mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 09:07:40 +00:00
f12e12f212e22bf457e7d0c96cdff80bbbc33ef8
928
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Brennan Benson
|
bb1b05e3bd |
Clear Google cookies from a browser profile, as often as you need (#34158)
* Add repeatable Google cookie clearing for browser profiles * Bind Google cookie clearing to its successful import target * Repair cookie-clear contract test boundaries and positive flows * Correct cookie-clear test fixture typing * test: use checked runtime bindings in browser profile RPC fixture * test: provide page registry to sidecar forwarding fixture * fix: use selected browser profile owner for cookie clear menus * test: provide confirmation context to link materialization fixture * test: classify cookie clear session channels * refactor: consolidate browser command property guards * test: update cookie clear fixture for merged registry API * feat: move Google sign-in recovery to browser settings * Freeze Settings Google cookie clearing intent and refresh availability * Restore baseline browser import disclosure coverage * Pass the selected browser profile into cookie settings * Localize Google cookie settings search keywords * Update cookie restart fixture policy exports * Keep localized browser search results visible * fix: make Google cookie clear a red right-aligned setting that explains when to use it * Explain why Google cookies are handled separately in the clear row caption |
||
 Neil
|
045f8c8266 |
feat(files): show images and PDFs from the byte-range preview path, local and remote (#35165)
* feat(files): show images and PDFs from the byte-range preview path, local and remote ImageViewer and PdfViewer read an orca-media:// URL instead of base64 when the editor opens a file: images load by URL, and pdf.js reads PDFs by range, so a large PDF no longer arrives whole through files.readPreview or pages into memory first. The grant mints only for the editor's viewers; diffs, git blobs, markdown images and the paired web client keep base64. - Minting an image checks its header with the base64 path's rule, so an image proven too large to decode safely never reaches the decoder. - orca-media gains fetch and CORS privileges, and range responses expose Accept-Ranges and Content-Range, so pdf.js can read by range. - Grants report the file size the viewer used to estimate from base64. * fix(files): read PDFs by real range, check served images, keep old hosts' previews - pdf.js fetches ranges only over http(s), so an orca-media URL was read whole; a small range transport now hands it bytes=a-b reads from the grant, and a failed range fails the preview instead of hanging it. - A file can change after mint, so the raster header is checked again on the bytes each image request serves (the same handle locally). - A paired host without files.readChunk falls back to files.readPreview for images and PDFs, as before; only audio and video need the update. * fix(files): mint no local document grant for a renderer gone mid-mint The local image/PDF mint is async now (authorize, open, header check), so a renderer that closed meanwhile could leave a grant no teardown drops. It binds the renderer lifetime first and refuses to mint once it's gone, as the remote mint does. * fix(files): keep the 50 MB cap for URL images, and probe remote headers incrementally An <img> decodes the whole file, so image grants keep the base64 path's 50 MB cap; PDFs, now read by range, don't need one. A remote header probe reads only each wider step's new bytes instead of re-reading from the start. A replaced image of a different size resets its zoom. * fix(files): tear down a PDF load whose range failed, and read 256 KiB ranges A failed range only showed the error and left the pdf.js task, its worker and pages alive; it now destroys that load first. pdf.js asks for one readChunk-sized range at a time instead of 64 KiB, and a Range preflight gets its CORS answer instead of 405. * fix(files): read PDF ranges over IPC so orca-media needs no fetch or CORS orca-media had gained supportFetchAPI and corsEnabled, and its responses sent Access-Control-Allow-Origin: *, so pdf.js could fetch ranges. That let any default-session frame holding a token read the bytes. pdf.js now reads a PDF grant's ranges through fs:readPreviewRange, which main answers only for the renderer that minted the token. The scheme is back to element-load privileges (standard, secure, stream), responses carry no CORS headers, and preflights get 405. Grant bookkeeping moves to preview-grant-registry.ts. An e2e spec proves an orca-media URL can't be fetched from the app page or read from another session. * ci(e2e): route the byte-range preview sources to the viewer specs that exercise them Changes to the orca-media grant path, the image/PDF viewers and the PDF range transport now run the PDF reload, rebuild and find specs, the remote large-file open, media playback and the partition-isolation spec. * fix(files): stop PDF range reads on abort, abort remote reads with the window, fix the CI route - A closed or reloaded viewer schedules no