After running `gh auth refresh` in a terminal, users had to manually
reload Orca to pick up the new token state. Surface a one-click Reload
button in both the block and banner variants of GhAuthErrorHelp.
Co-authored-by: Orca <help@stably.ai>
Aligned shouldUseMacOSNativeProvider gate with send-time check by using resolveMacOSComputerUseExecutablePath, restoring symmetry so RPCs no longer throw when only the bundle exists.
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
* Fix terminal output lag from background panes
Co-authored-by: Orca <help@stably.ai>
* Fix scheduler edge cases: replay ordering, foreground gate, dispose race
- Drain queued background bytes before replay/snapshot writes so the
scheduler's deferred drain cannot land older bytes on top of the replay.
- Gate foreground on isVisibleRef only — visible-but-inactive split panes
should not be throttled; only hidden panes (background tabs) should be.
- Catch writes to disposed terminals in the drain loop so a late PTY ping
after pane.terminal.dispose() drops the dead entry instead of crashing
the scheduler for other panes still draining.
- Update App.tsx comment to drop stale agentStatusEpoch reference; epoch
no longer ticks on every PTY event after the agent-status slice change.
- Guard e2e Math.max(...drainWrites) against empty array to avoid a
vacuous pass.
Co-authored-by: Orca <help@stably.ai>
* Fix flaky e2e: put background marker after burst payload
The terminal-output-scheduler e2e test asserts that a background marker
appears in the terminal buffer after switching to that tab. getTerminalContent
returns only the last 4000 chars of the serialized buffer; with the marker
prefixed before a 50000-char x-burst, the marker is always evicted and the
final assertion always fails.
Move the marker to the END of the burst so it survives tail truncation. The
burst itself remains the same length, so the chunked-drain invariants the
test exercises are unchanged.
Co-authored-by: Orca <help@stably.ai>
* Add terminal scheduler regression coverage
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* feat(ssh): stream fs.readFile to lift 10MB SSH preview cap (#1095)
Replaces the single-shot fs.readFile path on the SSH relay with a
push-style stream protocol modeled on VS Code's readFileStream.
Wire shape:
- fs.readFileStream request returns metadata (streamId, totalSize,
isBinary, mimeType, chunkEncoding, resultEncoding, optional empty)
- Relay pumps fs.streamChunk notifications (256 KB base64 chunks) and
ends with fs.streamEnd or fs.streamError
- Client cancels via fs.cancelStream notification
Invariants:
- Max 16 concurrent streams per FsHandler (TooManyStreams)
- Client clamps totalSize against caps before allocating
- Sequence-number defense against out-of-order/missing chunks
- Subscribe-before-await with frame queueing until streamId is known
- Pump cleans up registry+handle in finally; disposeAll aborts before
release so in-flight reads exit cleanly instead of EBADF
- Empty files short-circuit (no streamId, no handle open)
Compat:
- New client tries fs.readFileStream first, falls back to legacy
fs.readFile on JSON-RPC -32601 (with once-per-session warn log)
- Bumps MAX_PREVIEWABLE_BINARY_SIZE 10 MB to 50 MB to match local
Tests: 91 streaming tests across relay, client, mux, integration.
Co-authored-by: Orca <help@stably.ai>
* test(ssh): wait for streamEnd instead of fixed flush() in stream test
Why: the binary-streaming test relied on 5 setImmediate ticks to drain
the pump, which is racy on slower CI runners (each handle.read is async
I/O). Swap to a deadline-bounded waitFor(streamEnd) so the test is
deterministic regardless of scheduler latency.
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): preserve small binary detection in streamed reads
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): rebind file watcher when connection id hydrates
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): refresh explorer for update-only file creates
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): recompute file watches when repo connection changes
Co-authored-by: Orca <help@stably.ai>
* Revert "fix(ssh): refresh explorer for update-only file creates"
This reverts commit 7c3c683cd0.
* fix(ssh): install relay watcher dependency
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): enable TCP_NODELAY on ssh2 client to eliminate per-keystroke typing lag (#1660)
ssh2 leaves Nagle's algorithm on by default. For single-byte keystrokes
through a remote PTY, Nagle interacts with the kernel's delayed-ACK timer
and adds up to ~40 ms per keystroke — visible as the typing lag reported
in #1660. OpenSSH's `ssh` client sets TCP_NODELAY whenever a PTY is
allocated; this change mirrors that on the ssh2 client right after the
`ready` event in doSsh2Connect, covering both initial connect and
auto-reconnect.
Proxy-command / proxy-jump connections (where ssh2's underlying socket
is a custom Duplex over a child-process pipe) are a no-op by design,
gated by the public Client.setNoDelay()'s own type guard. A discriminating
log line records which path each connect took.
Tests cover initial connect and a full reconnect cycle to guard against
the regression class "Nagle is re-enabled because someone refactored
only the initial connect path."
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): bound relay-lost reconnect with exponential backoff
When the relay exec channel keeps dying (e.g. a remote-side bug closes
every fresh --connect channel right after handshake, or a stale bridge
keeps being replaced), the unguarded _onRelayLost handler reconnects as
fast as the network allows — spawning relay deploy attempts in a tight
loop until the user force-quits. Each iteration spawns a fresh ssh2 exec
channel, hammers sshd's MaxSessions counter, and floods the renderer
with state churn.
Add per-target exponential backoff (500ms → 15s, capped at 6 attempts)
so the loop terminates instead of running forever. After the cap the
session goes to 'error' state with a 'Relay channel kept dropping.
Please reconnect.' message — visible in the renderer instead of an
invisible failure where typing in remote terminals just stops working.
Successful 'ready' resets the attempt counter only if the session
stabilized for >= 5s; faster flaps preserve the counter so a flaky
remote backs off rather than retrying indefinitely on every brief
ready→lost cycle.
Backoff state is cleared on explicit disconnect, on session replacement
during reconnect, and on connect failures, so a real reconnect attempt
after backoff exhaustion always starts from zero.
