case now reads the fixture receipt through the typed acquisition reader instead of spreading the record field through a cast; the three assertions and their inputs are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): narrow the rig acquisition link before relinking it The account-setup cases spread an optional link, which typed its id as possibly undefined; the rig always links a handle, so a guard that cannot fire narrows it. No assertion or input changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): follow main's chat admission in fixtures and bound the History account projection Chat admission no longer reads an experimental host setting, so the continuation-context test drops the spy main dropped in its own fixtures. The two History consumers that install a minimal chat host give their fake store the record accessor and host id the real store has, since the projection now reads the acquisition receipt. An operation-count contract holds the production History projection to one roster read and one record lookup per owned row at 10 and 100 rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): give the declared-effort catalog fake its capture port The declared-effort fixture builds a catalog service without the capture member the options reader asks every catalog for, which failed its desktop, catalog and phone consumers; it now supplies the inert test operation like the other fakes. The History projection contract also drops an unused map parameter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Consume main's outcome change feed in the receiving-account index Main's keyed journal records deliver each change after an epoch's frozen prefix as an outcome sequence naming touched keys instead of typed rows. The receiving-account index now re-reads those keys at their current values: queue cards by id, a deleted submission retires its exact notice, and a deleted item drives the existing recovery rebuild, with Stop marks still excluded. The in-process read row exposes the already-persisted queue.cards keys and per-key deletion facts; itemIds and submissionIds keep listing every touched key. The mobile unknown-consumer test mocks MobileSwitch as main's picker test does. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> |
||
|
Neil
|
b69a5c6c7e |
feat(themes): per-folder-name icons in plugin icon themes (#36565)
* feat(themes): per-folder-name icons in plugin icon themes Icon themes could only set one generic folder and folder-open icon, so themes like Material Icon Theme could not give src, docs or tests their own icons. Add VS Code's folderNames and folderNamesExpanded maps. They use the same lowercasing, duplicate checks, own-key records and limits as fileNames, and older Orca builds skip them. Every folder icon now goes through FolderIcon: the explorer, Source Control, diff and conflict trees, and the remote, sparse and symlink pickers. * fix(themes): match the common icon-theme fallback for open folders |
||
|
OrcaWin
|
1afbd1d559 |
test: remove eight low-value suites and 198 individual cases (#36650)
* test: remove low-value suites and cases * test: fix retained timestamps and prune flaky baseline * test: document malformed persisted-provider fixture cast * test: restore types used by retained divergence regressions |
||
|
Brennan Benson
|
0d94c0ba8f |
Native chat: queue messages sent while the agent works (on by default, Settings toggle, Cmd/Ctrl+Enter to send one now) (#36588)
* Advertise mid-turn queueing as queued-messages.v2 Released clients read the v1 name with an unfinished queue UI; they never see v2 and keep sending immediately. (cherry picked from commit |
||
|
Brennan Benson
|
4a8114375d |
Share chat option writes across desktop and phone (#36624)
* Share chat option writes across desktop and phone * Restore main's failure notice scope for chat option picks Held launch refusals toast again while the transport is still closed, desktop notices follow only the chat's presentation scope so a fence or status change on the same chat still reports, and the phone banner no longer depends on the read record. |
||
|
Neil
|
55507b87e9 | fix(plugins): link community plugins to the author's repository, not the mirror (#36638) | ||
|
Brennan Benson
|
233b3dc704 |
Make explicit hosted review refresh fetch current provider state (#36522)
* Make explicit hosted review refresh read current provider state * Name the right provider and keep GitHub's own copy when a Checks refresh fails A failed manual refresh now names the repo's provider (from the review, its link, or the remote), clears once a newer read lands for the panel, never stops GitHub checks and comments from refreshing, and gives way to GitHub's classified sign-in or rate-limit copy. The copy is one interpolated line in every locale. * Read after the write when Orca merges, closes, reopens or edits a GitLab MR Every GitLab merge request write now drops the host's cached review lookups for the repository, and the Checks panel's follow-up read can't join a poll that began before the write, so merging in Orca shows Merged and Delete Workspace without a manual Refresh. A user refresh also forgets Gitea's shared repository scan before reading. * Clear a failed Checks refresh only on a real provider read The host now tells the desktop store, when asked, whether its answer came from a provider read it stored as current or from a cache or last-good fallback. The Checks panel keeps a failed Refresh until such a read lands, a click succeeds, or the context changes. On GitHub the PR read owns the refresh status, so a failed review-card read no longer raises the generic failure. * Don't let a joined host lookup clear a failed Checks refresh A poll that joins a lookup already running for an earlier request didn't start that read, so its answer can't show the provider recovered after the failure. Only the request that started the stored lookup reports a provider read now. The host read also uses the shared reply outcome directly, and the renderer writes the provider-read generation where it publishes the entry. * Type the Checks refresh breadcrumb for every review provider The breadcrumb already received Bitbucket, Azure DevOps and Gitea values; its annotation now says so. Tests build typed fixtures instead of asserting types. * Test the read-outcome reply at IPC, RPC and runtime, and the post-merge read The flag reaches the runtime, and only a caller that asks gets the envelope, including for a definitive null. After Orca merges, the card read starts after the write, and its failure leaves the merge reported as done. * Use a boolean for the empty-state fixture's remote-operation flag * Trim redundant hosted-review refresh tests * Keep the signed-out GitHub empty-state test |
||
|
Neil
|
b45d71bf8d |
plugins: ask "Make sure you trust <publisher>" before installing any non-official plugin (#36271)
* plugins: ask "Make sure you trust <publisher>" before installing any non-official plugin * plugins: show the derived publisher in the install trust dialog * plugins: rebase install trust dialog onto main; register its copy as protected |
||
 Jinwoo Hong
|
bf13e6cc76 |
Guard concise orchestration list output against long text (#36625)
One table-driven test keeps every concise orchestration list row short when stored text is huge. Concise run-list cuts each Run's objective to one line of at most 160 characters; --full is unchanged. |
||
 Brennan BensonandCodex
|
2cc33b8d89 |
fix(native-chat): save each chat change as keyed records and reopen from the newest (#36024)
* Save native chat state and restore only its journal tail Publish versioned reducer checkpoints atomically, checkpoint through the chat write queue, and backfill closed chats without retiring journal rows. Co-Authored-By: Codex <noreply@openai.com> * Keep checkpoint recovery durable and skip unchanged captures * Keep journal timer and restart fixtures compatible with checkpoints * Keep checkpoint performance tests focused on operation contracts * Remove unused benchmark import * Restore journal append interception and control Stop fixture time * Compare saved reducer state without a key assertion * Supply thread scope in checkpoint test appends * Prove restored journal consumer paths * test: exercise restored consumer backward pagination * fix: pace journal backfill with a monotonic clock * refactor: keep journal opening cursor checks together * refactor: project chat journal state in the append transaction Track isolated reducer mutations and persist keyed changes under a savepoint before adopting committed state. Keep appends working through projection lag and repair coverage on the write lane, including legacy bootstrap. Co-Authored-By: Codex <noreply@openai.com> * fix: keep reducer objects live across journal commits The draft isolates every write until COMMIT, then writes each dirty copy back onto its original, so submissions, items and queue cards handed out before a commit keep reading current values as they did with in-place folding. A failed COMMIT still leaves live state untouched. Also replaces banned Reflect.get uses and adds braces the lint rule requires. * fix: bound projection repair and check the invariant after notification Failed publications and