further pieces of a merged range, and a remote range read stops when its window goes away. - A URL without a size is an error rather than a fetch the scheme refuses. - The PR guard job's sparse checkout and its admission test include the new route module, and the route now also covers the mint handler, preload bridge, editor surfaces, scheme registration and read client. * fix(files): classify linked previews by their target, keep range reads off stopped WSL distros A local image or PDF reached through a link is classified by the file it resolves to, at mint and on every read, and a re-mint after the link is retargeted gets a fresh grant of the new type. A paired host's document whose first bytes are another kind defers to files.readPreview, which classifies the target there. Lazy local reads go through the non-waking WSL guard, as fs:readFile and fs:readFileChunk do. |
||
  Oleksandr SuvorovandNeil
|
3bfb2bd094 |
fix(build): explain missing mobile/ deps instead of failing build:mobile-web (#24325)
mobile/ is a separate pnpm project, so the root pnpm install leaves mobile/node_modules empty and pnpm build failed in build:mobile-web with hundreds of unexplained esbuild "Could not resolve" errors. build-mobile-web-app-bundle now checks for mobile/node_modules first and exits with the one command that fixes it. The probe path is shared with the bundle tests' dependency check. CONTRIBUTING documents the install in Local Setup and points "Before Opening a PR" at it. Fixes #24324 Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
fceb475e44 |
test(wsl): measure distro restart to first output for the WSL host and an old-bridge lower bound (#34864)
* test(wsl): measure reboot to first prompt for the WSL host and the old bridge The real-WSL lane's phase 3 now terminates its distro and times, median of 3 each, how long a WSL-host project takes to a working terminal (holder boot, orcad start, terminal spawn and an answered command) against one wsl.exe into the login shell, as the old bridge does. Test-only. * test(wsl): relabel the restart baseline honestly and raise the WSL2 job cap The baseline measures distro restart (VM warm) to first command output; the old-bridge figure is a non-PTY wsl.exe --exec lower bound, not ConPTY first paint. The job cap rises to 40 minutes so it no longer undercuts phase 3's own 30-minute timeout. |
||
 Grit
|
03dcd30367 |
docs: fix README typo and drop stale release-rc.yml cron note (#14569)
The README misspelled "sponsored" in the Signed Builds section, and CONTRIBUTING.md still pointed at a scheduled release-rc.yml workflow that no longer exists (release-cut.yml is dispatch-only). Fixes #14568 |
||
  OrcaWinandOrcaWin
|
7cdfebdc1b |
Revert iteration checks and custom Vitest selection (#34834)
* revert: remove iteration checks and custom Vitest selection * chore: use upstream affected-test selection --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 NeilandClaude
|
1eaaf85e9f |
Land the WSL project mover dark (merges only after verify-15b, the flag-off audit and green CI) (#34059)
* test(orcad-migration): pin the SSH manifest through the real dormant collectors Co-Authored-By: Claude <noreply@anthropic.com> * refactor(orcad-migration): read the dormant-state export through a source-kind scope A local-WSL scope lives on host local and owns only its projects, so host-wide matches stay an SSH whole-host rule. SSH bytes are pinned by the collector golden. Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): export a local WSL move's signed manifest with its dormant state (D1b-3c) Collects the scoped projects, their groups and every dormant-state kind through the local-WSL export scope, rewrites UNC paths to the distro's, and returns blockers for anything the collectors can't carry instead of dropping it. Automations move disabled, as the wire requires, and come back as a list to re-enable on the host after commit. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset an interrupted move to zero, or finish it once the host proves a commit Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): abort a move by its identity when its manifest is too large for a request Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): cap a new move's manifest below the request limit, and move forward on a by-reference commit only once the host flushed it Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): remove only the newest move of a distro, so its chain stays readable Co-Authored-By: Claude <noreply@anthropic.com> * feat(runtime): clients read a migrated pane's scrollback from its host (D1b-6d-1) * fix(runtime): hold a remote pane only when its host is known to serve scrollback, and never read bytes in render (D1b-6d-1) * fix(runtime): route the scrollback read by the tab's own host, never the focused one (D1b-6d-1) * fix(runtime): resolve the scrollback host through resolveOwner and use the shared RPC error check, after main moved both (D1b-6d-1) * feat(wsl-mover): a moved project's existing chats stay listed and resumable on this computer (D1b-7a) * fix(wsl-mover): moved-project chats go through the layout