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): detect stale relay daemons via running-version marker
The on-disk relay version check compares local .version against the
remote .version file in the relay dir. A daemon launched by an earlier
deploy keeps running its in-memory copy of the OLD relay code, so when
the client later rewrites relay.js + .version on disk and bridges in
via --connect, the new bridge process drives a stale daemon. Protocol
or behavior changes between the two versions then tear down the
channel in a tight reconnect loop (observed against PR #1672 on a
daemon predating that change).
The daemon now writes its running version into a .running-version
sidecar at startup, anchored to the relay-script directory rather than
process.cwd() so test spawns cannot pollute the repo root. Before
attaching to an existing socket, the client probes that marker and,
on mismatch with the locally-deployed .version, kills the stale
daemon (TERM only, never KILL) and falls through to a fresh launch.
Conservative defaults: when either marker is unreadable, attach so
older builds keep their live PTYs.
Co-authored-by: Orca <help@stably.ai>
* Revert "fix(ssh): detect stale relay daemons via running-version marker"
This reverts commit e58acf07c0.
* fix(ssh): isolate relay versions via per-version install dirs and wire handshake
The relay's previous single-dir layout (~/.orca-remote/relay-v0.1.0/) let
the deploy step rewrite relay.js in place while a daemon was still loaded
in memory at the previous version. New clients then drove that stale
daemon, surfacing as a reconnect loop (issue #1660 follow-up) and the
field failure observed against an 8-day-old daemon on openclaw.
Switch to a VS Code-style versioned layout where each (RELAY_VERSION +
content-hash) bundle installs into its own directory and is never
mutated after install. A v2 client's --connect socket path is rooted in
relay-${v2-hash}/ and structurally cannot reach a v1 daemon's socket.
Defense-in-depth: the daemon now reads exactly one Handshake-typed frame
on each newly-accepted Unix socket before attaching the JSON-RPC
dispatcher (mirrors VS Code's remoteExtensionHostAgentServer.ts:340).
Mismatch closes the socket; the bridge exits with code 42; client maps
that to a typed RelayVersionMismatchError and skips the relay-lost
backoff loop instead of retrying through 6 attempts.
Other deploy hardening:
- atomic mkdir-based install lock with stale-lock recovery serialises
concurrent first-installs of the same version
- .install-complete sentinel distinguishes a finished install from a
crashed-mid-install partial that should be retried
- gcOldRelayVersions removes unreferenced sibling dirs (allowlist regex,
skips locked or incomplete dirs, skips dirs with a live socket)
- readLocalFullVersion fails fast on a missing/empty local .version
rather than silently falling back to a path where a daemon from a
different code generation may already be running
Includes a cross-version isolation test that fails any future refactor
which collapses the per-version layout back to a shared dir.
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): harden relay versioning per review feedback
Address must-fix and should-fix findings from the parallel triple review of
26d1666e:
- Surface RelayVersionMismatchError to ssh.ts on initial establish() (not
just reconnect), so the user sees the typed terminal error instead of
silent retry on first connect (#13).
- Give the sentinel timeout a 500ms grace window for the close handler to
deliver exit-42, so a slow remote does not misclassify a wire-handshake
mismatch as a generic timeout (#D11).
- Drain the handshake decoder's residue at the handshake -> dispatcher
transition on both daemon and --connect sides; pipelined frames that
were coalesced with the handshake are now forwarded into the dispatcher
/ stdout instead of silently dropped (#A1, #A2).
- Reset the install-lock acquire timer after a stale-lock recovery so a
single post-recovery race does not immediately exhaust the budget (#E14).
- Treat a stale install-lock as recoverable in the GC pass when
.install-complete is present (covers an interrupted finalize where the
rm-lock failed) (#E15).
- GC legacy relay-v\d+\.\d+\.\d+ install dirs whose daemons have died,
now that .install-complete is no longer required for them (#12).
- Resolve symlinks in readLaunchVersion() so a daemon launched via a
symlinked entry script still reads .version next to the real file (#G21).
- Flush stderr before exit-42 in --connect handshake mismatch path so the
diagnostic line reaches the client before the process tears down (#C8).
Tests:
- Round-trip handshake over a real Socket pair: matching version, mismatch
exit-42, leftover bytes preserved on both sides when frames are
coalesced with the handshake.
- waitForSentinel exit-42 -> RelayVersionMismatchError, exit-1 -> generic.
- SshRelaySession terminal-error callback fires on both establish() and
reconnect() when deployAndLaunchRelay throws RelayVersionMismatchError.
- acquireInstallLock concurrent BUSY -> OK polling, stale-lock recovery
with reset timeout window, and fresh-lock timeout failure path.
- gcOldRelayVersions stale-lock-with-complete branch, legacy-dead path,
legacy-alive path; existing locked-test asserts fresh-lock now keeps.
- Cross-version isolation test now asserts a blanket invariant that every
v1-referencing command from a v2 deploy is a read-only liveness probe.
Lint and typecheck clean across all 3 tsconfigs; 426 SSH/relay tests pass.
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): bypass npm init for content-hashed relay dirs and harden install probe
The versioned-install dirs land at `relay-${version}+${hash}/` (e.g.
`relay-0.1.0+07994a7870e1`). npm 11 / Node 26 reject the `+` in derived
package names and `npm init -y` exits 1 — silently, since both stderr
and the failure landed inside the `2>/dev/null && ...` chain. The catch
swallowed the throw, `.install-complete` was written anyway, and every
reconnect surfaced 'node-pty is not available' at first pty.spawn.
Sidestep `npm init` entirely: SFTP-write a hardcoded minimal
package.json (`name: orca-relay`, `type: commonjs`) and run
`npm install node-pty` directly. `type: commonjs` pins the module
system against future Node default flips or remote-side .npmrc overrides.
Also harden the install path against the same class of silent failure:
- npm install errors now propagate (no more `.install-complete` on hard
fail; future reconnects retry instead of stranding the user)
- Replace the weak `test -d node-pty` post-install probe with
`node -e 'require("node-pty")'` so built-but-unloadable installs
(missing prebuild, wrong arch, broken native binding) surface clearly
- Add a session-level error handler on the SFTP write so a torn-down
session rejects the promise instead of hanging until enclosing timeout
Separate fix: add `for-each-ref` to the relay's git subcommand allowlist.
