* fix(macos): opt out of press-and-hold so held keys repeat (#14746)
macOS routes press-and-hold to the accent picker unless an app sets
ApplePressAndHoldEnabled=false for its own bundle, so holding j in vim
inserted one character instead of repeating. Orca never set it.
Written at most once, and never over an explicit value: `defaults read`
is domain-scoped and exits 1 when the key is absent, which is the only
way to tell "unset" from a deliberate false — Electron's
systemPreferences.getUserDefault reports false for both. A recorded
decision in userData keeps a later launch from re-clobbering a user who
deletes the key to get the accent picker back.
* docs(macos): record the revert hazard and CI's macOS test gap
Two things a reader of this module cannot otherwise know.
A revert leaves the key written in every user's domain forever. AppKit reads
the plist, not this file, so removing the code alone keeps press-and-hold
disabled for everyone who ran an affected build. The sibling period-substitution
module carries the same warning because that fix was already lost once this way.
And the real-binary test file that pins the defaults(1) exit-code semantics this
design rests on never runs in CI: the e2e workflow and both unit-test jobs are
ubuntu and windows, and the only macOS runners in the repo are build and
packaging jobs that run no tests. Those six tests plus the real-bundle e2e case
pass on a developer Mac and execute zero times in a green PR, so the comment
should not imply enforcement that is not there.
Refs #14746
* feat(macos): let users turn the accent menu back on (#14746)
Orca disables press-and-hold for its own preferences domain so held keys
repeat. That is the right default, but the way back was a `defaults write`
buried in a source comment: nothing in docs/ or the README mentioned it, and
the preference is per-application, so it silently takes the accent picker
away from the Markdown editor and every other text field too.
Terminal -> Advanced now carries a "Character Accent Menu" switch, macOS and
desktop only. A web client cannot write a macOS preference for the machine the
user is looking at, so the control and its search-index entry are both gated on
that, not on the client's platform alone.
Precedence, which is the part that is easy to get wrong: the setting is
`undefined` until the user touches it, which is what keeps a hand-run `defaults
write` in charge for everyone who never opens the toggle. Once used, Orca owns
the key and writes exactly what the switch asks for -- `ApplePressAndHoldEnabled`
*is* the accent-menu switch, so it maps straight through with no inversion. The
choice is compared against `appliedSetting` in the existing decision record
rather than against the domain, so a `defaults write` made *after* using the
toggle is still the newer choice and survives the next launch. Re-asserting the
value every launch would have reintroduced the clobbering the record exists to
prevent.
The write lands for the next launch, since AppKit reads the preference as the
process starts, so the toggle shows the same restart banner the window-blur
setting uses. That banner is now a shared component, keeping its original
translation keys.
docs/reference/macos-press-and-hold.md records the precedence rules, the
`defaults read` rationale, the revert hazard, and the fact that none of this
executes in CI: every macOS job builds or packages and runs no tests, so the
real-binary and e2e coverage here passes only on a developer Mac.
* docs(macos): stop asserting when AppKit re-reads the press-and-hold key
Five places stated "AppKit reads the preference as the process starts" as
fact. That is the reason given for requiring a relaunch, and it is not
something this change ever measured.
Evidence points the other way: terminal emulators that register this key
after their process has started get key repeat in that same launch, which a
read-once-at-startup model cannot explain.
The relaunch requirement itself still looks right, but for a different and
verifiable reason: the write goes out through a separate `defaults` process,
so this app's own cached copy need not observe it. That is what the comments
now say, with the AppKit question left open rather than answered.
Refs #14746
* docs(macos): correct the startup comment's launch-timing claim
The comment said this call site is "the last point that can still matter for
this launch", which contradicts the rest of the module: the write is assumed
to land for the next launch because it goes out through a separate `defaults`
process. Reported on the PR by @innocarpe, who also supplied the replacement
wording.
Co-authored-by: innocarpe <innocarpe@users.noreply.github.com>
* refactor(macos): probe press-and-hold through the shared spawn chokepoint
`src/shared/child-process/child-process-import-boundary.test.ts` forbids a
direct `node:child_process` import outside its allowlist, and the allowlist only
shrinks — so this module moves to `runProcessSync`, which exists for callers
that genuinely cannot await. This one runs before `app.whenReady()`.
`runProcessSync` returns a non-zero exit instead of throwing it, so the
three-way read decision is re-expressed against `ProcessResult`: exit 0 is an
explicit value, exit 1 is a missing key, and a timeout, a signal kill, any other
exit, or a child that never started all stay 'unknown'. The throw path is now
inside `interpretDefaultsRead` so a spawn failure is reachable from a test
rather than hidden in an untested catch, and the write checks the exit code —
a refused `defaults write` no longer looks like success.
Both boundary-test failures were the same import: with it gone the offender
count returns to 155, so no ratchet baseline is bumped.
* Revert "feat(macos): let users turn the accent menu back on (#14746)"
This reverts commit cc5669f306.
---------
Co-authored-by: innocarpe <innocarpe@users.noreply.github.com>
* Enable drag-to-reorder for floating workspace tabs
- Wrap tab bar with FloatingWorkspaceTabDragContext to reuse workspace
tab-drag-split logic and gesture model
- Disable sensors while panel is closed to avoid DndContext conflicts
with main workspace
- Extract isFloatingTerminalDragTarget to separate module for clarity
- Add tests for reorder behavior and titlebar drag-target detection
* Add client-hosted row support to floating panel drag-to-reorder
- Include `[data-client-hosted-browser-row-id]` in no-drag selectors alongside other tab types
- Broaden type check from HTMLElement to Element for better SVG support
- Add test coverage for client-hosted rows and SVG icon interactions
* Improve floating terminal drag target detection with Element safety chec
Handle undefined Element in non-DOM contexts by explicitly checking for its
existence before type-checking. Clarify the logic by replacing double negatives
with explicit null comparison, making the intent clearer and the code more
resilient.
