mirror of
https://github.com/stablyai/orca.git
synced 2026-09-22 00:02:31 +00:00
OrcaWinandOrcaWin
ac7f9a4fe1
* fix(pty): require proven absence before retiring a stable pane owner "Session not found" only proves the provider we asked has no such PTY. A degraded router answers unmapped session ids from the local fallback, which never owned a daemon session, so a live agent's PTY produced the same error a dead one does — and the pane was then given a synthetic exit, its durable pane->PTY binding deleted, and a duplicate spawned. For a single-pane tab the retirement also drops the tab from persisted state, which the renderer cannot add back. Gate the retirement on probePtyLiveness, which polls every possible owner and answers false only when all of them agree the session is absent. `null` (nobody could answer) is not absence. Providers without a probe are their own sole owner, so their refusal stays authoritative and their behavior is unchanged. Also move the retirement's durability barrier off writeToDiskSync: it fsyncs the whole multi-MB state from the main thread, and a restore that retired N dead panes paid that stall N times. * fix(pty): make the unproven-absence veto transient and route attaches to the real owner Review found the proven-absence gate correct in direction but terminal in effect: "probe says alive" and "probe says unknown" both became a hard spawn failure with no consumer, no retry, and a raw internal token in a toast. - Graceful teardown (should-fix): a session being killed reports alive (getAppliedSize answers while isAlive, and isTerminating does not flip _state) while createOrAttach already throws SessionNotFoundError, so for up to KILL_TIMEOUT_MS the pane failed instead of retiring the doomed binding. The veto now re-proves on a bounded 6s budget: the moment any owner answers "absent" the pane retires and spawns fresh exactly as before. - Unprovable owners (should-fix): DaemonPtyAdapter.probePtyLiveness never called ensureConnected, so a merely disconnected adapter answered null forever and one null poisons probePtyOwners; it also took no deadline, so a wedged daemon burned the client's 30s request timeout per attach. It now connects first (like listProcesses) and threads an absolute deadline through the fan-out. The thrown error is user-legible English instead of terminal_pane_owner_unverified. - Durability barrier (should-fix): flushPendingOrThrowAsync is not a twin of flushOrThrow — it defaults to the drain-to-stable-generation loop the sibling best-effort caller deliberately avoids, adds active-view and GitHub sidecar writes, re-serializes state per iteration, and rejects when writes are frozen where the sync path no-ops. Reverted to flushOrThrow, matching the sibling retire paths in orca-runtime. - Misrouting root cause (nit): DegradedDaemonFreshSpawnRouter.spawn sent an unmapped sessionId to the local fallback and DaemonPtyRouter.spawn sent it to the current daemon, both faking "Session not found" for a live session. Both now resolve an existing owner first (the same resolution every non-spawn path already uses); minted ids still route to the fallback/current daemon. The pane reattaches instead of only surviving. Tests: retry-until-proven, teardown-window retire, misroute-then-reattach, probe deadline threading, unconnected-adapter probe, and both routers' owner resolution. Each fails with only the source reverted. * fix(pty): drop the follow-up, keep the minimal proven-absence guard Revertsaa27eb5274and leaves only the original guard: retire a stable pane's owner solely when a provider authoritatively answers absent (probePtyLiveness === false). `true` and `null` still refuse to authorize destruction, and providers without a probe keep their refusal authoritative, so their behavior is unchanged. The follow-up bought too much surface for a P0, and two of its pieces did not hold up: - The `hasPty` owner scan added to DaemonPtyRouter.spawn and the degraded fresh-spawn router is inert for the case it targeted. `hasPty` reads `activeSessionIds`, which only spawn/attach populate — `listProcesses` (daemon-pty-adapter.ts) never does. After a failed discovery the scan therefore cannot find the owner it was written to find. - Its two routing tests could not fail: the mocks backed `hasPty` and `listProcesses` with one shared array, giving the fake adapter knowledge the real DaemonPtyAdapter provably lacks. Also dropped: the bounded 6s retry loop and its constants, the sentinel symbol, the exported user-facing message, the `opts.deadlineMs` widening of probePtyLiveness and its threading through the probe/routers, and the ensureConnected change in DaemonPtyAdapter. Kept from the follow-up: the flushOrThrow revert. flushPendingOrThrowAsync