* fix(agents): apply paired host preferences to launch menus
* fix(agents): keep desktop preferences for older hosts and reopen menus instantly
Hosts without settings.agent-launch.v1 (before 2026-10-11) cannot store
launch preferences, so their menus keep the desktop's visibility and
default instead of losing both. Cache the last host answer per
environment so freshly mounted menus render at once and revalidate;
host-settings saves invalidate the cache.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): align new-agent shortcut with host menu and bound first read
The tab.newAgent shortcut, its menu badge, and bound per-agent shortcuts now use
the same per-host preference snapshot as the menu. A first read that fails or
stalls past 3s falls back to desktop preferences (pre-PR behavior) instead of a
neutral order or a long placeholder; a late answer still applies.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(usage): read Cursor Unified Ultra current-period quotas
* fix(usage): fall back when Cursor serves the current-period route as HTML
Cursor answers unknown /api/dashboard routes with a 200 HTML app shell, so a
retired current-period endpoint would surface as a permanent parse error for
every Unified Ultra account instead of the summary fallback.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(usage): stop labelling Cursor plan usage as monthly
Unified Ultra now reports a weekly period, so the Accounts heading and search
copy no longer promise a monthly window.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(usage): read weekly Cursor periods for all unified and idle-pool plans
Cursor's weekly X Subscription plans (Plus/Premium/Super/Ultra, incl. enterprise
seats moved to Premium) all keep stale monthly zeros in usage-summary. Gate on
unified_* membership, or on idle summary pools with a sub-monthly current period;
non-unified plans ignore current-period failures so their behavior is unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(usage): skip the Cursor current-period request for unlimited non-unified plans
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(cli): reject orchestration ask waits above the documented maximum
* fix(cli): keep ask timeout help ASCII and trim redundant cases
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
#32018 pushed headless-terminal-tab-close.ts over the 300-line lint limit,
and its new test passed sleepWorktree to RuntimeNotifier after #31564 removed
it. setMobileSessionTabProps moves unchanged into RuntimeHeadlessTabProperties,
which already owns the helpers it calls and directly extends the close class.
* fix(claude): match WSL account selection across distro casing
* fix(claude): keep exact WSL selection spelling ahead of casing aliases
A saved key that matches the launch distro exactly now resolves as before,
so existing mixed-alias selections do not regress to System default.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(terminal): parse Markdown file destinations before bare paths
* fix(terminal): keep Windows backslashes in Markdown file destinations
Markdown unescaping turned C:\Users\me\.config\app.json into
C:\Users\me.config\app.json, a regression versus bare-path detection.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(github): reject cached same-branch PRs with foreign heads
* fix(github): keep same-repo cached PRs behind renamed remote URLs
A stale origin URL after a repository rename or transfer made the
foreign-head check reject the checkout's own same-repo PR and clear its
cache. Treat a PR whose head matches its canonical base URL as local.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(search): date undated Cursor sessions and retain sidecar metadata
* fix(search): truncate repaired Cursor dates to whole milliseconds
SQLite rounds sub-millisecond file times while Date#toISOString truncates,
so repaired rows could land 1ms after the date a re-read writes.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(git): retain normalized authentication diagnostics in push errors
* fix(git): label auth failures for every remote operation
Pull, fetch, fast-forward and rebase toasts leaked the IPC wrapper around the
normalized auth message; Git <2.46 also reports 'could not read Password' for
remotes whose URL carries a username.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(cli): negotiate agent launches with paired runtimes
* refactor(cli): share paired client capability list across request paths
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add Orca's own bundled-skill planner and installer (not wired in yet)
One planner decides what installing Orca's bundled skills does to each
target folder; execute re-plans under per-path locks and runs only a plan
whose digest still matches; a shared summary derives badge, wording and
exit code. A copy counts as Orca's untouched one only when its SKILL.md
bytes match a version some build shipped (resources/skills/released-digests.json,
generated from git history and checked add-only).
Nothing calls this yet; the npx path is unchanged.
* Report left-alone folders as warnings and keep backups in the home
A leave is no longer a failure: the outcome line says what happened plus
"N left alone: <reason>", and the exit code is 1 only for a failed or
changed op. Backups for every scope go to <home>/.agents/.orca-skill-backups
on the executing host, so a project Replace never writes into the repo;
moving there falls back to copy, verify, then remove across filesystems.
* Update Orca's skills with Orca's own installer instead of npx skills
The app's Update skills dialog, badge, nudge and status pills now read the
bundled-skill plan and summary, and Update executes the reviewed plan's
digest. `orca skills install|update` runs the same planner in-process with
--dry-run, --force, --json and per-summary exit codes. Removes both npx
spawn sites, the freshness inventory modules and the npx round-trip CI.
* Update only where the skill already is; one provider-root rule for app and CLI
installedOnly now drops every location that holds nothing (keeping the shared slot
only when an existing agent link points at it), so Update never adds a skill for
another agent. The app and CLI resolve the Claude skills folder through the same
rule in localBundledSkillInput; a test asserts both plan identically.
* Compact Update skills dialog: one row per skill, locations named by agent
summarizeBundledSkillPlan now returns each skill's locations, labelled by
agent (or "Shared folder") with a ~-collapsed path; the dialog shows one row
per skill that needs something, collapses up-to-date skills into one line, and
lists every location behind "Show all locations". The result reads "Updated N
skills · M left alone". Under installedOnly a Replace with no shared copy
replaces in place instead of adding one.