Add isSelectAllShortcut() utility to detect Cmd+A (Mac) or Ctrl+A (Linux/Windows). Use it to preserve native select-all behavior in editable fields instead of being intercepted by dialog keyboard handlers.
* Always enable Tasks button and provider shortcuts
Allows the task page to show an empty state explanation when no git
repos are available, instead of disabling the button entirely.
* Make task provider shortcuts keyboard-accessible sibling buttons
Convert task provider shortcuts from non-semantic spans to proper button
elements and position them as siblings of the Tasks button rather than
children. This keeps them in the keyboard tab order while using opacity
instead of display for visibility, ensuring they remain discoverable by
keyboard navigation alongside the main Tasks button.
* fix(codex): heal WSL hooks before typed launches
* test(codex): keep launcher fixture type-safe on Windows
* fix(build): list codex-home-wsl-env in the CLI typecheck project
`managed-home-shell-preflight.ts` is already in the CLI project's include list and now imports
`wslCodexRuntimeHomeForGuestHome` from `src/main/pty/codex-home-wsl-env.ts`, which the list did not
cover — TS6307, so the CLI typecheck failed on every push.
Added the single module rather than a `src/main/pty/**` glob: it is a 31-line leaf with no imports
of its own, so it does not widen what the CLI bundle can reach.
* fix(codex): converge the two WSL hook install lanes onto one writer
Two independent readiness reviews agreed the Orca-terminal boundary holds, but Codex Sol found a
P1 the other rated P2: the new just-in-time repair raced the existing relay installer and the two
produced DIFFERENT hook and trust representations for the same managed home. Two unserialized
writers emitting different formats is worse than the bug this PR fixes, because it fails
intermittently rather than cleanly — a pane works or does not depending on which lane won.
- Relay Codex installs now delegate to the runtime-home writer, so there is one canonical
representation instead of two. Redirected scripts use the runtime path, the readable wrapper,
and the prepended group.
- `installForRuntimeHomeSerialized` puts every asynchronous WSL caller for a given home on one
queue (`wslInstallQueues`), so concurrent panes cannot interleave writes.
Also rewrites the stale pin test the new `-x` guard broke. It asserted the defect —
"would run the impostor if the preflight carried an unqualified command name", expecting the
hijack marker to exist. The guard is a security improvement, so the test now asserts the contract:
an unqualified preflight is skipped and the marker is never written. Rewritten to the new
behavior, not loosened or deleted.
818 tests pass across the affected suites; typecheck clean. The changed-file quality gate could
not run locally — its pnpm engine-warning JSON parser fails under Node 26 — so CI covers it.
The boundary both reviews verified is untouched: paired/relay/mobile clients stay hard-blocked
from the RPC, params remain shape-locked to the managed home suffix with traversal rejection,
nothing is written outside the managed home, and macOS/Linux stay inert.
* fix(codex): serialize resolved WSL hook homes
* fix(codex): recover managed WSL homes after restart
* fix(wsl): translate Codex preflight through WSLENV
* fix(cli): cover bounded WSL Codex repair
* fix(codex): coalesce duplicate WSL hook repairs
* fix(codex): verify reconstructed WSL homes
* wip: normalize untrusted project catalog rows at load boundaries
* fix(catalog): make ProjectHostSetup field types true at the ingest boundary
Crash 3bcc5be3: a setup row whose repoId arrived null reached Settings'
projectByRepoId memo and threw on .trim(). The type said `string`; persisted
JSON and remote hosts on other versions can disagree.
Normalize project/setup rows where untrusted data enters typed code — the
persisted-state load (marking dirty, which is the migration), profile
transfer reads, the repo-derived projection, and the renderer's IPC/RPC
ingest and adoption steps — instead of re-guarding each consumer. Also
covers `setup.path`, whose identical crash is on the sidebar render path.
Coercion only: never drops a row, never adds or removes an optional key, and
returns input references when a row already conforms, so selector and useMemo
identity is unchanged.
* refactor(catalog): drop the `as` casts the normalizer introduced
A change whose thesis is "stop the declared types from lying" should not use
`as` to paper over types.
The four source casts all came from the row normalizers returning `readonly`
arrays into mutably-owned fields. Take and return mutable arrays instead, and
copy at the one caller that holds a readonly projection — where identity is
not load-bearing, unlike the persistence path, whose dirty check compares it.
Tests built deliberately malformed rows by casting a literal. Build a valid
row and `Reflect.set` the bad value onto it, which says outright that the
fixture violates its type; parse the non-array case from JSON, which is how
it actually arrives. Fixtures that were merely incomplete needed no cast at
all — `Repo` requires only the five fields they already had.
Also narrow normalizeLoadedProjectCatalog to the two fields it reads.
* refactor(profiles): validate untrusted profile JSON instead of asserting it
Removes the last introduced cast and the unsound pre-existing ones in the
file this change already touches.
The test cast is gone because narrowing normalizeLoadedProjectCatalog to the
two fields it reads made `{}` assignable on its own.
arrayOrEmpty and recordOrEmpty checked the shape and then asserted the
element type, which is the same "declared type is a promise the data does not
keep" problem this change exists to fix. Array.isArray already narrows on its
own, and a generic isRecord narrows the value part, so both assertions delete
outright. JSON.parse returns any, so annotating the binding beats asserting
its result.
The two remaining `as const` in project-host-setup-actions are untouched and
deliberate: a literal assertion narrows a type rather than overriding it.
* Make project catalog normalizers handle null rows defensively
Instead of crashing when corrupt or null catalog rows are encountered,
the normalizers now gracefully repair them with default values. Refactored
helper functions for clarity and added type predicates to improve type
narrowing.
