* fix(runtime): one owned-session teardown policy; removal closes host browser pages everywhere, headless sleep stops terminals
A declared table says what each entry point (worktree, folder and project removal,
sleep, disconnect) does to each owned kind (PTY, native chat, host browser page,
launch record), so a new kind is a compile error until decided. Removal over desktop
IPC and repo.rm now close the host's browser pages and launch records like the
runtime removal; worktree.sleep with no renderer sleeps the host's terminals instead
of doing nothing. Sleep->chat is declared pending #28445; disconnect stops nothing.
* fix(runtime): project removal finds headless pages and failed launches without a client page; stub the new runtime method
* fix(runtime): headless sleep rejects an unproven stop; read headless page owners through the bridge, not Electron
* refactor: de-barrel remote-runtime-client and runtime-terminal-stream (D2)
importers name the defining modules; the two vi.mock factories that named a re-export move to
the defining module (pty-id spy) or drop the dead key (RemoteRuntimeClientError)
* refactor(renderer): de-barrel runtime-terminal-inspection (D3)
importers name runtime-terminal-input-recording, runtime-terminal-verified-input and
shared/remote-runtime-pty-id; 22 vi.mock factories move the re-exported keys to those modules
(pty-id keeps its other exports via importOriginal)
* test: drop the duplicated verified-input mock (Opus P3)
The revocation gate, the input cancel list and the hold's lifecycle each lived in two places.
Sinks now call one gate, held input is recorded at the CDP send (and the one native key path),
and runWithRemoteCliPageAdmission owns retire-on-revoke, release and error conversion.
* fix(ssh): a cancelled or revoked host's browser command stops on the desktop
orcad now tells a cancel-capable desktop when the CLI gave up on a forwarded browser command, and a running host command on the desktop checks revocation before every side-effecting step (each helper CDP message and each direct input dispatch).
* fix(browser): keep local commands out of a host's scope, gate each helper on its proxy
* fix(browser): hold a host-driven page at its input sinks instead of per call site
* test(browser): checked mock types in the host revocation suites
* fix(browser): refuse only a host's own traffic, never the desktop's page commands
* fix(browser): a host's proxy never keeps its scope, and a revoked click still lets go of the button
* fix(browser): a revoked command may release only what it pressed, on every input path
* fix(browser): refuse every revoked step, and let the desktop release what a revoked command left held
* fix(browser): retire a revoked command's helper daemon before letting go of the page; release held input with a lease, synced pointer state and the focus guard
* fix(browser): deferred proxy input keeps its hold, releases count once they land, and a revoked helper is retired at once with its routes kept
* test(browser): keep the mock page cast on its SAFETY line
The guest will-navigate guard cancelled every file: navigation, so clicking a
relative link on a file:// page did nothing. Allow file: -> file: when the
current page is itself a local file; web pages still cannot navigate or
redirect into the filesystem.
* test(browser): expose native popup admission blockers with faithful app events
* test(browser): probe Electron popup identity and inherited sandbox API limits
* test(browser): handle requests without associated contents in popup probe
* docs(browser): record blocked Electron popup compatibility gates and test routing
* docs(browser): keep popup evidence in PR
* refactor(ssh): move the ssh-connection and ssh-target cluster into ssh/connection/ and ssh/targets/
Pure git mv plus import and path-literal rewrites. ssh-connection-utils stays put; the next PR splits it.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(e2e): keep the release-checkout import at the v1.4.218 path
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(browser): switch client-hosted profiles with staged guest replacement
Squashed from #30351 by @oliver-mee onto the current main.
Fixes#30350
* fix(browser): fence staged profile guests, release switch grants, carry host profile metadata
- A fence during automation retirement now revokes and stops the staged guest.
- A failed or late-settling switch releases its execution-host grant so the page can be recreated.
- Staging cleanup failures before handover stay visible to executor close.
- createPage/restorePage carry host-owned profile metadata to profile-switch-v1 desktops,
so recovery and restore can rebuild a switched page.
