mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 17:37:40 +00:00
fbb3381dfeb9f321640181af940b8a441d48bfaa
1623
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Neil
|
5913a1c663 | refactor: group shared agent-session options and catalogs (#36878) | ||
|
Neil
|
b2842603e4 | refactor: finish shared native-chat model and transcript organization (#36843) | ||
 Brennan Benson
|
7e2f29aaf1 |
Open native chats on the phone in place (#36315)
* Open native chats on the phone in place * Preserve desktop host and agent when opening chats * Preserve chat opening and captured lifecycle contracts * test: cover sender focus and unconfirmed chat close outcomes * test: exercise structured worker CLI lifecycle through runtime socket * test: use checked parked mail observation in CLI integration * test: validate provider notification correlation identities * test: construct checked lifecycle and navigation fixtures * Keep cross-program session proofs in their test program * Localize mobile chat opening feedback and complete runtime contracts * Use the mocked text component identity in History feedback proof * Temporarily expose grown E2E type diagnostics * Keep E2E timer and fetch fixtures in their runtime domains * Reconcile decreased E2E wait pattern counts * Preserve live test clocks and expose remaining type diagnostics * Keep mobile session data types independent of native views * Complete structured session wire surface fixtures * Expose existing grown E2E type diagnostics temporarily * Preserve checked wire fixture tab mock signatures * Preserve worker redrive when automatic close is refused * Honor automatic close admission before settlement and retirement * test: retain History reveal and close publication race * Match automation reveal callback to activation result * Align CLI integration fixture with current settings and output * Prevent retained chats from reopening removed workspaces * Import notification types directly from their owner * Unify local removal fences for accepted worktree aliases * Keep cross-surface authority tests in the combined test project * Initialize coordinator mail test workspace ownership * Register the retained automation chat test workspace * Use checked inputs in worker start failure test * Preserve the automation test repository host literal |
||
 NeilandClaude
|
93a37ca6d6 |
fix(wsl): a stopped distro's messages say Start or a new terminal starts it, not switching projects (#36771)
* fix(wsl): a stopped distro's messages say Start or a new terminal starts it, not switching projects Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl): translate the WSL hosts description, and say Start for a stopped host when it isn't connected Co-Authored-By: Claude <noreply@anthropic.com> * test(e2e): a project switch never boots a stopped WSL host; Start does, once Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
 Jinjing
|
21accb2316 |
End multiple PTYs without blocking the Resource Manager (#36753)
* End multiple PTYs without blocking confirmation dialogs - Add virtualized multi-selection and bounded concurrent termination - Show per-terminal errors while ending continues in the background * Batch PTY termination updates to keep the Resource Manager responsive - Share four termination slots across all End actions - Coalesce completion and exit publications to reduce render churn - Preserve focus when virtualized terminal rows are ended * Defer PTY inventory refresh until termination batches drain * Remove obsolete terminal end confirmation translations * Allow PTY end strings to be localized * Refine terminal list row spacing and remove redundant icon * Remove extra left padding from PTY details button |
||
|
NeilandClaude Opus 5.5
|
ea7af2dd7c |
fix(ssh): prune superseded staged server builds when an update defers (#35881)
* fix(ssh): prune superseded staged server builds when an update defers GC ran only after an activation, so a host whose updates kept deferring over live terminals kept one staged orcad slot per release. Prune on deferral too, keeping the active, previous, live-daemon and newly staged builds. Refs #34149 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(ssh): keep recently staged builds; route and harden the deferred-slot e2e Desktops on different releases can share a host, so the deferral prune keeps complete builds staged within three days instead of deleting a peer's candidate and forcing it to re-upload. Windows hosts, which cannot date their builds, keep them all. Refs #34149 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(ssh): read a build's staging age as unknown when find cannot date it A find without -mtime used to read as an old build and let the deferral prune remove a peer's candidate. Report an error instead, which keeps every candidate; a build without .install-complete reads as not recent. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * test(ssh): pin that an undatable staged build keeps every build Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * test(ssh): fold the deferred-slot e2e into the update-anyway spec Keeps the routing table under its size limit and runs the check on the same deferred-update sources. Also drop the unused readiness argument from pruneSupersededOrcadCandidates. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(ssh): report GC as unfinished when it kept a recently staged build Callers that memoize a clean pass would otherwise never prune the build once it ages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Neil
|
964fe5b73c |
fix(wsl): a restored chat or a web hooks check never starts a stopped distro (E9) (#36779)
* fix(wsl): a restored chat or a web hooks check never starts a stopped distro (E9) A chat pane mounting on launch restore or a remount read its transcript as a user open and booted the transcript's stopped WSL distro. Only the mount that the user's own switch caused, and paging, now ask main to start it; otherwise the read refuses and the pane shows the distro's stopped copy at once (a stopped UNC transcript was reported as missing and spun as pending). A web client sent repo.hooksCheck without background, which a server treated as a launch that may open the distro. The server now opens it only for an explicit wakeWslDistro; clients send it for launches and keep background for older servers. * fix(native-chat): key a chat's open wake on its own workspace; update wake assertions A chat in another workspace mounting inside the switch window no longer takes the switch's wake. The paging and worktree-removal assertions now expect the explicit wakeWslDistro flag. * fix(native-chat): set the pane-key ref in the layout effect, not during render |
||
|
Brennan Benson
|
a2235ad4b9 |
fix(native-chat): new chats' model picker opens with the full list instead of a partial one (#36646)
* fix(native-chat): show the account's model list while a new folder's own listing runs A new Claude or Codex chat in a folder with no saved model list showed only its remembered model (or nothing) until that folder's model probe finished, then the full list appeared 1-2 s later. Every new worktree and every chat after a restart hit this, because these agents keep one list per folder and the account-level list reads already fall back to was never written. The account's own listing (prewarm names no folder) now also saves that list, and a read whose folder isn't listed yet answers from it, including before its scope resolves. The stand-in names no default as the folder's; the folder's own listing still replaces it. * fix(native-chat): preserve account catalog publication ownership * fix(native-chat): retain scoped account inventory under binding pressure * test: make passive catalog deadline coverage deterministic * test: consolidate catalog fixture type imports * test: repair catalog fixture types and integration placement * fix: retain accepted model catalog authority during refresh |
||
|
Brennan BensonandClaude Fable 5.1
|
002e975e96 |
Open chats move to the account you switch to, before their next message (#30955)
* fix(native-chat): an open chat moves to the account you switch to before its next message A running chat's agent read its account only when it started, and nothing compared it with the account a start would use now, so open chats kept answering on the old account after a switch. The agent a chat runs now records the account its launch used, and the host's replace-before-the- next-send check replaces an idle one whose account is no longer what a start would use. A chat mid-reply finishes on the old account first. Claude chats follow; agents whose chats keep the account they were created on are never compared. A chat's model-list reads and saves now use the account it runs on, so a moved chat no longer writes its new account's list under its first account (STA-11281). Tracked in STA-11211. * fix(native-chat): declare the launch-account read for the runtime layer that wires the host * fix(claude): find custom chat history before managed-account resume * test(claude): assign the complete custom account home * Preserve unknown account model facts and legacy option replay * Clarify terminal account-switch feedback in translated locales * Keep option mutation plans checked against their contract * Cover unknown model choices across chat consumers * Keep consumer fixtures aligned with canonical types * Match the mobile picker label in its consumer test * fix: clarify terminal scope in translated Claude account settings * Update integration tests for current session and remote client contracts * Keep native worker replies on their receiving account * Preserve receiving accounts across cold starts and nested reports * Preserve the delivery receiver when reading chat commands * Clarify native reply matching and consolidate imports * Resolve catalog scope without re-entering conversation queues Give owned option mutations and delivery settlement a resolved catalog input while external reads acquire scope once. Preserve account routing, catalog lifetime and current response obligations. * Align catalog and mobile test fixtures with current contracts Explain the existing timeout budgets and provide the idle turn identity and truthful model-only picker label in the mobile fixture. * Align receiving-account readers and fixtures with typed contracts * Repair account-switch fixtures and measure receiving work * Use the checked account-home path in catalog tests * Restore executed-option recorder context * Control receiving catalog deadline test clock * Align unknown-model consumer fixtures with send capture * Consolidate session host type imports * Align cross-version catalog fixtures with host read contracts * test(native-chat): bind Runs through the current start authority in receiving fixtures Main now resolves a worker start lazily through bindRun with objective and task references, and creating a Run no longer unbinds a coordinator's earlier Runs; run-use does. The receiving fixtures follow the same production owners so every original scenario, input and bound is exercised unchanged. The receiving runtime subclass moves verbatim into its own support module. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(native-chat): follow the selected account before its folder exists A live Claude chat compared its account against the selected one only after that account's folder passed an availability check, so an account still being set up (or whose setup failed) left the chat silently answering on the previous account, and a resting chat refused its start before preparation could run. The retirement comparison and the start pre-read now ask the router for the selected route as identity, through the existing resolver purposes; catalog, create and probe reads keep checking availability. Preparation, typed launch failure and parking are unchanged. Session History details show the account a chat was last launched under when the host recorded one, else its founding home. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(ai-vault): build the stale acquisition receipt without a type assertion The History account case now reads the fixture receipt through the typed acquisition reader instead of spreading the record field through a cast; the three assertions and their inputs are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): narrow the rig acquisition link before relinking it The account-setup cases spread an optional link, which typed its id as possibly undefined; the rig always links a handle, so a guard that cannot fire narrows it. No assertion or input changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): follow main's chat admission in fixtures and bound the History account projection Chat admission no longer reads an experimental host setting, so the continuation-context test drops the spy main dropped in its own fixtures. The two History consumers that install a minimal chat host give their fake store the record accessor and host id the real store has, since the projection now reads the acquisition receipt. An operation-count contract holds the production History projection to one roster read and one record lookup per owned row at 10 and 100 rows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test(native-chat): give the declared-effort catalog fake its capture port The declared-effort fixture builds a catalog service without the capture member the options reader asks every catalog for, which failed its desktop, catalog and phone consumers; it now supplies the inert test operation like the other fakes. The History projection contract also drops an unused map parameter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Consume main's outcome change feed in the receiving-account index Main's keyed journal records deliver each change after an epoch's frozen prefix as an outcome sequence naming touched keys instead of typed rows. The receiving-account index now re-reads those keys at their current values: queue cards by id, a deleted submission retires its exact notice, and a deleted item drives the existing recovery rebuild, with Stop marks still excluded. The in-process read row exposes the already-persisted queue.cards keys and per-key deletion facts; itemIds and submissionIds keep listing every touched key. The mobile unknown-consumer test mocks MobileSwitch as main's picker test does. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> |