* fix(skills): keep location paths readable by putting the state under the path
* fix(skills): hold the last plan in state, not a ref mutated during render
Split the update dialog's rows, headline and footer into components, move the Update label
next to the other plan copy, and use z.strictObject for the request schemas.
* Escape non-ASCII characters in bundled-skill regex and wording
The orcad bundle rejects a literal non-ASCII character in a regex.
* fix(cli): escape non-ASCII apostrophes in the skills install help text
* Plan and update Orca's skills on paired servers, SSH hosts and WSL
* Show the skills pill for paired hosts; real-WSL installer test
* test(orcad): check the bundled CLI plans a skill install without npx
Drop the deleted roundtrip workflow's group from the closed-PR cancellation fixture.
* Let the WSL installer create the backups folder itself
* Review fixes: follow the active workspace's host, keep hosts' plans and runs apart, never boot WSL for a background check
* test: execute requests carry the plan request; CLI pill follows the local target
* Write large WSL skill files in chunks that stay under the command-line limit
* Make bundled-skill test fixtures link folders the way the product does on Windows
Directory links in fixtures are junctions on Windows, which need no
Developer Mode; the one file-link fixture is skipped there.
* Let a client ask a host to install named Orca skills, not only update installed ones
* WIP surfaces
* fix casts
* Prune ratchet and shard entries for deleted files
* Review fixes: disable feature-wall Install without a host, name unknown-skill errors, drop leftovers
* Setup buttons follow the plan: Update only when it would change something, Replace for an edited copy; complete translations
* Plan an SSH workspace on the managed server that serves its host; ask to connect otherwise
* Translate the remote skill states into every locale
* Install on SSH workspaces through their managed server; ask to connect an unserved SSH host
* Resolve legacy skill agent keys canonically
* Reject stale skill replacements when auxiliary content changes
* Remove the Windows-hosted WSL bundled skill installer
* Wait for active workspace ownership before planning bundled skills
* Keep legacy WSL skill setup on its inline npx flow
* Use each setup surface's target for discovery and installation
* Describe skill setup actions and results from their install plans
* Keep ordinary bundled skill classification shallow
* Leave unreadable skill replacements alone without aborting plans
* Show blocked skill setup plans as needing attention
* Resolve skill setup discovery and installation from workspace ownership
* Keep legacy WSL setup scoped to the selected runtime
* Pass force-all through shallow planning and describe unreadable copies
* Keep skill setup previews shallow until Replace is clicked
* Stop Replace when its explicit plan cannot replace a selected copy
* Keep skill setup within the focus and workspace-record read ratchets
* Clarify skill update statuses and folder details
* Clarify skill setup results and blocking reasons
* Keep selected skill replacements in place with one status
* Use first-install wording when no agents have the skill
* Report completed skill replacements with their backup confirmation
* Preserve main’s skill selection for unavailable Computer Use
* Derive setup status and coverage from the install plan
* Use shared plan status labels on every setup panel
* Show blocking skill folders and keep incomplete setup steps pending
* Clarify available skill updates and skipped copies
* Pass setup execution outcomes to the skill result API
* Use update skipped wording in skill setup results
* Keep skill update results in preview order
* Show skipped skill copies before installing for more agents
* Show unsupported skill setup guidance before installation
* Use the host install plan for orchestration agent coverage
* Show each skill skip reason once
* Count skipped skills instead of skipped folders
* Make installer input and link tests work on Windows
* Show disconnected host guidance before offering skill installation
* Bound bundled skill classification reads and parse names linearly
* Keep workspace skill roots inside the resolved workspace
* Compare workspace skill roots with native path semantics
* Restrict bundled skill backups to their owner on POSIX
* Keep bundled skill updates on the proven local workspace host
* Keep skill details on the originating setup target
* Keep recovered skills needing attention until they are updated
* Expect recheck after a failed skill setup plan
* Count completed skill updates in the status tooltip
* Count only usable skills in orchestration agent coverage
* Sync the runtime localization catalog
* Add Orca's own bundled-skill planner and installer (not wired in yet)
One planner decides what installing Orca's bundled skills does to each
target folder; execute re-plans under per-path locks and runs only a plan
whose digest still matches; a shared summary derives badge, wording and
exit code. A copy counts as Orca's untouched one only when its SKILL.md
bytes match a version some build shipped (resources/skills/released-digests.json,
generated from git history and checked add-only).
Nothing calls this yet; the npx path is unchanged.
* Report left-alone folders as warnings and keep backups in the home
A leave is no longer a failure: the outcome line says what happened plus
"N left alone: <reason>", and the exit code is 1 only for a failed or
changed op. Backups for every scope go to <home>/.agents/.orca-skill-backups
on the executing host, so a project Replace never writes into the repo;
moving there falls back to copy, verify, then remove across filesystems.
* Update Orca's skills with Orca's own installer instead of npx skills
The app's Update skills dialog, badge, nudge and status pills now read the
bundled-skill plan and summary, and Update executes the reviewed plan's
digest. `orca skills install|update` runs the same planner in-process with
--dry-run, --force, --json and per-summary exit codes. Removes both npx
spawn sites, the freshness inventory modules and the npx round-trip CI.