* fix(windows): stop a wedged process-table reader retaining a callback per cooldown
The vendored reader pushes every callback onto a module-global queue and drains
it only when the request holding its `requestInProgress` latch completes. When a
Toolhelp32 snapshot never comes back, that latch is stuck for the life of the
process, so the 30 s cooldown -- which let one probe through per window --
bounded the rate of new callbacks but not the total: one more closure retained
every 30 s, forever, plus a full 3 s deadline block on whichever caller drew the
probe.
Gate on the outstanding read instead. Once a read misses its deadline and has
not called back, every further read is refused until that read's callback fires,
which bounds retention at exactly one callback. Nothing is given up on recovery:
a probe queued behind the latch could never have observed the drain anyway,
whereas the stuck callback firing IS the drain, so the reader now resumes the
instant it recovers rather than up to 30 s later.
It matters more on a relay, which binds the bare addon with no JS queue to
absorb the retries. Each read there is a `Napi::AsyncWorker`, so a wedged one
holds a libuv threadpool slot for good and one probe per window would have
pinned all four default threads inside ~2 minutes -- hanging every async `fs`
and DNS call in that process, not just the process table.
A wedge still does not engage the PowerShell fallback, and a wedged read still
rejects rather than resolving empty, so "unavailable" stays distinguishable from
"nothing is running" on every host.
Fixes STA-5499.
* fix(windows): invalidate stale reader deadlines on reset
* fix(agent-hooks): stop the Windows hook launcher spelling the AV-denied flag pair (STA-5237)
`-WindowStyle Hidden` + `-EncodedCommand` is denied at CreateProcess by
Kaspersky on Windows 11, whatever the payload decodes to. Bash reports it as
`Permission denied` and every managed hook event fails, so agent status never
arrives; the parent shell also briefly cannot spawn anything afterwards, so a
denied hook can take the user's next command down with it.
Measured on the reporting host (#16003), with a harmless `exit 0` payload:
-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand 126
-NoProfile -WindowStyle Hidden -EncodedCommand 126
-WindowStyle Hidden -EncodedCommand 126
-NoProfile -EncodedCommand 0 (5/5)
#16576 removed `-ExecutionPolicy Bypass`, which is the one flag of the three
NOT in the signature, so hooks kept failing after that fix. The pair that has
to stop being spelled is `-WindowStyle Hidden` + `-EncodedCommand`.
Because the change is to the shared switch constant, it covers every site that
spells the denied pair in one edit: Claude via `wrapWindowsPowerShellEncodedCommand`,
gemini/cursor/droid/command-code/copilot via `wrapWindowsHookCommand`, the
`runtime-home-hook-command` unsafe-HOME fallback, and the spaced-path fallback
for codex/grok/devin/antigravity. Only a flag is removed, so parser and payload
compatibility is unchanged for every executor: the string is still a PowerShell
command line, still one self-contained token, still base64-shielded.
The tradeoff, recorded rather than hidden: `-WindowStyle Hidden` was the shipped
fix for #14815 (+#14828, #15117, #15447, #15767), and this removes it. Its
suppression was never measured — #14825 confirmed it visually, #16576's author
stated it "remains unverified on a real box", and #15506's author argued it
cannot help a `.cmd` child with no console to inherit. The console is allocated
by the parent chain, not by this command line. A live window measurement is
still outstanding and is called out in the PR.
Also adds `windows-hook-payload-delivery.test.ts` to the PR CI Windows leg,
which had never run it.
* test(agent-hooks): keep launcher token out of source grep
* fix(workspace-cleanup): color review pills by PR/MR state
The inactive-workspace review dialog rendered every linked review pill in
one of two flat tones, so a merged PR, a closed PR, and an unlinked row all
looked alike. Reuse the state colors the PR page and item dialog already
use (purple merged, rose closed, slate draft, emerald open) and give the
pill the matching state glyph.
The mapping lived in two byte-identical copies; both now delegate to a
shared review-state module, as does the sidebar's state-icon picker.
* fix(workspace-cleanup): expose review state in confirmation rows
* fix(workspace-cleanup): don't repeat the review number in the pill's sr-only text
The confirmation row's screen-reader span read the whole tooltip, so the PR
number was announced twice. Announce only what the color carries — the
translated state label and title.
* refactor(github): collapse the duplicated work-item state badge
The PR page and the item dialog each carried their own copy of the badge:
identical markup, identical base classes, identical open-state tone. Only
the closed-ISSUE tone genuinely differs, so that becomes a parameter and
the rest moves to one component.
Also drops a one-line tone wrapper in workspace-cleanup and folds the
review tooltip onto the screen-reader text it already duplicated.
* feat(diagnostics): name the code driving a React commit cascade
React #185 reports blame whichever component dispatched after the
root-global counter tripped. react-update-depth-attribution already tells
the report that boundary_id names a bystander; nothing recorded what the
real driver was.
Count commits through react-dom's devtools commit hook — the only
per-commit seam that survives minification. Profiler's onRender is
compiled out of the production bundle, and a dependency-less root layout
effect fires per render of its own component, not per commit (measured: a
root effect saw 1 of 11 commits a leaf drove).
Mirror React's own reset rule rather than a time window: a commit that
leaves no sync lanes pending ends the cascade, and a different root
restarts it. The steady-state cost is a mask, a compare and an increment,
with no clock read and no allocation. Stack sampling arms only once a
cascade is already deep, so ordinary work never pays for it.
* fix(diagnostics): remove the install-order trap and guard the write path
Adversarial and perf review of the cascade diagnostic:
The install-order ratchet guarded the wrong thing. The observer self-installs
at the bottom of its own module, so it only ran after its transitive graph
evaluated — one new import reaching react-dom would have killed the
diagnostic in production with every test green. The entries now import the
import-free shim instead, which only has to make the global exist; wrapping
the callback is timing-independent because react-dom re-reads it per commit.
The store write probe called the sampler unguarded, so a throw there dropped
the write on the app's universal write path. Guarded; the try/catch measured
free at +0.005ns.