owner instead of writing layout directly (D1b-7a) * test(wsl-mover): run the moved-project chat runtime test in the Node runtime (D1b-7a) * test(wsl-mover): read the hidden local row through main's per-host hidden-repo API (D1b-7a) * feat(wsl-mover): rewrite the desktop's routing and seed the host's session after a move (D1b-7c) Registers the main-side desktop rewrite stores ui-routing, session-globals and host-session-seed. Adds a +2 main layout-writer baseline line for wsl-move-main-rewrite-stores.ts: these are one-shot, ledgered move rewrites, and no LayoutCommand can set focus or seed a runtime host's partition. * fix(wsl-mover): finish the main rewrite before the window loads, keep one copy of each moved tab, and copy instead of move (D1b-7c) * feat(wsl-move): rewrite renderer stores for moved projects and keep their UI through catalog prunes (D1b-7d) Registers the renderer-side desktop rewrite stores quick-open-history, file-view-preferences and notebook-environments. The renderer copies each moved workspace's entry to its WSL host key, marks it applied in the same storage, and records the ledger entry; main requests a storage flush first and accepts only the main window. Committed moves are re-listed for re-application at every startup. Catalog prunes keep filters, hook trust and setup-script dismissals of moved repos. * fix(wsl-move): import the migration manifest types from main's orcad-migration folder (D1b-7d) * fix(wsl-move): import wslUncPathToLinux from shared wsl-paths in the manifest exporter, where 7d moved it (D1b-7d) * feat(wsl-mover): rewrite a moved project's orchestration history on the desktop (D1b-7e) Settled local worker dispatches and their worker-terminal rows in a moved project take the WSL host's worktree id, in one ledgered, idempotent store. Chat workers, live rows, federated attachments and JSON receipts stay as written; automations keep their unchanged local copy (the scheduler only advances it). Per-table dispositions for orchestration.db. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): hold the orchestration store while a worker in scope is live; skip federated rows (D1b-7e review) Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): copy in-app browser logins into the WSL host on a move (D1b-7f) A committed WSL move now copies each in-app browser profile's cookies once into the WSL host's stable route partition (owner decision 3a), merging without overwriting what the host jar holds and never touching the source. Where that is infeasible (no deployment link so no stable partition, the destination is not a WSL host or is gone, or the partition name is held by another identity) the host starts fresh and the move journal records why (3b). Registered as the ledgered browser-cookies rewrite store; it runs only once browser sessions and an app window exist. WSL_MOVE_DESKTOP_REWRITE_REGISTRY_COMPLETE stays false. * feat(wsl-mover): retain moved source rows, reconcile them on start, and plan delta moves (D1b-8) * fix(wsl-mover): keep the retained mark out of the WSL move manifest (D1b-8) * feat(wsl-mover): the move driver runs a WSL move end to end, with production gate facts and journaled restore folders One entry point (and preview/start/cancel/listUnfinished IPC for D1b-9) plans the move, gates terminals on the hook server's agent status, the close-tab process probe, running automation runs and live dispatches, pauses and proves exit, stages, sends blobs, commits only from blobs-transferred (#29825), and finishes on the desktop. Any failure resets to zero or goes forward when the host committed. Restore folders and the automations to turn back on are kept in the journal; the host turns those automations back on after commit, retried until it confirms. A real-PTY test pauses daemon shells, and runs on a real distro in the WSL orcad lane. * feat(wsl-mover): move dialog with preview, blockers, progress and result behind the internal WSL hosts gate (D1b-9) * fix(wsl-mover): move dialog hides instead of blocking, follows runs after a reload, and lets a start settle an unfinished move (D1b-9 review) * fix(wsl-mover): word an unfinished earlier move as still finishing (D1b-9) * test(wsl-mover): type the e2e's fake move state instead of reading it through Reflect (D1b-9) * WIP(wsl-mover): 7f-2 registry complete, coverage proof, startup re-apply (D1b-7f-2) * test(wsl-mover): registry-complete lifecycle, stale-focus restart, unload re-apply (D1b-7f-2) * fix(wsl-mover): share the session focus write so the re-apply adds no layout writer (D1b-7f-2) * fix(wsl-mover): redo additive rewrites once at a stale window's unload; behavioural coverage proof (D1b-7f-2 review) * test(wsl-mover): the IPC record test now finishes the rewrite with the registry complete (D1b-7f-2) * fix(wsl-mover): fence worktree-less spawns by cwd and re-prove terminal exit before commit (R46, WIP) * test(wsl-mover): pin the commit re-proof, browser jar identity and repeated move generations (R45, R46, R47) * fix(wsl-mover): fence any spawn by its folder and name the re-proof's reason (R46 review) * fix(wsl-mover): a terminal in a known