* Update only where the skill already is; one provider-root rule for app and CLI
installedOnly now drops every location that holds nothing (keeping the shared slot
only when an existing agent link points at it), so Update never adds a skill for
another agent. The app and CLI resolve the Claude skills folder through the same
rule in localBundledSkillInput; a test asserts both plan identically.
* Compact Update skills dialog: one row per skill, locations named by agent
summarizeBundledSkillPlan now returns each skill's locations, labelled by
agent (or "Shared folder") with a ~-collapsed path; the dialog shows one row
per skill that needs something, collapses up-to-date skills into one line, and
lists every location behind "Show all locations". The result reads "Updated N
skills · M left alone". Under installedOnly a Replace with no shared copy
replaces in place instead of adding one.
* fix(skills): keep location paths readable by putting the state under the path
* fix(skills): hold the last plan in state, not a ref mutated during render
Split the update dialog's rows, headline and footer into components, move the Update label
next to the other plan copy, and use z.strictObject for the request schemas.
* Escape non-ASCII characters in bundled-skill regex and wording
The orcad bundle rejects a literal non-ASCII character in a regex.
* fix(cli): escape non-ASCII apostrophes in the skills install help text
* Plan and update Orca's skills on paired servers, SSH hosts and WSL
* Show the skills pill for paired hosts; real-WSL installer test
* test(orcad): check the bundled CLI plans a skill install without npx
Drop the deleted roundtrip workflow's group from the closed-PR cancellation fixture.
* Let the WSL installer create the backups folder itself
* Review fixes: follow the active workspace's host, keep hosts' plans and runs apart, never boot WSL for a background check
* test: execute requests carry the plan request; CLI pill follows the local target
* Write large WSL skill files in chunks that stay under the command-line limit
* Make bundled-skill test fixtures link folders the way the product does on Windows
Directory links in fixtures are junctions on Windows, which need no
Developer Mode; the one file-link fixture is skipped there.
* Let a client ask a host to install named Orca skills, not only update installed ones
* Plan an SSH workspace on the managed server that serves its host; ask to connect otherwise
* Translate the remote skill states into every locale
* Resolve legacy skill agent keys canonically
* Reject stale skill replacements when auxiliary content changes
* Remove the Windows-hosted WSL bundled skill installer
* Wait for active workspace ownership before planning bundled skills
* Keep ordinary bundled skill classification shallow
* Leave unreadable skill replacements alone without aborting plans
* Pass force-all through shallow planning and describe unreadable copies
* Clarify skill update statuses and folder details
* Keep selected skill replacements in place with one status
* Report completed skill replacements with their backup confirmation
* Clarify available skill updates and skipped copies
* Keep skill update results in preview order
* Show each skill skip reason once
* Count skipped skills instead of skipped folders
* Make installer input and link tests work on Windows
* Bound bundled skill classification reads and parse names linearly
* Keep workspace skill roots inside the resolved workspace
* Compare workspace skill roots with native path semantics
* Restrict bundled skill backups to their owner on POSIX
* Keep bundled skill updates on the proven local workspace host
* Keep recovered skills needing attention until they are updated
* Count completed skill updates in the status tooltip
* Sync the runtime localization catalog
* fix(connectors): a connector backlog cannot fill orchestration's receipt ledger
Connector deliveries now refuse with delivery_backlog_full once 1,000 are
unsettled, and a new seam settles a previous process's pending connector
receipts as completed-unknown so the ledger can prune them.
* fix(connectors): settle only a previous process's receipts, not a re-enable's
The delivery receipt owner now lives for the install (one per process) and
is shared by every enabled-period seam, so toggling connectors off and on
no longer completes this process's still-running deliveries as unknown.
* Add Orca's own bundled-skill planner and installer (not wired in yet)
One planner decides what installing Orca's bundled skills does to each
target folder; execute re-plans under per-path locks and runs only a plan
whose digest still matches; a shared summary derives badge, wording and
exit code. A copy counts as Orca's untouched one only when its SKILL.md
bytes match a version some build shipped (resources/skills/released-digests.json,
generated from git history and checked add-only).
Nothing calls this yet; the npx path is unchanged.
* Report left-alone folders as warnings and keep backups in the home
A leave is no longer a failure: the outcome line says what happened plus
"N left alone: <reason>", and the exit code is 1 only for a failed or
changed op. Backups for every scope go to <home>/.agents/.orca-skill-backups
on the executing host, so a project Replace never writes into the repo;
moving there falls back to copy, verify, then remove across filesystems.
* Update Orca's skills with Orca's own installer instead of npx skills
The app's Update skills dialog, badge, nudge and status pills now read the
bundled-skill plan and summary, and Update executes the reviewed plan's
digest. `orca skills install|update` runs the same planner in-process with
--dry-run, --force, --json and per-summary exit codes. Removes both npx
spawn sites, the freshness inventory modules and the npx round-trip CI.
* Update only where the skill already is; one provider-root rule for app and CLI
installedOnly now drops every location that holds nothing (keeping the shared slot
only when an existing agent link points at it), so Update never adds a skill for
another agent. The app and CLI resolve the Claude skills folder through the same
rule in localBundledSkillInput; a test asserts both plan identically.