Report the frames that name the driver instead of capturing eight and
reporting one, arm the self-check on the paths where install fails, bind the
sample cap to the write count rather than a V8-only API, and stop defining
the devtools global for every test file to serve one.
The cascadeRoot comment claimed a strong reference cannot retain; a WeakRef
probe disproved it. It is still not a leak — the next non-cascading commit
clears the slot — so the comment now says that instead.
* test(diagnostics): close the ratchet holes guarding the cascade hook
Adversarial review loop 2:
The install-order ratchet only saw imports whose `from` shared a line with
the keyword, so a multi-line `import { createRoot } from 'react-dom/client'`
in the shim passed it — and that is the one edit that kills the diagnostic in
production. 43% of files in this directory use the multi-line form. Scan the
shim source directly as well as walking the graph.
The 4000-char budget for the driver frames is bought by the key ending in
`stack`, but the only test asserting that emitted its own literal key, so
renaming the real one truncated the frames with the suite green. Assert the
name the renderer actually emits.
Also correct the comment on the `installed` placement: the self-check never
reads that flag, it arms because it sits outside the try.
* test(diagnostics): stop the shim ratchet firing on prose
Adversarial review loop 3 caught two flaws in the guards added last commit.
The source-scan regex used an unbounded `[\s\S]*?` after an anchor that also
matched the shim's own `export type`, so it degenerated to "does the word
`from` appear later in the file" — rewriting a doc comment to say "reads the
hook from the global" failed the ratchet. A guard that fails on prose is a
guard someone deletes, and this one is what stands between a reshuffled
import and a silently dead diagnostic. Require a quote after `from`, tolerate
comment obfuscation, and catch `await import(...)`, which makes the shim
async so react-dom evaluates before the hook is installed.
The 4000-char budget assertion matched `/stack$/i` against the raw key, but
the real rule camel-splits first — so `driverstack` would pass while shipping
truncated frames. Assert through sanitizeCrashReportDetails, resolving the
key from the payload rather than hard-coding it.
* feat(browser): open target=_blank links and unnamed popups in new Orca t
- Treat target=_blank as a new-tab request matching browser behavior
- Route unnamed, featureless window.open() calls to Orca tabs instead of native popups
- Add rate limiting to prevent page-initiated tab loops
- Inherit session profiles when opening links to maintain isolation boundaries
* fix(browser): deny new-tab window.open when renderer is destroyed
Move deny action outside conditional to ensure new-tab intents are
safely rejected even if renderer vanishes mid-open, preventing native
popup fallthrough. Add test coverage and simplify comments.
* Share page-initiated tab budget across opener popup tree
Prevent pages from bypassing the new-tab rate limit by chaining popup
windows. The page-initiated tab quota is now shared by all popups in
an opener tree (root + named children), so child windows inherit their
root's budget instead of each getting a fresh allocation.
* Suppress default quit on window-all-closed in DNS probe
Destroying the probe window awaits stopLogging, which yields to the event
loop long enough for the default window-all-closed exit (non-macOS) to
trigger before the result can be written. Preventing this default behavior
allows the result to complete and exit cleanly.
* Preserve Japanese Skills UI labels; fix test flakiness and deps
- Add skipKeyPrefixes filter to Japanese phrase fixes to prevent automatic
translation of UI labels (e.g., keep エージェント in Skills components)
- Wrap timing-dependent tests in vi.waitFor to eliminate race conditions during
reconciliation and scheduler boundary ticks
- Complete useEffect dependency arrays to resolve React hook warnings
* Fix updater startup scheduling test flakiness
Set last update check to 23h ago instead of null to make timing deterministic. The startup check arms its own 24h timer; by pre-setting the last check time, only the result handler's re-arm can produce the expected check 24h later, eliminating race conditions.
* fix(ports): stop joining an undefined resourcesPath on a non-Electron host
`resolveWorkerEntryPath` branched on `isPackaged` alone and joined
`process.resourcesPath`. orcad reports `isPackaged` true — correctly, it is a
production build, and ~15 consumers read it that way to gate HTTPS-only skill
downloads and the real CLI name — but `process.resourcesPath` is Electron-only
and `undefined` under plain Node.
So the packaged branch threw
`TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string`
where a clean "worker unavailable" was the honest outcome. The type said
`resourcesPath: string`, which is how it went unnoticed; it is now
`string | undefined`, so the compiler carries the fact.
A host with no Electron resources tree has no asar to look in, so it falls back
to the module directory and lets the caller report a missing worker.
Found by the item 1 agent while auditing the same `isPackaged` defect class in
the watcher. Verified in both directions: reverting the guard reproduces the
TypeError.
* feat(orcad): prove node-pty loads before anything requires it
Of the two ways node-pty fails, only one is catchable. A missing module throws
MODULE_NOT_FOUND. A module built against the wrong libc or Node ABI is refused by
the dynamic loader, and in the worst case takes the process down before any handler
exists — that is #9902, which crashed the desktop app on Ubuntu 20.04 before a
window appeared. There was no libc or ABI precondition anywhere in the tree.
So orcad now proves the load in a CHILD process, from main.ts, before anything
requires node-pty. Whatever the child does — throw, abort, die on a signal — is data
rather than our own death, and the operator gets a sentence naming the host's libc,
Node ABI and prebuild slot plus the command to run. Proven-unloadable exits 78
(EX_CONFIG), so a supervisor does not restart an unequippable host forever. A probe
that never answered is unverifiable, not blocked: refusing to boot on an inconclusive
signal would take down hosts that work.
The child dlopens the file node-pty would have chosen, before requiring the package.
node-pty's loader walks several directories and rethrows only the LAST error, so a
refused binary reads as "Cannot find module ./prebuilds/..." — which sends the
operator to install a module that is already there. It also reports through stdout:
node echoes the whole -e source above a stack trace, and matching tokens against
stderr made the probe's own source text answer for the verdict.