folder outside the move never blocks it (R46 follow-up) * test(wsl-mover): kill the real move driver at every point against a real host store; abort a reset move's leftover stage on reconnect Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry unsaved drafts into the moved project; round-trip every fixture through the real export, driver and host import Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset a move waiting on a distro that is proven unregistered; test updates mid-move (R41), lost distros (R38) and two desktops (R39) Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): list the D1b-10 real-SQLite mover tests Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): type the fault test's journal hook without a cast Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset for a lost distro even when its kept host fails to connect, never for a renamed one; compare filled-in repo keys only where the source lacked them Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry markdown frontmatter visibility and closed-terminal-tab tombstones into the moved project Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): read the persisted stage through a typed record, not Reflect Co-Authored-By: Claude <noreply@anthropic.com> * feat(telemetry): report how WSL moves end, by phase and reason code (R43) Co-Authored-By: Claude <noreply@anthropic.com> * fix(telemetry): report a pause refusal's reason, an outcome for a thrown run, and only real transport errors as unreachable Co-Authored-By: Claude <noreply@anthropic.com> * fix(agent-hooks): a WSL host's orcad never removes the hook entries the WSL bridge shares (R42) Co-Authored-By: Claude <noreply@anthropic.com> * fix(agent-hooks): a WSL host's Codex account-home launch with hooks off skips too; mark the R42 guard to drop with the bridge Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): "Use on this computer again" brings a moved project back as it was before the move Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): judge a bridge WSL pane's foreground inside its distro On Windows every live bridge pane's own process is wsl.exe, so the busy-terminal gate read every open WSL terminal as running a program and refused the move. Read the pane's terminal foreground process group inside the distro (processes carry ORCA_PANE_KEY): only shells means idle, anything else blocks, and an unreadable guest stays unverifiable. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): only the selected projects' session rows can refuse a WSL move The session eligibility check treated host local's whole partition as the move's, as the SSH conversion does. So an agent session or unsaved draft in any other project on this desktop, or in a project an earlier move retained, refused every later WSL move from that distro. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): sign the manifest as the journal and the host read it The digest was computed over in-memory rows. A value with toJSON (a Date on a row added this session) canonicalized to {} when signing but to its string once written to the journal or sent to the host, so the first move after adding a project reset with orcad_migration_manifest_digest_mismatch until a restart reloaded the row. Normalize through JSON before signing. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry a slept pane's scrollback from its daemon checkpoint The move sleeps every pane first, and a slept pane's history lives only in the daemon's checkpoint, never in a renderer snapshot. The export carried renderer snapshots only, so moved terminals opened empty. After Sleep the driver reads each paused pane's checkpoint (as cold restore would replay it) and the export carries it under the pane's own snapshot ref; the snapshot channel serves those bytes, checked against the signed hash. SSH conversions pass no reader and are unchanged. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): say why when a move can't be prepared, instead of a bare reset An export or journal failure after the pause (a digest mismatch, on awin) was rethrown and shown as "everything was put back" with no reason. Nothing is journaled yet at that point, so refuse with the error named instead. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): retry a renderer store main refused to record The renderer applied a store and wrote its marker, but ignored a refused ledger record (gated-off, failed, not-main-window), so a committed move stayed unfinished and refused every later move of the distro until the next app start. Log the reason and retry with backoff until it lands. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): a WSL pane is idle only when its shell has nothing else Review of #32343: reading only the terminal's foreground group let background jobs, nohup and disowned work, setsid daemons and a script waiting at read pass as idle, and the move's Sleep would end them. Scan the pane shell's subtree, its session and every process carrying its key; any non-shell process, or a shell running a script, blocks. