* fix(native-chat): make the chat view toggle a remappable keybinding
The terminal and Chat UI toggle was hardcoded to Mod+Shift+J, so users
could not rebind or disable it, Settings did not list it, and it
overrode user bindings on that chord. Declare it as
terminal.toggleNativeChat in the keybinding registry, match it through
the user's keybindings, and render its menu labels from the registry.
* fix(keybindings): align native chat toggle admission and execution
* fix(keybindings): preserve runtime input and defer closed menu hints
* test(keybindings): use typed alias read instrumentation
* Fix keybinding dependency direction and physical modifier inputs
* Preserve typed input facts in floating shortcut arbitration
* Clarify native chat shortcut precedence on Windows and Linux
* Simplify native chat shortcut resolution and nominal labels
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(ports): bound macOS scans by the lifetime of each operation
* refactor(ports): keep Darwin metadata acquisition together
* fix(ports): preserve valid Darwin observations and source host routing
* fix(ports): retain scan admission outside aged temporary cleanup
* perf(ports): skip unused listener acquisition for ownership actions
* test(ports): make child fixture streams portable across runtimes
* fix(ports): share source host derivation across scan rows
* test(ports): initialize scan projection without a type assertion
* fix(ports): restore existing browser open routing
* fix(ports): preserve scanner compatibility on degraded hosts
* test(ports): explain real process lifetime timing
* fix(native-chat): render math and center standalone equations
* fix(native-chat): parse math without rewriting message source
* fix(native-chat): accept element roots for math selections
* fix(native-chat): preserve math boundaries and selected source
* fix(native-chat): derive math fence closure from accepted parser events
* fix(native-chat): reuse exhausted math searches per tokenizer
* fix(native-chat): load math typesetting after parsed formulas
* Use declaration references for chat math augmentations
* Declare chat math metadata and register equation label
* Preserve i18n exports in selection quote test mock
* test: expect cached legacy failure display reuse
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Several zh.json strings used a translation with the wrong meaning for the
UI context (e.g. git base ref, dividers, host, browser profile, search
keywords). Align them with the intended sense and consistent terminology.
Co-authored-by: Neil <neil@stably.ai>
The packaged agent-browser binary resolves its version-matched skills from the
nearest skills/ directory above it (Resources/). Only the binary shipped, so
`agent-browser skills get core` answered "Skill not found" and `skills list`
"No skills found". Ship node_modules/agent-browser/skills/agent-browser and
skill-data beside it on mac, linux and win, and cover it with a test that stages
the host's extraResources slice and runs the real binary.
Refs #17705
Co-authored-by: zerone0x <zerone0x@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): show Move anyway on a host card whose move saved state refuses
A host whose move to its Orca server was refused over saved state (an
enabled SSH automation and its runs, stale workspace details, unsupported
saved tabs) stayed in error on every Connect. Move anyway, which connects
it and leaves those items on this computer, was only in the card's
overflow menu, so the host looked stuck. The card now offers Move anyway
next to its refusal, as it already does for Recover server.
Refs #29083.
* fix(ssh): make Move anyway the next step when saved items refuse a host's move
When a host's move to its Orca server is refused only over saved items
that Move anyway can leave on this computer (#29083's enabled
automation and its runs, for example), every surface now leads with it:
- the host card says which items can't move and that Move anyway
connects the host and keeps them here, with Move anyway as its
primary button;
- the refusal toast says the same and offers Move anyway, opening SSH
Hosts where the move is confirmed;
- the terminal pane's Move anyway is primary too;
- the host picker and connect toast read the same line.
Refs #29083.
* fix(wsl-host): boot only the focused WSL host, and keep a stopped one down
E9 connect policy, part 1. A stopped distro now boots only for an explicit user action
or when its host becomes focused:
- Visible work is the active workspace plus workspaces focused earlier in this window
that still have tabs. Saved tabs alone no longer count, so a launch with two hosts
boots only the focused one.
- After a confirmed stop (wsl --shutdown, WSL update) the host is parked. Liveness no
longer reboots it even when it is visible, and polls get "<distro> was stopped"
instead of a boot. Re-focusing the host, Connect, or the distro running again lifts it.
- Liveness recovery always needs a confirmed-running distro, so a distro that stops
mid-recovery is never booted again.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl-host): launch boots one of two hosts; polls never boot; lost contact never parks
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): only a focus entry or a user action boots a WSL host (E9 review)
Review of #33838:
- Re-focus never lifted a park: a host focused earlier stayed in the visible set, and
the renderer skips unchanged reports. The renderer now sends a separate focus entry
(focusHost) each time the user switches to a workspace on a WSL host, including the
launch restore; only that, or Connect, lifts a park and may boot.
