mirror of
https://github.com/stablyai/orca.git
synced 2026-10-08 08:02:32 +00:00
Jinjing
449b8ca17d
* fix(drop): copy macOS drag-temp files so the PTY daemon can read them
macOS screenshot thumbnails live in $TMPDIR/TemporaryItems/NSIRD_*, which
only processes attributed to Orca main may open. The detached PTY daemon is
not, so agents in local terminals get EPERM and Claude Code silently drops
the paste.
fs:resolveDroppedPathsForAgent now copies those files, and only those, into a
private per-user orca-drops-<uid>/orca-drop-XXXXXX/ directory, keeping the
original name. It streams from an O_NOFOLLOW handle capped at the inspected
size, so no xattrs (com.apple.macl) come along. The copy is 0600 in a 0700
directory, bounded by the remote-import per-file and per-drop limits, and
rechecked for changes. Other paths pass through. The local branch returns
per-item results, authorizes what it returns, and accepts no worktreePath.
Expired copies are swept 7 days later.
No renderer calls the local branch outside WSL yet, so this ships dark
until the renderer routes local drops through it.
* fix(drop): route local terminal and composer drops through the resolver
Local terminal drops pasted the dropped path directly, and composer drops
attached it after a per-path authorize call. So a macOS screenshot thumbnail
reached Claude Code as a path in a folder the PTY daemon can't open, and the
paste was silently dropped.
Every local terminal drop now calls fs:resolveDroppedPathsForAgent, pastes
what it returns, and reports skips and failures with local wording ("Could
not prepare N dropped files"). The WSL-only branch and the direct-paste
branch are gone; the local-WSL path mapping stays as a step after
resolution. The composer resolves the whole drop in one call, without a
project path so its attachments never get the WSL rewrite, stats only the
resolved paths, and folds resolver skips and failures into its existing
toast. The pane, transport, mounted and owner checks still run after the
await.
* test: verify resolver and write errors surface independently on drop
Add a test case ensuring that when path resolution and PTY write both fail during a file drop, the UI reports both failures separately rather than letting the write error mask the resolution issues. Refactor error handling in pasteLocalDropPaths to catch IPC resolution errors immediately, then handle paste errors separately, so skipped/failed files are always reported via the finally block regardless of outcome.
* test: extract transport variable in drop resolution test
Improves readability by extracting the terminal transport creation from the Map initialization.
* refactor(drop): extract native file drop relay and temp staging utilitie
- Move the native file drop relay queue from attach-main-window-services into
a dedicated native-file-drop-relay module so it owns the async copy and
forward pipeline for drag-temp files, separate from main window setup.
- Extract shared temp-directory management (ownership checks, sweeps,
permissions) into owned-temp-staging-root, used by both drag-temp copies
and remote clipboard staging.
- Simplify dropped-path-resolution to handle only the WSL path rewrite on
local worktrees; the relay handles macOS drag-temp copying before it
reaches terminal/composer drop handlers.
* fix(drop): pass drag-temp files through uncopied with timeout and budget
Large files exceeding the copy budget are now passed through uncopied instead
of rejecting the drop, so copy failures don't lose the entire interaction.
Copy timeout prevents hung copies from blocking subsequent drops, and budget
tracking accounts for retained copies to prevent disk fill.
Extract darwin-user-temp-dir to resolve the correct macOS per-user temp dir
rather than relying on $TMPDIR.
* fix(drop): discard queued drops on renderer reload
Capture the renderer's lifetime when a drop is enqueued. When the
renderer reloads before a copy completes, the operation cancels and
queued drops are discarded, preventing stale content from reaching
the reloaded document.
* fix(drop): serialize drag-temp copies and localize failure reasons
Main no longer sends user-facing failure messages; instead it sends reason tokens
that the renderer localizes. Drag-temp copies run serially under one byte budget
with a pending-copy limit, so non-temp drops can overtake. When a copy stage
aborts, remove any partial copies made so far. Distinguish 'uncopied' (original
handed over) from 'failed' (couldn't get it at all), and add specific reasons for
storage, permission, timeout, and budget exhaustion.
* fix(drop): serialize drops and extend TTL to 7 days
Ensure drops reach the renderer in arrival order by queuing all path drops,
not just copies. Extend TTL from 24h to 7d to support lazy readers like
drafts and startup prompts. Withhold uncopied files from agents that can't
open originals (terminal, composer), keeping editor-only access working.
41 lines
1.1 KiB
TypeScript
41 lines
1.1 KiB
TypeScript
import { tmpdir } from 'node:os'
|
|
import { isAbsolute } from 'node:path'
|
|
import { runProcess } from '../../shared/child-process/run-process'
|
|
|
|
const GETCONF_TIMEOUT_MS = 5_000
|
|
|
|
let resolved: Promise<string> | null = null
|
|
|
|
/**
|
|
* The per-user temp dir macOS drag providers write to. `os.tmpdir()` follows
|
|
* `$TMPDIR`, so a custom one would hide every `TemporaryItems/NSIRD_*` drop.
|
|
*/
|
|
export function getDarwinUserTempDir(
|
|
platform: NodeJS.Platform = process.platform
|
|
): Promise<string> {
|
|
if (platform !== 'darwin') {
|
|
return Promise.resolve(tmpdir())
|
|
}
|
|
resolved ??= readDarwinUserTempDir()
|
|
return resolved
|
|
}
|
|
|
|
async function readDarwinUserTempDir(): Promise<string> {
|
|
try {
|
|
const result = await runProcess({
|
|
program: '/usr/bin/getconf',
|
|
args: ['DARWIN_USER_TEMP_DIR'],
|
|
timeoutMs: GETCONF_TIMEOUT_MS
|
|
})
|
|
const dir = result.stdout.trim()
|
|
if (result.code === 0 && isAbsolute(dir)) {
|
|
return dir
|
|
}
|
|
} catch {
|
|
// Fall through: `os.tmpdir()` is right whenever `$TMPDIR` is not customised.
|
|
}
|
|
// Why: don't pin a transient failure for the app's lifetime.
|
|
resolved = null
|
|
return tmpdir()
|
|
}
|