||
|
Neil
|
98615d3b12 |
plugins: Try it on a syntax plugin opens a blank untitled file (#36637)
Drop the hand-written per-language samples. Try it now opens an empty untitled<first extension> through the existing untitled-file flow, so the grammar highlights what the user types. Custom editors with newFiles keep their template-seeded new file. |
||
 Brennan BensonandCodex
|
2cc33b8d89 |
fix(native-chat): save each chat change as keyed records and reopen from the newest (#36024)
* Save native chat state and restore only its journal tail Publish versioned reducer checkpoints atomically, checkpoint through the chat write queue, and backfill closed chats without retiring journal rows. Co-Authored-By: Codex <noreply@openai.com> * Keep checkpoint recovery durable and skip unchanged captures * Keep journal timer and restart fixtures compatible with checkpoints * Keep checkpoint performance tests focused on operation contracts * Remove unused benchmark import * Restore journal append interception and control Stop fixture time * Compare saved reducer state without a key assertion * Supply thread scope in checkpoint test appends * Prove restored journal consumer paths * test: exercise restored consumer backward pagination * fix: pace journal backfill with a monotonic clock * refactor: keep journal opening cursor checks together * refactor: project chat journal state in the append transaction Track isolated reducer mutations and persist keyed changes under a savepoint before adopting committed state. Keep appends working through projection lag and repair coverage on the write lane, including legacy bootstrap. Co-Authored-By: Codex <noreply@openai.com> * fix: keep reducer objects live across journal commits The draft isolates every write until COMMIT, then writes each dirty copy back onto its original, so submissions, items and queue cards handed out before a commit keep reading current values as they did with in-place folding. A failed COMMIT still leaves live state untouched. Also replaces banned Reflect.get uses and adds braces the lint rule requires. * fix: bound projection repair and check the invariant after notification Failed publications and savepoints back off from 1 s up to an hour, reset by a healthy incremental write or a reopen. open() no longer waits for a legacy chat's publication; the scheduled repair publishes it on the write lane. A failed open closes its handle. The equality check runs after commit notification, only when projection tests opt in or, log-only and sampled, in development, and it requires the saved coverage to match. Removes the unused streamed commit argument. * fix: keep the background projection pass proportional to chats The orphan sweep reads one state row per chat and clears orphans by session key. A chat whose fold cannot publish stops at its first damage and is skipped until its epoch or newest row changes. * fix: version the keyed projection layout as codec 2 This branch's earlier whole-state layout used version 1; it now decodes to null and the chat replays. * test: follow the append-with-fold contract and deferred publication A submission whose fold throws now rolls back with its receipt before any dispatch, so those sends are refused and nothing is recorded. The unconfirmed continuation outcome is pinned through its real cause: the agent admits the message and no delivery proof arrives. Tests that need saved state right after a chat opens publish it explicitly, the history reload clears the saved state covering its edited row, and the codex stream bound matches its capture. * test: pin projection repair backoff, background pass and N/10N costs Covers the production repair timer under a persistent failure, a legacy open that publishes after it resolves, a failed open leaving no timer, a damaged closed chat skipped until a new row, and equal per-write, reopen, sweep and closed-chat publication work at N and 10N. Projection tests opt into the per-commit equality check. * refactor: inline draft write-back helpers The repo lint bans object-typed parameters; the copy and write-back now run in the closure that already holds the wrapped value. * fix: write a new epoch's saved state in its own transaction New chats, rollovers and rewinds publish the new epoch's projection beside its rows, inside the same statement-only savepoint the append path uses, so they start covered instead of waiting a second for a repair. A projection failure there still keeps the epoch and leaves the scheduled repair to publish it. * fix: keep the sampled development check log-only on any failure A read failing inside the check must not reject an append that already committed and notified. * fix: typecheck the draft copy without closure narrowing Assign the lazily created copy through a local so strict programs that do not narrow a captured variable after ??= still see an object. * test: catch whole-table sweeps and an undecodable projection The sweep contract now records exec statements too and pins its exact keyed statement list, so a NOT EXISTS scan through exec fails it. A projection whose item stops decoding fails the per-commit check on coverage although a full replay still matches. Also fixes two test lint findings. * refactor: drop draft casts the types can carry Overlay maps and sets finish from their own typed touched keys, and present map entries are read through one helper. The two remaining generic boundaries, a draft standing for its object and finishing back to it, carry the repo's SAFETY directive. * test: show a parked damaged chat publishes after a clean epoch replaces it The replacement ends at the parked chat's newest sequence, so only the epoch in the skip key re-arms it. * test: give the seeded queued card its enqueue cursor Production records queuedAt as the cursor before the queue row; the fixture now does too. * fix: catch lagging saved chat state up in atomic pages Repair of a legacy, lagging or undecodable chat, open or closed, no longer republishes the whole chat. One runner folds the rows after the saved coverage onto a private copy of the saved prefix, at most 32 rows or about 1 MiB of row text per page, and commits each page's changed entries with the new coverage in one FULL transaction. That transaction first checks the chat's epoch and the exact saved row the page was folded from, so a page from a retired epoch or a stale base writes nothing. Pages rest between slices, and the saved prefix is decoded in pages too. An open chat runs the pages on its write lane; sends keep committing between them and skip the projection until coverage reaches the tip, then project incrementally again. The background pass hands a chat over to its open owner at a page boundary. Damage parks the chat after the pages before it, and a failed page keeps the committed ones and retries from them on the existing backoff. Whole-chat publication now runs only inside epoch transactions. * test: pin the draft layer's tracked nodes per streamed revision and acceptance A transition now reports how many objects and collections its fold reached. The scaling chat gains accepted sends (receipts and aliases) and waiting, dispatched and returned queue cards at N and 10N. A streamed revision's only growing term is the card scan, one node per card plus each returned card's body; an echo also reads every item with its body and every submission. * test: append the between-pages send by item identity appendItem takes the provider identity, not its key. * test: check every catch-up prefix of the recorded Claude and Codex streams A runner can page single rows, so the recorded streams' aliases, Stop settlement and per-row timestamps are each checked at a committed prefix against a full replay. * test: measure each backfill pass's row reads on its own The parked-chat test counted its own replay checks: 64 pass rows plus 68, 68 and 100 oracle rows made the 300 CI saw. Each timer window is now measured alone, and coverage is read from its saved row, so the unchanged pass reads 0 rows and the re-armed one reads one page. * fix: bound catch-up reads, release the finished prefix, and keep unreadable views - A catch-up page now stops reading rows at the row whose text reaches about 1 MiB, so rows past the budget are never fetched and fetched again; saved-view item and entry pages use the same budget. - An open chat drops its private prefix once coverage reaches the tip and keeps it only across a failed or parked page. - A present current-epoch view this build cannot read (another codec version or corrupt content) is no longer cleared by the first page. Its whole history must fold cleanly through the tip first; otherwise it parks untouched. A storage error while reading the view fails with backoff instead of reading as a missing view. - The pace charges only the runner's own work units, so time spent waiting on an open chat's catch-up or the write lane no longer lengthens the next rest. * test: cover takeover, epoch replacement and stop in the middle of a pass A chat opened while the pass rests is caught up by its own runner from the committed page; the pass pages it no further and does not charge the wait to its pace. A replacement leaves its new view untouched, and a stopped pass resumes after its last committed page. * test: fail the takeover test without the handover break, and the replacement test without the stale-runner guard The takeover test asserts the pass asks the open owner only twice for the handed-over chat, and pins performance.now so the open runner's pace never waits on a fake timer. The replacement now lands while the open runner is resting in its saved-view decode, so its page reaches the lane after the replacement; the test asserts no transaction opens. * test: read saved-view pages with the page budget, and await database closes The paged-decode round trip passes the row-and-text budget and checks the view decoded. Projection, scaling and ACP launch tests await the now-async test database close, so a closing checkpoint worker cannot close the next test's database. * Persist native chat outcomes with a rebuildable cache Store immutable keyed transition results with canonical ordering, fence outcome epochs, and convert legacy inputs through paced invisible generations. Rebuild disposable caches from validated outcomes and read sparse logical sequence groups without changing the wire. Co-Authored-By: Codex <noreply@openai.com> * test: repair the split suites so they parse, lint clean and find their setup Restores the describe blocks the split truncated, the loop variable it renamed, the fixture references and imports it dropped, and a stray argument pair. Moves the grandfathered flaky-pattern counts with the code that moved. * test: read outcome epochs as outcomes where the adapted assertions read input rows A replaced epoch restates its Stop in the saved pause marks, the sparse-group batch test needs an outcome epoch rather than the input-format fixture, and a revised item keeps its first place, so the held-write order is read from the replayed groups. * test: expect saved queue cards as whole values in the queue-history assertions The adapted helpers read card outcomes, which store each card's whole state, so an import or refusal shows as the card's own state change rather than as an input row. * style: format the files this PR changed * test: import each module once in two journal suites * fix: decode saved outcomes with a frozen format-1 schema, independent of the cache codec Outcome values decode through a versioned format-1 schema that never follows the live reducer type; an unknown field reads as saved by a newer Orca, and the cache codec only delegates to it, so a codec bump rebuilds the cache and nothing else. * fix: key outcomes by an integer generation and keep the cache stamp in its state row Each outcome row names its generation, the attempt's id, instead of repeating