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): never leave behind an agent whose key may be the selected project Review of #32343: scoping the session check to the selected projects let an unqualified key for a repo id another host also registers fall out of both the transfer and the refusal. Such a key now refuses. Adds tests that fail on the old code: another project's live agent with its tab open and its draft don't refuse, the same kinds of state in the selected project still do. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): refuse an unreadable slept checkpoint, prefer it, and spool it to disk Review of #32343: - A checkpoint behind an unreadable log (or an unreadable one) refuses with the pane named instead of carrying stale history. - For a pane the move just slept the checkpoint is the newest copy, so it wins over an older renderer buffer or snapshot. - Buffers spool to a per-move folder and only their hashes and sizes stay in memory; the snapshot channel reads them by offset. The folder is removed whatever the outcome. - A journal write that landed before it threw is reset, so no orphan record blocks the next move. awin's checkpoints were 310-615 KB, well inside the 5 MB per-pane cap, so nothing there is trimmed. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): retry a failed listing, never a record another window was refused Review of #32343: not-main-window can't clear by waiting, while a listing failure is transient. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): sign the manifest as the host parses it The likelier cause of awin's digest mismatch: the signature covered the exported objects, but the manifest parser keeps only the fields it knows, so a session field it drops (one a sleep can write) left the journal and the host hashing something else. Sign the parsed form, and warn when the parser dropped anything, since such a field does not move. Co-Authored-By: Claude <noreply@anthropic.com> * chore(wsl-mover): split the journal step out of the driver, and format The review fixes took wsl-move-driver.ts past the line limit; the export-and-journal step moves to its own module unchanged. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): a slept pane passes the busy check; say what each move dropped or lacked Re-run on awin ( |
||
|
OrcaWinandOrcaWin
|
0866cb1b08 |
fix: bound local iteration checks and show live progress (#34700)
* fix: bound local iteration checks and show live progress * fix: harden check lifecycles and cached test evidence * fix: preserve process instrumentation and fixture lifecycles * fix: give fixture unref spy a portable function type --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
ca2154945b |
ci: run advisory e2e lanes on free hosted runners (#34725)
The layout oracle merge gate keeps Blacksmith via fast_runners: true; the advisory e2e call, nightly schedule and layout-owner dispatch run on ubuntu-24.04. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
8b7f8c88ce |
ci: run terminal perf on demand only, on a hosted runner (#34726)
* ci: run terminal perf on demand only, on a hosted runner The nightly failed every run: the presented-frame guard accepts only GitHub-hosted Xvfb displays, but the workflow ran on Blacksmith. Drop the schedule, move dispatch runs to ubuntu-24.04 and document local use. * docs: record the first hosted terminal perf result --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
8b64ec281a |
ci: restore main's Vitest transform cache in PR unit shards (#34512)
* ci: restore main's Vitest transform cache in PR unit shards Main produces per-shard transform caches on a schedule; PR shards restore the newest one for the same config/lockfile/runtime policy. A Vitest cache key generator folds each literal specifier's resolution candidates into the per-module key so newly added files that shadow a resolution invalidate the importer, and bails on glob-expanded dynamic imports. * ci: list the resolution key plugin in the node tsconfig project * ci: accept Vitest's CACHEDIR.TAG when sealing the unit module cache Vitest 5.0.5 tags its cache root, which made every seal fail with 'invalid cache entry name' so no producer cache was ever saved. * ci: reseed the unit module cache when any cache-key input lands on main Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
5f4d9654f9 |
ci: run operation-count performance contracts on hosted runners (#34668)
The contracts count operations and retained objects; wall-clock budgets stay in pnpm test:perf:benchmarks, which no CI job runs. They do not need Blacksmith's consistent hardware, and the PR path filter runs them ~40 times a day ($7.90/day, $5.50 of it on the 6-vCPU Mac). Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
1df26abf60 |
ci(adhoc): package Mac architectures on 6-vCPU runners (#34673)
Each 12-vCPU arch job spends ~3 of its ~7 minutes waiting on Apple's notary service; packaging itself runs at the same speed as the hourly build's 6-vCPU runner. Halve the per-minute rate. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
e0f32dcac1 |
ci: seed hosted Linux packaging and mobile bundle caches on main, and stop PR-local saves (#34672)
