optionalAskTimeout computed exactly what cappedWait does (an undefined timeout stays undefined;
anything else clamps to 0..ORCHESTRATION_ASK_MAX_TIMEOUT_MS), so the ask call uses cappedWait.
Three functions used only inside their own file lose their export, and the per-host switch's
doc names the orchestration commands it has gated since #29571.
Co-authored-by: Claude <noreply@anthropic.com>
* Run automated workspace setup in a dedicated tab
* Preserve native-chat setup route coverage after placement retirement
* Preserve Setup tab design and independent review evidence
* Classify activation test fixtures consistently for routing checks
* Sync runtime English catalog after removing setup preferences
* Update listener savings model after retiring setup action
* fix(terminal): open the picked Windows shell on a managed host instead of typing it into PowerShell
* fix(terminal): keep the shell pick through materialization and folder runtimes
* fix(terminal): refuse a shell pick on agent launches and update paired-tab expectations
* test(terminal): type the shell-selection runtime fixture instead of casting
resolveResumeLaunchRecipe now also carries the recorded agentCommand and ompResumeFilePath, so
the three resume lanes stop repeating the same conditional spreads. The rule is unchanged: a
resume relaunches with exactly what its launch recorded, or nothing.
Co-authored-by: Claude <noreply@anthropic.com>
The synchronous drainAgentHookSpool and currentAgentSessionThreadGoalBySequence lost their
last production callers earlier today; tests now exercise the functions production calls.
git-object-quarantine reuses isDefinitiveAbsence instead of a private ENOENT/ENOTDIR copy.
Co-authored-by: Claude <noreply@anthropic.com>
The deploy's pinned-runtime download (SSH, WSL host, Windows host) passes no fetcher, so it goes
through getMainHttpClient(), which the desktop backs with Chromium's default session: system, PAC
and Orca proxy settings and proxy login apply. Guard that a plain global fetch never replaces it.
Co-authored-by: Claude <noreply@anthropic.com>
A Claude chat's / menu listed /color, /doctor and /reload-plugins until the
first message ran, then dropped them: the CLI names its terminal-only commands
only in the init frame a turn emits, and the catalog treated that list as a
hide-list. Chat runs all three (/color and /reload-plugins answer locally,
/doctor is an ordinary turn), so the catalog now keeps every command Claude
reports and the menu no longer changes on the first message.
* fix(settings): show a Keychain unlock on its own instead of leaving the locked notice up
The server already recovers on its next status read, but Settings read Linear
and Jira status once, so the locked notice stayed until the user pressed Test.
While the notice is up it now re-reads its provider's status every 10 seconds.
* fix(settings): wait for each Keychain status read before the next
A newer status read discards an older one, so an interval could keep
discarding every slow read and never show the recovery.
* fix(settings): poll the Keychain status with an in-flight guard
* fix(wsl-cli): keep the WSL CLI status check from timing out on a cold or slow-profile distro (#29497)
* fix(wsl-cli): run install/remove without the login PATH; a PATH-check timeout reports PATH unknown
* Finish structured agent readiness before delivering held work
* Adapt permission fixtures to startup lifecycle
* Keep model discovery for chats before their first start
* Use one host readiness promise for provider operations
* Await provider opening in the execution host
* Await Claude initialization in host-owned open
* Observe Claude readiness through the host status
* Keep optional readback behind host readiness
* Recheck launch permission after host readiness
* Preserve the awaited child during permission revalidation
* Record failed owned opening before the first message
* Abort a matching provider open when its child exits
* Cover provider exit during an unanswered host open
* Cover explicit failure facts on a host-stopped child
* Keep startup waits cancellable and preserve operation order
* Keep live choices and delivery order while agents start
* Apply startup picks and let parked messages release operations [skip ci]
* Save a waiting startup pick after Stop ends its opening [skip ci]
* Save choices when startup ends or a replacement is still opening
* Check saved choices separately from Claude startup reports
* Align startup fixtures and preserve observed Claude exits
* Order startup picks before later messages and retain flow regressions
* Keep reviewed lifecycle contracts while pruning duplicate tests
* Save picks after a proven exit without requiring a child
* Type the startup reply fixture against the Claude control contract
* Honor the before-input callback in the startup reply fixture
* Keep startup option menus independent and show the saved choice
* Exercise startup picks across real menus and the runtime
* Keep saved effort visible when picking a model during startup
* Include the running-turn scope in repeated Stop fixture
* Use the current attach contract in import fixtures
* Align carried-message fixture with startup event contract
* Keep launch-only permission picks usable while prior writes wait
* ci: rerun on main with the locale fix
* Preserve goal retries and chat launch selections
* Give launch regression its request identity
* test(native-chat): type the provisional-launch hook's session prop
* fix(projects): refuse a folder-to-Git type change that would hide folder workspaces (STA-10638)
A folder project's extra workspaces exist only as metadata rows that the folder listing shows. Changing the project to Git switches it to `git worktree list`, so those workspaces drop out of the next refresh and their saved tabs are purged as if they had been deleted. Only the automatic upgrade checked for this; `orca project setup-update --kind git`, repo updates and clone-into-folder did not.