Client code (`src/main/git/repo.ts` ref-search and worktree-listing)
calls `git for-each-ref` over SSH; the relay was rejecting it. The
`--shell`/`--python`/`--perl`/`--tcl` format flags only control output
quoting (no eval) and the relay invokes git via execFileAsync (no shell),
so the read-only allowlist treatment matches `rev-parse`, `log`, etc.
Co-authored-by: Orca <help@stably.ai>
* comment(ssh-relay): TODO link to #1693 for VS Code-style pre-bundled node-pty
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): harden node-pty install probe and tighten review-fix tests
Round-3 review fixes on top of 963f56d7.
deploy.ts:
- Replace endsWith('OK') with includes('ORCA-NPTY-PROBE-OK'). Node can emit
deprecation/experimental warnings to stderr after our stdout 'OK' write,
and 2>&1 would push them past 'OK' producing false NPTY-MISSING warnings.
A unique sentinel survives any trailing stderr noise.
- Switch sftpPkg/ws .on -> .once for error/close. A late session 'error'
after the promise had already settled would otherwise become an unhandled
EventEmitter error and crash main.
- Trim per-block comments to 1-2 lines per AGENTS.md (was 7-9).
Tests:
- Pin the BEFORE-ordering contract: SftpWriteCapture now records the count
of execCommand calls observed at the moment ws.end() ran for each path,
and the test asserts that count <= the index of npm install. Catches a
future Promise.all-style refactor that would still pass final-state checks.
- Strengthen the SSH-channel-failure test: assert the rejection actually
came from the probe call (not an earlier exec) by finding the probe
invocation in mock.calls. Also assert NPTY-INSTALL-FAIL is NOT logged
(channel failure must not be conflated with install failure) and that
abandonInstall was called so the lock is released.
- Fix misleading clearAllMocks comment: it claims to wipe mockReturnValue,
but actually clearAllMocks only resets .mock.calls. Re-priming was
defense-in-depth, not a correctness requirement.
Validator:
- Add for-each-ref negative cases (--git-dir, --output, --work-tree) to the
global-denied-flags it.each. The first round of for-each-ref enablement
trusted that the post-subcommand GLOBAL_DENIED_FLAGS check applied; this
pins it so a future allowlist refactor that bypasses the global check
fails loudly.
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): split node-pty probe into test-d guard + load-test
Round-4 review fixes for the install probe in installNativeDeps:
(1) test -d guard runs before the load-test. If the install dir vanished
between npm install and probe (concurrent rm, fs unmount, permission
flip), the deploy now throws and the next reconnect retries fresh —
previously the cd failure flowed into '|| echo MISSING' and we'd
write .install-complete, stranding the user in degraded mode.
(2) Load-test discards stderr (2>/dev/null) so customized .bashrc
output (NVM init, conda greetings, etc.) can't pollute the sentinel
match. The shell-level '|| echo MISSING' is preserved so SSH-channel
rejections still propagate as exec errors, distinct from require
failures which exit the node process nonzero.
(3) PROBE_OK is passed via process.argv[1] so the JS literal stays
trivial regardless of future sentinel characters.
Test changes:
- New 'dir-gone' probe mode in makeExecResponses
- New test pinning that vanished-dir throws (not silent MISSING)
- SSH-channel test now asserts probeCallIdx > npmInstallIdx
- cross-version-isolation feeds an extra '' for the test -d slot
Co-authored-by: Orca <help@stably.ai>
* fix(ssh): simplify node-pty probe and harden test ordering pins
Round-5 review fixes for installNativeDeps:
Production:
- Drop redundant test -d guard. `cd ${dir} && (...)` short-circuits on
cd-failure (dir-vanished) and propagates as exec reject already; the
separate guard added a round trip without preventing anything.
- Capture probe stderr to a per-deploy file rather than 2>&1 or 2>/dev/null.
.bashrc noise can't pollute the sentinel match, but the require() error
message is preserved in the [NPTY-MISSING] log breadcrumb so bug reports
point at the real cause (e.g. GLIBC version mismatch).
- Mirror the install command's PATH (export PATH=${binDir}:$PATH) so any
future require-time child_process call resolves the same node binary
used during install.
- Add platform tuple to [NPTY-MISSING] and [NPTY-INSTALL-FAIL] logs for
triageable bug reports without asking users to dig out their arch.
- Trim probe comment per AGENTS.md (why-only, no mechanism narration).
Tests:
- Pin full installNativeDeps ordering: npm install < chmod prebuilds <
probe. Catches refactors that probe before install or move chmod after.
- Pressure-test .includes(PROBE_OK) survives bashrc/MOTD noise prefixed
to probe stdout (corporate banner / NVM init / conda greeting case).
- Pressure-test MISSING detection survives Node deprecation warnings
prepended to the MISSING token.
- Pin platform tuple appears in [NPTY-MISSING] log.
- Pin finalizeInstall called exactly once + abandonInstall not called
on happy paths; reverse on failure paths.
- Strengthen dir-gone test: assert probeIdx > npmInstallIdx so a refactor
that swaps order doesn't silently let the test pass on its own injected
error string.
- New probeStdoutOverride option in makeExecResponses for shell-noise
injection tests.
Cross-version-isolation: dropped obsolete test -d slot, added rm-stderr
cleanup slot to match the new probe shape.
eslint-disable max-lines on both files with rationale (pattern used widely
in this repo for cohesive single-responsibility modules).
441/441 tests pass; lint clean; typecheck clean. Probe shape verified
end-to-end on real remote.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix(worktree): preserve user push.autoSetupRemote, include path in warn
- Probe push.autoSetupRemote with `git config --get` before writing so a
deliberate user value at any scope (local/global/system) is preserved.
- Include worktree path in the warn log for failed config writes.
- Add test pinning the preserve-existing-value behavior.
- Remove stray 00-review-context.md committed during review tooling.