the chat id, epoch and a UUID; the cache stamp is a column of the cache's own state row, so there is one stamp to keep in step; cache ordinals are text like the outcomes they copy. Orphaned caches are swept from the per-chat state row with indexed per-chat deletes. The WSL census lists both schema files. * fix: finalize queue ownership before publishing a new epoch, and reject unreadable outcome rows Epoch replacement and rollover adopt the committed state, keep attachment claims and finalize the queue receipt before the fallible publication step, as before outcomes. Every persisted outcome row is read back through the row reader, so a row it rejects fails as journal_row_rejected. Publishing an epoch checks the epoch it replaces is still current. A key deleted and re-created in one write moves to the end of the pending changes, matching its new ordinal. * fix: open a chat synchronously and unpaced, and classify read failures by cause A user's open reads the cache or rebuilds from outcomes in one synchronous pass, like replay on main, so no background rebuild can interleave with it and nothing paces or bills it. Only an outcome decode failure is damage; a value from a newer format is refused as newer; storage errors propagate as unavailable. Writes derive cache currency from the stamp instead of a latch and ask the maintenance runner when it lags. * fix: run all journal maintenance through one paced runner per database One runner serves requested chats first, then lagging ones, one catch-up at a time, open or closed, so an open chat keeps its conversion's progress. A busy or replaced chat is skipped and the pass continues; content that cannot convert parks until the chat's rows change; storage failures back off. Background work alone pays the duty cycle. Conversion verifies the whole input once, then only the outcome tail; cache rebuilds copy outcome pages to the moving tip and stamp from the scalar outcomes. * test: adapt journal suites to generation-keyed outcomes, the merged cache stamp and the publication order Queries read outcomes by generation; the bootstrap test expects the queue receipt to finalize before publication; queue-import-scaling states the reopen's constant two key visits when it retries a failed import; append-delivery reads the outcome change index's item ids. * test: pin outcome format 1 with checked-in rows, and cover open consistency, transient reads and re-created keys A golden fixture of format-1 outcome rows covering every field and scalar must restore to the pinned chat; a cache codec bump only rebuilds the cache; an unknown field reads as newer. An open between two pages of a cache rebuild reads the whole chat from outcomes. A transient read error during open is unavailable, not damage, and the next open loads the chat. A key deleted and re-created around a new key in one row keeps live order, written or converted. * refactor: check a converting chat's epoch once, in the catch-up step that runs each page The catch-up reads the chat's epoch in the same synchronous step as the page's transaction, for conversion and cache rebuild alike, so the conversion's second copy of the check is dropped. * test: drive the maintenance runner over a real database, each guard killed by a mutation Startup sweeps, closed chats converted one at a time with a busy chat skipped, an open chat writing between conversion pages, a stop between pages, an epoch replaced mid-conversion, content parked until the chat writes again and then delivered, and a storage failure backed off rather than parked. * test: N/10N contracts for outcome appends, opens, conversion, publication, idle passes, sweeps, tail verify and wire catch-up Each counts statements through prepare and exec, rows read per table and rows and bytes written, never time, and requires the same work for a chat ten times larger: a streamed revision, a Codex plan update and an acceptance; a cached open reads no outcome; a conversion page reads one page of input and publication none; an idle background pass reads no history; a retired generation and an orphaned cache are deleted one indexed page at a time; a second verify reads only the new outcomes; a wire catch-up reads only the groups asked for. * test: shipped builds keep a new or converted outcome chat untouched The newest release refuses the chat as a newer Orca's and leaves every byte of the database as it was; a build from before that reason opens it read-only with nothing shown, refuses writes, and changes no saved row. * test: an epoch publication over an epoch the caller did not see is refused, and damage at row 1 still yields to a newer row Publishing a new epoch checks, inside its transaction, the epoch the caller last saw, and writes nothing when it changed. A chat whose first row is unreadable keeps reading for a newer build's row, as main does, and is refused as a newer Orca's. * test: old-build probes fold input rows only, and the interrupted-call probe writes inputs * test: import the state layout once in the cache test support * fix: type the tail verify's live lookups per collection, and two test call shapes The tail verify looked keys parsed from stored JSON up in a union of live maps, which does not typecheck; each format-1 collection now has a typed lookup that narrows the parsed key first, and the table is checked complete against the format's collection list. * fix: wake the maintenance runner for a request or a due retry ahead of the periodic pass One timer now wakes the runner at the earlier of the next periodic pass and the first due request or storage retry, re-derived from the waiting chats after each pass, so a request after the first pass is served within a second and a backoff retry is no longer replaced by the six-hour pass. A chat whose load swept a retired page keeps its turn instead of waiting for the next pass. Tests drive start(), requests and timers on fake time. * test: pin the draft's tracked nodes per streamed revision and acceptance at N and 10N The scaling chat gains dispatched and returned queue cards. A streamed revision's only growing term is the queue card scan, one node per card plus each returned card's body; an acceptance echo also reads every item with its body and every submission. Main's reducer makes the same scans on these rows; the draft adds one node per value reached. * test: cross-version probes read a new chat's turn end as one outcome sequence, and the kept-card downgrade uses an unconverted chat * fix: store every new write as format-tagged outcome records after an existing chat's rows, with no conversion An existing chat keeps its input rows byte for byte; its first write appends one marker row that shipped builds refuse, and its records follow. New chats hold only their marker and records. Each record carries its own format and the epoch keeps the highest format it holds, checked before a cache is used or anything is written. Opening a chat with an input prefix folds the prefix as main does and applies the records over it, deletions included, keeping prefix keys in place; catch-up pages the prefix rows, then the record groups. Background conversion and its attempts, staging, verification and publication are gone; the maintenance runner rebuilds only caches of chats without a prefix, parks a rebuild on its epoch's records rather than the newest sequence, and looks a requested chat up by its key. * test: pin the marker, prefix-plus-records reopen, record admission before the cache, cache-only runner parking and N/10N work Input fixtures stand for a chat an older build wrote: their input epoch keeps taking input rows, so the input reader still meets writer-made rows; epochs this build founds are written as it writes them. Conversion tests give way to a mixed chat whose prefix keys are deleted, recreated and updated in place, the runner's rebuild parking that later writes never re-arm, and contracts for writing to, opening and rebuilding chats at N and 10N. * fix: refuse a chat whose outcome marker is a newer version as a newer Orca's, not as damage * test: shipped builds refuse an existing chat at its appended marker, its input rows unchanged, and this build reads it whole again The probe writes three items as input rows the way an older build did, then this build's writes append one marker and outcome records; the newest release refuses the chat as a newer Orca's with every byte unchanged, the writable baseline latches read-only at the marker, and the re-upgraded build reads all six items with the prefix rows as they were. * test: read the runner's rebuild instances as rebuilds, so the parked-chat test typechecks * fix: admit saved outcome records and the cache only through a strict storage schema A saved record or cached value holding a key or union tag this build does not declare, at any depth, now refuses the chat as a newer Orca's before the cache is used or anything is written. The storage schema reuses the wire's shared definitions, completes the keys they leave out (failure facts, senders, edit patches and the rest), and closes every object and open union; string vocabularies and opaque payloads keep the wire's meaning. A compile-time check fails CI when a persisted type gains a key storage does not declare, and a checked-in corpus of every declared shape replaces the schema fingerprint, so an added optional key needs no new format. * fix: refuse an input row or legacy card holding a key this build does not declare before folding it Restating a chat on a new epoch is safe only if the open chat holds nothing this build half understands. An input row of a known kind (an existing chat's frozen prefix, with or without outcome records after it) is now checked key by key against what this build declares before main's reader normalizes it, and refuses the chat as a newer Orca's; values keep main's checks and execution options their legacy meaning. A legacy queued card whose saved body holds an undeclared key stays on disk, unadopted, as an unreadable card does. Client sends already arrive through strict request schemas, and their options through a reader that drops choices this build does not use. Main's tests that kept a newer build's unknown body kind, subject or key readable and writable now expect the refusal; the three that drove a newer Orca's approval or item through this build's own writers are removed, since this build can no longer hold one. A checked-in input prefix pins how this build folds older rows, and every value it folds into is one storage admits. * test: a persisted type holding a key storage does not declare, nested included, fails to compile * test: this build refuses a newer build's body or subject kind as a newer Orca's, keeping the row an older build deletes * fix: fold each outcome write from the row a reload reads, so an annotation the reader drops never fails the strict record write An ACP usage report with size 0 (allowed by the protocol) reached the model as an unusable window, the strict encoder refused it, and the agent was stopped mid-turn. Main writes that row and drops the annotation on reload; folding the read-back row keeps live state equal to that reload for every annotation the reader drops. * test: an echo declared without a known original is stored as null, the shape a reload reads * test: probe the downgrade refusal on both releases in the downgrade window, not only the newest * test: both releases in the downgrade window write a Claude and a Codex chat through their own writers, and this build admits every row and opens the chat as that release had it * test: rewind, replacement and rollover of a chat holding old rows, the marker and records keep what the user kept and delete the retired epoch whole * test: phone and paired catch-up over a chat holding old rows then records, from a cursor inside the old rows, draws as the clients render it * test: ACP launch decisions read an outcome chat from its cache and from its records alone, and a newer one as unreadable * Open new and mixed chats from each key's newest record and drop the saved-state cache The cache copied each key's newest record into a second set of tables and needed stamps, a paced rebuild, a savepoint fallback and a repair runner to stay usable. The records' key index already answers the same read: an open seeks from one key to the next, taking each key's newest record (deletions included) and never reading superseded revisions. A mixed chat still folds its frozen input prefix first. A send now writes only its records, the epoch's coverage and its receipt, so any failure among them refuses the send as main's row insert does. The background runner keeps only the paced sweep of retired generations, its one remaining job. The cache tables are no longer created; they never shipped. * Derive an outcome chat's last sequence from its coverage instead of recording it Every write recorded the sequence scalar beside its own records, about half the records on streamed paths. The epoch's coverage already holds it, so a read supplies it from there and a write no longer stores it. Records an earlier build stored still decode. * test: count strict admission