- Runtime calls could boot: ensureForRuntimeCall connected any visible, unparked host.
It now reads the host's reachability first: a confirmed-stopped distro parks at once,
an unreadable running list refuses, and only a distro confirmed running is
reconnected (for visible work). Visible work itself never connects anything.
- Turning WSL hosts on no longer boots every visible host, and focus isn't recorded
while they're off; the window re-reports its focused host instead.
- Each window's visible work is kept apart and unioned, so one window can't drop
another's.
- wakeForAutomation/isConnected move to the automation PR, which uses them.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): a poll waits for liveness's verdict right after an exit (E9 re-review)
Right after `wsl --shutdown` WSL can still list the stopping distro as running (the
supervisor waits and re-reads for exactly this). A poll's cold probe then read
'unreachable', reconnected, superseded the pending distro-stopped verdict and booted
the distro again. The supervisor now reports when it is settling (a verdict in
progress, or a watch/holder exit within the last few seconds), and a runtime call
refuses instead of reconnecting then; the verdict parks the host as before.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl-host): a new supervised entry starts with no recorded exit
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
OMP's ACP session advertises commands it handles itself (e.g. /fast), but
native chat claimed them as host-only TUI commands and refused them as
unavailable. Commands the running session reports in its slash menu are now
left unclaimed so they send through, on desktop and mobile. Mobile reads the
session command list once in the native-chat lane and shares it between the
send path and the composer menu.
* fix(forge): skip PR refreshes for a WSL host that is off, and say so
E9 connect policy, part 3. PR status for a workspace on a WSL host is fetched through
the host, and a poll never boots it. While the host isn't ready, the visible-row
refresh skips it (the row keeps its last badge and the existing "host disconnected"
mark), a direct PR refresh keeps the last answer and records a 'host-off' skip, and
the Checks panel says the host is off and to reconnect it. The cached-field half of the
refresh candidate moves to its own helper to keep the lookup file in bounds.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(forge): a WSL host that goes off keeps its last PR badge and records host-off
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(forge): only a stopped or closed WSL host is "off"; mark row badges as last known (E9 review)
Review of #33840:
- Connecting, reconnecting and unverifiable hosts were treated as off. Only a
confirmed-stopped (or parked) host, or one closed with WSL hosts turned off, is off
now; anything else lets the call proceed or fail as usual. A status change re-runs
the visible refresh, so rows refresh as soon as the host turns ready.
- Row badges now carry the stale mark too: the card's review status gets the hover
card's last-known treatment and "Last known status" in its label, and the hover
card's reference rows are stale and not fetched while the host is off.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(forge): build the host-off PR refresh test on the shared GitHub slice harness
Drops the copied store and seed casts.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The Team, Lead, Members and Labels popovers in the Linear new-project
dialog are portaled outside the dialog, so its scroll-lock cancelled
native wheel input over their inner max-h-64 lists. Opt their
PopoverContent into the shared wheel shim via wheelScroll, and move the
p-1 padding onto the children so the layout is unchanged.
Fixes#16412
Co-authored-by: Neil <neil@stably.ai>
Replace mistranslated subagent summaries ("kicked off" rendered as "fired"/
"kicked out", untranslated "Ran") and add missing measure words to the zh
tool-run clauses. Leading tool-run clauses are now joined with a translated
runListSeparator so CJK locales use 、 instead of an English comma.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): say why SSH failed when Connect never reaches the host
When the SSH session itself could not open (key rejected, port refused,
host not answering, host key not trusted), Connect on a host Orca had not
set up yet said "Orca couldn't start its server on this host" and offered
a plain SSH terminal that could not work either. Errors from opening the
SSH session are now marked where they are dialed, and a setup that fails
on one ends the connect with SSH's own reason. A held move keeps its
status. The connect-failure toast also drops Electron's IPC prefix.
* fix(ssh): lead an SSH connect failure with what to do about it
#33928 shows SSH's own reason when Connect never reaches the host. Raw
reasons like "connect ECONNREFUSED 10.0.0.1:22" or "Timed out while
waiting for SSH authentication" still leave users guessing. A failure
from opening the SSH session is now published with a next step for the
kinds users can act on (host key mismatch, rejected sign-in, refused
port, unknown host name, no route, timeout), and SSH's words follow in
parentheses. The connect-failure toast reads the same published text.
With the experimentalConnectors setting on and the desktop signed in to Orca, the desktop keeps one long-poll request open to the Orca Cloud connector and hands each delivery to the existing connector code that starts or talks to an agent. Each delivery is confirmed twice (received, then its result), and the agent's turn and prompt events are reported back. The desktop authenticates with a 5-minute connector token from the Orca sign-in service, follows the relay's start/stop lifecycle, and stops on sign-out. Its hello lists Slack as the one source it accepts. Off by default with no settings UI.