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix(worktree): narrow config --get error handling, tighten test asserts
Treat only exit code 1 from `git config --get push.autoSetupRemote`
as "key unset". Other read failures (corrupt config, locked file,
parse error) now re-throw to the outer warn handler instead of being
silently treated as unset and overwriting whatever value the user
actually has.
Also: add test for the non-unset read-error path; convert the
"preserves existing value" test from `.some()` predicates to a
full-array `toEqual` matching sibling-test style; explicitly mock
`config --get` (with code: 1) in the sparse-failure rollback test
so it exercises the intended branch instead of the helper's empty-
stdout fallthrough; document in the design notes that
addSparseWorktree's rollback intentionally does not unset
push.autoSetupRemote.
Co-authored-by: Orca <help@stably.ai>
* test(worktree): pin --get-empty-stdout and worktree-add-fail invariants
Why: addWorktree's post-create config probe has two ordering
invariants worth pinning so a future refactor can't silently
regress them: (1) `git config --get` succeeding with empty stdout
still counts as "already set" so we don't overwrite an explicit
empty value, and (2) the entire config block is skipped when
`worktree add` itself rejects.
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* docs(worktree): cross-ref local↔SSH addWorktree, clarify SSH-host git version, add empty-stdout parity test
JSDoc on local addWorktree now flags the push.autoSetupRemote side
effect; both paths cross-reference each other so the next change keeps
them in lockstep. Relay comment clarifies that the git version that
matters is the SSH host's, not the client's. Adds the missing
empty-stdout-as-already-set parity test on the relay side.
Co-authored-by: Orca <help@stably.ai>
* chore: remove 00-review-context.md from PR
Stray file from local review workflow; should not ship in this PR.
Co-authored-by: Orca <help@stably.ai>
* chore: remove worktree-ssh-no-track-parity.md from PR
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* feat(agent-dashboard): persist hook status across Orca restart
Hydrates the hook server's per-pane lastStatusByPaneKey from
userData/agent-hooks/last-status.json before binding the HTTP listener,
mirrors mutations to disk via a 250ms trailing debounce, and flushes
synchronously on stop(). Renderer dismissals fan out a new
agentStatus:drop IPC so the on-disk file evicts the entry and a
relaunch cannot resurrect it. Adds a bounded bootstrap queue in
useIpcEvents so events replayed by setListener() during window creation
are not dropped while App.tsx is still hydrating tabsByWorktree.
Gated on settings.experimentalAgentDashboard. Done, blocked, and quiet
working rows now all survive across restart.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-dashboard): harden hook persistence IPC and gate-off deletion
Address review findings on the retention-restart branch:
- Wrap agentStatus:getSnapshot and agentStatus:drop IPC handlers in
try/catch so a throw cannot surface as an unhandled invoke rejection
(silent startup-hydration failure) or crash main from a fire-and-
forget listener.
- runStatusPersist no longer permanently suppresses gate-off deletion
retries on transient unlink errors (e.g. EPERM); deletedOnDisable
now flips only on success or ENOENT.
- Tighten tests: stale-version-hydrate now asserts the warn message
content; getSnapshot test uses toEqual; drop-handler test rejects
null/{}/[] in addition to the prior bad inputs.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-dashboard): bound on-disk hydrate growth and reject tabId/paneKey drift
- Drop hydrate entries older than 7 days (HYDRATE_MAX_AGE_MS) so stale
rows from worktrees archived weeks ago do not pile up forever. PTY-
teardown eviction handles closed panes; the TTL covers daemon-restored
PTYs that never re-attach and crash-recovery paths.
- Reject hydrate entries whose `tabId` field diverges from the paneKey's
tab segment. Cheap defensive add against future renamer/shape drift.
Doc updated to move TTL out of the follow-ups list (now in scope).
Tests: new "drops hydrate entries older than the TTL cutoff" and "drops
a hydrate entry whose tabId disagrees with the paneKey prefix"; existing
hydrate fixtures now use a `recentTs()` helper instead of fixed 2023
timestamps.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-dashboard): post-review polish on hook status persistence
Apply review-fix corrections on the agent-dashboard restart-persistence
work:
- Split dropStatusEntry from clearPaneState so renderer-driven dismiss
IPC no longer wipes lastPromptByPaneKey/lastToolByPaneKey for a
still-alive pane.
- Validate paneKey shape at the IPC boundary (isValidPaneKey).
- Let getSnapshot errors propagate instead of silently returning [] —
matches the renderer's existing .catch and avoids masking a broken
persistence path.
- Trust main's authoritative timing.stateStartedAt unconditionally on
same-state pings; fall back to existing only when timing is absent.
- Use strict < on the snapshot/live updatedAt guard so two events in
the same millisecond don't drop the second one (a <= guard regressed
two existing slice tests).
- Don't reset snapshotRequestedForReadyWindow in the catch handler;
combined with the per-store-update subscriber it would retry-storm
on persistent IPC failure.
- scheduleStatusPersist now resets the timer on each call (true
trailing-edge debounce) instead of leading-edge throttle.
- Fix doc references that named clearPaneState in dismiss/IPC context
where the implementation uses dropStatusEntry; add type-level JSDoc
on AgentStatusIpcPayload.
109/109 in-scope tests pass.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-dashboard): clean stale on-disk entries during hydrate
- Defensive `lastStatusByPaneKey.clear()` at top of `hydrateLastStatusFromDisk` keeps repeat-start() calls from silently merging prior-session state.
- When sanitize drops entries (drift, TTL, schema), log a single `[agent-hooks] last-status hydrate dropped N entries (kept M)` warn and synchronously rewrite the file. Pre-fix, stale entries stayed on disk until a fresh hook event triggered a debounced write — users who hadn't run an agent in 8+ days would re-drop the same entries every cold boot.
- Prime `lastWrittenJson` from the raw on-disk bytes (instead of re-serializing) when hydration is lossless — robust against future shape drift in `serializeStatusFile`.
- `LAST_STATUS_FILE_VERSION = 2` comment now records why v1 was skipped (in-flight branch shape).