Verdicts reach clients as a terminal_unavailable degradation alongside the existing
browser_unavailable one, through the same cause-registry shape. degradations[].code
is now an open vocabulary; clients already render only `message`.
Prebuilds are compiled from PATCHED sources — the patch IS the glibc-floor fix, so an
upstream tarball reproduces #9902 — into linux-{x64,arm64}-{glibc,musl} and
darwin-{x64,arm64} slots. libc is in the slot name because node-pty's loader falls
back to prebuilds/<platform>-<arch> and cannot tell glibc from musl. orcad installs
the matching slot at boot, so a host with no compiler serves terminals.
The relay's five pure toolchain-diagnosis functions moved to a transport-free module
so the Node bundle can reuse them without dragging ssh2 in behind them; the relay
keeps its API by re-export. macOS gets `xcode-select --install` rather than the
cross-distro apt/dnf/pacman/apk menu, every line of which is wrong there.
* test(orcad): pin the node-pty precondition to ground truth, not a prepared host
CI's test shard runs `vitest` directly, so `ensure-native-runtime --runtime=node`
never prepares node-pty for the Node ABI — `degraded` is the correct verdict
there, and asserting 'ok' encoded an environment the shard does not have.
Asserting whatever it returned would be vacuous, so the expectation is now
derived from an independent require() of node-pty. Verified it still bites:
forcing the precondition to always report 'ok' fails the suite.
* feat(orcad): run the terminal daemon, and the ops contract around it
orcad declared `canRecoverPersistentLocalPtys: () => false` because it did not
run the terminal daemon, so every restart, update and rollback SIGKILLed every
running terminal — on the host whose selling point is that work survives the
client going away. That is the one property `ssh-execution-boundary.md`
recommends the peer model for.
Item 4 — the daemon:
- Port the launch path off electron: `daemon-init.ts`,
`daemon-host-relocation.ts` and `observability/logs-directory.ts` now read
the `AppEnvironment` port. Relocation additionally asks whether the app root
is an asar archive rather than whether the build is packaged, so a Node host
answering `isPackaged() === true` no longer walks into an Electron-only
NSIS-escape path (same precedent as `parcel-watcher-entry-path.ts`).
- `build-orcad.mjs` emits `daemon-entry.js` beside `orcad.js`, scans the
forked children's metafiles for electron/node:sqlite, and load-checks the
child under plain Node.
- orcad spawns and adopts the daemon; shutdown disconnects and never kills it.
`canRecoverPersistentLocalPtys` now reads the live provider and is false
under degraded routing, where fresh terminals would die with the process.
Item 3 — the ops contract (docs/reference/orcad-operations.md):
- Bind policy: `--bind`, default loopback, pinned so neither `orca serve`'s
wide default nor the connected-device widen can override it, and so a paired
client cannot rebind the listener from outside.
- Instance lock on the data root before profile load, scoped to the runtime
role so it never refuses a restart that a live daemon makes worthwhile.
- Supervision: exit codes a supervisor can act on (78 = do not retry),
second-signal escalation, a shutdown deadline, and crash-loop containment on
daemon respawn.
- Health in the readiness payload: build hash, Node ABI, and a PTY self-test
that spans both processes — the daemon spawns a real PTY in its own process
and the verdict crosses its socket.
Both bundle load-checks now assert on exit codes: these bundles are minified
onto one line, so Node's uncaught-exception report echoes every string literal
in the bundle and the previous message match passed against a bundle that
never loaded.
* feat(orcad): deploy, activate and roll back a versioned orcad install
Plan items 6 and 7 from docs/design/shipping-orcad.html.
Install reuses the relay's transaction verbatim — per-version lock, staged
SFTP write, .install-complete sentinel, stale-lock recovery — under a
parameterized namespace, so orcad-<v>/ sits beside relay-<v>/ permanently
(§06). Parameterizing GC is the trap that creates: each model now collects
only its own directories, enforced twice (prefix-scoped remote listing plus
a local ownership re-check), and a client picks its model from how the host
is registered, never from what it finds on disk.
Activation is separate from installation, because a versioned directory
selects nothing. A candidate is launched, publishes orca_server_ready, and
only becomes active if its cross-process health payload passes: right build
hash, listening, daemon live, PTY self-test green. A rejected candidate is
stopped and the incumbent restarted, so a careful deploy cannot cause the
outage it was being careful about.
Update and rollback are shaped by the daemon. An update restarts orcad, the
daemon outlives it, and the surviving daemon was forked from the outgoing
bundle — so live terminals defer the update rather than proceed, and GC pins
the active version, the rollback target and the live daemon's bundle. Orca's
persisted state carries no schema version, so rollback restores a
pre-activation snapshot rather than trusting backward-readability; the point
past which it is unsafe is the first terminal created after activation,
which the snapshot cannot describe and the surviving daemon still owns.
Running the generated shell for real found two bugs the text assertions
missed: tar members re-quoted inside a shell variable captured nothing, and
kill -0 reports a zombie as alive.
* test(orcad): assert the precondition is self-consistent, not environment-shaped
The real-host case cannot predict a status: CI's shard runs vitest directly, so
node-pty is never built for the Node ABI and 'degraded' is correct there, while a
prepared checkout gives 'ok'.
The previous attempt used require('node-pty') as ground truth, which resolves the
JS wrapper while the native binding loads lazily — it proved strictly less than
the precondition checks, and failed CI for exactly that reason.
What is invariant on a host with node-pty installed: never 'blocked', and never a
degraded verdict carrying an unestablished reason. The injected-input tests keep
the logic coverage.
* fix(orcad): drop an eslint-disable the rule no longer needs
* test(orcad): separate slot placement from the load verdict
Both remaining CI failures were the same shape: tests reaching into node_modules
for a pty.node that only exists after `ensure-native-runtime --runtime=node`,
which CI's shard never runs because it invokes vitest directly.
Slot *placement* is the logic worth checking on every host, so it now uses a
synthetic payload and asserts the verdict stays honest about not loading. The
three assertions that genuinely need a Node-ABI binding are gated on it existing.