* Compact Update skills dialog: one row per skill, locations named by agent
summarizeBundledSkillPlan now returns each skill's locations, labelled by
agent (or "Shared folder") with a ~-collapsed path; the dialog shows one row
per skill that needs something, collapses up-to-date skills into one line, and
lists every location behind "Show all locations". The result reads "Updated N
skills · M left alone". Under installedOnly a Replace with no shared copy
replaces in place instead of adding one.
* fix(skills): keep location paths readable by putting the state under the path
* fix(skills): hold the last plan in state, not a ref mutated during render
Split the update dialog's rows, headline and footer into components, move the Update label
next to the other plan copy, and use z.strictObject for the request schemas.
* Escape non-ASCII characters in bundled-skill regex and wording
The orcad bundle rejects a literal non-ASCII character in a regex.
* fix(cli): escape non-ASCII apostrophes in the skills install help text
* test(orcad): check the bundled CLI plans a skill install without npx
Drop the deleted roundtrip workflow's group from the closed-PR cancellation fixture.
* Make bundled-skill test fixtures link folders the way the product does on Windows
Directory links in fixtures are junctions on Windows, which need no
Developer Mode; the one file-link fixture is skipped there.
* Resolve legacy skill agent keys canonically
* Reject stale skill replacements when auxiliary content changes
* Keep ordinary bundled skill classification shallow
* Leave unreadable skill replacements alone without aborting plans
* Pass force-all through shallow planning and describe unreadable copies
* Clarify skill update statuses and folder details
* Keep selected skill replacements in place with one status
* Report completed skill replacements with their backup confirmation
* Clarify available skill updates and skipped copies
* Keep skill update results in preview order
* Show each skill skip reason once
* Count skipped skills instead of skipped folders
* Make installer input and link tests work on Windows
* Bound bundled skill classification reads and parse names linearly
* Keep workspace skill roots inside the resolved workspace
* Compare workspace skill roots with native path semantics
* Restrict bundled skill backups to their owner on POSIX
* Keep recovered skills needing attention until they are updated
* Count completed skill updates in the status tooltip
* Sync the runtime localization catalog
* fix(automations): a slept headless run opens from a paired desktop, and a half-failed sleep keeps its pane link
A paired desktop now asks the server to open a run whose pane retention slept (its PTY id
is dropped, its pane kept), instead of only opening the workspace. Retention finishes a
sleep that stopped the run's PTY and then failed, as the host's sleep state still holds it,
instead of forgetting the run's pane on the next sweep.
* test: use typed automation retention drain hook
* test(automations): fail the real resume-record write, and recover a slept run whose record failed to save
* revert(automations): drop the half-failed sleep recovery, which no real path reaches
A real headless serve keeps a slept run's pane resolving to its stopped PTY, so retention's
retry already re-sleeps and keeps the pane link; a failed resume-record write is swallowed
inside the sleep. Only a mocked null PTY lookup reached the runSleepHeld branch.
* Add Orca's own bundled-skill planner and installer (not wired in yet)
One planner decides what installing Orca's bundled skills does to each
target folder; execute re-plans under per-path locks and runs only a plan
whose digest still matches; a shared summary derives badge, wording and
exit code. A copy counts as Orca's untouched one only when its SKILL.md
bytes match a version some build shipped (resources/skills/released-digests.json,
generated from git history and checked add-only).
Nothing calls this yet; the npx path is unchanged.
* Report left-alone folders as warnings and keep backups in the home
A leave is no longer a failure: the outcome line says what happened plus
"N left alone: <reason>", and the exit code is 1 only for a failed or
changed op. Backups for every scope go to <home>/.agents/.orca-skill-backups
on the executing host, so a project Replace never writes into the repo;
moving there falls back to copy, verify, then remove across filesystems.
* Escape non-ASCII characters in bundled-skill regex and wording
The orcad bundle rejects a literal non-ASCII character in a regex.
* Make bundled-skill test fixtures link folders the way the product does on Windows
Directory links in fixtures are junctions on Windows, which need no
Developer Mode; the one file-link fixture is skipped there.
* Reject stale skill replacements when auxiliary content changes
* Keep ordinary bundled skill classification shallow
* Leave unreadable skill replacements alone without aborting plans
* Bound bundled skill classification reads and parse names linearly
* Keep workspace skill roots inside the resolved workspace
* Compare workspace skill roots with native path semantics
* Restrict bundled skill backups to their owner on POSIX
* feat(mobile): decode page-bundle download windows natively
Each 384 KiB window of the page-bundle download cost about 200-300 ms of
Hermes JS time (tweetnacl secretbox open, fflate gunzip, a base64 re-encode
check and the TextDecoder polyfill), which kept the JS thread busy for the
whole download.
The phone now opens v2 frames with react-native-libsodium (secretbox open and
strict base64) and decodes ranges with a local Expo module,
orca-bundle-window-codec (bounded gunzip via system zlib on iOS and
java.util.zip.Inflater on Android, plus strict UTF-8). The shared v2 session
takes these as optional primitives; the desktop keeps tweetnacl.
If any native piece is missing or fails a known-answer probe, the phone keeps
today's JS path, with the base64 re-encode replaced by an O(1) canonical check.
* refactor(mobile): name the native decode for every inbound frame, not just bundle windows
The native secretbox, base64 and UTF-8 primitives decode every inbound v2
frame on the phone, so the files and the Expo module are renamed for what
they cover (paired-e2ee-native-*, orca-gzip-utf8-codec). A throw from the
native UTF-8 decode now falls back to TextDecoder, since the frame is
already open and its counter advanced.