* fix(browser): roll back a switch whose replacement died, and report a lost old guest
* fix(browser): resolve client-hosted pages before the server-local target path when switching profiles
* fix(browser): a staged profile-switch guest owns downloads it starts while loading
* fix(browser): keep the original placement until a timed-out switch settles
* fix(browser): rebind the original guest before releasing a rolled-back staged guest
* test(browser): type the harness guest release mock
* fix(browser): release the replaced generation's download transfers when a switch commits
* fix(browser): admit file transfers from a staged profile-switch guest while its switch is pending
* fix(browser): release only the replaced generation's download transfers after a switch
* refactor(shared): import BrowserNetworkExecutionHost from its own module, no re-export
* fix(browser): adopt a profile switch the client finished after the caller timed out
---------
Co-authored-by: Oliver Mee <102673257+oliver-mee@users.noreply.github.com>
* fix(browser): a remote viewer larger than the host's browser pane sees the whole page and clicks land under the cursor
Fixes#30341
* test: note why the screencast double is cast
* fix(browser): drop guest frames until the fitted size is applied; forget the cached CSS size when the frame size changes
* fix(browser): keep a press's release and markup inside the letterboxed remote frame
* fix(browser): resume live frames once fitted metrics land; remeasure the page after its frame size changes
* fix(ssh): an opted-in desktop serves its browser to a managed SSH host's orca CLI again
* fix(ssh): scope bridged pages through the renderer, render them as desktop pages, and route the e2e
* fix(ssh): bridge refuses file URLs and clipboard reads, revokes on disconnect, closes desktop tabs
* fix(ssh): judge bridged paste chords as the page sees them; accept long workspace ids
* fix(ssh): bridged clipboard denial follows popups; revoked commands never leave the browser queue
* fix(ssh): refuse option-like host values bound for agent-browser argv; report undeliverable results
* fix(ssh): bound bridged error results and fall back when the host refuses one
* fix(ssh): bridge only routed host tabs, and bound bridged page scripts by a deadline and revocation
* fix(ssh): cap waiting bridged commands below the desktop socket's result capacity
* fix(ssh): bridge revokes on routing changes, checks each page's route at run time, and cancels host-driven downloads
* fix(ssh): name the bridge registry's owner type
* fix(ssh): bridge refuses pages showing a local document, and never starts a command past orcad's deadline
* fix(ssh): bridged commands may leave Chromium error pages, and stop starting before orcad's deadline
* fix(ssh): ask for a fresh opt-in to host CLI control saved before it drove the desktop browser
* test(ssh): type the bridge registry deadline test
* [CI] Keep transport-only tests outside the app store graph
* [CI] Advance the updater install clock in failure tests
* [CI] Avoid descriptor formatting in replay clip counts
* [CI] Advance native-chat test observation clocks
* [CI] Restore observation timers after failed test setup
* [CI] Clean up final headless daemons during public close
* [CI] Keep serializer test oracle out of production smoke triggers
* [CI] Keep three unit fixtures out of production smoke triggers
* [CI] Bound frozen-clock close callbacks in tests
* [CI] Avoid the app-store graph in feedback dialog tests
* [CI] Keep hidden popup fixture compositor frames active
* test(ci): reuse mobile runtime fixture for pairing listeners
* test: restore native chat clocks before rig cleanup
Detach the page's debugger before destroying its offscreen window, so a live
screencast closes before its in-flight snapshot can call capturePage on the
half-destroyed page (an Electron segfault). Also wait for the paired workspace's
first terminal in the link-routing e2e so its late focus cannot hide the pane.
* fix(browser): the remote browser tunnel goes through the server's outbound proxy
A client-rendered browser tab on a paired server reaches sites through a
tunnel the server opens. The server dialed each destination with a bare TCP
connect, so a network that only allows traffic through a proxy refused it,
while the server's own browser (which honors the proxy) worked.
The native tunnel connector now picks the upstream proxy the same way the
server's browser sessions do: Orca's proxy setting first, else
HTTPS_PROXY/ALL_PROXY/HTTP_PROXY, each with its own bypass list, never for
loopback. HTTP(S) proxies are reached with CONNECT (with basic auth from the
URL), a no-auth SOCKS5 proxy through the existing SOCKS client; a proxy kind
it cannot speak fails the open instead of leaking around the proxy.
Fixes#29154
* fix(browser): match Chromium bypass semantics for Orca's proxy setting; keep HTTPS-proxy tunnels half-open; tolerate raw percent in proxy credentials
* fix(browser): full-glob bypass rules and trailing-dot loopback names stay off the tunnel proxy
* fix(browser): scheme-qualified and IPv6 CIDR bypass rules match like Chromium
* fix(browser): expanded IPv6 loopback from the SOCKS front end stays off the tunnel proxy
* test(browser): loopback spellings the SOCKS front end hands the tunnel stay direct
* fix(browser): defer publication cleanup until native destruction completes
* test(browser): reproduce the serve tab-close SIGSEGV with a hidden page window
Headless serve backs each page with a hidden top-level BrowserWindow, whose
Aura view is what crashes; the <webview> guest the fixture used never reached
that path, so the test passed against the original code. With the serve shape
the test segfaults (fault 0x1268, RIP +0x55a8d7b) without the fix.