is not a like-for-like twin (drain-to-stable-generation loop, sidecar writes, per-iteration serialize, rejects when writes are frozen), so retirePersistedStablePaneOwner stays synchronous. One gap the strict one-shot gate does open is closed here. `getSize` landed in daemon protocol v18, and legacy adapters are created for every version in PREVIOUS_DAEMON_PROTOCOL_VERSIONS (1..30). A pre-v18 daemon error-replies "Unknown request type", probePtyLiveness catches it as `null`, and one `null` makes probePtyOwners unprovable forever — so a genuinely dead pane could never retire. probePtyLiveness now version-gates getSize and asks such a daemon for `listSessions` instead, the same inventory legacy discovery already routes by, requested directly rather than through listProcesses (which swallows errors into an empty list) so an unreachable socket still answers `null`. Unreachable never means absent; only an owner that answered does. * fix(daemon): detect getSize support instead of inferring it from the protocol number The version gate was not a sound boundary. `getSize` landed in22b00a7cd2while PROTOCOL_VERSION was already 18 and that commit did not bump it, so version 18 means two different things: daemons built before it lack the request, daemons built after it have it. Both report 18. A daemon from that window therefore passed the `>= 18` gate, was sent `getSize`, error-replied "Unknown request type", and answered `null` — and one `null` makes the owner fan-out permanently unprovable, so a genuinely dead pane could never retire. That is the same wedge the gate was added to close, just narrowed to one build window. Ask the daemon what it supports rather than trusting its number: attempt `getSize`, and fall back to `listSessions` only when the daemon itself replies that the request type is unknown. The predicate is deliberately narrow so a transient failure stays unproven instead of being mistaken for a missing capability, and the rejection is remembered so later probes skip a round trip that cannot work. This mirrors the capability-probe rule AGENTS.md already requires for Git, for the same reason: version numbers overstate capabilities. Unreachable still never means absent. * test(pty): pin that proven absence still retires, and correct a wrong rationale Review found the guard had no positive-direction coverage: every existing retire test uses a provider with no probePtyLiveness, so the guard is skipped there. Mutating `!== false` into `!== undefined` — which turns the guard into a permanent veto, so no daemon-backed pane could ever recover from a genuinely dead owner — left the whole suite green. Pinned with a case that fails under exactly that mutation. Also corrects the fallback's Why-comment. It claimed listProcesses "swallows errors into an empty list"; it does not — DaemonPtyAdapter.listProcesses rethrows and the router fails closed. The error-swallowing lives in discoverLegacySessions / discoverDegradedDaemonSessions. Requesting listSessions directly is still right, but because a liveness probe should not publish inventory audit observations as a side effect — not for the stated reason. * fix(daemon): bound the liveness probe so a wedged daemon cannot stall a pane mount probePtyLiveness passed no timeout, so each request fell back to the client's 30s REQUEST_TIMEOUT_MS. A wedged daemon holds its socket open rather than refusing, so it answers neither quickly nor at all — and probePtyOwners awaits every adapter before it can conclude anything. One hung daemon therefore stalled each restoring pane for up to 30s before the pane reported that it could not reopen. Nearly all local terminals are daemon-backed, so this is the common configuration, not an edge case. Bound both probe requests to 2s. Answering "unknown" quickly is strictly better here than answering slowly: unknown never authorizes retirement, it only defers it, so the only thing a shorter budget can cost is an earlier retry. The tests now pin the bound at the call rather than leaving it implicit. * test(daemon): pin the getSize probe timeout, and reattach an orphaned comment Review proved a coverage gap by mutation: removing LIVENESS_PROBE_TIMEOUT_MS from the getSize request left the whole suite green, so nothing stopped that leg regressing to the client's 30s default. Only the listSessions leg was pinned. The assertion now fails under exactly that mutation. Also moves isUnknownRequestTypeError below isDaemonGoneError. It had been inserted between isDaemonGoneError and the comment describing it, so that comment read as documenting the wrong function. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Orca
中文 · 日本語 · 한국어 · Español · Français · Português
The AI Orchestrator for 100x builders.