Verified: breaking slot installation fails both placement tests; with the real
pty.node hidden the file is 17 passed / 3 skipped instead of ENOENT.
* test(orcad): gate the load-dependent cases on a real load, not on the file existing
CI ships a pty.node built for Electron's ABI, so existsSync was true while require
still failed — the gate ran exactly the tests that host can never satisfy. It now
probes the binding in a child process, so a bad one cannot take the runner down.
The self-consistency assertion also allowed too little: 'blocked' is the honest
verdict for a corrupt binding, alongside 'ok' on a prepared host and 'degraded' on
an unprepared one. What stays invariant is that anything other than 'ok' names an
established cause, so a terminal is never declined for a reason nobody worked out.
Verified against all three host states: prepared (19 passed), unprepared, and a
corrupt binding (17 passed / 3 skipped, no failures).
* test(orcad): gate on the whole premise — binding AND spawn-helper
CI has a loadable pty.node but no spawn-helper, and a slot without the helper is
legitimately 'degraded'. So the previous gate let a test run whose premise ('a
complete slot yields ok') that host cannot satisfy.
Verified in both states: with the helper present 19 pass; with it removed the
load-dependent cases skip (17 passed / 3 skipped) instead of failing.
* fix(orcad): preserve degradation types after rebase
* fix(ai-vault): stop a whole opencode.db failure reading as one skipped transcript
#15036 reported "1 transcript skipped / database is locked" with both Agent
Session History scopes empty. Two separate defects.
The panel counts every unkinded scan issue as a skipped transcript, so a
failure that lost an entire *source* was reported as one lost *file*. The
whole-database failure is now kinded `scope`, and an unknown `kind` from a
newer host degrades to `scope` instead of failing validation and coming back
unkinded — a mixed-version remote host previously turned a source-level
failure into a phantom skipped transcript.
The read also inherited sqlite3's 0 ms busy timeout, so a genuinely contended
open failed in ~1 ms. It now opens once with a bounded timeout. No retry loop:
sqlite's own busy handler already blocks and retries internally for the whole
timeout, and WAL readers do not block on a writer at all (measured: 547/547
cross-process reads at timeout=0 while a writer held open transactions).
Measured against a real Ubuntu-24.04 distro, Windows cannot take SQLite's file
locks over \\wsl.localhost at all: an idle, never-WAL, nothing-attached
database still answers SQLITE_BUSY, a 5 s busy timeout does not change it, and
the identical bytes open fine once copied to local disk. So a lock-family error
on that share never means "a writer holds it" and no timeout can help. The copy
says so rather than sending the user after a write-ahead log that is not the
problem. Restoring those sessions needs an in-distro read; that is a follow-up,
and this PR no longer pretends a timeout will do it.
immutable=1 is deliberately not used as a workaround: over the same share it
opens and returns 100 of 150 rows, silently dropping everything still in the
uncheckpointed -wal — in a history panel, exactly the newest sessions.
* skip the provably futile busy wait on \\wsl.localhost paths
* test(worktrees): cover id: selector path-spelling parity with path: (#16243)
The renderer can only address a workspace by id (toRuntimeWorktreeSelector always
emits id:<repoId>::<path>), and the runtime matches that id byte for byte while a
path: selector has always compared through normalizeRuntimePathForComparison. A
stored id that spells its path differently from `git worktree list` therefore
resolves for the CLI and answers selector_not_found for the UI, which reads that
as a stale local mirror, calls forgetLocal, reports success, and lets the row
return on the next catalog refresh: a silent delete.
These tests fail on both resolution sites -- the fleet `id:` branch of
resolveWorktreeSelector and the scoped resolveScopedWorktreeIdRow a
host-qualified removal takes -- and pin what must stay closed: an exact repo id
(STA-4343), host qualification, dot segments neither selector canonicalizes, and
a refusal rather than a guess when two rows spell one path.
13 failing, 35 passing.
* fix(worktrees): resolve id: worktree selectors by path equivalence (#16243)
worktreeIdComparisonKey names one repo, one filesystem location, and one
folder-workspace instance, folding exactly the path spellings
normalizeRuntimePathForComparison already folds for a path: selector -- and
nothing more, so dot segments stay unresolved for both shapes. Both id:
resolution sites consult it only after an exact match finds nothing: the fleet
branch of resolveWorktreeSelector and resolveScopedWorktreeIdRow, which a
host-qualified removal takes. runtimeWorktreeIdsEqual now derives from the same
key so the runtime has one normalizer rather than a parallel one.
Not a pure refactor at that last site: runtimeWorktreeIdsEqual used to
normalize-compare ids that parse but carry an empty repoId or an empty path
('::/p', or 'repo::' against 'repo::/'), and worktreeIdComparisonKey returns
null for those, so across its call sites (PTY identity, refresh, mutation
queue) such ids now compare byte-exact instead. That narrows matching rather
than widening it, no real worktree carries such an id, and it is the behavior
#15616 guarantees for malformed ids -- but it is a behavior delta, not just a
tidy-up.
Perf (#14399): the exact match is still tried first and still wins outright, so
a resolvable id costs exactly what it did before. Neither site adds a scan --
the fleet branch re-filters the array it had already listed, the scoped lookup
re-filters the single owning repo's projected rows -- so an explicit id still
never scans every repo.
Fail-closed behavior is unchanged: the repo id compares exactly (STA-4343), host
qualification is untouched, the folder-workspace instance suffix stays part of
the path, and a scoped lookup with two equivalent rows refuses instead of
guessing. The bare unprefixed selector branch keeps byte-exact id matching,
since only the id: shape reaches a renderer caller.
Shares src/shared/worktree/id.ts with the open #15616, which introduces
worktreeIdComparisonKey for the same divergence in lineage pruning and
authoritative-scan purging; this adopts that helper rather than adding a second
one. Complementary to the open #16295, which makes the miss visible; this
removes the miss.