per open, catch-up page and write of an existing chat at N and 10N Admission walks each input row it reads once (on top of main's parse), and each outcome record it reads or writes once: the open of a mixed chat walks exactly its prefix rows and admits one record per key, a catch-up page walks one row per input row it returns, and a write walks its row's read-back and admits each record it inserts. Linear in what is read, with a constant of one. * Keep a record that updated a prefix key when a later prefix fold no longer yields that key A tail record with the prefix ordinal is the key's newest value. If a later build's reducer reads the old rows differently and no longer produces that key, the value is appended instead of refusing the whole chat as damaged; only that key's place can change. * Resume each sweep page at the generation it is deleting After a page of records the sweep went back to its start position, so every later page rescanned every live chat's generation numbered below the retired one. It now resumes at that generation; a contract at N and 10N live chats pins that only a pass's first page walks them. * test: the sweeper rests nine times each page's work * Start the retired-record sweep from the chat database the attachments already take The sweep was wired through an optional parameter, so dropping it at the one production caller would have left retired records forever with every test passing. It now runs on the required journal database, and a wiring test checks that installing starts it and stopping ends it. * test: an existing chat whose first write fails keeps no marker, and the newest release still opens and writes it * test: chats the window's releases and the oldest release with this chat database wrote are edited, sent to and rewound by this build as the newest release does Each release writes a Claude and a Codex chat through its own writers. This build opens it, edits a card the old rows hold (its first write: the marker and an in-place update), sends, rewinds (every kept message and card saved again through the strict encoder) and reopens, with every commit restoring to the live chat. The result equals the newest release's after the same steps. The oldest release is resolved from tags, as the window is. * test: the released-chat writer resumes the queue after every Stop it records, and the probe reads each step's result once * test: the released-chat probe checks this build's edit, send and rewind on its own result Comparing the carried chat with the newest release's would fail the required cross-version check for any legitimate main change to those flows until the next release ships. The probe still admits every released row, opens the chat as the release and the newest release do, keeps the release's rows byte for byte with one marker, and restores to live after every commit; after that it checks the edited card, the accepted send and the rewind's survivors. The oldest release with the per-host database is named directly: it never changes. * test: the golden input prefix holds data in every keyed collection Six collections folded empty, so a change to how old rows derive their keys went unnoticed there. Eight rows v1.4.245 wrote through its own journal (an item with an execution owner, a declared echo, a removed turn, and a queued card handed over with carried history, then cancelled in doubt) follow the existing rows unchanged, and the test now requires every collection to be non-empty. * Say once, beside the marker version, that the reading of old rows under it is frozen The fold comment claimed an unheld prefix-ordinal value only moves that key; a prefix read differently can also show a key twice or bring back one the tail deleted. The marker version now states the rule: a build that reads old rows into different keys or values keys that reading off a new marker version, and duplication or resurrection is never intended. * test: the released-chat probe compares what the release wrote, not fields this build adds The open check compared whole snapshots, so a field main starts setting would fail the required cross-version job until a release ships it. It now compares the release's items, sends and cards, in order and by value, allowing added fields; the byte-identity and restore-equals-live checks are unchanged. * test: say why the first-write-failure downgrade test needs a longer timeout * Type the open-union fallback check by schema, not a bare object * Check each outcome-format key set separately so no check reads as a redundant union member * Read an open or branded string as a value in the storage key check, not as an object * Decode each newest outcome record from the value admission parsed, without parsing or walking it again or keeping its text * Match each encoded record to its change by position, so a settlement batch's encode stays linear in its mutations * Encode each changed value as the draft holds it, without reading it through the draft's tracking * test: rewind, replacement and rollover restate a chat with fixed statements and work linear in what they restate --------- Co-authored-by: Codex <noreply@openai.com> |
||
|
Brennan Benson
|
ae09815770 |
Support automations in Orca Mobile (#31617)
* Add host-owned automations flow to mobile * fix: resolve initial mobile automation CI failures * Preserve automation target identity and mobile action state * Preserve selected automation targets through discovery and terminal launch * Cover draft reversion after uncertain automation creation * Preserve automation target and submitted action authority * Preserve selected hosts and editor operations across restored state * Refresh mobile web bundle measurements for merged routes * Fix automation history observation and catalog scaling * Fix automation mobile presentation and merged launch bindings * Refresh measured mobile bundle sweep and correct automation test inputs * Move real-module test loads to collection and consolidate imports * Use typed row access to count worktree ownership reads * Refresh selected automation history on matching host events * Fix automation contract types and merged test imports * Fix automation theme updates and committed history ownership * Update folder terminal contract fixtures for canonical host catalogs * Consolidate historical session activation fixture imports * Repair automation contract project boundaries and owner type ports * Preserve acquired automation folder owners and fix integration lint * Retain terminal pane owners captured at connect * Use checked pane manager context in owner retention test * fix: adapt merged editor and terminal test contracts * fix: preserve captured automation targets and terminal owners * fix: honor explicit automation source clears and refusal contracts * test: construct terminal transport mocks with checked types * test: supply retained-owner context in terminal fixtures * test: align terminal fixtures with callable mocks and store ports * fix(mobile): localize automation screens and run details * fix(mobile): use automation translations in context * fix: preserve editor owner checks and automation repair guidance * fix: reconcile captured workspace contracts after main sync * Repair automation integration tests and retained target diagnostics * Keep test support owned by registered unit roots * Expose full blocked automation run reasons in menus * Anchor mobile bundle envelope to measured route sweep * fix(mobile): localize coded automation run failures * fix: preserve automation decisions and captured resource ownership * fix: qualify remaining automation workspace owner consumers * fix: preserve resolved watch and child editor owners * fix(editor): share qualified worktree watch ownership * fix(editor): reuse immutable repo ownership lookup * fix: preserve host ownership without duplicate catalog scans * fix: align automation destination host types and ratchets * fix: align mobile bundle envelope with measured sweep * fix(mobile): resolve automation setup policy before save * test(mobile): qualify reconciled automation target inspection * fix(mobile): keep server setup consent within its authority * fix: accept narrow qualified workspace owner snapshots * fix: reuse qualified owner state for workspace directories * fix(mobile): localize known automation orphan reasons * Correct automation controller and Chat harness types * Refresh editor requests after paired host restart * Refresh measured mobile web bundle envelope |
||
 Jinwoo Hong
|
8138232c4f |
Print concise orchestration CLI output for agents, with --full for the full record (#36498)
Orchestration commands print small flat fields in text and --json by default; --full prints the previous output. Failures exit non-zero with error: <code>: <message> on stderr. |
||
 Kelvin Amoaba
|
2048245a26 |
fix(browser): let grab and annotate pick elements in modal dialogs and popovers (#36518)
Top-layer content (showModal dialogs, popovers, fullscreen elements) paints above the overlay's max z-index and a modal dialog makes it inert, so hover and clicks reached the page instead of the picker. The outline now lives in the top layer and is raised again when new top-layer content opens; the overlay reads hover and blocks trusted presses at window capture and hands real pointer picks to awaitClick. Fixes #28657 |
||
|
Brennan Benson
|
76cf164cf9 |
Chat UI leaves Experimental: each agent's Chat or CLI choice decides what opens (#36110)
* Chat UI leaves Experimental: each agent's Chat | CLI choice decides launches Remove the experimentalNativeChat switch and every gate on it. The Chat settings page, Default Agent Chat | CLI choice, + menu Chat/CLI rows, source-control surface choice, Antigravity chat section and orchestration chat-error switch are always present. What a new launch opens comes only from the per-agent choice (no saved choice opens a chat) plus the existing support checks. - One lookup, nativeChatPreferenceFor, keyed by agent id so host-registered agents read the same way; unreadable settings still open a terminal. - A relayed desktop stamp (nativeChatDefault) maps onto the launched agent; an explicit surface still wins. Old phones' createSupport keeps admitting by the host's per-agent choice. - settings.get stops publishing the retired switch keys; nothing in the repo reads them from a host. - Startup chat sync and hydration run when some agent can open as a chat or the machine already holds chats. - The retired key is stripped on load. The one-time upgrade tip from the chat upgrade is retired with its audience record; a new record, captured once from the raw profile, marks which existing profiles had Chat UI off. - The window-side AI-button tab path, which only ran with the switch off, is deleted. * Keep profiles that had Chat UI off on the terminal Existing users who never turned Chat UI on would otherwise see new agent launches open as chats, since an agent without a saved choice now opens as a chat. The one-time load step that records the new audience also sets every known agent to CLI for those profiles, in the same save and only when the record was absent, overwriting saved chat choices the old switch masked. Profiles that had Chat UI on and new profiles are untouched. Browser profiles keep their own settings, so the web client does the same once: a stored switch that is not on seeds CLI choices, and dropping the key marks the step done. Agents first seen after this step open as chats. * Agents without a saved Chat | CLI choice open as their CLI An agent with no saved choice now opens in the terminal for everyone, including fresh installs and agents first seen later. The one-time load step carries what launches opened while Chat UI was experimental: with the switch on, every known agent without a saved choice is saved as chat; with it off, chat choices the switch masked are saved as CLI. Existing profiles join the launch tip audience whether the switch was on or off. Browser profiles get the same carry from their saved key. The startup chat restore and host agent list now run only when some agent is saved as chat or the runtime holds chats. * Preserve owned terminal launches and local chat choices * Clarify chat and terminal support * Explain worker CLI integration timeout budget * Use checked annotations for chat graduation test fixtures * Store agent surface default separately from per-agent overrides * Preserve explicit Chat intent across default changes * Preserve current browser settings during host replies * Correct browser settings factory and regression types * Name exported launch fixture mock types and clarify agent defaults * Preserve settings fallbacks and complete launch test lifecycles * Check allocated tab identity before launch fixture interpolation * Register combined integration project for compiler parity probes * Use checked settings in the launch test fixture * Preserve retired Chat preference data privately * Align chat E2E fixtures and capture pane lifecycle evidence * Use typed raw settings in retention contracts * Consolidate transcript diagnostic imports * test: align chat fixtures with live pane and native menu contracts * test: capture relay tab selection loss diagnostics * test: wait for owned shells before synthetic chat fixtures * test: preserve all-host visibility in SSH observer * test: bind synthetic transcript fixtures before provider seeding * test: assert selected chat owner after narrow image preview * ci: allow fifth compiler project to complete comparison * Type the web-terminal fixture's chat map without an assertion * Right-click the selection itself in the chat copy spec |