- IPC test mock uses `vi.importActual` for `isValidPaneKey` so it stays in sync with the real validator.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-dashboard): persist acknowledgedAgentsByPaneKey across restart
Without this, agent rows the user already visited come back bold every relaunch now that the rows themselves survive restart (per docs/agent-dashboard-retention-restart.md). Hydrate sanitizes input field-by-field (rejects null/non-object/array, prototype-pollution keys, non-finite/non-positive values) and applies a 7-day TTL paralleling HYDRATE_MAX_AGE_MS in agent-hooks/server.ts so hard-quit/crash paths can't grow the persisted map forever.
Co-authored-by: Orca <help@stably.ai>
* docs(agent-dashboard): drop in-tree retention/restart design doc
Doc was a working artifact for this branch; the rationale lives in commit
history and the comments next to the persistence/hydrate code. Scrubs the
three call-site references that named it.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
H2 (and exported H1) headings rendered with a thin border below them;
this removes the rule so headings sit flush with following content.
Co-authored-by: Orca <help@stably.ai>
When the editor is disposed during a parent render, the dispose
listener's setState re-runs this effect and triggers a synchronous
root.unmount() inside React's commit work loop, producing React 19's
"Attempted to synchronously unmount a root while React was already
rendering" warning. Snapshot the roots and clear bookkeeping
synchronously, then unmount via queueMicrotask — matches the
deferred-unmount pattern already used in the diff-pass effect.
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix(updater): repair retry-state correctness in release-transition fallback
Address issues surfaced by automated multi-agent review on the 30s
silent-retry + 1h backstop introduced in this branch:
- forceLaunchUpdateCheck now OR-merges userInitiatedCheck instead of
overwriting it, so a manual click during the 30s wait survives the
timer's launch (the click's upgrade was being clobbered).
- The .catch path mirrors the same OR-merge by reading the live module
flag, so a synchronous throw or pinPrereleaseFeed rejection during the
retry doesn't lose the click upgrade either.
- checkForUpdatesFromMenu upgrades userInitiatedCheck = true before
early-returning during the 30s wait, so the in-flight retry's result
reflects the user's click.
- Removed cross-cancellation between the 30s retry and 1h backstop
callbacks: each callback only nulls its own handle, and both timers
stay armed until a terminal event clears them centrally. The backstop
is no longer destroyed at T+30s, restoring the app-nap recovery the
design intended.
- 'error' handler's non-'checking' branch now (a) clears retry state
unconditionally so transitionRetryInFlight can never be stranded
across a status-race, and (b) suppresses sendErrorStatus when status
has already advanced to a good terminal (available/downloading/
downloaded), preventing a late backstop error from overwriting a
successful retry result.
- performQuitAndInstall now clears the retry timers and flag so the
install-quit path (which bypasses the before-quit handler via
markMacQuitAndInstallInFlight) doesn't leak a timer firing into the
bundle-replacement window.
Co-authored-by: Orca <help@stably.ai>
* fix(updater): simplify benign check failures
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Force a freshness check each time the user enters the Checks tab
(open sidebar, switch to Checks tab, or switch active worktree/branch)
so stale PR metadata, cached-null "no PR" results, stale checks, and
stale comments are surfaced immediately rather than waiting for the
cache TTL.
- Extracts entry-refresh logic into `checks-entry-refresh.ts` with a
30 s grace window to suppress rapid show/hide duplicate fetches.
- Adds a `shouldEntryRefresh` effect in `ChecksPanel` keyed by
`activeWorktreeId::repo.path::branch`; resets on panel hide so
close-and-reopen re-evaluates freshness.
- Fixes a stale-closure bug in `handleRefresh`: `fetchPRChecks` is now
called directly with the freshly resolved `headSha` after PR refresh
instead of reusing the pre-refresh closure's captured sha.
- Adds 11 unit tests in `checks-entry-refresh.test.ts`.
- Design doc: `docs/refresh-on-checks-tab.md`.
Co-authored-by: Orca <help@stably.ai>
* feat(sidebar): allow manual drag-and-drop reordering of repos
Users can now drag repo headers in the sidebar to reorder them. The
custom order is persisted to disk and survives restarts. Includes
design doc at docs/manual-repo-reorder.md.
Co-authored-by: Orca <help@stably.ai>
* fix: scope post-drag click swallow to dragged repo header
Avoid silently eating unrelated clicks if one races between pointerup and
the failsafe teardown.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Updates the Custom Sound search entry description and keywords to include
the supported formats (MP3, WAV, OGG, M4A, AAC, FLAC), and adds a small
caption under the setting's description in NotificationsPane for clarity.
Co-authored-by: Orca <help@stably.ai>
* feat(agent-hooks): introduce relay wire envelope + connectionId stamping
Adds the shared `agent-hook-relay.ts` module with the `agent.hook` JSON-RPC
notification envelope, the `agent_hook.requestReplay` /
`agent_hook.installPlugins` method names, and the
`ORCA_FEATURE_REMOTE_AGENT_HOOKS` flag helper. Promotes `AgentHookSource` to
`shared/` so the relay can import it without dragging Electron in.
Threads a `connectionId: string | null` field through `AgentHookEventPayload`,
the `agentStatus:set` IPC contract, and the renderer-bound preload listener.
Local hook posts stamp `null`; the relay-forwarded path will stamp from `mux`
identity in a later commit. Renderer uses the stamp for stale-event filtering
when an SSH connection tears down with notifications still in flight.
See docs/design/agent-status-over-ssh.md §1, §5, §8 (commit #1).
Co-authored-by: Orca <help@stably.ai>
* refactor(agent-hooks): extract shared listener; add relay-side adapter
Extracts the listener internals (request parsing, payload normalization,
endpoint-file writing, per-CLI extractors, warn-once Sets, slowloris timer
helper, request size cap, paneKey caches) from `src/main/agent-hooks/server.ts`
into a new transport-agnostic `src/shared/agent-hook-listener.ts`. The shared
module uses only Node builtins (no Electron) so it is safe to import from
`src/relay/`.
