Repository navigation
fix(sidebar): raise selected workspace contrast in dark mode - #8321
Merged
nwparker merged 1 commit intoJul 26, 2026
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughWorkspace card active styling now uses data attributes instead of secondary-specific Tailwind classes. Main CSS updates light and dark primary and secondary active surfaces, including backgrounds, borders, and box-shadow rings. Quick-action tests now verify the active-state and surface attributes and ensure previous background utility classes are absent. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Taking a look! |
Dark-mode active worktree cards used a 10% white wash on transparent, which nearly vanished on --worktree-sidebar. Drive selection from token-based color-mix into the sidebar fill, and stop Tailwind from overriding the CSS state. Fixes stablyai#6213
brennanb2025
force-pushed
the
fix/6213-selected-workspace-contrast
branch
from
July 21, 2026 00:20
4b3fb49 to
982bee6
Compare
Contributor
|
Thanks for the fix! I rebased this onto current main and tightened the implementation before pushing it to the PR branch. The live active-state attribute now owns the complete primary/secondary card styling, which avoids stale utility styles during immediate navigation; primary selection also uses the dedicated worktree-sidebar tokens with a clearer dark-mode surface and border, while the secondary ring is preserved in CSS. I added focused DOM and stylesheet regression coverage and verified 61 relevant tests, renderer typecheck, touched-file lint/React Doctor, formatting, and the max-lines ratchet. |
Contributor
Manual QA — before / after (dark mode)Electron, Appearance → Dark. Base = Selected inactive workspace
Selected primary workspace
Selected bg before: |
Contributor
|
@anishekkamal sorry took awhile, PR makes sense! Merging |
This was referenced Jul 27, 2026
OrcaWin
added a commit
that referenced
this pull request
Jul 27, 2026
…10697) * fix(browser): retry a transient Windows lock on the Chromium cookie snapshot copy The snapshot attempt loop only reacts to a `false` return, so a throwing copy escaped it entirely. On Windows, AV/EDR briefly opens a file literally named "Cookies" with FILE_SHARE_NONE, which turns an otherwise-fine copyFileSync into `EBUSY errno -4082 syscall=copyfile` and aborts the whole import (#9355). Route the main-database copy through the existing `copyFileWithWindowsRetry`, already used for the same AV window in #1507. It is a no-op off Windows (maxAttempts=1), so POSIX still fails fast and ENOENT is never retried on any platform. * fix(browser): degrade the cookie-import staging DB instead of aborting the import Staging exists only to back the cold-restart replay for cookies the in-memory path rejects, but three points in it were fatal to the whole import (#9355): - the staging copy from the live partition DB — also a file named "Cookies", so the same AV/EDR handle blocks it; - opening/PRAGMA-ing that staged file; - both were unguarded, so a throw escaped to the catch-all and returned `ok: false` even when every cookie could load in memory. Each is now non-fatal and diagnosed. Two invariants keep the degraded path honest: `imported++` moved out of the staging insert so the summary counts importable cookies rather than staged rows, and `setPendingCookieImport` is never called when staging is unavailable — registering a path that was never written would replay a missing or partial DB over the live partition on cold start. * fix(browser): stop a degraded cookie import from replaying a stale staged database Review round 1 found the staging-degradation path could leave an older pendingCookieImports entry registered while the import rewrote the live session, so the next cold start replayed the stale DB over fresh cookies. - add clearPendingCookieImport so a degraded import retires the old entry - degrade staging on BEGIN/insert/COMMIT failure instead of aborting the import - discard the staged cookie copy on every non-registering path - pin the stagingAvailable guard, which previously survived mutation Co-authored-by: Orca <help@stably.ai> * fix(browser): report a degraded cookie import honestly instead of as a clean success Making the staging failure non-fatal introduced a silent-loss path: the import clears the live jar before loading cookies, so when staging was unavailable AND Electron rejected cookies, the user lost their old jar, got none of the new cookies, and still saw "Imported N cookies". Adds an optional `warning` to the import summary, set only on that degraded branch, and routes every cookie-import toast through a shared emitter that raises a warning toast instead of an unqualified success. Also closes three test holes found in review: - clearPendingCookieImport had no direct tests; deleting the wrong partition key survived all 10 registry persistence tests. Now covered, mutation killed. - The staging-insert-failure test was vacuous (memoryFailed === 0 suppressed registration on its own). It now forces a memory failure. - No test pinned the success-path clear; removing it survived. Now covered. * fix(github): resolve owner/repo through SSH Host