mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
* fix(skills): judge official skill updates by ownership, not snapshot matching Orca decided whether an installed official skill was pristine by matching its bytes against a shipped list of past snapshots, falling back to the skills CLI's lock hash. Copies installed between releases, CRLF copies, and installs whose lock recorded a sha256 hash all read "doesn't match the official version" and could not be updated (#26841), and older content could be labelled newer and never offered. Now an official skill is Orca's when the skills.sh global lock says it came from stablyai/orca, and it is current only when its listed files equal the bundled manifest (line endings and sidecars ignored); anything else is outdated. Install and update are one pinned `skills add .../tree/v<appVersion>` command, used by the in-app runner, `orca skills update`, and the Settings rails. The update dialog preselects Orca-owned rows and lists same-named skills from elsewhere unchecked. Removes the snapshot registry, release mapping, git-tree identity, lock trust and convergence logic, and the release-cut provenance step. * ci(skills): run the pinned-add round trip on a skills CLI that can fetch a commit * fix(skills): let orca skills update target the shared folder on a bare host Update became the same pinned add as install, so it inherited install's refusal when no agent is detected. That broke the bare-host update the old command guaranteed, and the built-CLI check (update --dry-run, no --agent) on CI runners. The in-app runner already fell back to universal; both now share one detectSkillsCliUpdateAgentKeys rule. Also brings the CLI skills docs off `npx skills update`. * refactor(skills): derive the update selection from the grouped rows The selection hook took the live and the retained inventory, re-derived Orca ownership from installations beside the grouping's own orcaOwned, and kept a separate display count. Groups already carry both eligibility and ownership, so the hook reads them once; the button's existing live-scan gate is the only authorization check. The unselected line is inlined into the headline. * refactor(skills): drop helpers the ownership design made redundant - isOwnerManagedSkillScope only negated into the participation check once plugin caches stopped participating; fold it in. - Eligibility re-checked resolvedPath/physicalIdentity, which observation already turns into 'inaccessible'. - The manifest verifier probed access() before a readFile that throws anyway. - orchestration-install-command.ts only forwarded one constant from the lib module its three importers already import. * i18n(skills): stop naming npx skills update in four skipped-copy strings The es/ja/ko/zh cantUpdateReason and tipDuplicate strings still named `npx skills update`, which Orca no longer runs for its skills. Say 'the update command' instead. * refactor(skills): inline the single-use pinned source URL helper orcaSkillsSourceUrl was exported but only called by the builder beside it. * fix(skills): let an update choice lapse when the install source changes The selection froze every checked name, Orca's preselection included, the moment the user ticked anything. A re-check that then attributed a name to another source kept it checked, replacing it without consent. Store only the user's explicit choices, keyed by name and lock source, and default to ownership otherwise. * fix(skills): label the empty update action 'Update skills', not 'Update 0 skills' The button stays whenever a row is updatable, so unticking every row (or a dialog with only non-Orca copies outdated) doesn't reflow the footer. At zero selected it stays disabled and reads 'Update skills' instead of a zero count. The label lives beside the dialog's other count copy. * fix(skills): let keyboard focus open the Not from Orca tooltip The source of a non-Orca copy is only in the tooltip, and its trigger was a plain span. Make it focusable like Orca's other tooltip-on-text triggers (tabIndex 0, cursor-help, the row primitive's focus ring), as in the agreed mock. * test(skills): hold the round-trip add equal to the shared install builder The CI round trip hardcoded its skills add argv, so it could drift from what Orca runs. A .mjs script can't import the TS builder (extensionless imports), so the argv moves into an exported roundTripAddArgs and a unit test asserts it is the builder's unattended add with the tag swapped for the PR commit. The script runs under the same main guard as the manifest generator. * i18n(skills): translate the skill row's location count and duplicate reason es, ko and zh still carried English for SkillUpdateRow.oneLocation and manyLocations, and es and ko for SkillFreshnessRow.skippedReasonDuplicate. * fix(skills): pin official skill installs to the build commit and skills CLI `skills add .../tree/v<version>` only works for stable and RC builds: hourly, daily and adhoc builds publish elsewhere, so stablyai/orca has no tag for their version and both install and update failed there. Every build is made from a commit that exists in stablyai/orca, so the build now stamps `git rev-parse HEAD` and the one shared builder pins to `tree/<commit>`, which equals the bundled skills by construction. Main, renderer, web and vitest get it as ORCA_BUILD_COMMIT (replacing ORCA_APP_VERSION); the tsc-built CLI reads it from the compiled out/package.json boundary. A missing or malformed commit fails the build or the command with a clear error instead of building a bad URL. The builder also pins the skills CLI (`npx skills@1.7.2`): 1.5.x cannot fetch a commit, and a bare `npx skills` can reuse a stale cache or resolve to another binary (#18687). The CI round-trip script reuses the same constant. * ci(skills): run the round trip on the shared pinned skills CLI version * docs(skills): document the commit-pinned skills add * refactor(skills): keep the pinned skills CLI version in the install builder skills-cli-version.ts existed only so the plain-Node round-trip script could strip-load a .ts file, which needed --disable-warning in CI. The version now lives beside the builder that uses it; the script keeps a literal, and the existing round-trip test already asserts its argv, skills@<version> included, equals the builder's. * refactor(skills): validate the build commit once, where it is resolved resolveBuildSourceCommit already refuses anything but a full hash, and both the define and the CLI's stamped package.json come from it. The builder's second check could only fire as a module-load throw in the renderer's command constants. Also drops the resolver's unused cwd parameter. * test: stamp a fixed build commit instead of running git in the vitest config Tests only interpolate ORCA_BUILD_COMMIT, so they need not read HEAD (or fail outside a git checkout) on every run. * refactor(settings): match only skills add in the Windows npx preflight Every official skill command is now the builder's skills@<version> add; no rail emits skills update any more. * fix(skills): fail an update that leaves a broken skill link behind Eligibility already skips names with a broken link before the run, so one afterwards is the run's own damage; report it instead of claiming success. * ci(release): refuse to tag when the skill manifest is stale The removed --release step implicitly checked the committed manifest against skills/. Keep that guarantee with a verify-only run; it writes nothing. --------- Co-authored-by: Orca Worker <orca-worker@localhost>
75 lines
3.3 KiB
TypeScript
75 lines
3.3 KiB
TypeScript
import { isUsableSkillsCliAgentKey } from './skills-cli-agent-keys'
|
|
|
|
export const ORCA_SKILLS_REPOSITORY_URL = 'https://github.com/stablyai/orca'
|
|
|
|
// Why: one skills CLI for every install rail. 1.5.x cannot fetch a commit, and a bare
|
|
// `npx skills` can reuse a stale cached copy or another binary (#18687).