savepoints back off from 1 s up to an hour, reset by a healthy incremental write or a reopen. open() no longer waits for a legacy chat's publication; the scheduled repair publishes it on the write lane. A failed open closes its handle. The equality check runs after commit notification, only when projection tests opt in or, log-only and sampled, in development, and it requires the saved coverage to match. Removes the unused streamed commit argument. * fix: keep the background projection pass proportional to chats The orphan sweep reads one state row per chat and clears orphans by session key. A chat whose fold cannot publish stops at its first damage and is skipped until its epoch or newest row changes. * fix: version the keyed projection layout as codec 2 This branch's earlier whole-state layout used version 1; it now decodes to null and the chat replays. * test: follow the append-with-fold contract and deferred publication A submission whose fold throws now rolls back with its receipt before any dispatch, so those sends are refused and nothing is recorded. The unconfirmed continuation outcome is pinned through its real cause: the agent admits the message and no delivery proof arrives. Tests that need saved state right after a chat opens publish it explicitly, the history reload clears the saved state covering its edited row, and the codex stream bound matches its capture. * test: pin projection repair backoff, background pass and N/10N costs Covers the production repair timer under a persistent failure, a legacy open that publishes after it resolves, a failed open leaving no timer, a damaged closed chat skipped until a new row, and equal per-write, reopen, sweep and closed-chat publication work at N and 10N. Projection tests opt into the per-commit equality check. * refactor: inline draft write-back helpers The repo lint bans object-typed parameters; the copy and write-back now run in the closure that already holds the wrapped value. * fix: write a new epoch's saved state in its own transaction New chats, rollovers and rewinds publish the new epoch's projection beside its rows, inside the same statement-only savepoint the append path uses, so they start covered instead of waiting a second for a repair. A projection failure there still keeps the epoch and leaves the scheduled repair to publish it. * fix: keep the sampled development check log-only on any failure A read failing inside the check must not reject an append that already committed and notified. * fix: typecheck the draft copy without closure narrowing Assign the lazily created copy through a local so strict programs that do not narrow a captured variable after ??= still see an object. * test: catch whole-table sweeps and an undecodable projection The sweep contract now records exec statements too and pins its exact keyed statement list, so a NOT EXISTS scan through exec fails it. A projection whose item stops decoding fails the per-commit check on coverage although a full replay still matches. Also fixes two test lint findings. * refactor: drop draft casts the types can carry Overlay maps and sets finish from their own typed touched keys, and present map entries are read through one helper. The two remaining generic boundaries, a draft standing for its object and finishing back to it, carry the repo's SAFETY directive. * test: show a parked damaged chat publishes after a clean epoch replaces it The replacement ends at the parked chat's newest sequence, so only the epoch in the skip key re-arms it. * test: give the seeded queued card its enqueue cursor Production records queuedAt as the cursor before the queue row; the fixture now does too. * fix: catch lagging saved chat state up in atomic pages Repair of a legacy, lagging or undecodable chat, open or closed, no longer republishes the whole chat. One runner folds the rows after the saved coverage onto a private copy of the saved prefix, at most 32 rows or about 1 MiB of row text per page, and commits each page's changed entries with the new coverage in one FULL transaction. That transaction first checks the chat's epoch and the exact saved row the page was folded from, so a page from a retired epoch or a stale base writes nothing. Pages rest between slices, and the saved prefix is decoded in pages too. An open chat runs the pages on its write lane; sends keep committing between them and skip the projection until coverage reaches the tip, then project incrementally again. The background pass hands a chat over to its open owner at a page boundary. Damage parks the chat after the pages before it, and a failed page keeps the committed ones and retries from them on the existing backoff. Whole-chat publication now runs only inside epoch transactions. * test: pin the draft layer's tracked nodes per streamed revision and acceptance A transition now reports how many objects and collections its fold reached. The scaling chat gains accepted sends (receipts and aliases) and waiting, dispatched and returned queue cards at N and 10N. A streamed revision's only growing term is the card scan, one node per card plus each returned card's body; an echo also reads every item with its body and every submission. * test: append the between-pages send by item identity appendItem takes the provider identity, not its key. * test: check every catch-up prefix of the recorded Claude and Codex streams A runner can page single rows, so the recorded streams' aliases, Stop settlement and per-row timestamps are each checked at a committed prefix against a full replay. * test: measure each backfill pass's row reads on its own The parked-chat test counted its own replay checks: 64 pass rows plus 68, 68 and 100 oracle rows made the 300 CI saw. Each timer window is now measured alone, and coverage is read from its saved row, so the unchanged pass reads 0 rows and the re-armed one reads one page. * fix: bound catch-up reads, release the finished prefix, and keep unreadable views - A catch-up page now stops reading rows at the row whose text reaches about 1 MiB, so rows past the budget are never fetched and fetched again; saved-view item and entry pages use the same budget. - An open chat drops its private prefix once coverage reaches the tip and keeps it only across a failed or parked page. - A present current-epoch view this build cannot read (another codec version or corrupt content) is no longer cleared by the first page. Its whole history must fold cleanly through the tip first; otherwise it parks untouched. A storage error while reading the view fails with backoff instead of reading as a missing view. - The pace charges only the runner's own work units, so time spent waiting on an open chat's catch-up or the write lane no longer lengthens the next rest. * test: cover takeover, epoch replacement and stop in the middle of a pass A chat opened while the pass rests is caught up by its own runner from the committed page; the pass pages it no further and does not charge the wait to its pace. A replacement leaves its new view untouched, and a stopped pass resumes after its last committed page. * test: fail the takeover test without the handover break, and the replacement test without the stale-runner guard The takeover test asserts the pass asks the open owner only twice for the handed-over chat, and pins performance.now so the open runner's pace never waits on a fake timer. The replacement now lands while the open runner is resting in its saved-view decode, so its page reaches the lane after the replacement; the test asserts no transaction opens. * test: read saved-view pages with the page budget, and await database closes The paged-decode round trip passes the row-and-text budget and checks the view decoded. Projection, scaling and ACP launch tests await the now-async test database close, so a closing checkpoint worker cannot close the next test's database. * Persist native chat outcomes with a rebuildable cache Store immutable keyed transition results with canonical ordering, fence outcome epochs, and convert legacy inputs through paced invisible generations. Rebuild disposable caches from validated outcomes and read sparse logical sequence groups without changing the wire. Co-Authored-By: Codex <noreply@openai.com> * test: repair the split suites so they parse, lint clean and find their setup Restores the describe blocks the split truncated, the loop variable it renamed, the fixture references and imports it dropped, and a stray argument pair. Moves the grandfathered flaky-pattern counts with the code that moved. * test: read outcome epochs as outcomes where the adapted assertions read input rows A replaced epoch restates its Stop in the saved pause marks, the sparse-group batch test needs an outcome epoch rather than the input-format fixture, and a revised item keeps its first place, so the held-write order is read from the replayed groups. * test: expect saved queue cards as whole values in the queue-history assertions The adapted helpers read card outcomes, which store each card's whole state, so an import or refusal shows as the card's own state change rather than as an input row. * style: format the files this PR changed * test: import each module once in two journal suites * fix: decode saved outcomes