* test(mobile): pin the TextDecoder fallback when native UTF-8 throws
* fix(mobile): hand the native decode to the transport from the app entry
The transport modules are reached by shared, desktop and e2e code. Importing
the native bindings there pulled expo-modules-core into the e2e typecheck,
whose global types make NODE_ENV required and broke ~20 e2e files. The app
entry now provides the bindings; without them the transport runs the JS path.
* fix(mobile): a native-codec lookup before the app provides bindings does not pin the JS path
* feat(connectors): reopen a closed or exited agent when its conversation gets a message (B2c)
Behind experimentalConnectors. When a connector message reaches a conversation whose agent tab was
closed or whose agent exited, the seam resumes the agent's own session in the same workspace
through resumeAgentSessionInWorkspace, waits for its composer, delivers the message and answers
accepted with reopened. The session id is copied onto the conversation link as hooks report it.
Refusals: agent_asleep_in_window, no_session_to_reopen, reopen_refused; a session another pane
may still hold (an SSH host out of contact included) stays agent_not_reachable.
Resume claims now end as soon as the hook store reports the resumed session, rather than at the
next claim, since an agent that exits to its shell drops its hook row and kept the claim held.
* fix(session-resume): end a resume claim when the hook store reports it, not at the next claim
A resume claim (#31718) ended only when a later claim found the hook store naming the session in
the claimed pane. An agent that quits to its shell drops its hook row, so that later check found
nothing and the claim stayed held for as long as the shell lived: every other resume of the
session was refused as held_elsewhere. Claims now watch the hook store's provider-session changes
while any is held and end each hold as soon as it is reported.
* fix(connectors): pin reopened process before readiness and capture existing session
* fix(connectors): watch persisted links' sessions from host startup and after re-enable
A fresh seam (connectors turned back on, or a runtime restart) watched only the links its own
calls touched, so a session that changed before the next connector call was missed and a reopen
resumed the old conversation. A new seam now snapshots every persisted link's hook-reported
session and watches it, and the runtime builds the seam when its hook store attaches at startup
rather than on the first connector call.
* fix(session-resume): end a hold on report only when it covers one bound spawn
The report names a pane, not a spawn, so with a second overlapping open of the same pane still
unsettled or bound to its own PTY, ending the hold early could let another pane resume while
that spawn still writes. Those holds keep the existing PTY-exit and next-claim ends.
* fix(session-resume): settle a lost-reply resume attempt when a retry of the same request binds
A targeted resume whose spawn reply was lost keeps its share held, since its process may run.
A retry of the same request reconciles that same create, so when the retry binds its PTY the
earlier attempt's share is accounted for by it: the hold now ends when that PTY exits instead of
never. A different request's spawn still accounts only for itself, and a lost reply is never
read as an exit.
* fix: preserve overlapping resume holds during lazy report checks
* test: verify disabled connector startup and restored capture
* Track transcript content truncation across session readers
* Separate transcript decoding from preview truncation
- Preserve full searchable message content with explicit truncation metadata
- Keep bounded previews independent of transcript publication across parsers
* Fix AI Vault transcript preview parsing and cache upgrades
- Preserve full Devin and Grok transcript turns while bounding preview scans
- Exclude stale previews that may expose reasoning after cache schema changes
* Clarify Devin parser test payload terminology
* fix(session-resume): end a resume claim when the hook store reports it, not at the next claim
A resume claim (#31718) ended only when a later claim found the hook store naming the session in
the claimed pane. An agent that quits to its shell drops its hook row, so that later check found
nothing and the claim stayed held for as long as the shell lived: every other resume of the
session was refused as held_elsewhere. Claims now watch the hook store's provider-session changes
while any is held and end each hold as soon as it is reported.
* fix(session-resume): end a hold on report only when it covers one bound spawn
The report names a pane, not a spawn, so with a second overlapping open of the same pane still
unsettled or bound to its own PTY, ending the hold early could let another pane resume while
that spawn still writes. Those holds keep the existing PTY-exit and next-claim ends.
* fix(session-resume): settle a lost-reply resume attempt when a retry of the same request binds
A targeted resume whose spawn reply was lost keeps its share held, since its process may run.
A retry of the same request reconciles that same create, so when the retry binds its PTY the
earlier attempt's share is accounted for by it: the hold now ends when that PTY exits instead of
never. A different request's spawn still accounts only for itself, and a lost reply is never
read as an exit.
* fix: preserve overlapping resume holds during lazy report checks
judgeIdleRun's rule (fresh done since the prompt went in, shell refusal of the
agent command, 2-minute grace for agents that never report status) moves into
judgeIdleAgentTurn, keyed by rows and send time instead of an AutomationRun.
Automations keep their wording and call order. No behaviour change.
The transition-to-announcement rules (lead-agent finish under background work,
all-clear dedupe, quiet window for goal/Pi agents, restored-pane seeding) move
into TerminalAgentTurnNews; the phone push keeps its wording, window/mute gate
and burst cooldown and composes it. No behaviour change.
* fix(sidebar): land flip-a's switch-on fixes on main, still dark (no flip)
The fixes found while the sidebar ran from main's feed, without turning
that on: ORCA_SIDEBAR_INPUTS_IS_MAIN stays false, and none of flip-a's
stop-gaps come along.