* chore(worktrees): satisfy oxfmt and oxlint on #16243 tests
oxfmt --check flagged both new test files and oxlint's
unicorn/no-useless-fallback-in-spread flagged the store mock; the full
lint and format gates now match the pre-change baseline.
* test(worktrees): pin Windows spellings and malformed-id exactness (#16243)
Review found two axes the first pass left unproven at the two id: resolution
sites. Both are the invariants the open #15616 guarantees for the shared
worktreeIdComparisonKey it introduces for #15598, so violating either here would
break a contract a sibling PR depends on.
Windows: #15598's whole defect is that one checkout is recorded under both
`D:\Agentic\game2` and `D:/Agentic/game2`. The fleet branch, the scoped removal
lookup, and the key itself now each resolve the backslash spelling against the
forward-slash spelling git reports, and fold drive-letter case -- while a
backslash inside a POSIX path stays a filename character and a POSIX root stays
case-sensitive, exactly as normalizeRuntimePathForComparison already decides for
a path: selector.
Malformed ids keep exact matching at both sites: an id with no repo boundary or
an empty path still refuses, and the scoped lookup still refuses it without
scanning.
Four of these fail without the production change (three fleet/removal Windows
cases and the scoped one); the malformed-id and POSIX-backslash cases are
invariant guards that hold either way.
Verified: 58 passed in the three files; 18 fail with the production hunks
reverted; orca-runtime.test.ts and worktree-teardown-unstopped-pty.test.ts green
(1270 passed | 1 skipped); pnpm tc:node clean.
* test(worktrees): pin Windows id: spelling folds and fleet ambiguity refusal (#16243)
The Windows backslash spelling now rides the ID_SPELLINGS rows, so it is driven
through both id: sites -- resolveWorktreeSelector and the scoped removal target --
and compared against what the same workspace's path: selector resolves, rather
than only through worktreeIdComparisonKey. That is the spelling #15598/#15616
found in the wild and the one the owner's Windows client produces.
The fleet path's ambiguity refusal had no test: two same-repo rows spelling one
directory, an id: matching neither exactly, must reject selector_ambiguous. It is
the fail-closed guard on a delete-capable resolver, and the property a later
refactor is most likely to turn into a silent pick.
Also records two limits at the source instead of leaving them to be rediscovered:
a UNC or WSL root never folds into a drive-letter location (while Windows' two
WSL UNC aliases do name one location), and a folder-workspace id keeps a trailing
slash placed before the ::workspace:<uuid> suffix, so that spelling stays
exact-match-only. Neither behavior changes here.
The file docblock overclaimed parity. path: collapses duplicate same-host
registrations to the first row while a folded id: refuses them; the contract this
file pins is path-spelling parity, not dedup parity, and the divergence is
deliberate because this resolver also serves delete.
Non-vacuity, verified by temporarily reverting the production hunks: neutralizing
both id: fallbacks turns 10 of these tests red, including both new Windows rows
and the ambiguity refusal (it degrades to selector_not_found). Making the fleet
fallback pick the first folded match instead of collecting all of them turns the
ambiguity test red on its own. The remaining cases -- malformed ids, dot
segments, the POSIX backslash, the folder-workspace slash -- pass against the
pre-fix code too: they guard against future widening rather than proving this
fix.
Drops the two Windows cases the ID_SPELLINGS row subsumes.
The drive-letter case test asserted only the Windows half its name promised; it
now also pins that a POSIX root does NOT fold case, since an unconditional
lowercase would merge /data/Foo with /data/foo on the platform CI runs on.
Fixture paths use the upstream-attested /srv/projects prefix (and a neutral
plugin-host leaf) instead of a local install root; the spelling variations the
tests exist to pin -- doubled separator, dot segment, trailing slash, uppercase
POSIX, cafe NFC/NFD, and the Windows D: rows -- are unchanged in form.
* docs(worktrees): trim the id: selector test header and document the comparison key (#16243)
* fix(agent-hooks): correct durable spool delivery
* fix(agent-hooks): spool curl failures after retries
* fix(agent-hooks): keep replay out of runtime observations
* test(agent-hooks): pin managed hooks inert outside an Orca terminal
* fix(agent-hooks): address review findings on the durable spool
- claude: pass the literal source; options.agent does not exist (typecheck)
- kimi: the windows-local ordering runs its guard pre-stdin and before the
function exists, so it no longer spools there (printed command-not-found)
- writer: require a readable endpoint file before creating a spool tree
- antigravity: carry its out-of-band event name into the record and filter on it
- drain: truncate only the bytes consumed, preserving concurrent appends and a
torn trailing line
* fix(agent-hooks): ignore spool events without pane attribution
* fix(agent-hooks): make spool replay and appends robust
* test(agent-hooks): type spool replay records
* fix(agent-hooks): defer unterminated spool records
* fix(agent-hooks): replay spool events through relays
* fix(agent-hooks): preserve Codex prompt across child replay
* fix(relay): keep startup alive when spool replay fails
* fix(relay): simplify spool replay startup guard
This reverts commit ebcd637db9 (#16504) and dependent commit 673842db35 (#16505).
Launch-blocker rationale (findings-counsel validated):
- P0 Data Loss (F06-1): The WSL legacy auth drain deleteSource=1 path deletes intact source auth without re-validating the destination after concurrent destination rewrites, permanently corrupting auth credentials on upgrade.
- P1 Workflow Regression (FC-01): Pre-upgrade sessions under ~/.local/share/orca/codex-runtime-home/home are not linked into direct homes, breaking /resume in the Codex CLI for upgrading WSL users.
Codex silently discards Enter for ~75-150ms after its composer glyph first
renders, and the boundary widens with prompt size and machine load, so no
fixed first-Enter delay is provably safe on slow hosts. Submit success is not
verifiable from PTY output, but a redundant Enter is a measured no-op on codex
in both post-submit states, so send one blind retry after the first Enter.