- Warm electron-builder-linux-<versions> and the hosted ubuntu-24.04 Electron native modules - PRs restore hosted Linux Electron native modules without saving - Replace mobile verify's bundler-cache with a restore of a warmup-saved bundle - Drop the pnpm store cache where a direct install was faster (mobile main, glibc-floor containers) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
4cd62c4946 |
ci: split the layout oracle window scenarios across two shards (#34671)
The single-file oracle cannot be split by whole-file balancing, so pass Playwright test-level shards to the changed-spec lane. It was the last required check in 40 of 42 measured runs. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
1f5939dffc |
ci: run relay integration on a free hosted runner (#34666)
It finishes in ~1.2 min beside ~7 min unit shards, so Blacksmith minutes buy no wall time. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
beb53a7f9e |
ci: keep hourly and daily macOS builds on Blacksmith (#34640)
Hosted macos-15 fails afterPack's packaged x64 terminal host boot check (hourly run 40608643418: timed out waiting for the PTY), so no latest-mac.yml is published. Windows, template qualification and routing jobs stay on hosted runners. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
2cd3e6d6a3 |
ci: narrow churny cache keys and move PR-local cache saves to main (#34600)
* ci: narrow native, launcher and packaging cache keys and stop PR-local saves * ci: hash Rust crate sources, not build outputs, in launcher and hook keys * ci: fail closed on unlocked native packages and cover transitive key inputs * ci: resolve the Windows Rust cache scope with a script, not a nested local action --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
59dbb54dad |
ci: keep Git compatibility on Blacksmith (#34625)
Its three parallel real-Git lanes, two of them through Docker, push git-binary-compatibility.test.ts past the 30s test timeout on the 4-vCPU hosted runner (64s file time vs 14s), failing PR #34600 twice after #34566. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
965286939d |
ci: sweep caches on idle non-main branches every three hours (#34605)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
7a834988dc |
ci: run mobile main tests on the hosted ARM runner PR verify uses (#34611)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
791502fae4 |
ci: move secondary, scheduled and contract workflows to GitHub-hosted runners (#34568)
* ci: move secondary, scheduled and contract workflows to GitHub-hosted runners Public-repo standard hosted runners are free under Enterprise. Release, build, benchmark, e2e and unit workflows stay on Blacksmith. ci-xterm-cache seeds both cache stores since its PR consumer's pool is undecided. * test(pi): resolve the smoke bundle's external packages from the repo #34148 pulled zod into the commit-message planner graph; the bundle in the OS temp dir could not resolve it on any runner. * ci(unit): use four workers on the hosted four-core x64 runner --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
f4d98b74e3 |
ci: run hourly and daily dev builds on free hosted runners (#34585)
Hourly and daily builds publish unvetted dev channels on a schedule, so their latency is not user-facing. Move the macOS build to hosted macos-15, the Windows build to hosted windows-2022 (the release path), template qualification to hosted lanes, and the small routing/publish jobs to ubuntu-latest. Adhoc and release builds stay on Blacksmith. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
1864543ade |
ci: warm GitHub-hosted runner caches and drop the serve-switch installer cache (#34576)
* ci: warm hosted runner caches and drop the serve-switch installer cache * ci: seed only restored caches from hosted warm legs * docs(ci): hosted dev builds and no larger runners --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
03d359749e |
ci: stop publishing the pnpm store from GitHub-hosted runners (#34588)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
9cc555e2de |
ci: run off-critical-path PR jobs on free GitHub-hosted runners (#34566)
Keep preflight and the unit-test matrix (the PR critical path) on Blacksmith; move routing, aggregation, contract, packaging and mobile checks to hosted standard runners, which are free for public repos under Enterprise concurrency. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
3058cdd1a8 |
ci(node-server): run PR and scheduled qualification on free hosted runners (#34560)
Only explicit fast_runners callers (manual, hourly/daily/adhoc builds) keep Blacksmith; qualified-orcad-template's cache/save jobs always use ubuntu-latest. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 Kelvin Amoaba
|
917ef9c737 | feat(browser): install Chrome extensions from the Web Store into Orca's browser (#30940) | ||
|
OrcaWinandOrcaWin
|
7b8ca17c64 |
build(runtime): target Node 24 while retaining host compatibility (#34177)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
44f4b1d255 |
docs(contributing): list the native toolchain and system libraries a first pnpm install needs (#31592)