aliases (#10284) (#10361) * fix(github): resolve owner/repo through SSH Host aliases (#10284) Expand OpenSSH Host → HostName via ssh -G before classifying github.com identity so PR merge works when origin is git@alias:owner/repo.git. Transport URLs stay unchanged so IdentityFile selection is preserved. Do not long-negative-cache indeterminate ssh -G failures. * fix(github): harden SSH alias resolution * Update README downloads badge * fix(persistence): fsync state writes so a rename is actually durable (#10631) * fix(persistence): fsync state writes so a rename is actually durable `Store` wrote `orca-data.json` to a temp file and renamed it. rename() is atomic for readers but says nothing about durability: without an fsync the directory entry can reach disk before the data does. After power loss or a hard crash the file can come back holding the previous state or, worse, zero bytes — and `JSON.parse('')` throws, so an empty file takes the full corrupt-file path rather than degrading. This is the same empty-file symptom as #1158 from a different cause. That issue fixed a logic path that persisted empty state and added the .bak ring as a safety net; the ring also catches this, which is why it went unnoticed. Recovery costs up to an hour of tabs/layouts/session state (backups are throttled to >=1h spacing), and a user in their first hour has no backup slot yet, so they land on defaults indistinguishable from a fresh install. Both write paths now fsync the temp file *before* the rename, then fsync the containing directory. Directory fsync is best-effort by design: Windows cannot open a directory for fsync and some filesystems reject it, so it is swallowed. The file fsync is the load-bearing part and works everywhere. Measured cost on a 3 MB payload: ~0.2 ms per write, against a 1s debounce. The async path does not block the main thread. The syscall-order test mocks `node:fs` and counts fsync targets at the module boundary, asserting ['file', 'directory'] — proving the ordering rather than inferring it from reading the implementation, since a fsync after the rename would still pass every content assertion. * test(persistence): make the syscall proof platform-aware and actually prove the order Two problems, both found from CodeRabbit's Windows observation. The assertion hardcoded ['file', 'directory']. Directory fsync is deliberately best-effort — Windows cannot open a directory for fsync and some filesystems reject it — so on Windows the helper swallows the failure, only the file fsync is observed, and the test fails. The expectation now probes the real platform instead of assuming, keeping the guarantee tight where directory fsync works rather than dropping it everywhere. Worse, the test did not prove what its name claimed. Moving the fsync to *after* the rename still passes: the file is fsynced either way, and only fsyncs were recorded, so the correct and broken orders produced an identical log. Mutation-testing the "before rename" claim is what surfaced this — the mutation passed. The rename is now recorded in the same sequence, since it is the boundary the ordering is defined against. Re-running the same mutation fails, so the ordering claim is now backed by the test rather than asserted in a comment. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(window): stop burning macOS GPU on an invisible blur effect (#8482) (#10682) Co-authored-by: Orca <help@stably.ai> * feat(sidebar): distinguish and filter CLI-created workspaces (#10712) * perf(relay): stop snapshotting the whole pending-PTY map every drain tick (#10670) * perf(sidebar): share one worktree-keyed agent orchestration index (#10678) Co-authored-by: Orca <help@stably.ai> * fix(mobile): recover unreliable relay connections (#10709) * fix(mobile): recover unreliable relay connections * test(mobile): use valid raster preview fixtures --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * release: v1.4.157-rc.0 * docs(relay): trim the pending-output drain comment (#10714) Co-authored-by: Orca <help@stably.ai> * fix(history): quarantine unreadable recovery generations. (#10713) * fix(history): quarantine unreadable recovery files * fix(history): preserve mixed recovery generations * fix(history): reanchor reconciled live sessions * fix(history): serialize final checkpoint queue * fix(history): drain sleep shutdowns before disconnect * fix(history): restore legacy wide sessions * fix(history): preserve malformed mixed logs * fix(history): preserve malformed log tails * refactor tests to reduce file size * refactor(history-recovery): extract freeze helper and improve test robus - Extract takeRecoveryFreeze to eliminate duplicated freeze-and-clear pattern across five call sites - Skip permission-mode tests on root CI containers (chmod 0o500 doesn't block root writes) - Replace fixed sleep with deterministic wait for queued exclusive checkpoints - Distinguish ENOENT (missing) from corrupt in history metadata reads - Add ceiling-dimension restore test and torn-tail exclusion assertion - Wrap chmod operations in try/finally to prevent leaked permissions from masking test failures - Add .catch() to checkpoint promise to prevent