||
|
Brennan Benson
|
37ef6e9268 |
Explain Git Bash console exhaustion when terminal startup fails (#36422)
* Report Git Bash console exhaustion when terminal startup fails * Observe initial terminal diagnostics before startup output changes * Keep terminal startup diagnostics scoped to fresh launches * Preserve claimed terminal failure provenance * Finalize terminal startup failure classification at producers * Preserve terminal creation provenance and startup warnings * Correct startup diagnostic test type boundaries * Use a typed startup projection test adapter * Consolidate startup readiness diagnostic imports * Exercise installed DLL format fixture through terminal startup failure * Use checked startup failure test dependencies * Preserve exact DLL fixture bytes on checkout * Align terminal regression fixtures with exit contracts * Complete exit verdict expectations in runtime contracts * Drive ConPTY startup before fake-clock foreground checks * Cover formatted capacity failures in terminal error toast * test: preserve neutral exits after terminal wait integration |
||
|
Brennan Benson
|
dfa617cc67 |
Show each chat’s account in Session History details (#35392)
* Show recorded session accounts in History details * Fix session account lint failures and extract presentation * Isolate session account cards from unrelated settings updates * Keep session account labels tied to available current roster evidence * Add English session account labels * Share recorded session account observation and isolate optional stream evidence * Verify healthy account and usage consumers during optional registry loss * Bound session account comparisons and acquisitions * Use nonmutating reversal in account peer tests * Type the account subscription replay fixture without assertions * Repair account directory types and integration fixture imports * Give account details fixture a portable return type * fix: release account streams on transport abort * test: name desktop account stream IPC event type * chore: temporarily expose e2e compiler diagnostics * test: type account stream unsubscribe as callable |
||
|
Neil
|
48bb6bc863 |
test(plugins): follow per-plugin review for access-growing updates in update e2e (#36473)
Since #36218 a lone update that grows access opens straight into its own review, and several such updates list with Review buttons instead of joining Update all. |
||
|
Brennan Benson
|
12edee3ac6 |
Choose default models and effort for agents (#36210)
* Add host-owned model and effort defaults to agent settings * Unify terminal defaults and raw argument precedence * Keep agent model defaults typed through creation * Preserve quick-create prompt through preparation * fix: complete execution-host preference boundary and CI contracts * Preserve raw options until a replacement is emitted * Complete launch choice ownership and consumer contracts * Align launch contracts with compiler boundaries and consolidate proof * Name exported fixture mocks and verify ordered chip removal * Preserve typed choices across compound legacy publication edits * Preserve non-emitted composed launch choices through legacy edits * Preserve rollback omissions and settle agent launches before success * Carry terminal draft ownership through launch completion * Keep inline draft delivery independent of terminal projection * test: consolidate launch ownership contracts * test: check web launch fixture array types * test: align launch fixtures and conformity records * test: import the shell-ready marker from its declaring module * test: give caller routing the web host tab's completion contract |
||
|
Neil
|
8c777ea465 |
plugins: tell once when an automatic update waits for your review (#36462)
* plugins: tell once when an automatic update waits for review When the auto-updater holds back an update because it asks for more access or moved repository, show one toast per plugin version (grouped when several wait). Review opens the existing per-plugin update review or the Updates list; it never installs or approves. Told versions persist across restarts, kill-listed plugins are skipped, and the copy is protected from language packs. * test(plugins): wait on the update pass instead of sleeping in the review toast e2e |
||
|
Kelvin Amoaba
|
162ea19851 |
fix(browser): stop paired desktops serving mirrored browser tabs back to their host (#36447)
When two desktops pair both ways, B mirrored A's browser tab and republished it in its session inventory under A's workspace and page ids. A applied B's copy onto its own workspace, so A's local page became B-hosted and showed a dead Remote browser pane (selector_not_found from B). Browser rows whose page runs on a paired server now carry hostRuntimeEnvironmentId, as editor rows do since #33752, so B serves them to its phone but not to other runtimes. Fixes #36386 |
||
|
Brennan Benson
|
f06399f5fc |
Keep refreshed Linear Tasks rows current (#34591)
* Keep Linear refresh results authoritative in Tasks * Preserve scoped Linear edits through read settlement * Complete Linear consumer entry and source teardown * Fix scoped Linear read lifecycle and external refresh * Complete Linear terminal reads and causal refresh dispatch * Cover cached Linear read reconciliation under pending writes * Fix cold Linear lookup invalidation * Make Linear regression fixtures deterministic * Align Linear test fixture naming with lint policy * Consolidate Linear test imports * Keep Linear saved publications coherent through React replay * Preserve confirmed Linear accounts through unavailable checks * fix(linear): retire recovered credential errors on acknowledgement * fix(linear): keep runtime cache reset on account acknowledgement * Fix Linear CI fixtures after final main integration * Correct Linear mobile fixtures and scoped lint annotations * Keep the mobile fixture assertion annotation on its expression * Fix Linear static contracts and integration test boundaries * Complete audited Linear static gates and preserve no-op selection * Separate Linear selection decisions from observations and preserve create completion * Name exported Linear fixture mock types with public annotations * Preserve exact submitted drafts through create settlement * Read draft retention mode from its committed snapshot * Publish the current closing draft after queued form replay * Type Linear create attempts from their form owner * fix: supply complete task creation test fixtures * fix: complete checked Linear creation metadata fixtures * test: complete Linear dialog fixture composition * test: use host-qualified workspace keys for board sync fixture |
||
|
Jinwoo Hong
|
a1f7f97671 |
Orchestration v3: coordinators end their turn and Orca wakes them (#36137)
* fix(orchestration): keep a terminal's mail from being consumed by another terminal, and let settled structured workers take further tasks A plain orchestration check consumed the named terminal's mail whatever terminal ran it, so a coordinator checking a worker's handle took the worker's message. A consuming check from a terminal whose own live pane is a different terminal's is now refused; --peek and --all still read it without consuming. worker-start --terminal and dispatch --inject routed a structured worker (structworker_ handle) as a terminal and failed with terminal_unsupported_for_agent_session. Any agent-session party now takes its task as a send into its session, while a structured worker keeps the pane and process authority its first Dispatch had. * fix(orchestration): fence check by live terminal incl. acks; defer injecting structured workers Review fixes for the mail fence and structured worker reuse: - The check fence compares the caller's and the mailbox's live terminal process instead of recorded panes, so exited terminals keep the old behaviour and two processes sharing a recorded pane are told apart. It also covers --ack in every read mode. The caller lookup is shared with the lifecycle caller fence. - dispatch --inject to a structured worker stays refused as before: an injected Dispatch takes no custody, so releasing the first Dispatch could close a session working on the second. worker-start --terminal reuse transfers custody and stays supported. - worker-start decides pane-less chat authority from the resolved party and passes the session down, so delivery and next commands no longer re-derive it from the address spelling. - Receipts name an agent session, not a chat. * fix(orchestration): an exited caller's env pane names no caller The caller lookup fell back to the env pane key whenever the env handle was not live, so an exited terminal's pane resolved to whatever terminal now occupies it, and a tmux worker's own check was refused. The pane fallback now applies only when the env handle is not proven exited. * fix(terminal): keep surviving terminals streaming to main after a restart Main now attaches every live local daemon session it adopts at startup, not only ones a window pane or remote view is showing, and re-attaches after a daemon endpoint drop. The attach snapshot seeds main's screen, tail and title, and an attached-but-silent agent gets an output clock so readiness can see it has gone quiet. Waits on a survivor main could not attach fail at once instead of timing out. * fix(terminal): restore only pane-less streams after endpoint loss; one attach state - Endpoint loss re-attaches in main only sessions no renderer view reports; a pane restores its own. - The attach hide skips views mid-attach and leaves a pane's own hidden claim alone on failure. - One per-session stream state (attaching, attached, lost) replaces three sets and is forgotten on exit. - Waits retry the attach before failing, including after a failed re-attach. - The output clock starts wherever a reattach result is seeded, so pane reattaches get it too. * refactor(terminal): attach survivors at inventory adoption only; waits on unattached survivors fail at once; one ptyId output clock * test(e2e): scope the restart attach spec's terminal listing to the unopened workspace * fix(terminal): narrow survivor attach: waits behave as on main, one quiet clock per generation, keep main's hidden mark on failed attach * Teach the orchestration guide when to hand off and to end the turn after dispatch * Rewrap a messaging reference line * Keep the original placement default and skill trigger; keep the accuracy fixes * Point DAG retries at --retry-of and drop the last blocking-wait instruction * Check the served orchestration guide by its new worker heading * Apply council review: best-effort wake, full completion rule, restored safety rules, fixed scope and settled wording * Say when the orchestration skill applies, and prefer own subagents otherwise * Name the polling, steering, checkout, and worker fan-out habits to avoid * fix(orchestration): wake a coordinator whose turn ended while its program still reports working Claude Code keeps its OSC 7501 report on working while an agent-teams teammate is alive, even after the lead's own turn ends. The mailbox gate, idle edges and tui-idle all read that report, so worker mail was stored and never typed. A hook turn end newer than the program's working report now counts as rest; hook rows re-classify the PTY so the existing idle edge delivers. Agent Teams panes now join their claude hook rows. * fix(orchestration): compare the lead's own turn end, not the row's receipt A child's hook restamps the row's receivedAt while the lead's turn is still the old one, which could mark rest under a newer program working report. Use the lead's turn-end stamp on this runtime's clock, after the latest input. * feat(orchestration): a consuming check marks the batch it returns as handled * Say why watch scripts and open waits block the wake * feat(orchestration): release settled workers automatically after a grace period * fix(orchestration): use checked row reads for delivery cursors * fix(orchestration): trust a live own-process turn end instead of comparing clocks Drop programActivitySince and the turn-end clock mapping: replays and SSH host clocks made the comparison unreliable. A Claude lead counts as at rest under a program working report when its hook turn end is a live transition from this pane's host and launch, past the existing input and respawn floors. * test(orchestration): drop cast in ack no-op check * test(orchestration): seed legacy outstanding batch for held chat nudges * test(orchestration): built CLI check hands its batch over * test(orchestration): annotate unchanged casts and stub the keep item in tab menu tests * fix(orchestration): let real input, explicit release and host releases converge with