Local Setup named only Node, pnpm, and Bun. A first pnpm install also compiles node-pty and the native addons with node-gyp and loads them in Electron, and *.electron.test.ts fall back to xvfb-run on headless Linux. Document the per-platform build toolchain, the Linux Electron runtime libraries plus xvfb, and the Corepack/pnpm version caveats. Fixes #31589 Co-authored-by: Neil <neil@stably.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
 bangchang
|
20411c1e5d |
docs: fix typos in the PR template (#29692)
Fixes #29691 |
||
|
OrcaWinandOrcaWin
|
164ced27e9 |
ci: run the node-server Windows x64 lane on the free hosted windows-2022 runner (#34350)
The free windows-11-arm and macos-15-intel lanes already set the matrix's wall time; the paid 8-vCPU Blacksmith Windows lane finished minutes earlier for ~$48/day. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
64090416e3 |
ci(adhoc): start the 12-vCPU Mac packaging jobs after template qualification (#34327)
Both arch jobs overlapped ~2.5 min of setup with qualification, then polled for the template for 400-560 s on the most expensive runner we use. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
581e23319d |
ci: run the macOS computer-use smoke only for macOS-relevant changes (#34325)
The owner-loss smoke builds the Swift helper and forks the computer sidecar; neither imports src/cli or src/main/daemon, yet those paths started the paid macOS runner on every computer-e2e trigger. Move it to its own workflow with the macOS-relevant subset of the old paths. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
ab9532ecd8 |
feat(wsl): let an idle WSL distro stop once its server idle-exits (#33084)
* feat(wsl): let an idle WSL distro stop once its orcad idle-exits The WSL host's holder kept the distro (and the WSL VM) running after Orca quit, even with nothing running in it. orcad now leaves a release request in ~/.orca when a managed idle stop retired its terminal daemon; the holder waits for that orcad to exit, claims the request and ends, so WSL can stop the distro. Live terminals, working agents, enabled automations or a returning client keep the distro held as before. A host whose distro is stopped at startup reads as stopped instead of unreachable, and the real-WSL lane gains a phase that proves the release and records memory. * fix(wsl): key the holder release on the WSL-host launch marker; name the lane phase The real-WSL lane showed orcad idle-stopping with its daemon retired while the distro stayed up: the setsid'd orcad's environment is not guaranteed to carry WSL_DISTRO_NAME, so the release request was never written. Use ORCA_WSL_ORCAD_HOST, which only WSL-host launches set. Phase 3 now carries its phase name and path filter, and records what kept a distro running. * test(wsl): dispose the idle-release lane's guest transports Each guest command left its exec loop running, a wsl.exe client that kept the distro up after the holder had already let go (the receipt showed no holder, no orcad, no request left). * test(wsl): record which wsl.exe clients keep the idle-release lane's distro up * test(wsl): satisfy the flaky-test ratchet; feed the new idle port in the release test * test(wsl): snapshot guest processes after launch to find what holds the session * test(wsl): locate the step that leaves the zombie holding the idle distro * test(wsl): log the idle-release lane's guest commands with times to place the zombie * test(wsl): follow the remote runtime client's move * test(wsl): record when each leftover WSL session init started * fix(wsl): keep the distro while the user still runs anything, and never trip on the request file Review of #33084: - The holder now checks, before claiming a release, that no process of the user runs outside the holder itself (session plumbing aside: systemd --user, (sd-pam), dbus-daemon). A detached tmux, nohup job or dev server keeps the distro; it fails toward holding. - A new holder drops any request left from before it started, so an older orcad's request can never end a holder a client just asked for. - orcad touches the request file only for WSL-host launches and never throws over it. - The real-WSL lane proves a detached job keeps the holder and its request, and the distro stops once the job ends. * fix(wsl): a running container keeps the distro, whoever owns its shim Docker's containerd-shim processes run as root, so the user-only scan missed them and a release would have stopped running containers. Any containerd-shim process now keeps the hold. * fix(wsl): read each process status only up to Uid; document what keeps the hold Delta review of #33084: dash reads a status file a byte at a time, so stop at Uid. Document that a root default user never releases, that per-user agents hold it, and the hidepid exception. The lane's pkill no longer matches the shell running it. |
||
|
Neil
|
0cff8e0fb7 |
ci(windows): rehearse the orcad template reseal over SignPath-signed binaries (#34316)
* ci(windows): rehearse the orcad template reseal over SignPath-signed binaries * ci(windows): keep rehearsal template jobs on GitHub-hosted runners |
||
 hwantageandNeil
|
483573f0b9 |