Adds `src/relay/agent-hook-server.ts` — a thin HTTP-loopback adapter that
wires the shared listener to a `forward(envelope)` callback so `relay.ts` can
re-emit each parsed payload as an `agent.hook` JSON-RPC notification on the
existing SshChannelMultiplexer. The adapter owns:
- 127.0.0.1:0 socket + bearer-token auth, identical shape to the local server
- per-paneKey last-payload cache + replayCachedPayloadsForPanes() for the
request-driven replay path used after `--connect` reattach (see §5 Path 3)
- clearPaneState(paneKey) for PTY-exit eviction (symmetric with local server)
- buildPtyEnv() / endpoint-file writing for relay-spawned PTYs
Orca's `AgentHookServer` is now a ~200-LoC adapter over the shared listener
that owns the IPC fanout, listener replay, and `ingestRemote(envelope, connId)`
entry point that bypasses the HTTP path for relay-forwarded events.
See docs/design/agent-status-over-ssh.md §3, §8 (commit #2).
Co-authored-by: Orca <help@stably.ai>
* fix(preload): expose connectionId on agentStatus.onSet type
src/preload/index.ts already passes through `connectionId?: string | null`
from main, but the PreloadApi declaration in api-types.ts was missing the
field. Align the type with the runtime contract so renderer call sites
can read connectionId without an `as` cast.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): harden ingestRemote + relay replay; review-driven cleanup
- ingestRemote: re-run normalizeAgentStatusPayload at trust boundary;
trim+validate connectionId/paneKey/tabId/worktreeId
- relay: preserve source/env/version through replay via sidecar map;
drop sourceFromAgentType fallback that mis-tagged unknown agents
- shared listener: exhaustive switch+never on AgentHookSource dispatch
chains; extractPromptText returns trimmed values; export MAX_PANE_KEY_LEN
- preload: tighten connectionId from optional to required (always sent)
- main IPC: reorder spread so explicit envelope fields win on collision
Co-authored-by: Orca <help@stably.ai>
* chore(docs): drop agent-status-over-ssh design doc from PR
The design RFC was useful for authoring this PR series but doesn't belong
in-tree — keeping it here would freeze line-number references and design
prose against future churn. Folding it into the PR description instead.
Co-authored-by: Orca <help@stably.ai>
* chore(agent-hooks): widen ingestRemote type for env/version (PR2 prep)
Declares `env?: string` and `version?: string` on the `ingestRemote` envelope
parameter so PR2 only needs to add the `warnOnHookEnvOrVersionMismatch`
callsite, not also widen the type. The fields are forwarded verbatim from
the agent CLI POST body on the remote and let Orca's warn-once cross-build
/ dev-vs-prod diagnostics fire identically on remote-sourced events.
Type-only addition; no runtime consumer in this PR.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Replaces the DropdownMenu-based repo filter with a Command/Popover combo that
supports live search, All/None bulk actions, and a Clear all footer. Scales
to large repo sets without scroll friction. Design doc added at
docs/sidebar-filter-redesign.md.
Co-authored-by: Orca <help@stably.ai>
* fix: address pr-bug-scan validated finding from #1680
On cold open, optimistic comments are now surfaced via a loading-shell fallback in the details memo, with a state tick so the memo re-runs after appendOptimisticComment.
* fix: address react-hooks lint warnings on #1680 fix-PR
- handleSubmit useCallback: add missing itemType dep
- details useMemo: keep optimisticTick (rerender signal for cold-open
ref reads) with eslint-disable + why-comment
---------
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Co-authored-by: nwparker <neil@stably.ai>
Add legacy version-first ID branches (3-5-sonnet, 3-5-haiku) in normalizeModelForPricing so legacy logs map to existing pricing entries instead of returning null.
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Replace the setState-driven data flow with useSyncExternalStore so the
drawer reads cached work-item details synchronously on first render.
Warm reopens now paint the cached content immediately with zero blank
flash. Adds a pub/sub layer (subscribeWorkItemDetailsCache /
notifyWorkItemDetailsCache) to all cache-write paths so React is
notified on every touch or invalidation. Includes design doc at
docs/gh-work-item-drawer-cache-flash.md.
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix: address auto-review-fix-multi-agent findings
- Replace local ORCA_WORKTREE_ID_SEPARATOR with shared WORKTREE_ID_SEPARATOR
- Make hydrateLocalPtyRegistryAtBoot idempotent (one-shot per process,
but stays retry-eligible until daemon provider is available)
- Strengthen daemon-pty-adapter strict-parser test to actually exercise
the new short-circuit (test would have passed under the old loose
parser too without the change)
- Add eslint-disable max-lines directive to oversized merge test file
Co-authored-by: Orca <help@stably.ai>
* chore: archive auto-review context to .context/
Co-authored-by: Orca <help@stably.ai>
* fix: address auto-review-fix findings
Drop the destructive reconcileOnStartup call from boot-time PTY registry
hydration: a transient listRepoWorktrees failure (returns [] and only
warns) would otherwise let the reconcile pass kill live local sessions.
The boot path is now read-only against the daemon — listSessions() only.
Also: tighten parsePtySessionId to reject degenerate `::` halves; replace
stale pty.ts:1005 references and a misleading local-unknown comment in
the hydrate module; narrow Store dependency to Pick<Store, 'getRepos'>;
log adapter listSessions failures instead of silently swallowing them;
re-anchor design-doc references on stable symbols and align §1b/§1c/§1d
with the implementation.
Co-authored-by: Orca <help@stably.ai>
* docs(resource-usage): update remote badge spec
Co-authored-by: Orca <help@stably.ai>
* test(resource-usage): cover boot hydration failure modes + warm-reattach e2e
Adds the regression coverage flagged in PR #1667's test plan that wasn't
already locked down.
vitest (`hydrate-local-pty-registry.test.ts`):
- daemon offline at first call → no-op, hasHydrated stays false so a
later macOS dock re-activation can retry.
- listSessions rejection caught and logged, does not throw.
- pid-write ordering: a pre-existing registry entry with pid=12345 is
not clobbered by a stale `pid: null` from listSessions (§1d).