* test(runtime): wait for the deferred publication restore after paired create and close
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: remove repeated waits and fixture work
* test: give pure queue pause comparisons a unique suite title
* test(ci): remove repeated fixtures and deadline waits
* Use Jira favourite filters within their source site
* Keep favourite recovery actions available across host updates
* Bound favourite names within the Jira toolbar
* Fix static gates for Jira favourite filter UI
* Keep Jira fixture storage cleanup in test suites
* test(browser): await loaded guest and own find results
* Bump Electron to 43.7.8 to fix find-in-page looping
Find-in-page could loop when the host page contained iframes beside a
webview, so searches in the guest did not finish or wrap correctly.
Electron 43.7.8 includes the upstream fix (electron/electron#54199).
- Pin electron to 43.7.8 in package.json, pnpm-lock.yaml, and the
Node runtime pin.
- Raise the runtime floor in electron-runtime-floor.test.ts to 43.7.8.
- Add an Electron regression test that runs a find traversal in a
background window with host iframes before, after, and around a
webview, checking forward and backward matches wrap correctly.
* rm junk file
* fix(browser): end downloads that are waiting for a manual resume Orca never offers
* test(browser): drop type assertions from the manual-resume download test
* test(browser): focus manual-resume interruption regression
* fix(browser): agent typing into a cross-site frame no longer borrows the user's focus
Keys and text for a focused cross-site iframe went through the focus-borrowing
fallback, because widget input reaches only the guest's own renderer. They now
go to that frame's own CDP target session, found by following the page's focus
through frame elements, which reaches the frame without touching the user's
focus. The proxy keeps those Orca-owned sessions' events from the agent's client.
* fix(browser): retry frame focus emulation after a failed enable
* fix(browser): retry a failed frame focus-emulation enable before sending input
* Avoid unused module imports and trim cosmetic test coverage
* Capture hidden popup frames and attach CDP before guest creation
* Overlap relay test projects within the existing worker budget
* Consolidate native preparation and add an opt-in transform cache comparison
* Release inherited debugger sockets during final E2E teardown
* Refresh unit scheduling weights from all five qualified ARM shards
* Avoid retaining unasserted RPC call history in the delivery model
* Use the supported unconditional background wait syntax
* Overlap unconditional output upload with native preparation
* Verify relay integration stays enabled for ordinary unit callers
* perf(ci): reduce test overhead and reuse expensive build work
* test(ci): keep worker startup outside failure-case deadlines
* test: isolate push fixture advisory locks
* test(ci): preserve fixed drain retry allowance
* Align CI contracts with current triggers and guide content
* Stabilize consolidated reveal scenarios and retain behavioral CI contracts
* Fix upstream lint blockers while retaining behavior and assertions
* Classify global Jira preferences in the WSL migration inventory
* Align Jira test fixtures with startup and build safety checks
* Include package-test routing dependency in CI checkouts and fixtures
* Keep native stream classes intact in transcript dependency tests
* feat(serve): keep browser tabs across an orca serve restart
A host with no window now saves the browser tabs it opens in the same shape a
desktop window saves its own, and restores them the same way: listed at once
with their last address, each page started when a client first opens or
drives it. A closed tab is forgotten; a page that ends with the process is not
a close.
* test(e2e): the server's published strip now holds its saved browser tab
* fix(serve): save browser addresses cheaply, open once, restore by page id
Review fixes: a page's address is written onto its saved records without
reloading the layout, and only on committed navigations; reopening a saved
page writes nothing; a command naming only the page finds the workspace that
saved it; a refused save no longer throws from a page event or a close. The
browser-tab map is renamed to say it lists saved tabs too.
* fix(serve): list, switch and close saved browser tabs from commands that name no page or worktree
* fix(serve): a tab list does not start saved pages; only a command acting on a page does
* fix(serve): a pageless command starts the browser tab the layout shows, not the first saved one
A host now records the browser tab a window would show: the one it just
opened, and the one a tab switch picks. With nothing running, a command
that names no page starts that tab; when the layout shows none it starts
nothing and reports no browser tab open.