fix(browser): focus newly opened image tabs (#34127)
* fix(browser): focus newly opened image tabs Focus the window before the webview so Command+W closes the new image tab instead of the original tab after a plain image click. Add tests for focus order, image loading, and close-shortcut forwarding. Fixes #34114 * test(browser): verify image tab focus with native keyboard input * refactor(ci): keep browser E2E routes within registry size limit * fix(ci): enable background launch for native browser regression * test(ci): include browser routes in isolated detector fixture --------- Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
7a9abe48f3 | refactor: group remote runtime client modules (#34133) | ||
|
OrcaWinandOrcaWin
|
875d89af50 |
Refine lint performance and safe process execution (#34147)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
ad2156c358 |
test: remove 140 low-value cases and 49 suites (#34062)
* test: remove 140 low-value cases and redundant browser probes * fix: remove unused upstream chat menu import * test: pin the host-split layout fixture branch --------- Co-authored-by: Orca Test Audit <test-audit@stably.ai> Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Brennan Benson
|
5709037f4c |
Continue a chat after the terminal agent exits (#33759)
* fix(native-chat): a chat sends again once the terminal's agent exits on macOS The terminal-writer check required the pane's root process to be a shell, but macOS panes spawn under login(1), which stays as the shell's parent, so the check refused every send until the terminal closed. Census the shell login started instead. * Reconcile current terminal writer evidence before continuation * Share fresh foreground confirmation and prove hosted login census * Restore shell process identity import in foreground tracker * Correct process fixture identity and polling callback contracts * Align decisive Windows inspection fixture expectations * Complete foreground inspection Session fixture |
||
|
OrcaWinandOrcaWin
|
f34c13ca1e |
test: remove low-value main-process suites and browser probes (#33889)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
819d273e27 |
perf(lint): one ast-grep scan feeds both the lint gate and the flaky-test ratchet (#33903)
lint:ast-grep and check-flaky-test-pattern-ratchet each parsed the whole tree. ast-grep-gates.mjs scans once; the lint gate re-runs ast-grep only on files with warning-or-error findings (ast-grep's own report and exit code), and the flaky ratchet counts test-* matches from the shared scan. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
a26006aa6a |
perf(ci): overlap preflight's serial tail; parallel ratchets; allow 2-10 unit shards (#33887)
- Plan unit selection starts after setup (overlaps lint) instead of last. - Localization extraction starts with the typecheck; test-file-runners is background. - run-ratchets.mjs runs ratchets in a pool (19s serial -> 8s locally). - pnpm lint uses CI's single-parse check-import-boundaries.mjs. - ORCA_UNIT_FULL_SHARD_COUNT accepts 2-10 (default stays 5). Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Brennan Benson
|
407069bc63 |
Unify terminal starts under one host operation (#32076)
* Unify terminal starts under one host operation * Pin winning geometry across a late terminal join * Use terminal creation options type in launch race test * Check closed panes after acquiring the terminal spawn lease * Preserve terminal start resource and join boundaries * Keep terminal attach regression within project boundaries * Capture terminal spawn authority and preserve image coverage * Use checked fixtures for terminal image replay regression * test: expose persisted pane to main layout in attach race * test: contract terminal spawn scaling and retention * test: correct spawn scaling fixture types and CI selection * test(terminal): cover exited prompt claims and adopted team cleanup * test(pty): consolidate mock registry imports * fix(pty): retain untyped IPC resume inputs in common contract |
||
|
OrcaWinandOrcaWin
|
de93f326ea |
test: remove low-value inventories, passthroughs and redundant cases (#33796)
* test: remove low-value inventories, passthroughs and redundant cases * style: format test suites after pruning redundant cases * test: remove obsolete workflow and flaky-test references * test: prune deleted builder test from Windows shim allowlist --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 Jinwoo Hong
|
64bba690ad | feat(connector): inbox with held long poll, two confirmations and expiry, on connector tokens (#33734) | ||
|
Jinwoo Hong
|
8cc8024504 | feat(connector): connector service skeleton that checks auth-service tokens (#33723) | ||
|
Jinwoo Hong
|
a5f7da4928 |
revert(daemon): ship official Node in the macOS terminal host again, keep stall telemetry (#33688)
Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52. |
||
|
Neil
|
d9a7aa89c8 |
ci(wsl): rerun a WSL2 lane job once when its hosted runner freezes (#33532)
* ci(wsl): rerun a WSL2 lane job once when its hosted runner freezes * ci(wsl): pin the retry to the lane workflow and keep a 30 min job cap |