- tui-agent-config: new optional submitRetryDelayMs knob, set to 1200 on codex
only; every other agent is byte-identical to today.
- agent-paste-draft: after the post-paste '\r', wait the configured gap and
send exactly one more '\r' inside the same PTY input transaction, so a
concurrent paste cannot interleave. The retry is best-effort and never
downgrades the first Enter's result.
- Retry tests live in a new file to keep agent-paste-draft.test.ts under the
max-lines budget.
active-agent-note-send is deliberately exempt: its Enter rides the
terminal.send RPC (different transport, server-side sendable guard), has no
local agent identity to read the config from, and only fires on an
already-running agent, where the codex cold-boot submit gate cannot occur.
* refactor(codex): remove WSL runtime mirror machinery
* test(codex): drop allowlist entries the mirror removal made stale
runtime-home-service.ts no longer spawns wsl.exe or imports child_process;
both boundary guards fail closed on a stale entry so the goalpost keeps moving.
* fix(codex): drain legacy WSL auth before restart
* fix(codex): await WSL auth drain before restart
When Enter is pressed to confirm a rename, the input unmounts and its onBlur
handler fires as it detaches from the DOM. Without consuming this event, a
second commitRename call would attempt to rename against the old path. Setting
the cancel flag after capturing the new name causes the trailing onBlur to
return early, preventing the duplicate operation.
* fix(codex): launch WSL accounts from direct homes
* fix(codex): coalesce WSL auth drains and validate distro homes
* fix(codex): preserve legacy WSL account home metadata
* fix(codex): retain marked WSL home compatibility
* fix(codex): verify the bytes the WSL drain promotes, not an earlier read
The apply script validated the source hash and then re-read it with cp, so a
legacy pane rotating in that window put bytes freshness never judged over a
valid account home. Codex rewrites auth.json in place, so that read can be torn.
Covers it by running the real guest script under sh with a sha256sum shim that
rotates the source between the two reads; without the guard it exits 0.
* fix(codex): harden WSL auth drain races
* fix(mobile): quantize chat pinch font scale so a zoom stops re-measuring the list every frame
A user bubble on a 390pt iPhone painted five lines inside a frame that
reserved six, with the last painted line cut through a glyph at the content
edge and "no longer needed." gone.
The paint is React Native's: a `<Text>` with no `numberOfLines` gets a text
container whose `lineBreakMode` is `NSLineBreakByClipping`
(RCTTextLayoutManager.mm). Measure lays out into `{width, CGFLOAT_MAX}`, paint
lays out into the mounted content frame — so a frame one line short does not
re-wrap, it dumps the remainder onto the last fitting line and clips it, with
no ellipsis. Reproduced on-device against the real component with the message
text held constant, so five painted lines can only be truncation.
Two conditions are each necessary, and removing either makes it vanish over
~6000 measured bubble renders: a pooled `RCTParagraphComponentView` carrying a
shorter row's content frame (`prepareForRecycle` clears `state` but not
`_textView.layoutMetrics`), and whole-list re-measure churn while rows enter
and leave that pool.
The churn was ours. `renderItem` closes over `fontScale`, and the pinch handler
committed a new scale on every gesture frame, so one zoom drove hundreds of
full-list re-measures. The pinch is composed `Simultaneous` with the list's own
scroll, so a stray second finger during a scroll started that storm at scales
the user cannot see — matching the report, whose glyph metrics are `fontScale`
1.0 exactly.
`quantizeFontScale` snaps commits to a 5% grid. React bails out of a same-value
`setState`, so gesture noise now commits nothing and a full-range pinch commits
at most ~20 times. Under the churn that produced 67 defects in 6636 bubble
renders, the quantized build measured 0 in 6064 — with a forced-defect control
bubble flagged in 100% of frames of both runs to prove the detector was live.
This removes the trigger we own; it does not close the RN recycling window
itself. That needs a one-line reset in `prepareForRecycle`, which cannot land
here without refreshing the `patchedDependencies` hash under `mobile/`.
* fix(mobile): reset recycled paragraph layout before reuse
* fix(native-chat): anchor an unmatched chat echo where it was sent
The reported symptom was old user messages replaying below every new turn, so the
conversation read as scrambled. The cause was not that the echo failed to match a
transcript row. Claude consumes a mid-turn send through a `queued_command`
attachment and writes no `type:"user"` record for it, so some echoes can never
match, and no amount of matching will change that. The cause was WHERE an
unmatched echo rendered: buildMobileNativeChatTransientData appended every pending
item after the entire transcript, so it re-read below each turn that landed
afterwards.
Render each echo directly after the transcript row it was sent against, using the
baseline the send already captures. An unmatched echo is then at worst a duplicate
in the right position rather than a scrambled one, and it stays visible. Echoes
sharing an anchor keep send order; a send with no baseline, or one whose anchor
folding dropped, still falls back to the tail.
Deliberately NOT fixed by deleting the echo. Inferring from send ordering that an
echo can never match, then removing it, loses the user's own text for a message
the agent did receive, and it cannot fire in the common case anyway - measured
drain groups are 1,017 of size 1 against 55 larger. It also escalates an existing
gap: the count pass has no baseline-tail guard, unlike the glue pass, while
`messages` is a 40-row window that head-trims, resets on reconnect and grows at
the front on loadEarlier, so a false landing there would license deleting a
DIFFERENT outstanding message.
That count-pass gap is real and left for a separate change; anchoring makes its
worst case a duplicate in place rather than a scrambled conversation.
* fix(native-chat): preserve folded echo anchors
* fix(native-chat): preserve forward-folded echo anchors
* fix(native-chat): keep leading folded echoes in place
Brennan Benson
Neilandinnocarpe
Jinjing
Mark XianandBrennan Benson
Lesley Murfin
Jinwoo Hong
github-actions[bot]