[nwparker]

	Files	Added	Deleted	Net
Test	4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​774	$\color{#cf222e}{\Huge{\mathbf{−}}}$​1	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​773
Prod	16	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​985	$\color{#cf222e}{\Huge{\mathbf{−}}}$​28	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​957

ELI5

This PR does the conversion that #33128 only computed. When someone converts a project that Orca has open through WSL's view of a Windows drive (\\wsl.localhost\Ubuntu\mnt\c\src\app), Orca:

1. checks the project;
2. puts its terminals to sleep, keeping each shell's folder;
3. writes down what it is about to do;
4. restarts.

On the way back up, before the window opens, Orca renames everything to C:\src\app: tabs, layouts, worktree settings, sleeping agents, chats, orchestration history, and each slept terminal's saved history. Panes then wake into their old scrollback and folder, and Git runs on Windows. A crash at any point either finishes the conversion at the next start or leaves everything as it was.

What Changed

• Before: these projects can't be converted. The WSL mover refuses them, and they keep slow WSL Git (R36).
• After (behind the internal WSL hosts gate, Windows only): wslDriveUnc:convert converts them. The settings button and the renderer-side stores come in the next PR.
• How:
  • Start (src/main/wsl/wsl-drive-unc-conversion-run.ts):

    • It refuses when:

      • a conversion is already waiting;
      • a repo is outside feat(wsl): scope and path map for converting UNC Windows-drive projects (D1c-4a) #33108's scope;
      • a dry run of feat(wsl): re-key the profile of UNC Windows-drive projects converting to drive paths (D1c-4b) #33128's rewrite would split a project, or find different user data under both a UNC key and its drive key. The refusal names which, and the key. Bare rows that startup discovery wrote under the drive path merge into the saved UNC rows instead of refusing;
      • Git for Windows is missing;
      • a linked worktree was made by WSL Git.

      The last two reuse feat(wsl): run Git for Windows for a WSL project on a Windows drive (D1c-2) #33090's checks, run on the drive path.

    • It then runs the WSL mover's pause, pauseWslMoveScope. That runs the terminal gate, then Sleep, keeping each shell's folder.

    • It writes a prepared journal entry with the old→new worktree ids, then restarts with quit (not exit), so the window and the store save the slept panes first.

  • Journal (wsl-drive-unc-conversion-journal.ts): built on the mover's createMigrationJournalDirectory (durable, owner-only, fails closed), in its own wsl-drive-unc-conversions/ directory.
  • Fence: while an entry is prepared, the mover's fence keeps the projects read-only, with no new terminals (withWslDriveUncConversions in wsl-move-fence.ts). A terminal started in that gap would keep the old id.
  • Startup (wsl-drive-unc-conversion-startup.ts): runs in main-process-ready-foundation.ts before the profile store opens.
    • The profile write is the commit point. It goes through the profile-transfer path: one SQLite transaction with an expected revision (writeProfileProjectDomainChanges), and only the fields the rewrite changed are written.
    • A failure before that commit drops the journal, and nothing has changed (rolled-back).
    • After it, each other store runs in order and is recorded in the journal's ledger. A failed store is retried at the next start (resuming).
    • A crash between the profile commit and the journal update is safe: the rewrite is idempotent, and the id map was journaled before the commit.
  • Stores outside the profile (wsl-drive-unc-conversion-stores.ts):
    • Terminal sessions: each daemon session folder terminal-history/<session id> is renamed to the new id. A slept pane reattaches by its id, so it wakes with its scrollback and folder. The folder holds no id of its own.
    • Shell history: bash/zsh folders under terminal-history*/<hash(worktree id)> move to the new hash, and their meta.json is updated.
    • Orchestration history: reuses the mover's rewriteWslMoveOrchestrationHistory, now exported as a file-level function.
    • Chat journal: journal_sessions.workspace_id and each record's location.workspaceId, in one transaction. A record this build can't read stays byte-identical.

Why

• Owner decision: these projects become Windows projects with WSL terminals.

• Why a restart instead of rewriting live. This touches every saved id at once. Doing it before anything opens means:

  • one atomic profile write;
  • no window to hold off;
  • no live terminals to detach;
  • no service with the chat or orchestration database open.