automatic release - Record worker takeover at the owning runtime when it accepts UI input, before the bytes reach the PTY. - Run remote attachment releases through the same per-resource single-flight as local ones. - Apply the confirmed-release home projection when host observation reports a host-side release, and carry the host deadline in fleet snapshots. - Prove restart recovery with a file-backed database reopened by a fresh runtime. * test(orchestration): classify the keep RPC's worker fields instead of counting methods * fix(orchestration): checked delivery reads and observer and recovery help * refactor(orchestration): end a check when it hands over a batch; wake rides the wait result * fix(orchestration): refuse an automatic close after real input, join remote releases, converge the home - An automatic close checks the terminal's last driving-input time right before closing and keeps a worker someone typed into after worker_done; typing itself does no orchestration database work. - Remote releases share the per-resource single-flight with local release, so a home worker-release joins the host timer's close. - Host fleet snapshots and federationShow report released and the pending deadline; the home applies the existing release projection inside its observation fence. - Real restart tests: a file-backed database reopened by a fresh runtime releases a missed deadline once and finishes interrupted requests. * fix(orchestration): receipt a shared wake batch on arrival and report the applied Run ack * fix(orchestration): deliver the wake to a working coordinator; agents queue mid-turn input The wake was typed only into a live idle pane, so a Claude lead whose program status stayed working (teammate alive) never got it. Agents queue or steer text typed mid-turn, so a pane takes mail when live idle or working; dialogs, permission prompts, exited agents, unsettled panes and cold-parked Enter still hold it. Drops the held-batch Enter deferral and the per-turn-end hook logic. * fix(orchestration): record each remote release request before joining, publish archives only through the conditional commit - Each remote release caller records its own request before joining a close under way, and the close decides on the current row, so an explicit release that overlaps the host timer clears the automatic deadline. - Remote capture publishes its archive through commitWorkerTerminalArchiveForRelease, so a retain during capture leaves no stale archive for worker-read. - Remote worker-show projects the fenced host deadline and its next action. - The input guard lives in its own module instead of the scheduler. * feat(orchestration): start a worker in one step; worker-start creates the coordinator's Run when none is bound worker-start --spec now creates and binds a Run for a root coordinator with no bound Run, through the same path run-create uses, and names the Run it created or joined in every receipt. Workers on a Dispatch keep starting helpers in their own Run and never get a new one. A new CLI against an older runtime runs run-create and retries; old CLIs need no change. * fix(orchestration): drop the older-runtime fallback; check the spec before a Run is created The CLI fallback matched a refusal text the client decorates, could not prove the caller was a root coordinator on an older runtime, and recovered an inner run-create under the worker-start command. Older runtimes keep their refusal and the guide says to run-create first there. The prompt budget check now runs before worker-start can create a Run. * Route report-back requests to coordinators, complete the steer command, and label the wake loop branches * Say workers are done only when worker_done confirms, wait for helpers to settle, and let bare-shell workers exit * Route report-back requests away from handoff and steer supervised workers through their mailbox * docs(orchestration): teach auto-handled check, retry-request and inbox recovery in the guides * Describe the mid-turn wake in the messaging reference * docs(orchestration): say terminal workers are released 2 minutes after worker_done - The guide's Completion section, the reuse recipe and the recovery reference now describe the automatic release and its autoReleaseAt deadline: reuse or worker-retain before it; explicit worker-release still works and is required for chat workers and workers without a deadline. - The worker preamble says the terminal stays available until Orca releases it, about 2 minutes after worker_done unless retained. - Regenerated the bundled guides. * feat(orchestration): receipts say when to end the turn * feat(orchestration): tell the coordinator when a worker stops without worker_done * test+docs: worker stop reports * fix(orchestration): judge the empty-check stop with execution-host verdicts * test: drop casts from worker stop tests * Say that report-back requests still mean end the turn * Say that report-back requests still mean end the turn * fix(orchestration): stop reports wait for children, keep their Dispatch, and relay intact * fix(orchestration): a stop belongs to the Dispatch active when it was seen; restored stamps announce nothing * fix(orchestration): never say to stop while a remote worker runs * Shrink the orchestration guide to the end-state workflow * fix(orchestration): stop reports quote the agent's last words, or the screen for errors and prompts * fix(orchestration): withhold the stop while chat failure mail is off * test: a clean finish quotes the agent's last words * fix(orchestration): stop asking workers for heartbeats Workers are no longer told to send periodic heartbeats. A heartbeat that still arrives from an older worker or peer only records last_heartbeat_at: it is stored already handled, so it never lands in a coordinator inbox and never wakes a coordinator or a check --wait. Removes the stale-heartbeat warning and the heartbeat interval plumbing that only fed the preamble. * fix(settings): remove the worker heartbeat controls The Worker heartbeats switch and Heartbeat interval field only changed the worker preamble text, which no longer mentions heartbeats. Saved values are dropped on load as retired settings. * fix(orchestration): wake a coordinator that reports program status but never sets a title Program status only re-classified a pane that had a title, so a titleless agent (agy) never got a live status and the wake gate refused it. * fix(orchestration): a new Run no longer cuts a coordinator off from its earlier Run * test(orchestration): drop heartbeat-batch cases the handled heartbeat row removed * fix(orchestration): redact capabilities from a stop report's quoted output * fix(orchestration): never wake a mailbox for a heartbeat One rule at the runtime notification entry replaces per-call-site read checks, so mutation replay and federated control-mail import stay silent for heartbeats too. * Shrink the orchestration references and worker preamble to the end-state workflow * Name the older-Orca bind refusal as worker-start prints it * Owner-fence test: a refused foreign ack changes nothing, whatever the worker's own check already handled * Integration: drop the duplicate consumingCheck after merging #34043 and #35293 * Integration: await the worker-start next receipt before naming its Run * Apply review round 1: drain to zero, release without auto-release, retry after stop, Run before a DAG * Apply review round 2: start ready DAG Tasks, block when no failure wake, replay sends by request ID * Apply review round 3: one receipt-based wait rule for starts and wakes * fix(orchestration): a worker stopped without reporting needs action, and stop keeps its output worker-list projected a stop-reported attempt as live, in_progress, no action. It now projects finished_unverified with a worker-read recovery until mail reaches the worker. worker-stop closed the terminal before anything archived it, so release reported the archive unavailable; stop now archives the output first. * Revert "Owner-fence test: a refused foreign ack changes nothing, whatever the worker's own check already handled" This reverts commit |
||
|
Brennan Benson
|
527e7082b6 |
Reduce whole-app hitches when many chats are running (#35624)
* Move chat journal checkpoints off the host thread * Apply checkpoint lifecycle style and teardown test checks * Wake journal checkpoints for cleanup writes and retire fixture owners * Use fixed time in attachment checkpoint fixture * Derive checkpoint timer handles and check unref capability * Preserve journal test close completion and event typing * test: await journal close before fixture reuse and cleanup * test: await registered journal fixture cleanup * test: integrate goal sweep fixture with journal ownership * Simplify journal checkpoint worker lifecycle |
||
|
Brennan Benson
|
a68230334e |
Let automations run in Chat (#34332)
* Let automations run in Chat or Terminal through the shared agent launcher * Preserve automation targets and complete owned terminal lifecycles * Keep stale prompt projection available when recomputing * Count repeated desktop lifecycle resource cleanup * Preserve automation targets and observe committed chat work * Scope automation observation and reconciliation work to each operation * Restore automation server composition and process import boundaries * fix(automations): preserve busy chat reuse and runtime boundaries * Correct shutdown test acquisition and exported measurement types * Correct automation fixture contracts and duplicate imports * Keep Chat automations separate from Terminal execution * Preserve Chat automation intent while support loads * Resolve automation Chat validation diagnostics * Remove unused automation style directives * Make automation surface classes statically inspectable * Move automation surface styling into a toggle group variant * Correct automation launch test receipt and output fixtures * Account for pane and prompt journal reads in delivery test * Preserve admitted automation surface across save effects * Separate automation page test actions from their lifecycle owner * Complete automation route test fixture input * Reopen saved automation chats through the existing record owner * test: isolate session action fixtures and complete tab groups |
||
 Kelvin Amoabaandfanzzzd
|
0a12f82757 |
fix(browser): list browser tabs restored after a restart in tab list and load them on switch (#35563)
* feat(browser): list restored tabs in tab list and load them on demand After a restart Orca restores browser tabs lazily: a tab gets a page only once the user opens it. tab list only reported tabs with a live page, so an agent in a worktree with 26 restored tabs saw one and concluded there were none. tab list now reads the tab bar from the session snapshot the renderer already publishes on every tab change, and reports every tab in tab-bar order. Tabs without a page carry loaded: false. tab switch and tab close --index resolve indexes against the same list, and switching to an unloaded tab loads it in the background first. Waking a page now also waits for its first load to finish, so the next command does not read a blank page. Headless serve keeps every page live, so it lists as before. * fix(browser): list the tab bar even when Orca has no window open With the window closed the app keeps running and its restored tabs still exist, so tab list should report them. Headless snapshots are built from live pages only, and the merge dedupes those, so dropping the window check lists nothing extra there. * fix(browser): list an id held by a live page and a client page once * fix(browser): wait for the first load of a tab headless serve wakes Headless serve starts a restored page and returned at once, so the next command could read a blank page mid-load. It now waits for the first load, as the window path already did. * refactor(browser): keep the tab listing beside the browser tab catalog Main moved the runtime browser commands into runtime/browser/ since this was written. Also drops a window lookup the catalog no longer uses, and corrects the headless note: those snapshots list saved pages that have not started yet. * fix(browser): keep paired-server mirrors out of tab list and close indexed rows like --page A window also publishes the browser tabs it mirrors from paired runtimes, which this host can never load, so the tab bar is read only for workspaces this host owns. tab close --index now closes the listed row exactly as --page does, keeping its worktree, so an unstarted headless tab is retired instead of reported closed and left saved. With nothing active, the first live page is marked current again, matching where a pageless command goes. * fix(browser): wait for first load only on tab switch, and show tab indexes from the listing Every --page command wakes an unloaded page, including the tab show a remote browser pane awaits before streaming, so waiting up to 10 s for the first load there held the stream back. Only tab switch waits now. tab show reports a tab's index from the same listing tab list and close use. * fix(browser): list restored tabs in an SSH host's bridged workspace, and reject fractional close indexes An SSH host's workspace can have no repo row on the desktop, yet its pages render in the desktop window, so the bridge's scoped workspace counts as this host's own. A non-integer --index no longer falls through to closing the active tab. * test(browser): give the restored-tabs e2e's timeout and lease wait their reasons * test(browser): read restored-tabs RPC results through the shared e2e reader Reuses the browser e2e rpc helper instead of a local Reflect.get copy, and types the listing test's snapshot rows. * fix(browser): index tab show in the caller's scope, as tab list does * fix(browser): report an out-of-range close index as browser_tab_not_found Matches tab switch, so agents can recover by re-listing. The restored-tabs e2e now asserts the raw loaded value instead of coercing a missing one. --------- Co-authored-by: fanzzzd <fanzzzd@outlook.com> |