with a frozen format-1 schema, independent of the cache codec Outcome values decode through a versioned format-1 schema that never follows the live reducer type; an unknown field reads as saved by a newer Orca, and the cache codec only delegates to it, so a codec bump rebuilds the cache and nothing else. * fix: key outcomes by an integer generation and keep the cache stamp in its state row Each outcome row names its generation, the attempt's id, instead of repeating the chat id, epoch and a UUID; the cache stamp is a column of the cache's own state row, so there is one stamp to keep in step; cache ordinals are text like the outcomes they copy. Orphaned caches are swept from the per-chat state row with indexed per-chat deletes. The WSL census lists both schema files. * fix: finalize queue ownership before publishing a new epoch, and reject unreadable outcome rows Epoch replacement and rollover adopt the committed state, keep attachment claims and finalize the queue receipt before the fallible publication step, as before outcomes. Every persisted outcome row is read back through the row reader, so a row it rejects fails as journal_row_rejected. Publishing an epoch checks the epoch it replaces is still current. A key deleted and re-created in one write moves to the end of the pending changes, matching its new ordinal. * fix: open a chat synchronously and unpaced, and classify read failures by cause A user's open reads the cache or rebuilds from outcomes in one synchronous pass, like replay on main, so no background rebuild can interleave with it and nothing paces or bills it. Only an outcome decode failure is damage; a value from a newer format is refused as newer; storage errors propagate as unavailable. Writes derive cache currency from the stamp instead of a latch and ask the maintenance runner when it lags. * fix: run all journal maintenance through one paced runner per database One runner serves requested chats first, then lagging ones, one catch-up at a time, open or closed, so an open chat keeps its conversion's progress. A busy or replaced chat is skipped and the pass continues; content that cannot convert parks until the chat's rows change; storage failures back off. Background work alone pays the duty cycle. Conversion verifies the whole input once, then only the outcome tail; cache rebuilds copy outcome pages to the moving tip and stamp from the scalar outcomes. * test: adapt journal suites to generation-keyed outcomes, the merged cache stamp and the publication order Queries read outcomes by generation; the bootstrap test expects the queue receipt to finalize before publication; queue-import-scaling states the reopen's constant two key visits when it retries a failed import; append-delivery reads the outcome change index's item ids. * test: pin outcome format 1 with checked-in rows, and cover open consistency, transient reads and re-created keys A golden fixture of format-1 outcome rows covering every field and scalar must restore to the pinned chat; a cache codec bump only rebuilds the cache; an unknown field reads as newer. An open between two pages of a cache rebuild reads the whole chat from outcomes. A transient read error during open is unavailable, not damage, and the next open loads the chat. A key deleted and re-created around a new key in one row keeps live order, written or converted. * refactor: check a converting chat's epoch once, in the catch-up step that runs each page The catch-up reads the chat's epoch in the same synchronous step as the page's transaction, for conversion and cache rebuild alike, so the conversion's second copy of the check is dropped. * test: drive the maintenance runner over a real database, each guard killed by a mutation Startup sweeps, closed chats converted one at a time with a busy chat skipped, an open chat writing between conversion pages, a stop between pages, an epoch replaced mid-conversion, content parked until the chat writes again and then delivered, and a storage failure backed off rather than parked. * test: N/10N contracts for outcome appends, opens, conversion, publication, idle passes, sweeps, tail verify and wire catch-up Each counts statements through prepare and exec, rows read per table and rows and bytes written, never time, and requires the same work for a chat ten times larger: a streamed revision, a Codex plan update and an acceptance; a cached open reads no outcome; a conversion page reads one page of input and publication none; an idle background pass reads no history; a retired generation and an orphaned cache are deleted one indexed page at a time; a second verify reads only the new outcomes; a wire catch-up reads only the groups asked for. * test: shipped builds keep a new or converted outcome chat untouched The newest release refuses the chat as a newer Orca's and leaves every byte of the database as it was; a build from before that reason opens it read-only with nothing shown, refuses writes, and changes no saved row. * test: an epoch publication over an epoch the caller did not see is refused, and damage at row 1 still yields to a newer row Publishing a new epoch checks, inside its transaction, the epoch the caller last saw, and writes nothing when it changed. A chat whose first row is unreadable keeps reading for a newer build's row, as main does, and is refused as a newer Orca's. * test: old-build probes fold input rows only, and the interrupted-call probe writes inputs * test: import the state layout once in the cache test support * fix: type the tail verify's live lookups per collection, and two test call shapes The tail verify looked keys parsed from stored JSON up in a union of live maps, which does not typecheck; each format-1 collection now has a typed lookup that narrows the parsed key first, and the table is checked complete against the format's collection list. * fix: wake the maintenance runner for a request or a due retry ahead of the periodic pass One timer now wakes the runner at the earlier of the next periodic pass and the first due request or storage retry, re-derived from the waiting chats after each pass, so a request after the first pass is served within a second and a backoff retry is no longer replaced by the six-hour pass. A chat whose load swept a retired page keeps its turn instead of waiting for the next pass. Tests drive start(), requests and timers on fake time. * test: pin the draft's tracked nodes per streamed revision and acceptance at N and 10N The scaling chat gains dispatched and returned queue cards. A streamed revision's only growing term is the queue card scan, one node per card plus each returned card's body; an acceptance echo also reads every item with its body and every submission. Main's reducer makes the same scans on these rows; the draft adds one node per value reached. * test: cross-version probes read a new chat's turn end as one outcome sequence, and the kept-card downgrade uses an unconverted chat * fix: store every new write as format-tagged outcome records after an existing chat's rows, with no conversion An existing chat keeps its input rows byte for byte; its first write appends one marker row that shipped builds refuse, and its records follow. New chats hold only their marker and records. Each record carries its own format and the epoch keeps the highest format it holds, checked before a cache is used or anything is written. Opening a chat with an input prefix folds the prefix as main does and applies the records over it, deletions included, keeping prefix keys in place; catch-up pages the prefix rows, then the record groups. Background conversion and its attempts, staging, verification and publication are gone; the maintenance runner rebuilds only caches of chats without a prefix, parks a rebuild on its epoch's records rather than the newest sequence, and looks a requested chat up by its key. * test: pin the marker, prefix-plus-records reopen, record admission before the cache, cache-only runner parking and N/10N work Input fixtures stand for a chat an older build wrote: their input epoch keeps taking input rows, so the input reader still meets writer-made rows; epochs this build founds are written as it writes them. Conversion tests give way to a mixed chat whose prefix keys are deleted, recreated and updated in place, the runner's rebuild parking that later writes never re-arm, and contracts for writing to, opening and rebuilding chats at N and 10N. * fix: refuse a chat whose outcome marker is a newer version as a newer Orca's, not as damage * test: shipped builds refuse an existing chat at its appended marker, its input rows unchanged, and this build reads it whole again The probe writes three items as input rows the way an older build did, then this build's writes append one marker and outcome records; the newest release refuses the chat as a newer Orca's with every byte unchanged, the writable baseline latches read-only at the marker, and the re-upgraded build reads all six items with the prefix rows as they were. * test: read the runner's rebuild instances as rebuilds, so the parked-chat test typechecks * fix: admit saved outcome records and the cache only through a strict storage schema A saved record or cached value holding a key or union