unhandled rejections from finally re-throws * test(history-recovery): consolidate checkpoint assertions Wait for both the checkpoint call and set clear atomically to avoid a timing race where the spy fires before the set is cleared. * fix(persistence): unbreak main by expecting the new 'cli' card property in fresh defaults (#10722) Co-authored-by: Orca <help@stably.ai> * fix(sidebar): stop worktree drag from spazzing when cards resize mid-drag (#10725) * fix(sidebar): make Cmd/Ctrl+1-9 match the rendered card order when the sidebar is closed (#10693) * fix(native-chat): wrap question text and option descriptions instead of truncating (#10025) * fix(mobile): pop to home when leaving a host so the back chevron animates backward (#9723) * fix(i18n/zh): correct technical literals and clear sense errors (#10048) * feat(speech): add Korean streaming zipformer STT model (#9893) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(source-control): add copy relative path (#9018) * fix(gitlab): stop refresh button overlapping dialog close X (#9445) * fix(gitlab): stop refresh button overlapping dialog close X The GitLab item dialog's SheetContent renders its own close (X) at absolute right-4, but the header refresh button sat at the header's px-5 right padding and overlapped it. Reserve pr-10 on the header so the refresh button clears the close X, and lift it -mt-1.5 so its icon aligns with the close X on the same line. * fix(gitlab): integrate sheet controls into header --------- Co-authored-by: viniciussilva <vinicius.silva@plus10.de> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * fix(sidebar): raise selected workspace contrast in dark mode (#8321) * feat(editor): toggle Word Wrap from file tab actions and Alt+Z (#10086) * feat(editor): toggle Word Wrap from file tab actions and Alt+Z Long single-line and structured files wrap by default and misalign. Surface Word Wrap on the editor more-actions menu for normal file tabs (diff already had it) and add editor.toggleWordWrap (Alt+Z) so users can unwrap without opening Settings. Closes #9974 * fix(editor): toggle diffWordWrap for diff surfaces on Alt+Z CodeRabbit: Alt+Z previously always flipped editorWordWrap, leaving diff panes out of sync with the markdown actions menu. * test(editor): verify word wrap shortcut routing Cover editor/diff setting callbacks and the cross-platform Alt+Z binding. --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(repo-icon): detect Tauri and WebP icons (#7942) Expand repository icon auto-detection to conventional Tauri and public/icon paths with PNG/WebP magic and dimension validation. Bound SSH probing while preserving candidate priority and PNG-only user uploads; SVG remains rejected. * Add bulk tab closing to mobile long-press sheets (Close Others / Left / Right) and complete the desktop tab context menus (#9323) * Add Close Tabs to the Left and complete Close Others across tab menus and mobile long-press sheets * Fold the per-sheet Close action into the bulk-close module (session route max-lines) * fix(mobile): preserve pinned tabs during bulk close --------- Co-authored-by: Tom de Bres <tomdebres@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * feat: implement Cmd+Enter as commit shortcut in Source Control (#9773) * feat: implement Cmd+Enter as commit shortcut in Source Control * test: add unit tests for commit shortcut and tooltip formatting * fix: address review feedback on modifier keys and test coverage * test: split mac and windows/linux shortcut and keydown tests --------- Co-authored-by: Andres Van Reepingen <andres.vanreepingen@datacamp.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * Add SenseVoice speech-to-text model (Korean/Japanese support) (#7436) * Add SenseVoice speech-to-text model (Korean/Japanese support) SenseVoice (zh/en/ja/ko/yue) is the only bundled local STT model with Korean and Japanese support. The existing local models cover only English and Chinese (Parakeet, Zipformer, Paraformer); Whisper Tiny is multilingual but trades accuracy for breadth. - Add 'senseVoice' to SpeechModelType - Register the sherpa-onnx SenseVoice archive in the model catalog (pinned SHA-256, single-file model.int8.onnx + tokens.txt layout) - Handle the senseVoice type in the STT worker via createOfflineRecognizer with the senseVoice model config (auto language detection + ITN) - Add model-catalog regression tests for the new entry Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(speech): use int8-only SenseVoice archive * fix(speech): refresh SenseVoice catalog metadata --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: LauraGPT <LauraGPT@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(settings): show a way back to local accounts when a remote server owns provider-account scope (#8188) Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * feat(speech): add Parakeet TDT-CTC 0.6B JA voice model (#8207) * Add SenseVoice speech-to-text model (Korean/Japanese support) SenseVoice (zh/en/ja/ko/yue) is the only bundled local STT model with Korean and Japanese support. The existing local models cover only English and Chinese (Parakeet, Zipformer, Paraformer); Whisper Tiny