* fix(serve): report the saved active browser tab as current
Claude-Session: p2-headless
* chore(ratchet): count the serve browser-tab save as a main-process layout writer
Claude-Session: p2-headless
* fix(serve): use the window's active browser tab rule, one scope, one active row
Claude-Session: p2-headless
* fix(browser): pick the active tab among tabs this host can start
A desktop document page or a remote page recorded as active no longer leaves a
pageless command with no tab. Adds a test for the first-saved-worktree scope.
Claude-Session: p2-headless
* refactor(browser): restore saved serve tabs through the page wake point
Saved serve browser tabs now start where a window would mount them: the two
existing wake helpers ask one host hook before messaging a window. The offscreen
backend reports opened and moved pages, so the command layer no longer threads
save, list, select or close hooks. No worktree named and no page running reports
no tab, as a window does.
Claude-Session: p2-headless
* fix(browser): only page creation opens a saved serve tab
A navigation now only updates an existing saved tab, so a late load after a close
cannot re-add it; a restored page sends no open, so its saved title stays.
Claude-Session: p2-headless
* refactor(browser): drop the restore mark the open/navigate split made redundant
Claude-Session: p2-headless
* refactor(browser): save serve tabs from the create command, list unstarted ones as tab rows
The create command saves the tab (it holds the group), so the backend reports only
navigations. Unstarted saved tabs are tab-info rows the existing listings take
as-is, the restore dedupe map goes (a created page registers before createTab
returns), and one lookup gives a page's unified tab id.
Claude-Session: p2-headless
* fix(browser): opening a serve browser tab no longer records it as active
Which tab shows is a view's choice; after a restart the active tab is the one a
window recorded, else the first.
Claude-Session: p2-headless
* fix(browser): give the composed browser command owners the saved-tab host member
Completes the forward merge of main's browser command split (#27576).
Claude-Session: p2-headless
Any press on a <webview> guest moves Chromium focus into it, so an agent click
took the user's terminal focus (#20595). Main now asks the hosting pane to guard
focus for each agent press (Orca's click/mouse down and the CDP proxy) and the
pane puts it back inside the webview's focus event, and again when the press
ends. Offscreen pages keep their native focus.
Main-session CDP key and text input on a <webview> guest is routed by the window's
focus, so it landed in the user's terminal (#20595). Embedded guests now get
widget key/char events; child-frame focus and untypeable text keep the CDP path
after focusing the guest.
* fix(browser): preserve unnamed OAuth login popups
* fix(browser): preserve form and blank popup sessions
* Preserve native request context for Shift popup navigation
* Validate route popups with production policy attachment order
* Fix browser background modifier request continuation
* Route opener-less OAuth popups to Orca tabs and fix menu targets in nati
- Plain links and Cmd/Ctrl+Shift-clicks open OAuth URLs as Orca tabs instead of native windows. Those popups have no opener, so they lose nothing by reloading the URL.
- Scripted popups that have an opener keep the existing origin-bar window, so their window.opener link still works.
- Discard pending popup contents with a navigation veto before closing, so a link's first request cannot reach the server.
- A POST with no page to hand over is still blocked, because reloading it by URL would drop its body.
- Edit, Help, and paste menu actions now target the main Orca window when a native browser popup has focus. The popup has no Orca renderer to receive those IPC messages.
* Cover opener-less OAuth popups and popup request provenance in tests
- Add Electron tests showing opener-less OAuth links open as local tabs without loading the discarded page, and that modifier-opened POSTs are never replayed.
- Add a test that a remote foreground modifier click keeps the native cross-site request context (cookies, referrer, fetch site).
- Add a test that the first adopted link request is blocked when route preparation fails during popup creation.
- Launch the CDP fixture through resolveElectronProbeLaunch so Linux runs use the display-aware launcher instead of a hardcoded xvfb-run.
- Replace `as` casts in the popup tests with typed declarations.
* Route Edit menu actions to native browser popups
Copy, Paste, and Select All from the app menu did nothing when a native
browser popup was focused. The popup has no Orca renderer to receive the
IPC, so the action was dropped. Those actions now go to the focused web
contents, falling back to the popup's own contents, so they reach the page
the user is in.
Also removes the popup request-provenance Electron test, which is no longer
part of this change.
* Fix static analysis failures in browser popup handling
* Handle unavailable permission probe in browser popup fixture
* Admit script-opened native popups and enforce minimum size
Modifier-clicked `window.open` children from page scripts reach Electron after the opener's first task, so the one-shot admission lapsed and they were left unprepared. Their first request then lacked popup context, and the origin title could be hidden by a hostile page title.
- Keep a per-opener pending admission that answers the next native child the opener reports. Unadmitted native children are discarded rather than left as bare windows.