||
  OrcaWinandOrcaWin
|
5a925965d5 |
fix(git): compare staged renames against their HEAD source (#34779)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Kelvin Amoaba
|
b67c5254f0 |
fix(browser): agent fill, select, upload and type change the page or fail with a reason (#36263)
* fix(browser): fill, select, upload and type act on the agent's element or fail * refactor(browser): move agent key commands into their own bridge layer; fix test sender call |
||
|
Kelvin Amoaba
|
46237aa148 |
fix(e2e): return from every path of the WSL boot guard's running-list read (#36261)
#36256 made one branch return the retry promise while the others fell through, which trips noImplicitReturns (TS7030) and turns the e2e typecheck ratchet red on main. |
||
|
Neil
|
593e1dbc60 |
test(e2e): retry a WSL terminate that never took, once, when Orca launched nothing (#36256)
* test(e2e): retry a WSL terminate that never took, once, when Orca launched nothing * test(e2e): log PTY spawns for the E9 guard and refuse the terminate retry after one |
||
|
Brennan Benson
|
fd976a47be |
Keep zoomed PDF detail text sharp (#36173)
* Keep zoomed PDF detail text at device resolution * Test PDF detail update dimension-read bounds * Account for browser layout units in PDF geometry test |
||
|
Brennan Benson
|
70209b9b11 |
Keep chats stopped by a delivered kill readable after downgrading (#36142)
* fix(native-chat): keep chats stopped by a delivered kill readable after a downgrade v1.4.244 accepts only three death kinds and sets aside any other record, so a chat Stop force-killed (exit never observed) vanished after a downgrade. Store the delivered kill as the absent pid an older build's restart probe would itself record, plus an exact marker this build reads back; in-memory code still sees kill-delivered. * test(native-chat): explain release-checkout timeout * test(native-chat): cover downgrade recovery and workspace rekeying * test(native-chat): preserve checked record types at test boundaries |
||
|
Kelvin Amoaba
|
3b83d3d260 |
fix(computer): skip activation for accessibility clicks (#36006)
* fix(computer): leave Linux and Windows windows in the background for accessibility actions Element clicks no longer restore and activate the target window when an AT-SPI action or UIA Invoke/SelectionItem/Toggle pattern handles them; only the pointer fallback activates. On Linux, type-text and paste-text insert into the focused editable field through AT-SPI EditableText without needing window focus, and fall back to key synthesis or the clipboard otherwise. Refs #12412 * fix(computer): refuse pointer input after failed activation * fix(computer): stop after unconfirmed text writes * fix(computer): insert the full UTF-8 text on Linux * test(computer): focus each Linux text-entry trial * fix(computer): verify Linux text mutations before deletion AT-SPI can acknowledge writes without changing text. Read back mutation counts and caret state before reporting success. * fix(computer): verify complete Linux text replacements * fix(computer): decline unreadable Linux text selections |
||
|
Brennan Benson
|
d2d61ba0c0 |
Center plain Project table cells and label the linked PR overflow (#34532)
* fix(github-project): make linked PR numbers clickable * fix: open linked pull requests at their exact URLs * test: assert complete project relation cell text * fix: clarify linked pull request controls and overflow * Fix linked pull request focus clipping and overflow label * Keep linked pull request overflow outside clipped values * fix(github-project): center plain project cells and say what +N means Drop the clickable linked PR numbers: the numbers stay plain text as before. Plain text cells (repository, parent issue, linked pull requests, sub-issue progress) now center vertically like the other cells, and the linked PR overflow reads "+N more" instead of a bare "+N". * fix(github-project): keep the linked PR "+N more" visible when numbers truncate |
||
|
Brennan Benson
|
2e38249a7d |
Keep a chat's accepted model options in what it shows and sends (#31208)
* Keep a chat's accepted pick in what it shows and sends A pick held while a new chat is created is committed into the chat's active option record once accepted, through the same step a normal pick takes, and older options reads are dropped. The host also publishes the chat's saved effort, Fast and speed as optional status fields so another device's pick moves the option stamp and re-reads options. * Keep chat picks ordered and capture displayed send selection * fix: keep chat choices in one controller with accepted input capture * fix: pass captured Codex model input to the turn request * Keep structured chat option pickers usable during turns * Preserve logical selection ownership across runtime transitions * Consolidate selection lifecycle contract coverage * Consolidate mobile structured send imports * Preserve legacy action outcomes and opening message identity * Consolidate repeated selection test setup and assertions * Fix option reset admission and preserve uncertain write notices * fix(chat): complete option contract fixture types * test(chat): place affinity integration in cross-layer suite |
||
|
Neil
|
e8e0803672 |
fix(wsl): hold main's background WSL start before the cwd probe; let the user's runtime start check a WSL folder (#35971)
* fix(wsl): hold main's background WSL start in the shared preflight; folder launch scope honours the user's act Main's background start (no wslUserAct) is now held in resolvePtySpawnStartupTarget, before the startup cwd probe and any provider. A runtime start the user asked for (CLI, window, phone, split) checks a WSL folder workspace's path as their act, so it may start the distro; background work is refused with the stopped-distro message instead of folder_workspace_path_unavailable. * fix(wsl): agent-session create and user resume check a WSL folder as the user's act; background holds with Start * fix(wsl): agent-session ensure and a failed start's kept pane pass the user's act to the WSL folder check * test(e2e): a prepared terminal.create dedupes as the caller's act |
||
|
Brennan Benson
|
db9cfbdb0a | test(worktrees): cover both emoji branch naming modes (#35745) | ||
|
Brennan Benson
|
6e0c74465c |
fix(claude): avoid unsupported workflow agent views (#35749)
* fix(claude): keep unsupported child rows on their parent pane * fix(i18n): remove obsolete Claude agent denial translations * fix: recover unavailable Claude child navigation to parent * test: complete agent row navigation contracts and CI compliance * test: repair agent row localization and integration ownership |
||
|
Brennan Benson
|
e69baa3499 |
fix(linear): stop writes when their caller lifetime ends (#35020)
* fix(linear): bound write preparation and mutation to one caller lifetime * fix(linear): isolate cancellable preparation from shared reads * test(linear): keep CLI lifetime coverage in its compiler project * fix(linear): preserve comment change failure guidance * test(linear): place CLI and runtime coverage with integration tests * test(linear): reset CLI exit status across runtimes * fix(linear): preserve truthful confirmation deadline causes * test(linear): support renamed workspace selector in fixture * test(linear): adapt relation lifetime fixture to client factory |
||
|
Jinjing
|
21cb9ebb78 |
perf(terminal): send typed keys to the PTY before publishing activity; split echo latency phases (#36008)
* perf(diagnostics): split terminal echo latency into queueing, round-trip, parse and paint phases The typing diagnostic started timing at its own capture handler and lumped the PTY round trip, renderer output scheduling and xterm parse into one interval, so a stalled renderer could not be told apart from a slow PTY or TUI. Exact samples now also report trusted-event input queueing, onData to first output reaching the output scheduler, scheduler queueing, and xterm parse, plus each sample's overlap with long animation frames. The report shape only gains fields. * test(bench): measure terminal echo phases under accumulated workspace-update pressure Adds a typing bench scenario that types into one real PTY while the accumulated store receives rank-only order publications (and optional status traffic), runs the in-app phase diagnostic beside the PTY sidecar, and moves the shared bench knobs and report writer into a module both specs use. * perf(terminal): send a typed key to the PTY before publishing its activity stamp xterm fires onUserInput before onData, and the first key after a pause wrote lastTerminalInputAtByPaneKey synchronously there, so the key waited on every store subscriber before it was sent. Publish the stamp in a microtask instead: the same task still records it, after the key has been handed to the transport. At 1,620 workspaces and 2,356 store listeners, input-to-dispatch for keys after a pause fell from p50 1.2-1.5 ms to 0.5 ms. * Improve typing latency diagnostic accuracy * Flush queued long tasks in live typing latency reports |
||
|
Brennan Benson
|
f87d68b4a4 |
Chat runs launcher Commands like op run -- codex for every agent (#35592)
* Support launcher command prefixes for all chat agents * Preserve launcher path arguments and copy routing checks * Match Japanese command guidance to the Agent settings label * test(pi): expect version probe termination barrier * test(chat): expect current command refusal guidance * fix(acp): refuse copy arguments before launch preparation |
||
|
Brennan Benson
|
e6878905be |
fix(wsl-host): Start connects a stopped distro once and names it when it fails (#35438)
* fix(wsl-host): Start connects a stopped distro once and names it when it fails Start called the WSL host's connect and then the generic explicit connect, which routes to the same WSL host again, so one click deployed and supervised the server twice; a failure toasted main's raw text (a probe's command line). Start now makes only the explicit connect, which still refuses a host whose Remove is pending, and a failure says "Couldn’t start <distro>" with where to look. * test(wsl-host): cover moved Start admission and default failure toast * test(wsl-host): load actual registry outside test hooks * style(wsl-host): format admission test import * test(wsl-host): check pending removal fixture type |
||
|
641e4792b9 |
Startup shows chats as Interrupted or Done without reading their history (#32146)