The check now lives in the one repo write every type change goes through, so any caller gets the same refusal and nothing is written. The automatic upgrade and both clone paths use the same check and keep the project as a folder project.
* test(repos): give the repo handler store mock the metadata read the clone path now uses
* test: run repo catalog request coordination in Bun
* fix: remove redundant chat callback alias to restore lint
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Ask Claude for a resting chat's / menu instead of rebuilding it from folders
A Claude chat whose Claude isn't running (a new chat, or any chat after a
restart) offered only clear/compact plus folder commands and skills, so
Claude's own built-ins like /goal, /init and /review were missing until the
first message started Claude.
The at-rest catalog now sends Claude one initialize control request in the
chat's launch folder, through the same sessionless path the model list uses
(same binary, env, account pin and supervised runner), and shows the list
Claude answers. Hooks and MCP servers are off for that one process. Results
are cached per workspace and account for 5 minutes, and at most two probes
run at once. If Claude can't answer, the folder scan is used as before.
* fix(claude): keep Claude's own / list when a later refresh fails
* fix(claude): preserve CLI commands across overlapping fallback scans
* fix(claude): keep overlapping command refreshes eligible
* test(claude): await fallback settlement in overlap case
* test(pty): pin where the two spawn lanes build a daemon spawn's host env differently
Characterization on main's code before the host-env step merges: which failed env builds sweep
per-PTY state (minted ids only, both lanes), the empty-id split, the host-only WSL Pi/OMP guest
readiness wait, and that a host create operation still waits on a managed Codex login.
* refactor(pty): one host-env step for both terminal spawn lanes
The window (pty:spawn) and host (runtime controller) lanes each carried a copy of Codex resume,
Codex home selection, the managed-auth wait, backfill recovery and the daemon host-env build.
Both now call resolvePtySpawnHostEnv. Lane differences are explicit inputs: two TEMPORARY ones
(the host-only WSL Pi/OMP guest readiness wait; the host skipping host env for an empty id) and
three that mean the same in both lanes. The resume step's launchEnv was never read and is gone.
* test(pty): pin that both lanes hand Codex resume prep the request's CODEX_HOME
orca serve (#29209) skips resume prep for a launch whose env names a client-sent CODEX_HOME.
* test(pty): type the new lane-pin requests instead of asserting them
* test: pin selected Codex home on terminal restart
* test(launch): pin what a paired agent session spawns today
Characterization on main's code before createAgentSession moves onto the
host planner: plain launch, short/long/multi-line prompts on macOS, a
stdin-prompt agent starting clean, Windows PowerShell and cmd quoting, and
the identity-required refusal when no launch can be built.
* refactor(runtime): plan paired agent sessions with the host planner
terminal.createAgentSession built its own launch command beside the planner
every other host launch uses, and the two had drifted. It now hands the
request to createTerminal as a startupAgent, so one planner builds it.
The planner gains a draft delivery input, and one TEMPORARY input
(startupPromptCarry: 'force-line') keeps what createAgentSession did: the
prompt always rides the typed line, and an agent that reads its prompt
after start launches clean. The later change that delivers uncarried
prompts after start removes it. A launch that can't be built still refuses
with agent_session_identity_required.
* test(accounts): pin that the selected account wins over Settings agent env
A paired agent session now layers the host-selected account env the way
every other host launch does.
* fix(runtime): report prompt carry truthfully on the planner's direct path
Review round 1: a stdin-prompt agent's text never rides its launch line, a
draft comment that overstated the carry rule, the error class's name, and
formatting the cherry-picked commit skipped.
* docs(runtime): scope the account-order and draft comments accurately
Review round 2.
* test(launch): drop paired-session parity rows that pin nothing new
The no-prompt and short-prompt rows plan the same with or without
force-line, and the Windows cmd row repeats the OpenCode-model Windows
row's createAgentSession runtime and cmd quoting. The long-prompt,
aider, PowerShell, refusal and account-env pins keep the coverage.
