[OrcaWin]

ELI5

Removing a project from the command line used to happen silently even if terminals were still running in it. Now the command stops and tells you what you would lose, and you add --force if you really mean it. The remove dialog in the app also tells you how many open terminals will be closed.

What Changed

Before: orca project setup-delete --setup <id> on a project backed by a registered repo dropped the repo at once. Any terminals still running in its workspaces kept running with no project behind them, and the saved workspace details (names, comments, linked issues, ordering) were deleted. The sidebar "Remove Project" dialog said only that files stay on disk.

After:

• The CLI refuses when the project has terminals that are not known to have exited, or workspaces with saved details, and prints the counts plus "Re-run with --force to remove it anyway." With --force, or when nothing is in use, it removes as before.
• The sidebar dialog adds a line such as "2 open terminals in this project will be closed." (the app already closes them on remove; now it says so).

Mechanism: projectHostSetup.delete takes a new optional force field. The CLI always sends it (false unless --force). When it is exactly false, the host that owns the project counts, before deleting:

• its terminals for that repo on that host, using the existing worktree/host fence; a terminal whose host is unreachable counts as possibly live, never as exited;
• workspace metadata for that repo on that host, read through the host-qualified accessor (so a same-id, same-path sibling host's rows count too) and filtered with the same host rule the delete uses to prune it.

A non-zero count throws a readable error instead of deleting. The counting lives in src/main/runtime/project-removal-impact.ts.

Why

• The host decides, not the client. The terminals and metadata live on the execution host, so that host counts them at the moment of the delete. A client-side preflight would need several calls and could go stale before the delete.
• Absent force keeps the old unchecked delete. Clients and hosts update independently. An older desktop app sends projectHostSetup.delete from its own confirmed UI and must not start getting refusals. An older host drops the unknown field, so a new CLI there behaves as it did before. The desktop UI keeps its own confirmation and now shows the terminal count.
• Adapted from the design: the design says "setup-delete / repo remove". There is no repo remove CLI command; repo.rm is only called by the app's remove flow, which already confirms and closes terminals, so it is left alone. The "refresh identity in place" step listed as a prerequisite does not touch this code, so this PR does not depend on it.

Linked Issue

None. This is follow-up D4-3b in the owner-routing design.

Visual Proof

N/A for the CLI (text output). The dialog gains one line of text, built from existing tokens, under the description. Not captured: this machine is load-capped and cannot run Electron.

Testing

• src/main/runtime/project-host-setup-delete-guard.test.ts: acceptance test. It fails on origin/main (2 of 6: the delete runs while terminals or metadata exist) and passes with this change. It also covers the --force path, the unused-project path, the older-client path (no force), and host and repo scoping for SSH and local.

• src/cli/index-project-setup.test.ts: the CLI sends force: false / force: true.

• src/renderer/src/store/repos/repo-removal.test.ts and RemoveFolderDialog.test.tsx: the dialog's terminal count is host-scoped and rendered.

• pnpm tc, oxlint, check:code-quality:changed, localization catalog checks, verify:rpc-params-catalog.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

AI Disclosure

Review

P0/P1 review: an independent reviewer found one P1. The guard read only the raw-id metadata map, so a sibling host with the same repo id and path looked empty and its details could be deleted without --force. Fixed by reading host-qualified metadata, with a regression test; the follow-up review of that fix found no P0/P1.

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• SSH: terminal counts are fenced to the project's own host, and lost contact counts as possibly live (not exited).
• Folder workspaces: their repoId::path::workspace:<id> ids match by repo prefix.
• Windows and WSL: no path handling changes.
• Mixed versions: covered under Why.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 27b17481-d429-43a2-a96f-1058bc03beac

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between a3adffda472ff024ee300894410c94e0367baa26 and ba5b7cb.

---

---

📒 Files selected for processing (1)

• src/renderer/src/components/sidebar/RemoveFolderDialog.test.tsx

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

Project setup deletion now accepts a --force flag. Without force, the runtime checks for live terminals and saved workspace metadata before deleting a setup. The folder removal dialog counts open terminal tabs for the selected repository and host, then displays a singular or plural warning when tabs are present.

---

---

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to ba5b7

Current CLI users must use --force to bypass the terminal and workspace safeguard; older clients retain their established behavior. The inspected deletion and dialog paths use the selected repository and host, and no actionable merge risk remains.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 30.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 15 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: project deletion now warns about live terminals and requires --force.
Description check		The description is detailed and aligned with the template. It explains the user impact, implementation, rationale, testing, visual proof, review status, compatibility considerations, and checklist. Th…

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}