tag this build does not declare, at any depth, now refuses the chat as a newer Orca's before the cache is used or anything is written. The storage schema reuses the wire's shared definitions, completes the keys they leave out (failure facts, senders, edit patches and the rest), and closes every object and open union; string vocabularies and opaque payloads keep the wire's meaning. A compile-time check fails CI when a persisted type gains a key storage does not declare, and a checked-in corpus of every declared shape replaces the schema fingerprint, so an added optional key needs no new format. * fix: refuse an input row or legacy card holding a key this build does not declare before folding it Restating a chat on a new epoch is safe only if the open chat holds nothing this build half understands. An input row of a known kind (an existing chat's frozen prefix, with or without outcome records after it) is now checked key by key against what this build declares before main's reader normalizes it, and refuses the chat as a newer Orca's; values keep main's checks and execution options their legacy meaning. A legacy queued card whose saved body holds an undeclared key stays on disk, unadopted, as an unreadable card does. Client sends already arrive through strict request schemas, and their options through a reader that drops choices this build does not use. Main's tests that kept a newer build's unknown body kind, subject or key readable and writable now expect the refusal; the three that drove a newer Orca's approval or item through this build's own writers are removed, since this build can no longer hold one. A checked-in input prefix pins how this build folds older rows, and every value it folds into is one storage admits. * test: a persisted type holding a key storage does not declare, nested included, fails to compile * test: this build refuses a newer build's body or subject kind as a newer Orca's, keeping the row an older build deletes * fix: fold each outcome write from the row a reload reads, so an annotation the reader drops never fails the strict record write An ACP usage report with size 0 (allowed by the protocol) reached the model as an unusable window, the strict encoder refused it, and the agent was stopped mid-turn. Main writes that row and drops the annotation on reload; folding the read-back row keeps live state equal to that reload for every annotation the reader drops. * test: an echo declared without a known original is stored as null, the shape a reload reads * test: probe the downgrade refusal on both releases in the downgrade window, not only the newest * test: both releases in the downgrade window write a Claude and a Codex chat through their own writers, and this build admits every row and opens the chat as that release had it * test: rewind, replacement and rollover of a chat holding old rows, the marker and records keep what the user kept and delete the retired epoch whole * test: phone and paired catch-up over a chat holding old rows then records, from a cursor inside the old rows, draws as the clients render it * test: ACP launch decisions read an outcome chat from its cache and from its records alone, and a newer one as unreadable * Open new and mixed chats from each key's newest record and drop the saved-state cache The cache copied each key's newest record into a second set of tables and needed stamps, a paced rebuild, a savepoint fallback and a repair runner to stay usable. The records' key index already answers the same read: an open seeks from one key to the next, taking each key's newest record (deletions included) and never reading superseded revisions. A mixed chat still folds its frozen input prefix first. A send now writes only its records, the epoch's coverage and its receipt, so any failure among them refuses the send as main's row insert does. The background runner keeps only the paced sweep of retired generations, its one remaining job. The cache tables are no longer created; they never shipped. * Derive an outcome chat's last sequence from its coverage instead of recording it Every write recorded the sequence scalar beside its own records, about half the records on streamed paths. The epoch's coverage already holds it, so a read supplies it from there and a write no longer stores it. Records an earlier build stored still decode. * test: count strict admission per open, catch-up page and write of an existing chat at N and 10N Admission walks each input row it reads once (on top of main's parse), and each outcome record it reads or writes once: the open of a mixed chat walks exactly its prefix rows and admits one record per key, a catch-up page walks one row per input row it returns, and a write walks its row's read-back and admits each record it inserts. Linear in what is read, with a constant of one. * Keep a record that updated a prefix key when a later prefix fold no longer yields that key A tail record with the prefix ordinal is the key's newest value. If a later build's reducer reads the old rows differently and no longer produces that key, the value is appended instead of refusing the whole chat as damaged; only that key's place can change. * Resume each sweep page at the generation it is deleting After a page of records the sweep went back to its start position, so every later page rescanned every live chat's generation numbered below the retired one. It now resumes at that generation; a contract at N and 10N live chats pins that only a pass's first page walks them. * test: the sweeper rests nine times each page's work * Start the retired-record sweep from the chat database the attachments already take The sweep was wired through an optional parameter, so dropping it at the one production caller would have left retired records forever with every test passing. It now runs on the required journal database, and a wiring test checks that installing starts it and stopping ends it. * test: an existing chat whose first write fails keeps no marker, and the newest release still opens and writes it * test: chats the window's releases and the oldest release with this chat database wrote are edited, sent to and rewound by this build as the newest release does Each release writes a Claude and a Codex chat through its own writers. This build opens it, edits a card the old rows hold (its first write: the marker and an in-place update), sends, rewinds (every kept message and card saved again through the strict encoder) and reopens, with every commit restoring to the live chat. The result equals the newest release's after the same steps. The oldest release is resolved from tags, as the window is. * test: the released-chat writer resumes the queue after every Stop it records, and the probe reads each step's result once * test: the released-chat probe checks this build's edit, send and rewind on its own result Comparing the carried chat with the newest release's would fail the required cross-version check for any legitimate main change to those flows until the next release ships. The probe still admits every released row, opens the chat as the release and the newest release do, keeps the release's rows byte for byte with one marker, and restores to live after every commit; after that it checks the edited card, the accepted send and the rewind's survivors. The oldest release with the per-host database is named directly: it never changes. * test: the golden input prefix holds data in every keyed collection Six collections folded empty, so a change to how old rows derive their keys went unnoticed there. Eight rows v1.4.245 wrote through its own journal (an item with an execution owner, a declared echo, a removed turn, and a queued card handed over with carried history, then cancelled in doubt) follow the existing rows unchanged, and the test now requires every collection to be non-empty. * Say once, beside the marker version, that the reading of old rows under it is frozen The fold comment claimed an unheld prefix-ordinal value only moves that key; a prefix read differently can also show a key twice or bring back one the tail deleted. The marker version now states the rule: a build that reads old rows into different keys or values keys that reading off a new marker version, and duplication or resurrection is never intended. * test: the released-chat probe compares what the release wrote, not fields this build adds The open check compared whole snapshots, so a field main starts setting would fail the required cross-version job until a release ships it. It now compares the release's items, sends and cards, in order and by value, allowing added fields; the byte-identity and restore-equals-live checks are unchanged. * test: say why the first-write-failure downgrade test needs a longer timeout * Type the open-union fallback check by schema, not a bare object * Check each outcome-format key set separately so no check reads as a redundant union member * Read an open or branded string as a value in the storage key check, not as an object * Decode each newest outcome record from the value admission parsed, without parsing or walking it again or keeping its text * Match each encoded record to its change by position, so a settlement batch's encode stays linear in its mutations * Encode each changed value as the draft holds it, without reading it through the draft's tracking * test: rewind, replacement and rollover restate a chat with fixed statements and work linear in what they restate --------- Co-authored-by: Codex <noreply@openai.com> |