- Route popup children through the contents whose window-open handler answered, since Electron reports script-opened children to that contents.
- Create native popups content-sized with a 360x200 minimum, matching origin-bar popups, so `resizeTo` cannot shrink the origin title out of view. The limits move to `popup-window-minimum-size.ts` so both paths share them.
- Tests: cover scripted admission timing, unadmitted discard, minimum size, and route popup caps. Fixture waits for hidden iframe loads and polls with a longer timeout for CI.
* Prime hidden Linux OOPIF hit testing for all opaque popups
The popup compatibility test clicked a frame gesture target only for the "route" case when the input was opaque. Hidden Linux OOPIFs need that priming click before hit testing works, and the route's root gesture gate depends on it too. Other opaque cases were skipping it and could fail for the same reason.
Apply the priming click to every opaque case and correct the comment to describe the real reason.
* test(e2e): add a paired phone client helper and phone-mirror baseline specs
Later phone-mirror slices need one oracle that drives a real mobile-scoped device with the
phone's own capabilities against a serve host or a paired desktop. Pins #26022 across a serve
restart and today's gap: a desktop's phone does not list the desktop's server workspaces.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): show SSH host health on the workspace row host badge
Rows on an SSH host the desktop cannot reach looked healthy on the phone. The badge now
adds the desktop sidebar's own word ("devbox · Disconnected"), derived by the same shared
function from the connection status ssh.listTargetSummaries already sends; old desktops keep today's badge.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(e2e): compose the phone-mirror topology and check the cold snapshot
Slices need one composer for host, desktop and phone with a single teardown, so specs stop
copying setup. The serve-restart spec now reads the first tab-stream snapshot after the cold
start, which is what the phone builds its tab strip from.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): name an unhealthy SSH host even in a single-host list
The desktop card shows SSH status on any host count, so the phone now reads target summaries
whenever a repo is on SSH and badges an unhealthy host alone too. Labels and health share one
target-to-host keying, and a hook-level test pins the reply-to-row wiring.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(e2e): keep phone-mirror teardown errors from masking test failures
Teardown failures become a test attachment instead of replacing the real failure, and the
cold-snapshot poll reports stream errors together with the PTY list.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): clear stale SSH host badges and announce them without the dot
A catalog that no longer spans hosts or holds an SSH repo now clears the health and label maps,
so a host that left cannot keep badging rows. The badge gets a screen-reader label ("devbox,
Disconnected") instead of reading the middle dot.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(runtime): let a paired desktop register its phones as delegated mobile devices
A desktop paired to this runtime can now call pairing.delegatedMobileDevice.sync to make each of
its phones an ordinary mobile-scope device it owns, so the phone mirrors that host through the
desktop. Children are never pending, inherit the parent's reach, and die with the parent's grant.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(runtime): move the mobile device revoke primitive below dispatch
Dispatch binds the caller-bound delegated-device context, so the revoke path it needs now lives in
a layer under it as a pure move; this drops the abstract method seam. No behaviour change.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(runtime): keep a runtime grant until its delegated phones are revoked
A failed child cleanup now leaves the parent in place so a retry can still find the children, and
revokeRuntimeAccess lives beside the revoke it cascades to. Adds restart, rename and bounds coverage,
shares credential minting, and drops the timing-dependent census.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(runtime): fail a delegated sync whose dropped phone cannot be revoked
Matches the parent revoke: a child whose cleanup could not be saved is kept and the sync errors
before minting anything, so the desktop retries instead of believing the server matches its list.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): relay a paired phone's server-workspace requests through the desktop
A phone mirrors its desktop, including workspaces on the desktop's configured servers. The desktop
now forwards a request that names `executionHost: runtime:<env>` to that server over one socket per
(phone, server), signed in as the phone's delegated device; replies pass through untouched except
stream ids. Hidden until the phone client ships: the relay capability is not advertised yet.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): type the single-host health fixtures inline so the test tsc passes
Fixtures hoisted into consts widened their health maps to string, which the now-required
hostHealthById rejects under the tests-typecheck ratchet; passing them inline keeps the union.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* docs(mobile): state the desktop relay contract in its entry module
main dropped docs/reference, so the relay's contract lives beside the code. Also pins that a
server whose delegated sync fails (e.g. delegated_device_revoke_failed) is unavailable until a
later request syncs it again.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): pin the relay's configured-server adapter
The production hosts adapter was only typechecked; this pins that it resolves configured servers
by exact id only (never a name or a removed server), fences by pairing revision and runtime
identity, and stops reporting retirements once unsubscribed.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): re-record the repo-metadata goldens for SSH host health
The settled metadata state now carries hostHealthById, and an SSH-only catalog now reads the
target summaries so a lone unhealthy host can be badged. Scoped re-record via rpc-recording.mts.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): tighten the desktop relay after elegance review
Reuses the shared E2EE socket opener, folds relay state into fewer fields, never sends a request
whose link ended while opening, passes failure codes through, relays only this desktop's own