- Main stops counting a closed tab's terminal once it was asked to stop
and no pane shows it; a failed or refused stop takes the request back,
and a host out of contact stays unverifiable.
- Main fetches a paired server's rows with the transport's normal bound,
so a server slower than 5 s still lists.
- A deferred unread raise flips the folder row it was decided for, and a
read while the owner check is out cancels it.
- Phone: no worktree.ps flash before the feed; a host's last installed
feed stands in while a fresh read is out; it highlights its own
last-opened workspace and a fold never scrolls; projects file under
their project group with the desktop's indent; the collapse spinner
shows only after 500 ms; "Reopen to update" keeps the rows on screen.
- e2e helpers and journeys for the switch-on suite.
* fix(sidebar): keep an owed relay stop marked, clear a thrown stop, and prune pending unread raises
- A stop-and-wait that throws takes its stop request back, like one that fails.
- A final stop the legacy relay still owes stays marked, since the relay retries it.
- Pending unread raises are tracked only while one waits, so the map no longer grows.
- The paired-server fallback poll test gives its third fetch a reply and asserts live.
* feat(sidebar): main publishes cached snapshots and announces its own stores; detected, view and live-content domains (inert)
* fix(sidebar): keep links confirmed only by a new git run, no rescan on metadata writes, no phone wait on detected checkouts
* fix(sidebar): rescan the workspace rows when the Windows runtime default changes
* feat(sidebar): one lifecycle queue per workspace in main, with in-progress hints (switch-gated)
Create, delete, terminal.closeAll, terminal.sleep and worktree.sleep now run through one
first-in, first-out queue per host-qualified workspace: strict order, no merging, delete
cancels what has not started and waits for what has, an unconfirmed outcome pauses until
the host's own answer. Hints publish in a new inProgress feed domain (no reader yet); the
creations domain is its projection. A finished create or delete keeps its hint until a scan
started after it applies, in the same revision. Adds the paired-server metadata serializer
(saving domain, no caller yet). Replaces the creation registry.
* fix(sidebar): a create never queues behind the previous occupant's delete
* feat(sidebar): main runs sleep; the window follows (P3b)
* fix(sidebar): keep electron out of the headless server's sleep path
The desktop registers how sleep reaches paired servers; a headless serve has none.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): type-check the sleep e2e specs; drop the removed VM suspend stub
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): resume a paused workspace by re-observing, never replaying
- A command issued while paused waits behind the pause; when the owner answers again main
re-reads terminal liveness and the listing, then carries on. A forced delete runs past it.
- Commands keep their arrival order across a workspace lookup; deletes by name key by the
resolved id, so they wait for that workspace's running sleep.
- A second delete with different options is refused as already in progress.
- Close and delete read lost contact as sleep does.
- A create always frees its own queue entry, even after a retry took over its id.
- Drops the unused opId, and the paired-server write serializer and its feed section,
which land with their first caller.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): main is the only writer of a sleep's wake records; sleep classifies only lost contact as unconfirmed
- The window no longer captures wake records for a sleep main runs; it takes main's records
from main's answer, which its wake and tab-open resume then read.
- A workspace reopened during its sleep keeps its VM running (the window and a phone's
activation tell main).
- Only lost contact pauses: a definite chat-stop failure or a server's still-live answer is a
plain failure with today's toast.
- A paired server's chats are asked with the Sleep mark, and again without it when an older
server refuses the field, instead of reading an unprobed status.
- A phone's worktree.sleep is answered on acceptance and its activation no longer waits on a
queued wake, so neither can outlast the phone's request timeout. The web client passes
markChatsAsleep and keeps the receipts.
- One desktop adapter, passed where the desktop builds the runtime, replaces the two module
slots; a headless server gets none.
Co-Authored-By: Claude <noreply@anthropic.com>
* chore(sidebar): share worktree.sleep's params with the RPC catalog; lint fixes
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): test the paired-server sleep where main runs it; drop the window's copies
The window no longer sleeps a paired server's terminals, so its convergence and order tests for
that path move to main (remote-workspace-terminal-sleep.test.ts) or follow main's answer.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): retry the sleep spec's liveness read while terminals stop
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sleep): main resumes every workspace-sleep wake; the window only attaches
- Main claims and starts each slept pane through its windowless resume path, with or
without a window: the "window present" check is gone.
- A phone's open queues main's wake, which finishes only once the resumes have started,
and always notes the reopen so a running sleep leaves the VM up.
- The window no longer relaunches a workspace sleep's records in fresh tabs; opening a
slept pane asks main to resume it and the pane's spawn attaches to main's terminal.
- A window save cannot overwrite main's workspace-sleep records.
- A VM that would not suspend no longer reads as "kept open": the terminals slept, and
the toast says the machine is still running.
* test(e2e): main resumes a slept pane once, in place, and keeps its record
* chore(i18n): add the VM-still-running sleep message
* fix(sleep): a phone's or the CLI's failed sleep shows the desktop toast again
* fix: restore main's final P2 test fixes a merge reverted
* fix(sleep): window saves never write or clear main's sleep records; headless wake report counts only real sleeps
* test: a same-id twin's grace follows the rows' change, not the removed catalog hook
* fix(sleep): drop the 1 s settle wait after an observed exit, and wake a slept workspace's mounted agents on phone open
A workspace sleep stopped each terminal through main's stop-and-verify, which polled for a
further second after the exit it had already seen. And a phone opening a slept workspace no
longer reached the window's mounted panes of agents that had finished before the sleep, so
they stayed asleep until the window opened their tab.