||
|
NeilandClaude
|
97681f3de9 |
feat(wsl): offer a \\wsl.localhost project's distro as a host; explain WSL 1 and empty distro lists (#36615)
* feat(wsl): offer a \\wsl.localhost project's distro as a host, and explain WSL 1 and empty distro lists Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl): restore the WSL hosts setting when accepting the host offer fails Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl): type the settings update stub with GlobalSettings Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWin
|
5edb1b6f9a |
test: remove 14 low-value suites and 119 individual cases (#36617)
* test: remove low-value suites and cases * test: shrink flaky-pattern counts after case removals * test: remove empty suite and stale release workflow fixture |
||
|
Brennan Benson
|
84aed85c7c |
Share chat options read ownership across desktop and phone (#36582)
* Share chat options read ownership across desktop and phone * Start a new chat context's options read at once Reads were coalesced on one queue for the whole view, so after a reconnect, provider restart, phone path change or chat switch the current read waited behind the previous context's request, up to the transport timeout. Each attachment now has its own queue: reads still coalesce to one active and one trailing request within a context, while a new context reads immediately and the old context's reply stays inert. Restores the shared option refresh contract and the reopen test to their original expectations. * Let desktop options tests wait for the shared read queue The shared read queue starts a read one microtask after it is scheduled, where the old desktop runner started it synchronously. The selection lifetime and context usage tests now wait for each read to start before asserting on it, keeping every original assertion, including one active and one trailing refresh. The paired server test compares transport targets by value, since the options view memoizes an equal target per environment. * Keep chat support projections stable between options answers Desktop and phone rebuilt the conversation, image and command support objects every render, and a host that omits commands produced a fresh empty list each time. Project them once per accepted answer. * Import options wire types once in the selection reads performance test * Keep chat support visible across a controller change Replacing the selection controller, as a desktop re-pair does, cleared the last accepted support, so slash commands, the goal row and the context meter disappeared until the next options answer. On the phone, returning to a chat before the other chat answered showed fallbacks. The support stays tagged with its session and every consumer already filters by session, so it is now kept, as before the shared owner. * Coalesce phone options rereads across turns and status changes Each new turn or host status change re-attached the phone's options reader, so a quick run of turns sent one parallel options request per turn. These changes now reread within the current context, as on desktop: one request runs and at most one waits behind it, and only the latest answer publishes. A status change that arrives while a read is in flight now waits for that read, which the transport bounds. * Restore the phone status wake assertion and type the burst test commands A refused pick is dropped rather than kept as a finished operation, and the path change replaced the options record, so no revalidation read is in flight when the status wake arrives. The wake therefore reads at once, as the original test asserted. The burst test's superseded answer now carries a real conversation command. |
||
|
Jinwoo Hong
|
47b7af097c |
Add --spec-file and one keep-open name to orchestration worker commands (#36545)
worker-start and task-create take --spec-file <path> (or - for stdin). worker-start --keep-open keeps a worker open after it finishes in one step, and worker-keep-open replaces worker-retain (kept as a hidden alias). Concise text output escapes terminal control characters in worker-written values. |
||
 Kelvin Amoaba
|
4cb86e7023 |
perf(worktree): check out new worktrees with all cores (#36559)
Git checks out with one sequential worker by default, so creating a worktree in a large repo spends most of its time writing files on one core. Every create-path command that writes the working tree (worktree add, the prepared-checkout and tip-refresh resets, and the sparse checkout) now passes -c checkout.workers=0, which gives one worker per core. On a 41,924-file clone on a 14-core Mac, git worktree add dropped from 3.8-8.3s to 2.4-3.0s. If checkout.workers is set at any scope, read with git config --get on the same host and repo as the checkout, Orca leaves it alone. Git before 2.32 does not know the key and ignores it. |
||
|
Brennan Benson
|
a1f658cc32 |
Keep settled permission notices compact on desktop and phone (#36304)
* fix(chat): collapse settled permission notices * Keep notice scroll addresses unique per rendered row * test(native-chat): cover notice scroll bounds and shared classification * fix(mobile): preserve notice summary long-press actions * Preserve mobile notice selection and caret rendering * Use type imports in mobile notice web tests * Resolve real SVG test host from mobile dependencies |
||
|
Brennan Benson
|
ae09815770 |
Support automations in Orca Mobile (#31617)
* Add host-owned automations flow to mobile * fix: resolve initial mobile automation CI failures * Preserve automation target identity and mobile action state * Preserve selected automation targets through discovery and terminal launch * Cover draft reversion after uncertain automation creation * Preserve automation target and submitted action authority * Preserve selected hosts and editor operations across restored state * Refresh mobile web bundle measurements for merged routes * Fix automation history observation and catalog scaling * Fix automation mobile presentation and merged launch bindings * Refresh measured mobile bundle sweep and correct automation test inputs * Move real-module test loads to collection and consolidate imports * Use typed row access to count worktree ownership reads * Refresh selected automation history on matching host events * Fix automation contract types and merged test imports * Fix automation theme updates and committed history ownership * Update folder terminal contract fixtures for canonical host catalogs * Consolidate historical session activation fixture imports * Repair automation contract project boundaries and owner type ports * Preserve acquired automation folder owners and fix integration lint * Retain terminal pane owners captured at connect * Use checked pane manager context in owner retention test * fix: adapt merged editor and terminal test contracts * fix: preserve captured automation targets and terminal owners * fix: honor explicit automation source clears and refusal contracts * test: construct terminal transport mocks with checked types * test: supply retained-owner context in terminal fixtures * test: align terminal fixtures with callable mocks and store ports * fix(mobile): localize automation screens and run details * fix(mobile): use automation translations in context * fix: preserve editor owner checks and automation repair guidance * fix: reconcile captured workspace contracts after main sync * Repair automation integration tests and retained target diagnostics * Keep test support owned by registered unit roots * Expose full blocked automation run reasons in menus * Anchor mobile bundle envelope to measured route sweep * fix(mobile): localize coded automation run failures * fix: preserve automation decisions and captured resource ownership * fix: qualify remaining automation workspace owner consumers * fix: preserve resolved watch and child editor owners * fix(editor): share qualified worktree watch ownership * fix(editor): reuse immutable repo ownership lookup * fix: preserve host ownership without duplicate catalog scans * fix: align automation destination host types and ratchets * fix: align mobile bundle envelope with measured sweep * fix(mobile): resolve automation setup policy before save * test(mobile): qualify reconciled automation target inspection * fix(mobile): keep server setup consent within its authority * fix: accept narrow qualified workspace owner snapshots * fix: reuse qualified owner state for workspace directories * fix(mobile): localize known automation orphan reasons * Correct automation controller and Chat harness types * Refresh editor requests after paired host restart * Refresh measured mobile web bundle envelope |
||
|
Jinwoo Hong
|
8138232c4f |
Print concise orchestration CLI output for agents, with --full for the full record (#36498)
Orchestration commands print small flat fields in text and --json by default; --full prints the previous output. Failures exit non-zero with error: <code>: <message> on stderr. |
||
 Kevin Langley Jr.