phones, and drops the unused host-state reader until S2 needs one.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): bound relay frames and stop sticky relay verdicts
Restores the 8 MiB frame cap on every remote runtime socket, re-checks an update-needed server on
each new link so an in-place upgrade relays, answers a phone the server just declined without
syncing again, and ends a link whose mirrored capability update cannot be queued.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): run targeted desktop-owned calls on the desktop
The phone tags every call on a workspace screen with its execution host, so a
paired-desktop method carrying `runtime:<env>` now runs locally instead of
failing 'forbidden'. The Mac stays the only reader of the routing table.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): list the desktop's configured servers and their last workspace rows for the phone
The phone needs the same host list the desktop shows, including servers that are offline or
too old to relay to. mobileRelay.hosts.list/worktrees answer from the desktop's own status and
its own worktree.ps fetches, cached per server and fenced by pairing, never from relayed replies.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): list server rows through one desktop fetch, with no side effect on listing
The phone now always lists a server's rows through mobileRelay.hosts.worktrees, so the
desktop's own fetch is both the live source and the cache, and stamping stays in main.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): fetch a server's full workspace list within a bound, and forget removed servers
The desktop now asks for the phone's full-catalog limit, answers within 5s with the last rows
when a server hangs, drops a server's rows when it is removed or re-paired, and checks the
server's identity after the fetch so a reply from before a re-pair is never served.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): name a server workspace's host on the phone's calls
A phone reaches a server's workspace through its desktop only if each call names the host; the
direct, cloud-relay and shell-bridge transports now carry `executionHost`, streams keep it for
replay and unsubscribe, and an older shell (no `executionHost` grant) refuses rather than strips it.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): list managed servers as the desktop sidebar does, and hide rows mid-delete
A server Orca manages on an SSH host now lists once under that host's name, or not at all while
the host is reached over the SSH relay, using the sidebar's own folding. Rows the server is
deleting are left out at reply time, as a phone asking the server itself would see.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): keep a disconnected server's last rows, and never join a re-paired server's fetch
Retirement also fires on a manual disconnect or managed-server update, which wrongly emptied
the phone's list; rows are now pruned only once a server is no longer configured. Fetches are
shared per server identity, so a poll after a re-pair asks the new server right away.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): list the paired desktop's server workspaces on the phone
Fixes the phone missing a desktop's `orca serve` workspaces: rows come from the desktop's
mobileRelay.hosts.* with each server's health ("Update needed", "Disconnected"), open through the
relay, follow the desktop's hidden hosts, and the desktop now advertises the relay capability.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): pin that a desktop failing the hosts list leaves only its own rows
The page asks a relaying desktop for its servers; a refusal such as method_not_found must leave
today's list with no server rows and no catalog error.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): mirror the desktop's shown hosts exactly, one host included
Jinwoo's call: the phone follows visibleWorkspaceHostIds as the desktop sidebar does, so a
one-host list narrows the phone too instead of being read as a single-host focus.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): scope a server workspace at its route, never the desktop
Every screen under a server workspace's route now reads one context and
gets that server's client and a router that keeps pushes on it, refusing
to fall back to the desktop; pins write to the row's owner like the Mac.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): never open an unreachable server workspace, and prove the relay in e2e
A server workspace the phone can't reach now gets one explicit screen at its route
and no row tap or action-sheet entry opens it; native routes read the route's host,
a census pins every workspace route, and the e2e reads files and git on the server.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): gate a server workspace on that server's own features
A targeted status.get now relays to the server, so a server workspace's route
provides that server's status to every screen under it and its action sheet,
while whether the phone can reach the server stays the desktop's answer.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(ci): run the remote-runtime WebSocket opener test on Node
Under the bun vitest project, `ws` resolves to Bun's built-in client, which
ignores maxPayload, so the frame-cap test hung. The opener only ships on
Node/Electron, so run its test in the Node runtime project like its siblings.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): give the file preview the workspace router, back to 128 page assets
The preview was the one workspace screen on the plain router, so the scoped router
was reached by a route set of its own and esbuild split it into an extra chunk
(129 assets); every workspace screen now uses it and it shares the route's chunk.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile-relay): derive the phone allowlist from the routing table
Adding a phone method now takes one edit (its route). A server-targeted call on a
legacy non-E2EE socket is refused instead of running locally, and only
execution-host methods enter the relay.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile-relay): drop unread freshness fields from server workspace lists
The phone reads only the rows, so stale, fetchedAt, totalCount and truncated
were dead wire weight. The desktop still serves a server's last rows while
the server is unreachable.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): read only the rows of a server's workspace list
The desktop no longer sends a freshness flag, so the phone's schema drops it.