A host whose move to its Orca server was refused over saved state (an
enabled SSH automation and its runs, stale workspace details, unsupported
saved tabs) stayed in error on every Connect. Move anyway, which connects
it and leaves those items on this computer, was only in the card's
overflow menu, so the host looked stuck. The card now offers Move anyway
next to its refusal, as it already does for Recover server.
Refs #29083.
A connector conversation now names its source (slack, discord or linear), and a posted reply reports a neutral messageId. Each machine's hello lists the sources it accepts, and the cloud only routes a Slack conversation to machines that list Slack. Machine events from other sources are filtered out where they arrive, and a reply for a non-Slack conversation is refused, so a Discord or Linear conversation can never post into a Slack thread with the same id. The unused turn-bound cancel fields are removed (they return with Stop). Inert: no shipped desktop uses the contract, and Slack is off unless configured.
sanitizeWorkspaceStatusLabel cut labels with slice(0, 32), which could keep
only the high surrogate of an emoji straddling the limit and render U+FFFD.
Use the existing surrogate-safe sliceAtCodeUnitLimit helper instead.
Closing the Agent Dashboard drawer or workspace board with Escape still
forwarded the key to a focused xterm, because xterm ignores
defaultPrevented. Stop propagation only when the target is the xterm
helper textarea so other fields keep their own Escape handling.
When an imported or cloned folder's derived project id does not match the
selected project, the error now names the id the folder resolves to (for
example github:owner/repo) instead of a generic mismatch message. Host-local
ids and identical ids keep the generic message. The setup-existing-folder
help notes which ids --project accepts.
Fixes#23528
Co-authored-by: Neil <neil@stably.ai>
When a Slack-started agent asks for approval or asks one pick-one question, the thread gets a card with one button per option. Only the person who asked for the work can answer; anyone else is told so privately. The answer travels through the existing inbox and delivery path, and the card closes once answered or no longer pending. Other question formats (grouped, pick-several, typed answers) still point to Orca; a follow-up adds them. Connector service only; Slack is off unless configured.
setActiveWorktree's no-op guard now compares activeWorkspaceKey with the key
derived from the target worktree, so reselecting the current worktree repairs
a stale key instead of returning early.
Session hydration always derives activeWorkspaceKey from the restored
activeWorktreeId instead of trusting a persisted key that may name another
workspace, which kept the wrong sidebar row highlighted after restart.
Fixes#14474
Co-authored-by: Neil <neil@stably.ai>
An Orca launched from inside a Claude Code session inherits CLAUDECODE,
CLAUDE_CODE_EXECPATH, and CLAUDE_CODE_ENTRYPOINT alongside the child-session
stamps #9961 already strips. Every pane then looks nested to Claude Code and
to agent-aware tools, and the inherited entrypoint overrides Claude's own
detection. Add them to the existing inherited-stamp deletion list so every
local, daemon, and relay spawn drops them while explicit pane values win.
Closes#9155
Co-authored-by: Neil <neil@stably.ai>
* fix(claude-accounts): restart System default sessions on the outgoing login when switching
A Claude account switch only restarted sessions in the outgoing account's
own folder. A session on System default (~/.claude) signed in to that
account's exact login, as older Orca's copied login leaves it, was skipped
silently. Match it by email and organization, read by main at switch time;
never compare managed folders by login. Sessions in the user's own
CLAUDE_CONFIG_DIR are no longer treated as System default, and legacy
accounts match their current launch folder.
The ask dialog groups sessions into Running on X, Not on X and Can't move,
and the Always restart toast names sessions it left and offers Review.
* refactor(claude-accounts): simplify the switch login match, scan and toast styling
Inline the single-use login adapters, carry each pane's foreground result with
its row, keep the header-pin listener local to its effect, move the inline
toast action classes to the Sonner module, and stop the Review dialog
promising a restart for sessions that cannot move.
Each terminal tab and the Floating Workspace own separate PaneManagers, each
with its own activePaneId. The hover gate skipped any pane that was already
its manager's active pane, so a single-pane main terminal never took focus
back from the floating terminal (or vice versa). Refocus an already-active
pane when DOM focus sits in another terminal pane; focus outside panes
(chat, editor, inputs) is still left alone.
Fixes#29912
Co-authored-by: Neil <neil@stably.ai>
Grouping a GitHub Projects view by a NUMBER field sorted group headers as
text (1, 10, 2, 8). Number values now carry their value as the group order
hint and the NUMBER comparator sorts by it, falling back to label. Stale
non-number values use the finite unknown-option sentinel so mismatched
single-select/iteration comparators stay consistent.
