NeilandSangrak Choi
b7eaef8148
* fix(ssh): hold the password challenge until the deferred key has been tried When an agent is configured, the first attempt carries only unencrypted explicit keys and leaves default-name (~/.ssh/id_*) and encrypted keys to the no-agent retry. keyboard-interactive still sat at the end of that first attempt's ladder, so a host that collects its password through keyboard-interactive showed the Password: dialog before the deferred key that authenticates had been tried. Since #15588 that prompt goes through the password dialog and caches the answer, and cancelling it marks the attempt cancelled, which also skips the key retry, so the connection fails instead of falling back to the key. An attempt that carries no key but defers some now skips keyboard-interactive when the host lists it as a first-factor method next to publickey. When the host does not list it, the challenge can only be a second factor after the agent key partially succeeded, so it stays in the ladder. When the host does not list publickey, the deferred key cannot help, so it stays too. Attempts that carry a key keep the challenge: SshConnection never retries them with the deferred keys, and the password retry reuses their config. The deferral applies only when every deferred key parses as a private key that needs no passphrase. With an encrypted one the retry would ask for its passphrase instead, so skipping the challenge would only swap one dialog for another, and cancelling the passphrase dialog fails the connection rather than reaching the password flow. A file that is no usable private key (corrupted, a public key under a private-key name, an unsupported type) makes ssh2's connect() throw before the retry sends any auth request, which is not an auth error, so the connection would fail without ever offering the challenge. Those targets keep the origin/main ladder. The cost: when the host rejects the deferred key, its password challenge now arrives on the key retry, one failed handshake (plus a respawned ProxyCommand, if configured) later than on origin/main. Constraint: ssh2 1.17 hands an agent key's USERAUTH_FAILURE to the next agent key before recording partialSuccess, so after an agent partial success the auth handler sees the pre-agent method list with partialSuccess=false Constraint: ssh2 parses config.privateKey before any agent auth can run, so default-name and encrypted keys stay deferred to the no-agent retry Constraint: SshConnection runs the no-agent key retry only when the agent-first attempt carried no key Rejected: drop keyboard-interactive from the deferring attempt's whole initial ladder | ssh2 hides an agent partial success, so publickey,keyboard-interactive hosts lose their second factor Rejected: defer whenever any key is deferred | a mixed-key attempt gets no key retry, so a keyboard-interactive password host would never see the challenge Rejected: defer for encrypted keys too | the Password dialog becomes a passphrase dialog, and cancelling it fails a connection that origin/main completes Rejected: check the deferred keys only for encryption | a garbage or public key file aborts the retry with a non-auth error, failing a connection that origin/main completes Rejected: run the no-agent retry even when no key is waiting on disk | adds the same extra handshake for agent users who have no key to try in between Directive: keep deferKeyboardInteractive in step with the key-retry guard in SshConnection.attemptConnect Confidence: medium Scope-risk: narrow Reversibility: clean Tested: pnpm test src/main/ssh; real-socket fixtures for a first-factor challenge on a publickey,keyboard-interactive host, an encrypted default key, and an agent partial success followed by keyboard-interactive; unit tests for a garbage or public key file under a default key name; mutation checks (no deferral, no key check, encryption-only check, publickey guard removed, whole-ladder withholding, any-key-deferred condition) each fail a new test Not-tested: the reworked revision against a live host Related: #15588 * fix(ssh): keep an agent key's second-factor challenge when the host first offered both methods * fix(ssh): defer the password challenge only for a single waiting key * fix(ssh): read the deferred key only after the agent attempt reaches the challenge --------- Co-authored-by: Sangrak Choi <kars@kargn.as>
Orca
中文 · 日本語 · 한국어 · Español · Français · Português
The AI Orchestrator for 100x builders.
Run Codex, ClaudeCode, OpenCode or Pi side-by-side — each in its own worktree, tracked in one place.
Download Orca
Features
Mobile CompanionMonitor and steer your agents from your phone — get notified when an agent finishes and send follow-ups from anywhere. |
 |
Parallel WorktreesFan one prompt across five agents, each in its own isolated git worktree — compare the results and merge the winner. |
 |
Terminal SplitsGhostty-class terminals with WebGL rendering, infinite splits, and scrollback that survives restarts. |
 |
Design ModeClick any UI element in a real Chromium window to send its HTML, CSS, and a cropped screenshot straight into your agent's prompt. |
 |
GitHub & Linear, NativeBrowse PRs, issues, and project boards in-app — open a worktree from any task and review without a context switch. |
 |
SSH WorktreesRun agents on a beefy remote box with full file editing, git, and terminals — auto-reconnect and port forwarding included. |
 |
Annotate AI DiffsDrop comments on any diff line and ship them back to the agent — review, edit, and commit without leaving Orca. |
 |
Drag Files to AgentsVS Code's editor with autosave everywhere — drag files or images straight into an agent prompt. |
 |
Orca CLIAgents drive Orca too — script every workflow with |
 |
Also in the box:
- Quick open — Search across worktrees, files, agents, commands, and repo context without leaving your flow.
- Account switcher & usage tracking — See Claude and Codex usage and rate-limit resets, and hot-swap accounts without re-logging in.
- Rich repo previews — Preview Markdown, images, PDFs, and repo docs in the workspace.
- Computer Use — Let agents operate desktop apps and visible UI when a workflow needs real interaction.
- Notifications and unread state — Know when an agent finishes or needs attention, then mark threads unread to come back later.
- And many, many more — we ship daily, so this list is perpetually behind. The changelog is the real feature list.
Supported Agents
Works with any CLI agent — if it runs in a terminal, it runs in Orca.
Claude Code
Codex
Grok
Cursor
GitHub Copilot
Muse
DeepSeek Harness
ZCode
OpenCode
MiMo Code
Amp
OpenClaude
Antigravity
Pi
oh-my-pi
Hermes Agent
Devin
Goose
Auggie
Autohand Code
Charm
Cline
CodeBuddy
Codebuff
Freebuff
Command Code
Continue
Droid
Kilocode
Kimi
Kiro
Mistral Vibe
Qwen Code
Rovo Dev
+ any CLI agent
Install
Desktop — macOS, Windows, Linux
- Download from onOrca.dev
- Or grab a build directly: macOS Apple Silicon · macOS Intel · Windows (.exe) · Linux AppImage · All builds
Or via a package manager:
# macOS (Homebrew)
brew install --cask stablyai/orca/orca
# Arch Linux (AUR) — or stably-orca-git to build from source
yay -S stably-orca-bin
Mobile Companion — iOS, Android
Pair with your desktop app to monitor and steer your agents from your phone.
- iOS: Download on the App Store
- Android: Download APK · Install guide
Community & Support
-
Discord: Join the community on Discord.
-
Twitter / X: Follow @orca_build for updates and announcements.
-
WeChat: Group 11 is full. Scan to join the Orca community WeChat group 12.
-
Feedback & Ideas: We ship fast. Missing something? Request a new feature.
-
Privacy: See the privacy & telemetry docs for what anonymous usage data Orca collects and how to opt out.
-
Show Support: Star this repo to follow along with our daily ships.
Developing
Want to contribute or run locally? See our CONTRIBUTING.md guide.
The relay that pairs the mobile app with a desktop host is also in this repository under
cloud/, with a separate pnpm workspace and setup guide.
Signed Builds
Windows code signing sponored/provided by SignPath.io, certificate by SignPath Foundation.
License
Orca is free and open source under the MIT License.