|
5e1689c835 |
feat: add Slatewave terminal theme (#9059)
Adds Slatewave to the popular dark extended catalog. Slatewave is a calm slate-and-teal palette with an existing theme family across Alacritty, Kitty, Ghostty, WezTerm, iTerm2, VS Code, Neovim, and Obsidian (https://getslatewave.com). The ANSI mappings mirror the upstream Slatewave palette exactly, so terminal output stays visually aligned with the editor themes in the same family. |
||
|
Neil
|
85edf1bba6 |
feat(plugins): show public install counts in the plugin catalog (#36537)
* feat(plugins): show public install counts in the plugin catalog * fix(plugins): tolerate the empty stats placeholder; count bundled official plugins * test(plugins): pin install-stats test clock |
||
|
Neil
|
fdc03848a5 |
fix(plugins): protect every security and destructive string from language packs (#36219)
* fix(plugins): protect every security and destructive string from language packs Language packs could rewrite trust copy outside a hand-kept list of app areas (catalog-link dialog, browser-extension Allow/Deny, Node mirror). Protected keys are now generated from structure: every key in a file that renders a security surface, a destructive confirmation, or a native message box, or that carries a // @protected-copy pragma, plus same-directory copy modules. verify:localization-catalogs fails when the list is stale. Pack strings are also capped at max(64, 4x English) characters and may not contain control or bidi characters. Validation stays strict; loading drops only the offending entries. * chore(plugins): resync protected copy keys with main * fix(plugins): cap pack strings in shared strict checks and pin new trust copy * fix(plugins): keep the packaged CLI off the English catalog * chore(plugins): resync protected copy keys with main * chore(plugins): resync protected copy keys with main |
||
|
Neil
|
584e672df8 |
fix(plugins): accept plain repo, release and tag page URLs in Git install (#36525)
* fix(plugins): accept plain repo, release and tag page URLs in Git install The Git URL install dialog refused anything without a #ref suffix, so pasting a repository or GitHub release link failed with "Add a #tag or #commit". It now reads owner/repo, repository URLs with or without .git, SSH URLs and GitHub / GitLab release, tag, tree and commit pages, pins the newest version tag (or the default branch's commit when there is none) with git ls-remote, shows that version and commit, and installs only that exact commit. * fix(plugins): let the Git install dialog close while a version check runs |
||
|
Neil
|
eff549111c | feat(plugins): link plugin pages to the README at the pinned release commit (#36527) | ||
|
Brennan Benson
|
a62f1e4955 |
Keep declared default effort visible for every chat agent (#36455)
* Show declared default effort consistently across chat agents * Leave unmappable reported effort defaults unknown * Separate default effort context from launch policy * Cover configured effort declarations without changing current input * Fix declared effort context through live options readers * Load declared effort fixtures outside test callbacks * Combine host catalog test imports |
||
|
Brennan Benson
|
5cf236730f |
Add Chat UI upgrade tip and Chat/Terminal default tiles (#36171)
* Chat UI leaves Experimental: each agent's Chat | CLI choice decides launches
Remove the experimentalNativeChat switch and every gate on it. The Chat
settings page, Default Agent Chat | CLI choice, + menu Chat/CLI rows,
source-control surface choice, Antigravity chat section and orchestration
chat-error switch are always present. What a new launch opens comes only
from the per-agent choice (no saved choice opens a chat) plus the existing
support checks.
- One lookup, nativeChatPreferenceFor, keyed by agent id so host-registered
agents read the same way; unreadable settings still open a terminal.
- A relayed desktop stamp (nativeChatDefault) maps onto the launched agent;
an explicit surface still wins. Old phones' createSupport keeps admitting
by the host's per-agent choice.
- settings.get stops publishing the retired switch keys; nothing in the
repo reads them from a host.
- Startup chat sync and hydration run when some agent can open as a chat
or the machine already holds chats.
- The retired key is stripped on load. The one-time upgrade tip from the
chat upgrade is retired with its audience record; a new record, captured
once from the raw profile, marks which existing profiles had Chat UI off.
- The window-side AI-button tab path, which only ran with the switch off,
is deleted.
* Keep profiles that had Chat UI off on the terminal
Existing users who never turned Chat UI on would otherwise see new agent
launches open as chats, since an agent without a saved choice now opens as
a chat. The one-time load step that records the new audience also sets
every known agent to CLI for those profiles, in the same save and only
when the record was absent, overwriting saved chat choices the old switch
masked. Profiles that had Chat UI on and new profiles are untouched.
Browser profiles keep their own settings, so the web client does the same
once: a stored switch that is not on seeds CLI choices, and dropping the
key marks the step done.
Agents first seen after this step open as chats.
* Agents without a saved Chat | CLI choice open as their CLI
An agent with no saved choice now opens in the terminal for everyone,
including fresh installs and agents first seen later. The one-time load
step carries what launches opened while Chat UI was experimental: with
the switch on, every known agent without a saved choice is saved as
chat; with it off, chat choices the switch masked are saved as CLI.
Existing profiles join the launch tip audience whether the switch was on
or off. Browser profiles get the same carry from their saved key.
The startup chat restore and host agent list now run only when some
agent is saved as chat or the runtime holds chats.
* Chat UI is here: a one-time tip for profiles that upgraded
Profiles saved before Chat UI left Experimental see a "Chat UI is here"
tip once, on the first launch after updating. Fresh installs, unreadable
audience records and the web client never see it.
- Had Chat UI off: says agents can now open as a chat and that the
terminal stays fully supported. "Use Chat UI" saves Chat for every
agent Orca knows (the roster the load step carries), then closes;
"Stay in terminal", close and Escape change nothing.
- Had Chat UI on: says Chat UI is now part of Orca and the terminal
stays supported; one "Got it" closes without changes.
- Both link to Settings -> Agents. The visual is an animated miniature
chat that sends a question, reads a file and draws a flow diagram,
then fades as one and repeats; reduced motion shows the finished
frame.
- The variant comes from main's once-decided audience record over a
new onboarding IPC read; the startup gate waits for it.
- FeatureTipActions takes a secondary label; the frame takes a copy
column class, used here so the buttons line up with the card's
composer. Other tips are unchanged.
- Telemetry: chat_ui_feature_tip_shown and chat_ui_feature_tip_action.
* Preserve owned terminal launches and local chat choices
* Chat UI tip: translate the miniature, honor reduced motion mid-loop
- The miniature's conversation (tab title, prompt, reply, diagram and
arrow labels) is translated in every locale; the composer, permission
chip, working row and Read verb reuse the chat's own strings. File
names, the /login route and the model name stay as written.
- The reply is one paragraph that wraps naturally; words (segmented per
locale, so scripts without spaces still stream) reveal in turn.
Diagram boxes size to their labels and arrow labels never widen the
row.
- Turning reduced motion on mid-loop jumps to the finished still with
no transitions.
- Telemetry records use_chat_ui only after the save succeeds and has a
distinct stay_in_terminal action.
- The dialog renders its own title, so the duplicate catalog copy is
gone; Use Chat UI writes the full roster without re-spreading saved
choices.
- Buttons: the primary's focus ring meets the card's bottom edge.
* Clarify chat and terminal support
* Explain worker CLI integration timeout budget
* Use checked annotations for chat graduation test fixtures
* Store agent surface default separately from per-agent overrides
* Preserve explicit Chat intent across default changes
* Preserve current browser settings during host replies
* Correct browser settings factory and regression types
* Name exported launch fixture mock types and clarify agent defaults
* Preserve settings fallbacks and complete launch test lifecycles
* Check allocated tab identity before launch fixture interpolation
* Drop file links from the Chat UI tip copy
* Register combined integration project for compiler parity probes
* Use checked settings in the launch test fixture
* Settings → Agents: "Open agents as" Chat or Terminal tiles
A new top section in Settings → Agents sets this computer's default for
how agents open: two tiles, Chat ("Rich messages, visuals and images.")
and Terminal ("Each agent's own CLI."), each with a still preview. The
chat preview reuses the tip's copy and flow diagram; the terminal preview
draws Claude Code's interface in the user's terminal theme and font.