* test: give the workspace-sleep wake record its prompt field
* refactor: match slept-agent records to the workspace with worktreeIdsEqual
* chore(sleep): one import from sleep-record-pane-claim
* test(sleep): route the disconnected-sleep SSH spec, declare the desktop sleep adapter, and open the workspace after its sleep starts
* test(sleep): delete a workspace the spec creates, not the seeded one later specs share
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(session-lifecycle): one targeted resume of a recorded agent session, sharing an in-flight claim with pane resume
resumeAgentSessionInWorkspace composes the lifecycle owner's existing
ownership check, window-wake claim, resume builder and terminal create, and
returns the new binding or a typed refusal, never a shell or fresh agent.
Pane resume now takes and consults the same in-memory claim, so an SSH
resume before its first hook (or any spawn in flight) cannot be resumed
twice. The explicit-command create path now carries launchRuntime.
* fix(session-lifecycle): claim before deciding, create runtime-owned, keep ambiguous spawns held
Both resumers take the in-flight claim before any awaited check, so a
settled claim always hands off to a fresh holder decision. The targeted
resume creates through the runtime-owned create with a pane identity
derived from its request, keeping launchRuntime with a window attached and
letting a retry reconcile the pane it may have started. A failure after the
spawn request left keeps the session held; a bound hold ends on its PTY's
exit as it happens.
* fix(session-lifecycle): bind a failed create's spawned PTY, retry over its own pane, forward abort
A create that spawned and then failed binds the hold to the PTY its pane
gained since the claim, so that PTY's exit still ends it (both resumers).
The targeted resume's holder check excludes its own request-derived pane,
so a same-request retry reaches create reconciliation after its hook. The
request signal reaches the runtime-owned create; an abort before dispatch
refuses as aborted.
* fix(session-lifecycle): settle resume claims only from the create's own PTY
A claim binds only to the exact PTY the runtime-owned create produced,
reported before publication can fail; its exit ends the hold. A spawn that
proved its exit during start, or a failure before dispatch, releases it.
Any other dispatched-but-unidentified outcome stays held. Drops the
pane-difference fallback, which could bind an unrelated shell. Signals
dispatch only after the create-mutation recipe check, which can still
refuse before dispatch.
* test(runtime): remove duplicate review-only test runner
* fix(session-lifecycle): hold a resume until every PTY its overlapping opens bound exits
Overlapping opens of one pane can each spawn; the hold now watches every
bound PTY and ends only when all have exited and no open is still
spawning. Test helpers replace Reflect calls with typed guards.
* fix(session-lifecycle): key resume claims by destination pane
* feat(connectors): connector seam lifecycle, conversation links and start behind experimentalConnectors (B2b-1)
* feat(connectors): connector follow-ups, held while the agent asks, behind experimentalConnectors (B2b-2)
* feat(agent-write): opt-in launch cancel, approval wait and binding fence on the shared writer
executeAgentLaunch takes an optional signal; sendTerminalAgentPrompt (and
sendAgentTurn) take optional onPermission: 'wait' and expectedBinding. No
existing caller sets them, so every current path is unchanged.
* fix(agent-write): keep the default writer path main's; fence cancel and real submit boundary
Only opted-in writes take the submit layer, so default timing and the leaf
re-read are unchanged. Cancellation is rechecked before a structured-refusal
terminal fallback, and an opted-in launch learns Enter from an onSubmitWritten
callback at the write itself, OMP's combined frame included.
* fix(connectors): pass the seam's signal to the launch, read links from each host's rows, and keep delivery ids on orchestration's durable receipts (B2b-1)
* fix(agent-launch): a cancel after a failed startup spawn recovers the created workspace
* fix(connectors): keep an unknown receipt once the launch published, and restore local-only metadata ownership (B2b-1)
* fix(connectors): settle a lane when its process is lost; removal stays host-qualified; folder delete announces removal
* fix(plugins): keep folder removals out of public worktree events
* fix(connectors): a launch admits its process for the lane, so queued sends never adopt a successor
* fix(connectors): classify connector RPCs as host-owned; CLI start output claims a start only when definite
* Transfer keyboard focus when a sibling chat pane opens
* fix(native-chat): hand focus to newly opened chat composer
* fix(native-chat): keep tab bar controller within line limit
* fix(chat): split into a fresh conversation beside the current chat
* test(chat): declare the split fixture store without an assertion
* fix(chat): route the split to the source conversation host
* test(chat): keep the split regression focused on the launch contract
* test(chat): give the command palette split fixture its conversation agent
* test(chat): seed the legacy command fixture without expanding its asserted shape
* test(chat): isolate pane identity commands from the split launch boundary
* Prevent chat splits from starting a terminal on host refusal
* Cancel structured launches when their destination pane closes
* Model live destination groups in agent launch test fixture
* Capture split chat focus intent at the user action
* fix(chat): hand input to the split pane during admission
* fix(chat): Split opens a fresh chat beside the current one
Split Right/Down on a native chat used to move the chat into a new pane.