|
|
export const SKILLS_CLI_VERSION = '1.7.2'
|
|
|
|
export const ORCA_CLI_SKILL_NAME = 'orca-cli'
|
|
export const COMPUTER_USE_SKILL_NAME = 'computer-use'
|
|
export const ORCHESTRATION_SKILL_NAME = 'orchestration'
|
|
export const EPHEMERAL_VMS_SKILL_NAME = 'orca-per-workspace-env'
|
|
export const ORCA_LINEAR_SKILL_NAME = 'orca-linear'
|
|
export const LINEAR_TICKETS_SKILL_NAME = 'linear-tickets'
|
|
export const LINEAR_AGENT_SKILL_NAMES = [ORCA_LINEAR_SKILL_NAME, LINEAR_TICKETS_SKILL_NAME] as const
|
|
|
|
// Why: `yes` and `agents` default off so every Settings/onboarding string a human
|
|
// pastes keeps its interactive prompts and the CLI's own agent detection. Only an
|
|
// unattended spawn, which nothing can answer, opts in.
|
|
export type AgentFeatureSkillCommandOptions = {
|
|
/** Full commit the running build was made from. */
|
|
sourceCommit: string
|
|
global?: boolean
|
|
yes?: boolean
|
|
agents?: readonly string[]
|
|
}
|
|
|
|
export function buildAgentFeatureSkillInstallArgs(
|
|
skillNames: readonly string[],
|
|
options: AgentFeatureSkillCommandOptions
|
|
): string[] {
|
|
if (skillNames.length === 0) {
|
|
throw new Error('At least one skill name is required.')
|
|
}
|
|
const global = options.global ?? true
|
|
// Why: -y with no --agent is the one combination that makes `skills add` install
|
|
// into every agent it knows. Refuse it here so no caller can express it.
|
|
const agents = options.agents ?? []
|
|
if (options.yes && agents.length === 0) {
|
|
throw new Error('An install target is required when skipping prompts.')
|
|
}
|
|
// Why: a value the skills CLI would drop leaves it with no target at all, which
|
|
// is the same all-agents install as passing no --agent.
|
|
const unusable = agents.find((agent) => !isUsableSkillsCliAgentKey(agent))
|
|
if (unusable !== undefined) {
|
|
throw new Error(`"${unusable}" is not a usable install target.`)
|
|
}
|
|
// Why: one flag per name remains compatible with both single-value and variadic parsers.
|
|
const skillArgs = skillNames.flatMap((name) => ['--skill', name])
|
|
return [
|
|
`skills@${SKILLS_CLI_VERSION}`,
|
|
'add',
|
|
// Why: pinned to the build's own commit so the installed bytes are the ones its bundled
|
|
// manifest judges freshness against, on every channel (hourly builds have no tag in
|
|
// this repo). `add` always re-copies, so the same command is install and update.
|
|
`${ORCA_SKILLS_REPOSITORY_URL}/tree/${options.sourceCommit}`,
|
|
...skillArgs,
|
|
...(global ? ['--global'] : []),
|
|
// Why: an explicit --agent stops `skills add` calling its own detection, whose
|
|
// zero-detected branch installs into all ~75 known agents and litters a bare
|
|
// host with agent config directories it has no agent for.
|
|
...agents.flatMap((agent) => ['--agent', agent]),
|
|
// Why: without -y `skills add` opens an interactive agent picker and blocks
|
|
// forever on any TTY, which is every ssh session.
|
|
...(options.yes ? ['-y'] : [])
|
|
]
|
|
}
|
|
|
|
export function buildAgentFeatureSkillInstallCommand(
|
|
skillNames: readonly string[],
|
|
options: AgentFeatureSkillCommandOptions
|
|
): string {
|
|
return `npx ${buildAgentFeatureSkillInstallArgs(skillNames, options).join(' ')}`
|
|
}
|