- Picking a tile writes only agentDefaultSurface, through the same queue
as the per-agent Chat | CLI rows. The tiles show the saved default; an
agent set on its own row keeps its choice and is not reflected up top.
- If any agent's own choice differs from the new default, one toast names
them ("Claude and Codex stay in the terminal, as you set.") with "Set
all to Chat" / "Set all to Terminal", which drops those choices so they
follow the default. Only agents whose row offers Chat | CLI count. No
toast when nothing differs, and never from the tip.
- "Choose per agent" scrolls to and focuses the Installed list.
- Shown for this computer only (not on a paired host's page); the web
client gets it too. Searchable as "Open agents as".
- Copy in all locales; the tip's intro copy in other locales also drops
"file links", matching English.
* Fix Chat UI settings navigation and acknowledged preference actions
* Keep the agent default surface controls in full Settings
* Keep the per-agent navigation button free of link underlining
* Use checked types and existing presentation primitives for Chat UI tips
* Preserve retired Chat preference data privately
* Align chat E2E fixtures and capture pane lifecycle evidence
* Use typed raw settings in retention contracts
* Fix Chat UI settings search types and localization catalogs
* Consolidate transcript diagnostic imports
* Keep setup-only dependency changes out of the branch
* Update dev education history expectation for Chat UI tip
* test: align chat fixtures with live pane and native menu contracts
* test: capture relay tab selection loss diagnostics
* test: wait for owned shells before synthetic chat fixtures
* test: preserve all-host visibility in SSH observer
* test: bind synthetic transcript fixtures before provider seeding
* test: assert selected chat owner after narrow image preview
* ci: allow fifth compiler project to complete comparison
* Drop 'keeps getting better' from the Chat UI tip's terminal line
* Trim the empty space above the Chat UI tip's visual
* Tighten the space above the Chat UI tip's flow diagram; undo the card resize
* Tighten the Chat UI tip's reply and diagram spacing
* Give the tip's flow diagram a little more room and shorten its tab bar
* Type the web-terminal fixture's chat map without an assertion
* Right-click the selection itself in the chat copy spec
|
||
|
Brennan Benson
|
76cf164cf9 |
Chat UI leaves Experimental: each agent's Chat or CLI choice decides what opens (#36110)
* Chat UI leaves Experimental: each agent's Chat | CLI choice decides launches Remove the experimentalNativeChat switch and every gate on it. The Chat settings page, Default Agent Chat | CLI choice, + menu Chat/CLI rows, source-control surface choice, Antigravity chat section and orchestration chat-error switch are always present. What a new launch opens comes only from the per-agent choice (no saved choice opens a chat) plus the existing support checks. - One lookup, nativeChatPreferenceFor, keyed by agent id so host-registered agents read the same way; unreadable settings still open a terminal. - A relayed desktop stamp (nativeChatDefault) maps onto the launched agent; an explicit surface still wins. Old phones' createSupport keeps admitting by the host's per-agent choice. - settings.get stops publishing the retired switch keys; nothing in the repo reads them from a host. - Startup chat sync and hydration run when some agent can open as a chat or the machine already holds chats. - The retired key is stripped on load. The one-time upgrade tip from the chat upgrade is retired with its audience record; a new record, captured once from the raw profile, marks which existing profiles had Chat UI off. - The window-side AI-button tab path, which only ran with the switch off, is deleted. * Keep profiles that had Chat UI off on the terminal Existing users who never turned Chat UI on would otherwise see new agent launches open as chats, since an agent without a saved choice now opens as a chat. The one-time load step that records the new audience also sets every known agent to CLI for those profiles, in the same save and only when the record was absent, overwriting saved chat choices the old switch masked. Profiles that had Chat UI on and new profiles are untouched. Browser profiles keep their own settings, so the web client does the same once: a stored switch that is not on seeds CLI choices, and dropping the key marks the step done. Agents first seen after this step open as chats. * Agents without a saved Chat | CLI choice open as their CLI An agent with no saved choice now opens in the terminal for everyone, including fresh installs and agents first seen later. The one-time load step carries what launches opened while Chat UI was experimental: with the switch on, every known agent without a saved choice is saved as chat; with it off, chat choices the switch masked are saved as CLI. Existing profiles join the launch tip audience whether the switch was on or off. Browser profiles get the same carry from their saved key. The startup chat restore and host agent list now run only when some agent is saved as chat or the runtime holds chats. * Preserve owned terminal launches and local chat choices * Clarify chat and terminal support * Explain worker CLI integration timeout budget * Use checked annotations for chat graduation test fixtures * Store agent surface default separately from per-agent overrides * Preserve explicit Chat intent across default changes * Preserve current browser settings during host replies * Correct browser settings factory and regression types * Name exported launch fixture mock types and clarify agent defaults * Preserve settings fallbacks and complete launch test lifecycles * Check allocated tab identity before launch fixture interpolation * Register combined integration project for compiler parity probes * Use checked settings in the launch test fixture * Preserve retired Chat preference data privately * Align chat E2E fixtures and capture pane lifecycle evidence * Use typed raw settings in retention contracts * Consolidate transcript diagnostic imports * test: align chat fixtures with live pane and native menu contracts * test: capture relay tab selection loss diagnostics * test: wait for owned shells before synthetic chat fixtures * test: preserve all-host visibility in SSH observer * test: bind synthetic transcript fixtures before provider seeding * test: assert selected chat owner after narrow image preview * ci: allow fifth compiler project to complete comparison * Type the web-terminal fixture's chat map without an assertion * Right-click the selection itself in the chat copy spec |
||
|
Kelvin Amoaba
|
10ffe0c940 |
fix(agent-status): stop showing Claude as Working after a hook blocks the prompt (#36495)
* fix(agent-status): settle a Claude pane when a prompt hook blocks the prompt Claude fires no Stop after a UserPromptSubmit hook blocks the prompt, so the pane stayed Working: 2 minutes until the OSC 7501 fallback, or until the next turn when Claude's idle landed before Orca's own prompt hook. A prompt now claims the program's working run, and a claimed run that goes idle without a result or user input settles the turn the way a plain Stop would, in either order. Input during the run (Escape, Ctrl+C) leaves the verdict to interrupt inference, and relayed panes keep the relay's adjudication. * fix(agent-status): keep a typed prompt from claiming an earlier rested run Any input since the run began now withdraws its rest from the blocked-prompt settle, so the keystrokes of the next prompt stop a stale idle run from being claimed if that prompt's hook lands before its own working report. |
||
|
Neil
|
2b00c57182 |
fix(agents): accept launch-time --model and --effort for grok (#36480)
* fix(agents): accept launch-time --model and --effort for grok Grok's session option catalog already maps model and reasoning effort to -m / --reasoning-effort, but it did not opt into worker launch preferences, so orchestration worker-start rejected --model/--effort for grok. Opt the catalog in and list Grok in the CLI help and docs. Fixes #36199 * test(orchestration): use an agent without launch preferences in the federation rejection test |
||
  Vyacheslav ScherbininandNeil
|
a5321f30cf |
fix(text-generation): discover installed CLIs when naming chats (#35954)