The relay capability list names the delegated-devices constant instead of
repeating its literal, which also retires a now-circular type check.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): show a server workspace as disconnected while its server is down
The phone read the desktop's connection state for a server workspace, so a stopped
server kept a green dot and "Loading tabs" spun forever. The workspace route now
narrows that state by the server's health from mobileRelay.hosts.list, reusing the
existing disconnected session UI and refetching tabs when the server returns.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): share one desktop server-list feed between the host list and workspaces
A server workspace polled mobileRelay.hosts.list beside the host list's own read, so
the phone could ask the desktop twice per tick and the row badge and the screen could
disagree. One feed per desktop client now owns that read; both readers join it.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(e2e): read a server's reachability from the hosts list, not a dropped stale flag
eff410fe30 dropped `stale` from mobileRelay.hosts.worktrees, so the mirror spec's
schema never parsed and its first poll timed out. It now waits on the server's
relay/health from mobileRelay.hosts.list, the field the phone itself reads.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* build(mobile): re-measure the page's script sweep for server workspaces
Main already sat on its 78-script ceiling (re-swept: 78, table: 74); the workspace
route's shared modules split importer sets three ways more, reaching 81. Re-swept per
route prefix on this head, as #24257 did for its feature; the spread is now 1 to 11.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): export the server-list feed's React reader beside the feed
useRelayHosts moves from workspace-server.ts into relay-hosts-feed.ts, so every reader (workspace screens now, the new-workspace sheet next) subscribes through the feed's own module. No behaviour change.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): keep polling the server list and read a server's reachability from relay
A hosts-list read slower than the poll stopped the feed for good, since the next tick was
scheduled when the read started; it is now scheduled from the finish. A server workspace now
reads connected only when the desktop relays to it, so a server with no status yet is not shown up.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): show a reached server as connecting and a too-old one as disconnected
A server the desktop has reached but whose status is not answered yet is moments from relaying,
so it reads connecting; a server too old to relay to never will, so it reads disconnected.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): view and drive server browser pages this desktop renders
A phone could not see or open browser tabs a server workspace places on the
desktop: the server hides them from callers without browser.clientHost.v1 and
cannot screencast them. The desktop now serves those calls itself.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): keep browser tab creation on the server and test the screencast release
tabCreate's page names a page to create, so it always relays; the census now
asserts that rule. Adds a relay round-trip for screencast subscribe/unsubscribe.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(shared): move the account capabilities into their own group module
Main's merge put protocol-version.ts at 301 lines, over the 300 cap. The account group moves out
like the relay and skill groups did, same strings in the same order; the page's script sweep is
re-measured because the split changed its chunking (81 to 79 at 16 routes).
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): name a server workspace through the request envelope
The server name now rides the generic request envelope from #27815 instead of
its own executionHost option, bridge grant and per-transport plumbing. Server
rows show only where the transport carries an envelope (native, or a shell
that grants rpcEnvelope), so an older app keeps today's list.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): pin the server-call wire and the no-envelope deep link
A server workspace call still reaches the desktop as the same top-level
executionHost frame, on the direct and relay wires, and a deep link into a
server workspace under an app without rpcEnvelope shows the unreachable screen.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): read a relay stream's envelope slot in sorted key order
Equal envelopes name one cleanup slot whatever their key order, the scoped view
passes its client's envelope answer through as it does the generation, and the
direct wire harness is shared instead of rebuilt.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): a phone's new chat in a server workspace follows the desktop's chat setting
A relayed agent.launch ran on the server, which picked chat vs terminal from its
own setting. The desktop relay now stamps its own default as nativeChatDefault;
new servers use it in place of their setting (feasibility still decides), older
servers strip it. Outside the replay fingerprint.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(mobile): move the relay's delegated phone grant cache into its own module
Keeps mobile-desktop-relay.ts under the line limit once #27749's page relay lands on it.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): show the early terminal tab from the relaying desktop's chat default
The early-tab preflight read the server's own chat setting while the launch
used the desktop's stamped nativeChatDefault, so on a windowed server with
chats off a relayed chat launch flashed a terminal tab. Both now read the
settings through readAgentLaunchModeSettings(runtime, nativeChatDefault).