  Profile transfer already restarts the same way.

• No undo, on purpose. Once the profile write commits, the conversion is one-way, like the decision not to build a reverse mover. Going back would mean re-keying every id to a UNC path that WSL 2.7.11 no longer lets Windows open. A failure before the commit leaves everything as it was.

• Why not reuse the mover's commit and desktop-rewrite pipeline. It is built around a destination host: a manifest, staging, a host commit, and a re-seeded host partition. Here nothing leaves this computer. So this reuses the mover's pieces (pause, fence, journal directory, orchestration rewrite) and the profile-transfer write, rather than a second copy of the pipeline.

Linked Issue

Part of the WSL re-write, step D1c-4 (risk rows R36, R6). Stacked on #33128.

Visual Proof

N/A: the IPC has no UI yet (next PR).

Testing

• Automated tests:
  • wsl-drive-unc-conversion-startup.test.ts, against a real profile SQLite database, terminal history folders and a chat journal database. It covers:
    • the full conversion, checking that only the re-keyed fields were written;
    • rollback on a collision;
    • a failed store resuming at the next start;
    • a crash after the profile commit.
  • wsl-drive-unc-conversion-run.test.ts covers:
    • the journal and pause;
    • the WSL-made worktree, out-of-scope repo and missing Git refusals;
    • the seeded real-host shape: a saved UNC worktree with tabs beside the bare drive row discovery wrote converts, and differing data refuses with its cause and key;
    • every UNC path throwing EPERM (WSL 2.7.11 denies \\wsl.localhost\<distro>\mnt\c\… to Windows): the checks only touch the C:\ side;
    • busy terminals;
    • a second conversion while one is waiting;
    • the fence before and after the profile rewrite.
• pnpm tc:node, plus the mover, IPC, profile and startup suites (7.5k tests), pass locally.
• Manual on Windows: not run. No Windows box is assigned to this work, and the shared ones are off limits.

Review

Self-reviewed.

Agent skill upstream boundary

• Not applicable.

Notes

• Flag-off: no change. The new startup step returns before reading anything unless it is Windows with the gate open (wsl-drive-unc-conversion-startup.ts), and the new IPC refuses while the gate is closed. The one ungated addition is the mover fence's existsSync on the conversion-journal folder, which only the gated convert handler can create, so it returns nothing. Everything else is a refactor or a type. The meta.json handling and the narrower pending check run only inside the gated conversion. Edge case, internal testers only: a journal left prepared by a run with the gate open keeps fencing its projects after the gate closes, because the startup step that finishes it is skipped. That fails safe.
• Known gaps (follow-ups):
  • The renderer's local stores (quick-open history, notebook kernels, file view preferences) come in the next PR.
  • Fish history is kept by fish under its session name, so it doesn't carry over. The mover doesn't carry it either.
  • An edit refused in the second before the restart shows the mover's "moving to its WSL host" message.
• SSH and paired hosts: untouched; local projects only.
• Wire compatibility: none. These are desktop-only IPC, and the profile shape is unchanged.
• Downgrade: an older build reads the converted profile as an ordinary C:\ project on WSL. It ignores the journal directory.