One-shot POSIX text generators (chat naming, commit/branch/PR text) passed a bare CLI name to the supervisor, whose PATH-only lookup missed version-manager installs (e.g. nvm) that native chats already find when the GUI process PATH omits them. Resolve bare commands with the existing guest-aware installed-CLI resolver, searching relative and empty PATH entries from the agent's launch cwd so project recipe CLIs keep precedence, and share that PATH resolution with Codex structured launch. Fixes #35942 Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
fba64aef1b | fix(wsl): keep the orcad idle window out of user shells; require the agent for discovered effort menus (#36492) | ||
|
Brennan Benson
|
37ef6e9268 |
Explain Git Bash console exhaustion when terminal startup fails (#36422)
* Report Git Bash console exhaustion when terminal startup fails * Observe initial terminal diagnostics before startup output changes * Keep terminal startup diagnostics scoped to fresh launches * Preserve claimed terminal failure provenance * Finalize terminal startup failure classification at producers * Preserve terminal creation provenance and startup warnings * Correct startup diagnostic test type boundaries * Use a typed startup projection test adapter * Consolidate startup readiness diagnostic imports * Exercise installed DLL format fixture through terminal startup failure * Use checked startup failure test dependencies * Preserve exact DLL fixture bytes on checkout * Align terminal regression fixtures with exit contracts * Complete exit verdict expectations in runtime contracts * Drive ConPTY startup before fake-clock foreground checks * Cover formatted capacity failures in terminal error toast * test: preserve neutral exits after terminal wait integration |
||
|
Brennan Benson
|
dfa617cc67 |
Show each chat’s account in Session History details (#35392)
* Show recorded session accounts in History details * Fix session account lint failures and extract presentation * Isolate session account cards from unrelated settings updates * Keep session account labels tied to available current roster evidence * Add English session account labels * Share recorded session account observation and isolate optional stream evidence * Verify healthy account and usage consumers during optional registry loss * Bound session account comparisons and acquisitions * Use nonmutating reversal in account peer tests * Type the account subscription replay fixture without assertions * Repair account directory types and integration fixture imports * Give account details fixture a portable return type * fix: release account streams on transport abort * test: name desktop account stream IPC event type * chore: temporarily expose e2e compiler diagnostics * test: type account stream unsubscribe as callable |
||
 Kelvin AmoabaandZheNing Hu
|
add1778e4a |
fix(terminal): link a URL wrapped inside a table cell on every row (#36482)
* fix(terminal): link a URL wrapped inside a table cell A markdown table rendered by an agent TUI wraps a long URL onto extra rows of its own cell, leaving the sibling cells blank. Two gates in the hard-wrapped HTTP builder rejected that layout, so the link stayed cut at the first row and opened a truncated URL: - a changed prefix under a second left frame was always read as an adjacent table cell, and - only the padding up to the URL's own right frame is cell-local, so a populated sibling cell to the right killed the row. Treat a blank gutter between the frames as the same cell continuing, and only require the URL's own cell padding to be blank. A blank-gutter continuation is also enough evidence to join a two-row URL, which the previous three-row minimum ruled out. * fix(terminal): join a two-row URL in the first table column A URL that starts in the left table column continues through the unchanged-prefix branch, so no blank sibling cell marks its continuation row and the row-count guard dropped the second row. Count the blank cells right of the URL as continuation evidence for that layout too, and keep single-column tables on the three-row minimum so a complete URL that happens to end at the cell border is not glued onto the next table row. * fix(terminal): join a table-cell URL only when its row's other cells are blank A wrapped table cell leaves every other cell on its continuation rows blank, so that one rule now decides a two-row join in any column. This replaces the adjacent-cell gutter count and the first-column 0.95 border threshold. Checking only the adjacent cell glued a next table row like `│ 2 │ │ notes │` onto the URL above it. * fix(terminal): end a table-cell URL at a row whose right-hand cells are filled Below the URL's first row, a filled cell to its right starts a new table row. Text beside an overlay with no table frame is not a sibling cell either. * fix(terminal): end a table-cell URL where the cells left of it change Every continuation row of a wrapped cell shows the same cells to its left, so a row that fills them again (a repeated label) starts a new table row. * fix(terminal): apply table-cell rules only to rows that keep the table frame An overlay's gutter can show a frame beside its first row only; those rows vary by design and keep the overlay join. * fix(terminal): count cells right of a URL as a table only when they close with a frame A split pane or screen text beside an overlay ends without a closing frame and is not a sibling cell. --------- Co-authored-by: ZheNing Hu <adlternative@gmail.com> |
||
|
Brennan Benson
|
12edee3ac6 |
Choose default models and effort for agents (#36210)
* Add host-owned model and effort defaults to agent settings * Unify terminal defaults and raw argument precedence * Keep agent model defaults typed through creation * Preserve quick-create prompt through preparation * fix: complete execution-host preference boundary and CI contracts * Preserve raw options until a replacement is emitted * Complete launch choice ownership and consumer contracts * Align launch contracts with compiler boundaries and consolidate proof * Name exported fixture mocks and verify ordered chip removal * Preserve typed choices across compound legacy publication edits * Preserve non-emitted composed launch choices through legacy edits * Preserve rollback omissions and settle agent launches before success * Carry terminal draft ownership through launch completion * Keep inline draft delivery independent of terminal projection * test: consolidate launch ownership contracts * test: check web launch fixture array types * test: align launch fixtures and conformity records * test: import the shell-ready marker from its declaring module * test: give caller routing the web host tab's completion contract |
||
|
Neil
|
d42130b433 |
fix(plugins): stop painting a disabled plugin's terminal theme (#36471)
* fix(plugins): stop painting a disabled plugin's terminal theme * fix(plugins): tell the clicking window when a plugin is disabled or removed * test: merge duplicate import |
||
|
Kelvin Amoaba
|
17cace4f22 |
fix(mobile): lead workspace-list agent rows with the conversation name (#36464)
* fix(mobile): lead workspace-list agent rows with the conversation name * fix(mobile): name a same-tab child once its parent row is gone * refactor(runtime): share the structured chat tab id parser * test(runtime): build the row-name summary without a cast * perf(runtime): read each worktree's session once per worktree.ps pass |
||
|
Neil
|
8c777ea465 |
plugins: tell once when an automatic update waits for your review (#36462)
* plugins: tell once when an automatic update waits for review When the auto-updater holds back an update because it asks for more access or moved repository, show one toast per plugin version (grouped when several wait). Review opens the existing per-plugin update review or the Updates list; it never installs or approves. Told versions persist across restarts, kill-listed plugins are skipped, and the copy is protected from language packs. * test(plugins): wait on the update pass instead of sleeping in the review toast e2e |
||
 OrcaWinandOrcaWin
|
e6a8959f4b |
test(windows): give the credential fixture's cold Python start 30s (#36465)
* test(windows): give the credential fixture's cold Python start 30s * test(windows): explain the credential test's timeout --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |