mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 17:37:40 +00:00
Brennan Benson
912a723f6c
* Give terminal agents a lasting Orca Agent ID Terminal agents now get an Orca ID (orca_session_id:<agent>_<uuid>) derived from their own conversation id on the host that runs them, so it stays the same across worktree sleep/wake, app restart and a hand-run resume in any pane. The terminal pane menu gets Copy Agent ID beside Copy Session ID, and worktree ps --json agent rows carry orcaSessionId. Messaging a terminal agent by that ID is refused with a message naming its pane until terminal delivery lands. * Name terminal agents at row admission and fix review round 1 - Perf: a row's Agent ID is resolved once, when its provider key changes at admission (legacy rows via the status adapter's prepareRow hook, tmux rows at canonical commit) and carried on the row as runtime-only agentIdentity. Snapshots, publications and internal notifications only copy it; no key serialization, cache lookup or database access per walk. Drops the pane FIFO cache. - Refusal: the identity service keeps a reverse index id -> rows, kept exact by the adapter's rowChanged hook; a terminal refusal reads only matching panes and names only confirmed running ones (no resume seeds, exited or unconfirmed restored rows). - Retry: a read-only identity file is lookup-only and never mints; any store failure backs off all SQLite work for 30 s; a Copy click retries once. - Menu: Copy Agent ID shows for a live pane only when its host stamped an ID, and for a sleeping pane only when this app owns it on macOS/Linux. - SSH: a sleeping record keeps its connection; a foreign (non-WSL) one resolves no ID. - Renderer keeps an existing ID only for the same agent, owner and provider key including the Pi transcript locator. - tmux-selected terminal rows carry their ID at every snapshot seam and in Copy resolution; structured chat rows stay excluded. * Keep Agent ID work out of notifications and reach Copy wherever a host can answer - Internal status/provider notifications walk rows without Agent ID work: canonical (tmux-selected) rows are decorated only for outputs that carry the id (snapshots, live emit, ps, Copy). The tmux publish body is now publishTmuxSelectedStatus so tests drive the production path. - A row this host can name but has not yet (failed or pending link) is published with orcaSessionId: null; older hosts omit the field. The renderer offers Copy Agent ID on a live row whenever the field is present, and the click retries through terminal.agentId. - Hosts advertise terminal.agent-id.v1. A sleeping pane offers Copy Agent ID when its owner is this app on macOS/Linux, or a remote owner that advertises the capability on a known non-Windows platform, and its record names no foreign connection. - "Running in pane" places require that this runtime observed the row; a saved status, Done included, is history. * Guard the pane menu subscription and stop offering Copy where it can never succeed - A settled read-only miss (no link in a newer build's identity file) no longer publishes orcaSessionId; only a resolved id or a pending failed link does, so Copy Agent ID is offered only where a click can succeed. - Render contract for the per-pane menu selection: another pane's or host's status change re-renders no unaffected pane; a pane's own stamp flips its availability. * Move terminal agent identity SQL into a worker thread Main's blocking-SQLite ratchet forbids the synchronous identity store, so (per the decider ruling) agent-identities.db is now owned by one lazy worker-thread entry per hook-server owner, desktop and orcad alike. - The schema, open/version handling, mint/link transaction and read-only behaviour move unchanged into agent-identity-worker-entry.ts; main keeps only the key type, path and an async client over WorkerThreadRequestQueue. - Admission stays synchronous: a new key is published pending (null), one request per exact key is shared by every row and click, and the committed answer re-stamps the current rows still pending on that key (legacy and tmux-selected) as identity-only replays. Replies are fenced by store generation, key and current subscription; failures back off 30 s and a Copy click retries once. - terminal.agentId and the terminal-ID refusal are async: Copy waits for the pending lookup and revalidates the pane; send/task routing resolves the terminal recipient (awaiting the store's has() on an index miss) before any synchronous routing or effects. - The renderer treats the host's row naming a conversation as authoritative for its id, so a settled miss clears a pending null, while ID-less local updates keep it. - Packaged for desktop and orcad; registered as a worker entry, no baseline growth. * Own identity demand per key, publish settled ids as projections, recheck authority Implements the second decider ruling for the identity worker: - One owner-level demand table replaces the per-key promise backlog and the settled-row scan: each exact key a current row or caller needs has one record (identity, places, waiters); the pump sends the worker one operation at a time, only for keys still needed, so a healthy burst completes and detached keys are never sent. Operation deadlines start at dispatch; a caller's wait expiring never drops a row's demand. - One failure gate for lookups and membership: after a failure nothing is sent for 30 s except one coalesced Copy attempt; a single owner wake retries while rows still wait, and cancels with the last demand or close. - The retirement barrier outlives a client: a replaced worker must exit before another starts; a different store path is a different authority. - Settlement re-stamps the stored row and publishes a projection only: window readers get the row without its hook event (no agent-state record) and session.tabs is woken by a row touch; no enriched subscriber, plugin event or freshness heartbeat runs again. - Copy and terminal membership check the owner generation after their waits. A known chat is decided by the chat store alone; send, peer mail, reply and assignee admission resolve the terminal recipient before reading the facts they act on, recheck the sender after the wait, and group send reselects its audience and mailboxes after each wait before writing. * Scope identity answers to their store authority, expire Copy grants with callers, index provider aliases - One synchronized authority token before Copy/reverse fast paths, compared after their awaits; answers carry their authority and an ended store turns rows, tmux subjects and the reverse index pending together. Status path changes sync the authority outside admission. - A failed operation reschedules the pump so a queued click gets its attempt; grants belong to live waiters and a click joining a running attempt earns none. - Provider-native ids resolve through a commit-maintained alias index at the record store. - Group fan-out no longer classifies authoritative candidates; @idle rereads statuses with current candidates before the final synchronous selection. - Hook-server unit fixtures use an in-memory identity client; a real worker load/stop failure check covers the worker boundary. * Pick a shared provider alias's owner among its owners only The alias index keeps the store's listing order (readable, then unreadable) as derived ranks, updated from the draft's appended keys on commit, so a duplicate alias no longer walks the history per lookup. * Ask a remote pane's host for its Agent ID by the host's own pane key Copy Agent ID on a web-terminal surface sent the client's mirrored pane key, which the execution host does not know, so it answered null. * Keep focus where the user moved, recover a missed identity re-stamp, ack peer-mail replays first Copy Agent ID refocuses its pane only when focus is unclaimed or still in the pane; a carried pending row takes its key's settled answer; an already-delivered peer-mail retry is acknowledged before recipient preparation.