* docs(runtime): label the draft's carry-rule exemption temporary
Skipping the typed-line carry rule for drafts is createAgentSession
parity, not design: a draft on the line has the same hazards as a
submitted prompt. The one prompt/draft delivery policy removes it with
force-line.
* fix(runtime): keep main's error name for an unbuildable agent launch
Overriding the name made every other planner caller's stringified
error read 'AgentLaunchUnbuildableError: ...' instead of main's
'Error: ...', which renderer code that strips an 'Error:' prefix
would show raw. createAgentSession matches by instanceof, so the
override bought nothing.
* chore(i18n): translate new keys to es/fr/ja/ko/zh
Scan 2026-10-15 (window 7244bf3e6f..e2f2277d512): 38 new en keys, 16
removed, 0 changed. All five locales missed the same 18 keys (the other
14 are pinned English-fallback). Translated the 18 x5, fixed badly
translated existing strings, and ran two review rounds.
* rm worklog file
* Add website navigation to the Cmd+J palette
Typing a URL or host such as brex.com or localhost:3000 in Cmd+J now
offers a "Go to <url>" row that opens the site in a new browser tab in
the invoking group. Previously the query only went to search, and the
new tab always opened the default page.
- Classify input with the existing tab-create URL classifiers. Blocked
schemes such as javascript: and file:, oversized queries, and plain
words stay on the normal search path.
- Pass an optional URL through openNewBrowserTabInActiveWorkspace. A
requested URL skips address-bar focus so the page can load directly.
- Rank the website row first unless an exact entity match or an
issue/PR URL should lead. Query-bound actions carry sourceQuery and
are ignored on select if the live input has changed, so a stale row
cannot open the wrong site.
* Open typed websites from Cmd+J in a browser tab
Cmd+J now opens a typed site such as brex.com or localhost:3000 in a new
browser tab. Bare dotted names only count as sites when the suffix is a
listed domain, so file names like App.vue or Cargo.lock still resolve as
files. Browser open failures show a toast instead of an unhandled rejection.
* Fix Cmd+J website action availability
* Leave adopted live terminals' tabs to main's frames in a layout-owner build (dark, build switch off by default)
* Adopt only into a pane main's frames hold for that terminal; test a tab-bar id that differs from its terminal id
* Count only a pane main binds to the adopted terminal; check the pane key's tab
* Read frame-held panes through a small module so window-owned builds keep the frame sync out
* fix(agents): direct work-item and checks-fix launches quote for the execution host
GitHub Project Start, PR checks Fix and the source-control/checks preflights
resolved their launch platform from the client OS whenever the repo had no SSH
connection, so a Windows client starting work on a paired Linux Orca server sent
a PowerShell-quoted --prefill to bash. They now read the execution-host facts
#27259 introduced (server-reported OS, SSH-reported OS, WSL), and the
path-shape resolver is removed so one helper decides.
* fix(agents): resolve direct-launch and preflight platforms from the repo owner
Review follow-up: a WSL worktree on a paired Windows server quotes for Linux,
the owner-row fixture reports its server OS, and the source-control preflights
read the repo owner rather than the focus-defaulted worktree route.
* fix(agents): preflight platform honours a worktree's own host
Review follow-up: a per-worktree host outranks the repo owner, the host-platform
test's mutable client platform is typed, and the source-control panel fixture
carries the host slices.
* fix(agents): a server-projected SSH worktree reads its server's SSH state
Review follow-up: the preflight resolver keeps the runtime owner for nested SSH
worktrees instead of reading this client's own SSH connections.
* fix(agents): cmd.exe pastes a multi-line draft instead of prefilling it
Review follow-up: now that direct launches pass the local Windows shell, a
multi-line --prefill under cmd.exe would submit at its first newline.
* fix(agents): direct launches quote for the shell their tab spawns
A project's Windows runtime can override the terminal setting (WSL setting,
Windows runtime spawns PowerShell), so resolve the tab's effective shell before
quoting. The cmd.exe parity row now expects cmd quoting.
* One pane-commit path for main's splits, a late-mounted split recorded again, and one fresh-pane exit rule (dark, build switch off by default)
* Runtime panes write only touched records in the layout-owner build; main keeps a split the window already recorded
* Admission patch that finds no change writes nothing, as layout.apply
Brennan Bensonandm4air
NeilandClaude
Jinjing
OrcaWinandOrcaWin
Kelvin Amoaba
Žan MlakarandKelvin Amoaba
Jinwoo Hong