* fix(browser): keep client-hosted browser pages opaque
Client-hosted pages were created without transparent=false, so a page with no
background had a transparent canvas: the desktop's backdrop showed through it,
and its screencast to the phone was solid black (JPEG has no alpha). Both
browser-page guests now share one preferences constant.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Count unreadable cookies separately from related cookies withheld by existing import safeguards. Keep import and clearing decisions unchanged and retain the legacy warning for older or invalid summaries.
Co-authored-by: oliver-mee <102673257+oliver-mee@users.noreply.github.com>
On Windows and Linux, Orca's app menu is attached to every window, including web popups, so it permanently takes up vertical space above the popup content. Popups now hide that menu by default, so they match a normal browser window. Alt still reveals it, but revealing it shrinks the content area without resizing the window. The origin bar and content view kept their old heights, which left a gap or clipped content. The popup now listens for `bounds-changed` on its content view and re-runs its layout, so the content fills the space under the revealed menu bar.
* fix(browser): annotation card and outline follow the selected element
The grab overlay keeps re-measuring the picked element after the click
(scroll in any box, resize, element size changes), and the isolated
viewport bridge reports that live box so the pending card follows it,
including page zoom. The card's side pick uses its measured height.
* fix(browser): bind annotation card to selected element
* fix(browser): keep document annotation card on selection
* fix(ci): point the main sync-spawn ratchet at the shared ratchet library (#28054)
#27756's script imported baseline helpers from check-focus-read-ratchet.mjs
after #27788 had moved them into ratchet-baseline.mjs, so it crashed on start
and failed every PR that merges main. Use the library's helpers, and record the
two daemon-process launches from #27769 that the broken check never saw.
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(browser): follow selected element outer-box size
* refactor(chat): give the start-refusal resumable table its own module (#28085)
#27946 and #26684 together put agent-session-failure-words.ts at 304 lines,
over max-lines, which fails lint and the pre-commit hook on every merge of
main. The refusal-code table is standalone with one reader, so it moves out.
Co-authored-by: Orca Worker <orca-worker@localhost>
---------
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(browser): settle WSL tunnel reads so responses past 256 KiB complete
The WSL execution route hands the deferred socket a credit-accounted tunnel
duplex, but the deferred socket forwarded its data without settling it, so the
relay's 256 KiB receive window was never replenished and larger responses
stalled. Settle each chunk once tunnel-socket listeners have taken it; their
pause() still holds the source, so unsettled bytes stay bounded by the window.
Fixes#27356
* test(browser): bound the WSL backpressure wait so a regression fails instead of hanging
* test(browser): keep unchanged WSL route test lines in their original form
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* refactor(providers): delete the SSH git and filesystem providers and relay-only wiring
* refactor(ssh): drop relay-protocol exports only the deleted stream readers used
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Desktop, CLI, web and runtime transports now take a PairedRuntimeConnection
(endpoint, pinned host key, credential) instead of a PairingOffer. Offers stay on
the pairing input path (codes, QR, links, environment add) and are converted with
pairedRuntimeConnectionFromOffer. The credential is token-only today; request
envelopes still carry the same deviceToken, so the wire is unchanged.
This lets device-key and ticket credentials replace the token later without
touching every connect call site again.
Co-authored-by: m4air <m4air@Mac.localdomain>
Extract subprocess execution and process contracts into @orca/process-host with explicit public entry points, independent checks, and one Node 18 compatible CommonJS runtime. Migrate application consumers and integrate package builds, dependency selection, import enforcement, and runtime resource staging.
Preserve daemon startup ownership and profile isolation, and qualify development rebuild recovery and concurrent output publication. Remove unnecessary aliases, test forwarding exports, and a duplicate output scan.
Validation: full typechecks, changed-code quality, package and artifact checks, native Windows builds/types plus 306 runtime tests, and independent native reviews.
Matched full E2E controls on original main and unchanged reviewed head both pass all 17 applicable tests (nine skips). Earlier intermittent E2E failures are documented in the PR; no assertions were weakened. The final combined-tree audit preserves both branches with no import-boundary violations.
Kelvin Amoaba
Neil
Jinwoo Hong
Jinjing
OrcaWinandOrcaWin
Brennan Benson