Fixes#19395
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Usage caches and their source sidecars hold session ids and project
paths, but their durable temp files were created with the process
default mode, so a replace under umask 022 published them as 0644.
Thread an optional creation mode through writeFileDurable /
writeFileDurableIfCurrent and pass 0o600 from UsageCacheSnapshotWriter
and the usage source sidecar writer. Other durable writers are unchanged.
Fixes#31026
Log-only, Cloud Run director only. Each runtime line gains per-window deltas of the instance's /proc/net/snmp TCP counters (segments in and out, retransmits, errors, resets), so a stall can be checked against packet re-sends. Unreadable or reset windows are omitted.
The connector cloud now assigns each machine connection's revision instead of trusting the desktop's saved number. Acks, events and polls from an older connection get 409 hello_required, and the desktop announces itself again. Also records the cloud's request size limit in the shared contract and adds the current turn to the machine snapshot so a stale turn end cannot clear a newer prompt. Connector service only; not deployed to production.
* Apply Codex Ask permissions at each fresh turn
* fix: admit fresh Codex input with current host permissions
* fix(native-chat): finish cancelled Codex input under its owner
* fix(native-chat): preserve mobile type boundary for input finalization
* test(native-chat): bound input finalization work at scale
* Fix cancellation result fences and exercise host proofs
* Fix input finalization type contracts
* Remove obsolete Portuguese permission description
* Preserve proven Stop outcomes during input finalization
* Preserve input handover proofs with session-ending Stop
* Preserve pending input recovery before lifecycle cancellation
* Assert one recovery card across overlapping close requests
* Preserve unwritten inputs across shared-agent Close preparation
* Narrow cancelled dispatch to its rejected outcome
* Import Codex app-server types from their colocated modules
* Use standard Ask policy for fresh Codex chat input
* Deliver applied Codex permission reports to the host
* Cover applied reports with pending settlement waiters at scale
* Fix settlement waiter timer portability on mobile
* Keep pre-send exit failures with their original input result
Adds the Slack side of the Orca Cloud connector: verified Slack event ingress, owner-only routing, thread starts held in the shared inbox, a post queue for replies and status, and agent replies into the thread. Off unless the connector is configured with Slack secrets; no production deployment.
* fix(sidebar): show chat-only workspaces as active before the first message
A workspace whose only tab is a native chat showed the grey Inactive dot
until a message was sent, because the dot counted only live terminals and
browser tabs. Count a chat that is not explicitly slept, the same rule the
sleeping-workspace check already uses, in the sidebar cards, the parent
picker and the Cmd+J switcher.
* test: bound chat status work on unrelated store writes
* test: correct chat status contract formatting
* test: use a fixed clock for chat status fixtures
* test: prune obsolete chat status clock allowance
* test: complete sidebar status store fixtures
Director only. When one pooled connection is far slower than its peers (median over 25 ms and 3x theirs, or third-slowest statement in 60 s over 200 ms and 5x every peer's slowest), it is destroyed on release and the pool dials a fresh one. At most one per pool per 10 s; never mid-transaction; no change in connection count. Fixes the 10-26 director stalls where one connection stalled the sticky lane.
The bundled orca-cli skill guide never mentioned `terminal read --screen`,
so agents onboarded from it used the stream read on repainting TUIs and got
stacked fragments. Add a --screen example plus the stream-vs-screen and
--screen/--cursor rules, and realign the root help usage lines for
terminal read and terminal split with their command specs.
Fixes#15856
When the floating workspace panel had focus, Ctrl+Tab (tab.previousRecent)
and the recent-tab switcher resolved tabs from the main workspace, so the
shortcut either did nothing or switched main-workspace tabs. Route the
previous-recent command and the RecentTabSwitcher to the floating
workspace's group when the panel is focused, and share the recent-tab
lookup via getPreviousRecentTab. Floating simulator tabs are now included
in the visible-tab set used for cycling.
Fixes#33134
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Match Terminal only redefined --foreground on the sidebar surfaces, but
inherited text color comes from body's already-computed color, so labels
without their own color class (e.g. project names) stayed the app
foreground. Set color directly on the surface as well.
Fixes#29151
Co-authored-by: Neil <neil@stably.ai>
Pr1pandBrennan Benson
Samuel VilaandBrennan Benson
Kelvin Amoaba
lvxindaandBrennan Benson
Chen ShiandNeil
OrcaWinandm4air
Jinwoo Hong
hjkwonandNeil
apeppppandNeil
shahidbeig-a11yandNeil
Yunqian FanandNeil
BAEKSEUNGHYEONandNeil
Yoshito Ohata (sheat)andNeil
monemandNeil
ka2umaz
Jason Brashear
Nikolas SapalidisandNeil
Serhii SavenkoandNeil