* feat(agent-session-journal): save each chat's open root turn beside its epoch A restart could only tell whether a chat was cut mid-turn by replaying its whole journal. journal_sessions now keeps the open root turn (open_turn_id, open_turn_since), set by the row that opens a turn and cleared only by a finish the provider reported, in that row's own transaction. A turn a quit, crash or Stop cut short stays open, which is what the next launch reads as Interrupted. Journal schema version 5 adds the two nullable columns with a forward migration; a new epoch starts with no turn open. * fix(native-chat): restore chat tabs at startup without replaying any history Startup opened every chat in the saved tab index and replayed its whole journal into the main process to learn its status. With hundreds of tabs and gigabytes of history, Orca froze in GC on every launch. Startup now lists each restored chat from its record and publishes its row as Interrupted (a turn was open when its host stopped, or the last quit's resume offer lists it) or Done, through the status stream and the agent-status sink, reading only each chat's journal_sessions row and its newest row's time. A chat's history is read when something opens it; that open settles what the gone generation left running and publishes the journal's own row over the restored one. No other startup path replays chats: restart offers list from their markers without opening chats, and orchestration mail opens the chats it must read one at a time. Opened chats are capped at 24 resident folds; opening one past the cap closes the least recently active folds that are only a cache, with the idle sweep's own close test. * Fix lazy chat restoration and cache ownership * Restore saved chat work across runtime restarts * Wait for committed structural progress in migration fixture * Correct restored ownership and bounded journal recovery * Preserve bounded work selection during legacy recovery * Complete deferred restart status publication * Fix restart recovery test fixtures * Use legal legacy recovery fixtures * Correct population delete observation * Bound legacy journal replay in a readonly worker * Repair legacy worker proof oracles * Reduce legacy scratch key serialization cost * Decode population meter namespaces with scratch UTF-16 encoding * Consolidate structured session imports for CI * Remove redundant casts and document checked type exceptions * Correct compiler contracts and retain journal fixture invariants * Fix checked test fixture contracts after compiler validation * Name population fixture identity type in exported signature * Preserve historical quit presentation after rewind * Fix structured session retry and remote worker delivery * Preserve settlement and restored status contracts * Enable legacy chat readiness on standalone hosts * Repair structured session static checks * Verify retained submission identity across rewinds * Show saved chat status without replaying history at startup * Keep chats closed when startup status finishes loading * Keep startup owner recovery independent of history loading * Preserve intentional quit verdicts in saved chat status * Use a checked host fixture in startup restoration tests * Group saved startup roster publication and verify scoped status work * Use checked array access in status cut counters * Complete checked saved status fixture typing * Declare portable roster counter contract * Use current saved chat startup APIs in contracts * Preserve complete chat tab authority across startup * Repair checked startup restoration test consumers * Keep authority fixture module mocks in test entries * Consolidate authority test fixture imports * Check restore fixture contracts and recorded queue recovery --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> |
||
|
Neil
|
4595be8263 |
fix(codex): launch Codex without its paste-burst guess outside Windows (#35975)
* fix(codex): launch Codex without its paste-burst guess outside Windows Codex treats a fast run of keys followed by Enter as a paste and turns the Enter into a newline. Keystrokes relayed from a remote client can reach the host bunched together, so the prompt stayed in the composer as a draft. Orca's terminals bracket every real paste, so the guess can only misfire there. Orca now launches and resumes Codex with disable_paste_burst=true, except on Windows, where Codex reads console input records and relies on the burst for pastes. Fixes #34496 * test: expect Codex launches to disable the paste burst off Windows Refs #34496 * fix(codex): keep the paste-burst flag out of commands that end their options Refs #34496 * fix(codex): decide the paste-burst flag from a paired server's own OS on resume Resume quoting on a paired server keeps the client's platform, so a macOS client resuming Codex on a Windows server would have disabled the burst that Windows Codex needs. The resume target now carries the server's reported OS and leaves the flag off when it is Windows or unreported. Refs #34496 * fix(codex): add the paste-burst flag only when the command runs Codex itself A wrapper override may not forward -c, which would break every launch. Refs #34496 * fix(codex): leave the paste-burst flag off compound commands and unreported SSH hosts Refs #34496 * test: leave pass-through resume input untouched in the banner spec Refs #34496 * test(mobile): expect AI-vault Codex resumes to disable the paste burst Refs #34496 |
||
|
Neil
|
2a5f6c79c1 |
test(e2e): on the real WSL lane, background work never starts the stopped distro (E9 guard) (#35590)
* test(e2e): on the real WSL lane, background work never starts the stopped distro (E9 guard) The Windows real-WSL lane opens a project inside its own imported distro, terminates that distro, and runs a window of background work elsewhere (focus/blur/reveal, workspace switches, a linked issue/PR card, Settings panes, Tasks, account switches). Every child the main process starts is logged; no wsl.exe may run anything in the distro (listings are fine), and `wsl --list --running`, watched each second, must never show it, which also catches UNC touches. Opening a terminal in the WSL workspace then starts it. A participation check fails the lane if the guard skipped. * test(e2e): actually render each Settings pane in the WSL lane's E9 background window openSettingsTarget alone only set the navigation target, so no pane mounted and none of its reads (servers, accounts, agents, integrations, CLI status, the repo pane's orca.yaml check) ran. Open Settings, wait for each pane's section to mount, then close it. * test(e2e): harden the WSL lane's E9 guard per review - process-host logs every spawn to ORCA_E2E_SPAWN_LOG when set, so the guard sees worker-thread and inheriting-child spawns (e.g. the Codex rate-limit fetch), sync ones included. - The spawn baseline is taken before `wsl --terminate`, and the running-list watcher starts right after it, so work in the stopping window counts. - A wsl.exe launch counts as starting the distro unless it names another or only lists/terminates. - The watcher is async with a 5 s timeout and non-overlapping ticks; a failed read is retried and fails the guard after three, never reads as "stopped". The recorder throws if it cannot hook, and the spawn log must be non-empty. The doc names the watcher as the authoritative assertion. * test(e2e): bound the terminate grace, keep the spawn log out of shipped runs, tolerate torn lines - The watcher forgives running reads only within 3 s of `--terminate` and before its first not-running read, which the rounds now await; any running read after it fails the guard. - Main drops ORCA_E2E_SPAWN_LOG outside e2e mode (no ORCA_E2E_USER_DATA_DIR) before anything spawns, so no daemon, PTY or agent inherits it; the log holds full argv, tests only. - readSpawnLog skips a line torn by a concurrent append. * test(e2e): no blocking wsl.exe in the WSL lane's E9 guard, and a timeline for failures The first lane run was cancelled at the 30-minute job limit while the guard step had run 25 minutes: past three 5-minute test timeouts, which only a blocked worker survives. Every wsl.exe call (setup, terminate, cleanup) is now async with a timeout, so a hung one fails the test. The guard logs a timestamped timeline (each running-list read, terminate, rounds) for diagnosis, and the job limit goes to 50 minutes for the three added runs. * test(e2e): let the setup's own WSL terminal launch settle before the terminate; 10 s grace The lane run failed with "Ubuntu was still listed 3000 ms after --terminate" in all three runs. The timeline showed why: focusing the WSL workspace in setup is a user act that opens a WSL terminal, and its launch (codex trust probe, PTY, hook relay) landed about a second after the terminate and restarted the distro. Setup now waits for that terminal's PTY and for wsl.exe launches to go quiet for 3 s before terminating. The grace is two running-list reads (10 s). * test(e2e): interleave wsl.exe launches into the E9 guard's timeline The lane saw the distro boot about two seconds after the terminate with nothing naming the launcher; each running-list tick now also prints the wsl.exe launches logged since the last one. * test(e2e): time and stack every logged spawn and main's WSL UNC touches The E9 guard printed spawns at its poll time, up to a second late, and with no caller. Each record now carries when it happened and the caller's stack, and main's fs touches of \\wsl.localhost paths are logged too, so a boot with no wsl.exe launch before it can still be attributed. * test(e2e): keep spawn-log stacks and main's fs hooks strictly to e2e mode process-host now writes the spawn log, and captures caller stacks, only when ORCA_E2E_USER_DATA_DIR is set as well, so a stray log variable in a CLI or daemon environment does nothing. The main-process fs/spawn hook refuses to install outside an e2e-mode app, and a source scan pins that no shipped code imports or installs it. * test(e2e): guard a focused WSL workspace left idle through the stop Device runs saw a stopped distro restart with its bridge workspace focused and nothing touched: the stop's own fallout re-ran renderer reads as user acts. The new case keeps that workspace focused with a folder expanded in the Explorer and Source Control shown, terminates, and idles. Shared guard helpers move to tests/e2e/helpers/wsl-boot-guard.ts. * test(e2e): capture caller stacks deep enough to reach the IPC handler * test(e2e): give the focused-idle guard's timeout bump its reason |
||
|
Neil
|
8cc687818e |
test(e2e): force the stale-title window in the live-reattach mode check (#35936)
The same-process serve restart step relied on timing to land the reattach replay inside the window where the host still publishes the tab-default title, which happened about one run in five. Pin the client's published pane title to the tab default and clear its pane status for the duration of the restart, so the replayed image's own title alone must prove the live agent. The check fails 3/3 without #35920 and passes with it. Refs #35559 |
||
|
Neil
|
43ed9878b7 |
fix(terminal): judge live-agent reattach modes by the image's own title (#35920)
After a serve restart where the daemon survives, a paired client could drop mouse and focus reporting for a still-live agent. The host publishes the pane with its tab-default title until it seeds the daemon's live title about 180 ms later. A reattach image replayed inside that window was judged against the default title, read as a plain normal-buffer program, and got the reset that disarms its modes, though the image itself carried them. The snapshot now carries the host's tracked title when the image was taken, as an additive `lastTitle` field in the snapshot info, gated on the image's seq. Every reset that judges a replayed image as a live agent's (the post-replay reset, the focus-in that follows it, the hidden-restore reset, and the model-snapshot reattach) uses that title when present, so the decision describes the same moment as the replayed bytes. Local Electron model snapshots already carried this title and now use it the same way. The reattach policy itself is unchanged: non-agent normal-buffer panes still shed modes a dead child may have left (#7329, #7893). Older hosts omit the field and clients fall back to the published title. Older clients ignore it. Refs #35559 |
||
|
Neil
|
211bbbb6d1 |
fix(wsl): main's background terminal starts never start a stopped WSL distro (#35865)
* fix(wsl): main's background terminal starts never start a stopped WSL distro Every start main makes through the runtime controller is background work unless its caller names the user's act (CLI and window creates and splits, paired-client creates and tab opens, agent launches and sessions, conversation resumes). #35813's hold now also holds those fresh and restored starts while the distro is stopped or unverifiable. * fix(wsl): headless Run now starts as the user's act; update create expectations A headless automation's Run now names the user's act through launchAgentTerminal, so it may start a stopped WSL distro; a scheduled run stays background and is held. The paired-client background create expectation now includes wslUserAct. * fix(wsl): main's background start checks a folder workspace's path passively With #35899's folder stat gate, the runtime preflight passes passiveWslRestore = !wslUserAct, so a background start never stats a stopped distro's folder as a user act before the daemon hold. |
||
|
Neil
|
557f281780 |
fix(wsl-host): a chat holds Send while its WSL distro is stopped, until Start (#35864)
* fix(wsl-host): a chat holds Send while its WSL distro is stopped, until Start * test(wsl-host): find the held Send by the reason it waits |
||
|
Neil
|
84a4995e65 |
fix(terminal): drop a replaced process's title and input modes on restore (#35889)
When a host restart restores a pane by starting a new shell, the pane kept the dead process's title and the client's xterm kept its input modes. A pane that had Claude open came back as bash but still read as Claude, so the reattach picked the agent-preserving reset and mouse moves and focus changes were typed into the shell as escape codes. Two process-bound facts now follow the respawn verdict: - Title: the cold-restore payload no longer carries the checkpoint's last title into the new process's records, and durable checkpoints of the new process take the title from the live terminal only. The title, agent identity and title-derived status reflect the new shell. - Input modes: a pane records which process incarnation its xterm's modes belong to. When the host binds a different known incarnation, the pane grounds the process boundary before the new process's replay, the same ground a fresh spawn already writes, so only modes the new process set are armed. Older servers still report incarnations, so new clients ground their modes against them; older clients get the neutral title from new servers and take the shell reset path. Fixes #35559 |