- SSH-gate: a session whose repo has a non-null connectionId stays out
of the registry, mirroring the spawn-time gate in pty.ts.
- Happy-path: a local session is registered with the daemon's pid.
Playwright e2e (`resource-usage-warm-reattach.spec.ts`):
Full quit→relaunch cycle against the same userDataDir; asserts that
on the second launch the snapshot includes the warm-reattached PTY
with a real pid before any pane mount, and that the seeded repo
resolves as local (no connectionId). Mirrors the existing
terminal-restart-persistence pattern.
Co-authored-by: Orca <help@stably.ai>
* fix(test): satisfy Pick<Store, 'getRepos'> in hydrator vitest
CI typecheck failed because FakeStore's getRepos returned objects missing
Repo's required fields (path, displayName, badgeColor, addedAt). Fill with
placeholder values; the hydrator only reads id + connectionId, but the
type signature still has to line up.
Co-authored-by: Orca <help@stably.ai>
* chore(resource-usage): drop bug-doc files; strip dead doc refs from comments
Remove docs/resource-usage-remote-mislabel.md (new in this PR) and revert
docs/resource-usage-merge-spec.md to the PR-base state. Strip the
matching `docs/...md §N` pointers from code/test comments, keeping the
surrounding "why" explanations intact so readers still get the
warm-reattach mislabel context.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix: gate worktree status on live PTYs so sleep reports inactive
Sleep preserves tab.ptyId as a wake-hint sessionId, so the previous
liveness check (`tab.ptyId != null`) kept the workspace dot green and
agent rows as "working" until the 30-min stale TTL decayed them.
Switch liveness to ptyIdsByTabId (cleared by every pty.kill / sleep)
via a new tabHasLivePty helper, and drop live agentStatusByPaneKey
entries on sleep so the inline rows disappear with the dot. Retained
"done" rows survive — that signal is dismissed by the user, not the
system.
Co-authored-by: Orca <help@stably.ai>
* fix: drop retained agent rows on worktree sleep
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix: preserve slept worktree status liveness
Co-authored-by: Orca <help@stably.ai>
* fix: treat slept pty hints as inactive
Co-authored-by: Orca <help@stably.ai>
* chore: remove sleep status planning docs
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When a remote SSH workspace contains a symlink whose target lies outside
the registered repo/worktree roots, file reads failed with 'Path outside
authorized workspace'. This silently broke common workflows: HPC dataset
mounts, multi-checkout repos, dotfile editing, and any cross-mount
symlink.
Drop `RelayContext.authorizedRoots`, `validatePath`, and
`validatePathResolved` along with all ~33 call sites in fs-handler.ts
and git-handler.ts. The relay's threat model becomes 'the relay runs as
the SSH user and trusts the renderer.'
Why this is acceptable: `pty.spawn` and `git.exec` already concede the
same threat. A renderer that wants to reach `/etc/passwd` can spawn a
shell or run `git -C /etc cat-file`; the FS allowlist was friction, not
a security boundary. Intra-worktree path checks in `getDiff` and
`discard` are intentionally preserved.
Back-compat preserved: `session.registerRoot` (notification + request)
remains a valid RPC, retained as no-ops on new relays. Old main + new
relay and new main + old relay both keep working through the upgrade
window. `registerRelayRoots` is also kept for the same reason. A
narrowed error-translation block in `worktree-remote.ts` handles old
relays still surfacing the legacy error string to users.
Tests: removed two negative-allowlist tests; added a positive control
('reads files outside any registered root') and a direct regression
test for #1661 ('reads files via symlinks resolving outside the
workspace'). All 469 relay/SSH/IPC tests pass.
See docs/relay-fs-allowlist-removal.md for the full rationale,
back-compat matrix, alternatives considered, and follow-up cleanup
plan.
Closes#1661
Co-authored-by: Orca <help@stably.ai>
* feat(telemetry): instrument on_path:false triage on onboarding_agent_picked
Adds path_source and path_failure_reason to onboarding_agent_picked so the
~30% on_path:false rate on dashboard 1562016 can be split between shell
hydration failures and genuinely-not-on-PATH cases before picking a fix.
See docs/agent-on-path-detection.md.
Co-authored-by: Orca <help@stably.ai>
* fix(telemetry): close PathSource compile-time-sync hole
Add `_PathSourceSync` guard mirroring `_PathFailureReasonSync` so adding
a new `PathSource` value to the alias without updating the schema (or
vice versa) fails the build. Without it, drift would silently drop
`onboarding_agent_picked` at the strict validator. Also replace stale
line-number references in docs/agent-on-path-detection.md with named
function/handler references that survive future edits.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When there are unstaged/untracked changes but nothing staged yet, the
Source Control primary button now reads "Stage Files" and bulk-stages all
unstaged + untracked paths in one shot, so users can immediately hit
Commit on the next click without manually staging first. This replaces
the previous behavior where Pull/Sync/Push/Publish could appear as the
primary on a dirty tree and then fail with "Please commit or stash them".
Co-authored-by: Orca <help@stably.ai>
* feat(telemetry): track agent_hook_install_failed per agent
Replaces the closure-style installer loop in `src/main/index.ts` with a
labelled `runManagedHookInstallers` so each catch can attribute the
failure to its agent. Adds the `agent_hook_install_failed` event +
`hookInstallAgentSchema` enum (claude/codex/gemini/cursor) and a unit
test pinning fail-open semantics, label routing, and the 200-char
error_message truncation.
Co-authored-by: Orca <help@stably.ai>
* fix(telemetry): harden agent-hook installer fail-open
- describeError always returns a string (JSON.stringify can return
literal undefined for throw undefined / Symbol / function, which
would crash the catch handler before track fires)
- wrap track() in inner try/catch so a telemetry-side throw can't
abort the installer loop
- dedupe AGENT_HOOK_TARGETS into one tuple in agent-hook-types so
the IPC AgentHookTarget type and hookInstallAgentSchema can't drift
- regression tests for object/undefined throws and track-throws
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* feat(diff-viewer): scroll to first change when opening a diff
On a fresh diff tab open (no cached view state, no pending scroll-to-note),
center the first diff change in the viewport. Cached view state and
explicit scroll-to-note requests still win.