It now opens an empty pane beside the chat and launches a new chat of the
same agent on the same host into it through the New Chat launch, so the
new composer takes focus at once. A launch that never opens a tab closes
the empty pane. Drops the earlier admission and focus-transfer changes
that main now covers.
* fix(chat): Split palette search words describe a new chat, not a move
* fix: remove misleading chat move shortcut hints
* fix(chat): a new chat stays in its pane until its host lists it
A host tab list built before a chat's create landed can arrive after the
create reply. Once the reply settled the launch, nothing protected the new
tab, so that older list dropped it: Split's new pane collapsed and focus
moved to another chat, and the next list re-added the chat elsewhere.
Keep a small in-memory record for a chat this client created that no host
list has shown yet. While it exists, a list that omits the chat keeps its
tab. The record ends when an accepted list from that host includes the
chat, when the tab closes, on workspace teardown, or 30 seconds after the
reply, when the worktree is re-read from its host (including an unchanged
version) so a chat the host really closed is dropped then. The launch
lifecycle, status, persistence and settlement are unchanged.
* test(chat): type the faked create replies without an assertion
* Keep new chat protection tied to accepted host lists
* Update paired chat close regression to current suppression API
* fix(chat): Portuguese Split palette words describe a new chat
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(orchestration): let a worker start helpers on the Run it works for
A dispatched worker could only start helper workers by taking a coordinator
seat on a new Run, and taking a seat moved its inbox. worker-start now also
accepts a worker on an active Dispatch: its helpers run in the same Run, report
to it (worker_done, heartbeat, escalation, status, ask), and it answers their
questions. The worker's own mailbox never moves. When it settles, whatever its
helpers sent that it never handled goes to the Run's coordinator.
Authority comes from the worker's own Dispatch, re-checked inside the
reservation transaction. Helpers are fresh agents on this host; a worker may
retry only its own helper's latest attempt. Remote workers keep the old
own-Run instructions. No saved field or wire change.
* fix(orchestration): read helper rows without type assertions
* fix(orchestration): hand a settled helper creator's mail to the Run as live delivery
When a worker that started helpers settled, its helpers' unhandled mail was
re-addressed to the Run by settlement SQL alone. Nothing woke the Run's
coordinator, delivered rows kept their old delivery stamp so pointers and the
restart scan skipped them, payload-free status reports were left behind
because selection required payload.dispatchId, and a question asked while the
creator was being stopped stayed with the stopped creator.
- Select handed-back mail by its recipient mailbox and Run (unread reports
plus pending questions, even ones already read), reset delivery and pointer
state on the moved rows, and fence the old mailbox's Deliveries.
- After the settling transaction ends, the runtime re-reads exactly the moved
rows and wakes the Run with their real types; a rollback wakes no one and a
failure falls back to the existing repoint retry. Restart recovery is the
existing unread-undelivered scan.
- Hand mail back again at the final stop settlement, which also closes the
stopped Dispatch's own questions asked during the stop.
- A worker_done receipt replay re-offers the handed-back targets.
- Scope markAsDelivered to the mailbox it pointed, so a late pointer stamp
from the old owner cannot hide mail now owned by the Run.
* test(orchestration): drop an unused inbox type
* fix(orchestration): read only the Run when handing a settled worker's mail back
Every settlement runs the hand-back, so a full dispatch row read there added a statement per settlement. Also expect the mailbox-scoped delivered stamp in two delivery tests from main.
* fix(orchestration): re-offer handed-back Run mail on every worker_done replay
A helper creator's worker_done hands its helpers' unread reports and pending
questions to the Run. The send stored the Run's extra wake targets in the
mutation receipt, but the executor rewrites that receipt on completion and on
each replay, so an identical retry only woke the original destination.
Derive the targets at replay time instead: for the settled Dispatch (when it
has same-Run helpers), notify run:<id> for each type of unread report or
pending question there. Notification only; nothing is re-settled or inserted.
The receipt augmentation is removed.
* style(orchestration): format with the formatter version main now pins
* feat(connectors): connector seam lifecycle, conversation links and start behind experimentalConnectors (B2b-1)
* feat(agent-write): opt-in launch cancel, approval wait and binding fence on the shared writer
executeAgentLaunch takes an optional signal; sendTerminalAgentPrompt (and
sendAgentTurn) take optional onPermission: 'wait' and expectedBinding. No
existing caller sets them, so every current path is unchanged.
* fix(agent-write): keep the default writer path main's; fence cancel and real submit boundary
Only opted-in writes take the submit layer, so default timing and the leaf
re-read are unchanged. Cancellation is rechecked before a structured-refusal
terminal fallback, and an opted-in launch learns Enter from an onSubmitWritten
callback at the write itself, OMP's combined frame included.
* fix(connectors): pass the seam's signal to the launch, read links from each host's rows, and keep delivery ids on orchestration's durable receipts (B2b-1)
* fix(agent-launch): a cancel after a failed startup spawn recovers the created workspace
* fix(connectors): keep an unknown receipt once the launch published, and restore local-only metadata ownership (B2b-1)
* fix(connectors): classify connector RPCs as host-owned; CLI start output claims a start only when definite
NeilandClaude
Jinwoo Hong
Jinjing
Kelvin Amoaba
Brennan BensonandOrca Worker