Status

• 2026-10-28, head 74d1a1b05bc: rebased onto main 64344142fa0, which has feat(wsl): run Git for Windows for a WSL project on a Windows drive (D1c-2) #33090 squash-merged (fix(wsl-host): tell users how to fix a distro Orca can't host (D1c-1) #33085 earlier) and fix(wsl-mover): hold an app update install while a moved project comes back #35357; feat(wsl): offer Git for Windows in a Windows-drive WSL project's settings (D1c-3) #33097 now targets main. Every commit is kept. CI: running on this head.
• Safety review fix: a shell-history meta.json that a crash left torn is skipped instead of throwing, so a conversion can no longer stall before re-keying chats. The file is now written atomically (temp file, fsync, rename via writeFileDurableSync). A new conversion is refused only while this profile has a prepared journal. Tests cover a torn meta.json, the startup step leaving a journal untouched with the gate closed or off Windows, a profile-rewritten journal not blocking a new conversion, and the IPC handlers (refused with the gate closed or off Windows, parsed for the active profile, invalid arguments rejected). The optional Low item (a failed history rename on the failure path) is not done.
• Re-review: only this profile's waiting conversion refuses a new one as conversion-pending (the same per-profile filter startup uses). Test added; it compares the two journals without depending on directory order, which differs between filesystems.
• Review fixes: a failure writing the journal after the commit leaves it prepared and reports resuming, never a false rolled-back (test throws on that write). The journal records profileId, and startup runs only the active profile's conversions. The run reads the distro's drive mounts for the scope check.
• Added here: the conversion's pause connects to a WSL host as a user action, the mode Land the WSL project mover dark (merges only after verify-15b, the flag-off audit and green CI) #34059's mover now asks for (it would not typecheck otherwise). Kept from the previous owner: the refusal names its cause, startup rolls back only when the drive key holds different user data, and a test that the conversion runs Windows Git only on the drive path.
• pnpm tc, pnpm run typecheck:ci, the PR's tests, check:code-quality:changed, the anti-slop oxlint, repo oxlint and ast-grep (including the no-real-time-sleep test rules) and the e2e typecheck ratchet all pass locally on this head, run one branch at a time.

[greptile-apps]

Uncertain commits lose their journal

rewriteProfile throwing does not prove the profile rolled back. The profile writer can throw ProfileStateIndeterminateWriteError when COMMIT ends without a confirmed rollback. This catch still deletes the conversion journal.

If the commit took effect, the profile uses drive paths, but terminal history, chats, and the other stores keep their old IDs with no journal left to retry them. Keep the journal when the write result is uncertain and check the saved profile before deciding to roll back.

Knowledge Base Used: Desktop persistence and lifecycle

[greptile-apps]

Retries abandon old shell history

If shell-history fails after the profile commits, startup continues and the project can open new terminals. A new terminal creates the history folder for the new worktree ID. On the next start, this check skips the old folder because the destination exists, then marks the store complete without copying its history.

The old folder still names the old worktree and can be deleted by history cleanup. Keep affected terminals blocked until their history moves, or merge both folders safely before recording completion. The same skip-existing check also appears in renameTerminalSessions.

Knowledge Base Used: Desktop persistence and lifecycle

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 82d21727-c351-4d32-9bdb-22655210e4ce

Commits

Reviewing files that changed from the base of the PR and between dc4a990 and c675fa9.

Files selected for processing: 20

• src/main/app-relaunch.ts
• src/main/ipc/register-core-handlers/register-core-handlers.ts
• src/main/ipc/wsl-drive-project-handlers.test.ts
• src/main/ipc/wsl-drive-project-handlers.ts
• src/main/ipc/wsl-drive-unc-conversion-handlers.test.ts
• src/main/ipc/wsl-drive-unc-conversion-handlers.ts
• src/main/orca-profiles/profile-project-domain-changes.ts
• src/main/persistence/moving-wsl-projects/wsl-move-fence.ts
• src/main/persistence/moving-wsl-projects/wsl-move-orchestration-history-rewrite.ts
• src/main/persistence/moving-wsl-projects/wsl-move-scope-guard.ts
• src/main/startup/main-process-ready-foundation.ts
• src/main/wsl/wsl-drive-project-windows-git.ts
• src/main/wsl/wsl-drive-unc-conversion-journal.ts
• src/main/wsl/wsl-drive-unc-conversion-run.test.ts
• src/main/wsl/wsl-drive-unc-conversion-run.ts
• src/main/wsl/wsl-drive-unc-conversion-startup.test.ts
• src/main/wsl/wsl-drive-unc-conversion-startup.ts
• src/main/wsl/wsl-drive-unc-conversion-stores.ts
• src/main/wsl/wsl-drive-unc-state-rewrite.ts
• src/shared/wsl-drive-unc-conversion-types.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Other profiles lose terminal access

resolveWslMoveFence loads every profile's conversion journal, but startup only finishes the active profile's conversions. If an interrupted conversion leaves profile A's journal prepared, switching to profile B still blocks A's project IDs and folders. A project shared by both profiles can no longer open terminals in B, even though B has no pending conversion.

Filter conversion journals by the active profile when building the fence, matching startup.