The scroll runs from a dedicated useEffect, not from handleMount, so it
sequences after the comment-decorator inserts its view zones — otherwise
late zone insertion shifts content downward and the user lands on a note
further down the file instead of the first change.
Uses getTopForLineNumber(line, /* includeViewZones */ true) so the math
accounts for whatever zones the decorator added in this render pass.
A one-shot ref guards against re-firing on later effect re-runs.
Co-authored-by: Orca <help@stably.ai>
* test(window): mock ipcMain.handle/removeHandler in createMainWindow.test
The pr-bug-scan from #1583 added an ipcMain.handle('window:isMaximized', …)
call to createMainWindow but didn't extend this test's electron mock. Main
already added these mocks (PR #1634); add them here so the branch's CI passes.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(windows): tab row drag region overlaps window-controls overlay
The top-right tab group's no-drag spacer was hardcoded to 40px (for the
floating sidebar toggle). On Windows the fixed-position window-controls
overlay (138px wide) sits on top of the same corner, making the buttons
unreachable when the tab row's drag surface extended under them.
Widen the spacer to calc(40px + var(--window-controls-width, 0px)) so
it punches a hole for both the sidebar toggle and the overlay. The var
is 0px on non-Windows so this is a no-op there. Fixes#1664.
* fix(windows): remove double-compensation spacers from toggle and sidebar header
Two places were using both a CSS-based offset AND an internal spacer div,
doubling the reserved width (276px instead of 138px):
1. Floating right-sidebar toggle (workspace view): the container already
uses right:var(--window-controls-width) to position itself clear of
the overlay. The extra window-controls-titlebar-spacer inside was
pushing the button further left AND laying an invisible 138px div over
the pane-actions Ellipsis button, blocking clicks.
2. Right sidebar header (both layout modes): the header already has
right-sidebar-header-inset = padding-right:var(--window-controls-width).
The internal spacer was double-compensating, shifting the close button
far left with wrong spacing.
Remove the internal spacers from both. The single offset mechanism in
each case is sufficient.
* fix(windows): side-mode sidebar header has wrong gap before minimize button
In side activity-bar mode the 40px icon strip sits to the right of the
panel content, so the panel header never reaches the window-controls zone.
The right-sidebar-header-inset class (padding-right: 138px) was still
applied, pushing the close button 178px from the window edge and producing
a 40px visual gap between the close button and the minimize button.
Remove the inset class from the side-mode header only. The top-mode header
spans to the window edge so it still needs the inset.
* fix(windows): side-mode header close button overlaps minimize button
The 40px side activity bar absorbs only 40px of the 138px window-controls
overlay, leaving 98px of overlap on the panel header. The previous commit
removed all inset (making the gap 0), which caused the close button to
sit under the minimize button.
Add .right-sidebar-header-side-inset with padding-right:
max(0px, calc(var(--window-controls-width, 0px) - 40px))
= 98px on Windows, 0px elsewhere — exactly the uncovered remainder.
* fix(lint): remove unused isWindows variable in right-sidebar
---------
Co-authored-by: Neil Parker <nwparker@anthropic.com>
Reopening a GitHub issue/PR drawer paid full IPC + `gh` startup latency on
every open. Two changes here:
1. Module-level SWR cache in GitHubItemDialog.tsx keyed by
(repoPath, issueSourcePreference, type, number). Reopening within 30s
paints cached data instantly; older entries paint stale-then-refresh.
Concurrent opens dedupe on a shared in-flight promise. Mutation
handlers invalidate by (repo, type, number); a cache-generation
counter prevents in-flight refetches from resurrecting stale data
after a mid-flight invalidation.
2. Collapsed GraphQL query for issue details replaces 3 serial `gh`
subprocesses (REST issue + REST comments + GraphQL participants) with
one round-trip. Falls back to the legacy fan-out on any GraphQL error
so historical contract is preserved.
Cross-window invalidation rides a new `gh:workItemMutated` IPC broadcast
that skips the originating sender (the source already updated its cache
optimistically — re-broadcasting would race the optimistic write).
`addIssueComment` now takes a `type` so the broadcast scopes correctly
when a PR shares its number with an issue.
Co-authored-by: Orca <help@stably.ai>
* fix(status-bar): hide usage bars for agents not on PATH
When a CLI like Gemini isn't installed, the corresponding usage bar (and
its right-click / Settings toggle) was still surfaced — e.g. a fresh
Ubuntu install showing 'Gemini Usage' with no Gemini CLI on PATH.
Gate the Claude/Codex/Gemini bars + toggles on the existing
preflight.detectAgents() result. OpenCode Go is intentionally exempt
(it's a web/cookie-auth provider, not a CLI on PATH). Pre-detection
(null) preserves legacy behavior so nothing flickers on cold start, and
bars/toggles re-appear automatically once the CLI shows up on PATH.
Co-authored-by: Orca <help@stably.ai>
* fix(status-bar): refresh agent detection alongside rate-limit refresh
Self-review follow-up: when a user installs a new CLI (e.g. Gemini) after
Orca is already running, clicking the status-bar refresh button should
make the corresponding usage bar appear without an app restart.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When the active surface was a browser tab (or focus was inside a
browser guest webview), Cmd/Ctrl+T was creating a new browser tab
instead of a terminal. Make Cmd/Ctrl+T always open a new terminal
regardless of active surface; Cmd/Ctrl+Shift+B remains the dedicated
new-browser-tab shortcut.
Co-authored-by: Orca <help@stably.ai>
* refactor(sidebar): tidy worktree list group header layout
Move the collapse chevron next to the group label, swap repo icon for a neutral muted Folder, and adjust header padding for better alignment.
Co-authored-by: Orca <help@stably.ai>
* style: minor padding tweaks on worktree group header
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
NeilandOrca
Jinwoo HongandOrca
buf0-bot[bot]andorca-bug-scan-bot
Brennan BensonandOrca
JinjingandOrca