Run Codex, ClaudeCode, OpenCode or Pi side-by-side — each in its own worktree, tracked in one place.
Download Orca
Features
Mobile CompanionMonitor and steer your agents from your phone — get notified when an agent finishes and send follow-ups from anywhere. |
 |
Parallel WorktreesFan one prompt across five agents, each in its own isolated git worktree — compare the results and merge the winner. |
 |
Terminal SplitsGhostty-class terminals with WebGL rendering, infinite splits, and scrollback that survives restarts. |
 |
Design ModeClick any UI element in a real Chromium window to send its HTML, CSS, and a cropped screenshot straight into your agent's prompt. |
 |
GitHub & Linear, NativeBrowse PRs, issues, and project boards in-app — open a worktree from any task and review without a context switch. |
 |
SSH WorktreesRun agents on a beefy remote box with full file editing, git, and terminals — auto-reconnect and port forwarding included. |
 |
Annotate AI DiffsDrop comments on any diff line and ship them back to the agent — review, edit, and commit without leaving Orca. |
 |
Drag Files to AgentsVS Code's editor with autosave everywhere — drag files or images straight into an agent prompt. |
 |
Orca CLIAgents drive Orca too — script every workflow with |
 |
Also in the box:
- Quick open — Search across worktrees, files, agents, commands, and repo context without leaving your flow.
- Account switcher & usage tracking — See Claude and Codex usage and rate-limit resets, and hot-swap accounts without re-logging in.
- Rich repo previews — Preview Markdown, images, PDFs, and repo docs in the workspace.
- Computer Use — Let agents operate desktop apps and visible UI when a workflow needs real interaction.
- Notifications and unread state — Know when an agent finishes or needs attention, then mark threads unread to come back later.
- And many, many more — we ship daily, so this list is perpetually behind. The changelog is the real feature list.
Supported Agents
Works with any CLI agent — if it runs in a terminal, it runs in Orca.
Claude Code
Codex
Grok
Cursor
GitHub Copilot
OpenCode
MiMo Code
Amp
OpenClaude
Antigravity
Pi
oh-my-pi
Hermes Agent
Devin
Goose
Auggie
Autohand Code
Charm
Cline
Codebuff
Command Code
Continue
Droid
Kilocode
Kimi
Kiro
Mistral Vibe
Qwen Code
Rovo Dev
+ any CLI agent
Install
Desktop — macOS, Windows, Linux
- Download from onOrca.dev
- Or grab a build directly: macOS Apple Silicon · macOS Intel · Windows (.exe) · Linux AppImage · All builds
- Running
orca serveon a headless Linux server? See the headless Linux server guide.
Or via a package manager:
# macOS (Homebrew)
brew install --cask stablyai/orca/orca
# Arch Linux (AUR) — or stably-orca-git to build from source
yay -S stably-orca-bin
Mobile Companion — iOS, Android
Pair with your desktop app to monitor and steer your agents from your phone.
- iOS: Download on the App Store or join TestFlight
- Android: Download APK 0.0.36
Community & Support
-
Discord: Join the community on Discord.
-
Twitter / X: Follow @orca_build for updates and announcements.
-
WeChat: Scan to join the Orca community WeChat group 7.
-
Feedback & Ideas: We ship fast. Missing something? Request a new feature.
-
Privacy: See the privacy & telemetry docs for what anonymous usage data Orca collects and how to opt out.
-
Show Support: Star this repo to follow along with our daily ships.
Developing
Want to contribute or run locally? See our CONTRIBUTING.md guide.
Signed Builds
Windows code signing sponored/provided by SignPath.io, certificate by SignPath Foundation.
License
Orca is free and open source under the MIT License.