is multilingual but trades accuracy for breadth. - Add 'senseVoice' to SpeechModelType - Register the sherpa-onnx SenseVoice archive in the model catalog (pinned SHA-256, single-file model.int8.onnx + tokens.txt layout) - Handle the senseVoice type in the STT worker via createOfflineRecognizer with the senseVoice model config (auto language detection + ITN) - Add model-catalog regression tests for the new entry Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(speech): add Parakeet TDT-CTC 0.6B JA to the speech model catalog * test(speech): cover stt-worker-model-config file resolution incl. single-file models * feat(speech): decode Parakeet TDT-CTC JA via sherpa-onnx nemoCtc offline recognizer * fix(speech): use int8-only SenseVoice archive * fix(speech): refresh SenseVoice catalog metadata --------- Co-authored-by: xsacdw <xsacdw@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: LauraGPT <LauraGPT@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(terminal): stop switch bold flash and Windows lag (#10692) * fix(terminal): stop bold flash on worktree switch Worktree hide disposes WebGL and falls back to xterm's DOM renderer. On reveal, resume ran after paint and flushed backlog against DOM first, so the first frame used heavier CSS-AA glyphs before WebGL settled. Resume in useLayoutEffect and reattach WebGL before backlog flush so the first painted frame stays on the GPU path. No cold-park policy change. Co-authored-by: Orca <help@stably.ai> * fix(terminal): fit WebGL grid before backlog flush on resume Adversarial review: resume-before-flush alone wrote TUI backlog onto the transient DOM↔WebGL one-column-off metrics window. Order is now resume → fitAllRevealedPanes → flush on heavy reveal and window wake. Co-authored-by: Orca <help@stably.ai> * fix(terminal): latch viewport intent before WebGL wake resume Adversarial review: wake path synced intents after resume/fit, which can re-latch a pinned viewport as followOutput. Capture before reattach and drop the post-resume re-sync on heavy reveal (outer path already latched). Co-authored-by: Orca <help@stably.ai> * fix(terminal): complete visibility bookkeeping before PaneManager exists useLayoutEffect runs before the passive lifecycle creates PaneManager, so the mount-visible path never set hasCompletedVisibleResume. The first intra-worktree hide then wrongly suspended WebGL. Bookkeep completion even when managerRef is still null (extracted helper for max-lines). Co-authored-by: Orca <help@stably.ai> * fix(terminal): re-sync pin geometry after resume backlog flush Keep the pre-resume intent latch (reattach must not re-latch pins as followOutput), then re-sync after flush with preservePinnedAtBottom so scrollback trim updates absolute pin lines before enforce. Co-authored-by: Orca <help@stably.ai> * fix(terminal): drop same-tick post-flush intent re-sync flushTerminalOutput only queues terminal.write and returns before parse, so a same-tick re-sync read pre-parse resume/fit geometry and could overwrite pre-resume pins. Keep pre-resume latch + enforce only. Co-authored-by: Orca <help@stably.ai> * fix(test): expect default worktree card properties to include cli #10712 added 'cli' to DEFAULT_WORKTREE_CARD_PROPERTIES, but the fresh default-profile assertion still omitted it and fails verify. Co-authored-by: Orca <help@stably.ai> * perf(terminal): retain Windows WebGL across worktree hides * perf(terminal): bound retained WebGL contexts * fix(terminal): harden retained WebGL lifecycle * fix(terminal): preserve healthy WebGL on wake * fix(terminal): preserve reveal recovery ordering --------- Co-authored-by: Orca <help@stably.ai> * fix(mobile): clear native-chat composer optimistically at send time (#10226) * fix(mobile): clear native-chat composer optimistically at send time Over relay the send RPC round trip is visible and a lost ack (or a relay/direct cutover) could strand the sent prompt in the composer forever: the unconfirmed-send deadline dropped its tracking entry, so a late transcript echo could never clear the draft. Clear the draft at send time and restore it only on a definite rejection. holdUnconfirmedSend now only manages the delivery-unconfirmed notice; it no longer touches drafts. * fix(mobile): isolate question answers from composer drafts * fix(cli): bound orchestration ask timeouts (#10689) * fix(cli): bound orchestration ask timeouts * fix(cli): harden remote timeout boundaries * fix(crash-reporting): stop fit-retry bursts from erasing the pre-crash trail (#10729) * fix(crash-reporting): stop fit-retry bursts from erasing the pre-crash trail Windows renderer OOM F0BKR84AHEH (0xE0000008) arrived with a 30-entry breadcrumb ring in which two `terminal_safe_fit_retry_exhausted` bursts consumed 26-90% of the slots. Every hidden pane is `display:none` -> 0x0 -> unmeasurable, so one post-reload reattach wave exhausts the retry budget once per mounted pane inside ~60ms. The bursts were also uninterpretable: `pane.id` restarts at 1 per PaneManager and there is one manager per tab, so 34 identical `paneId: 1` crumbs cannot distinguish one pane looping from 34 panes firing once. Coalesce the crumb by name and carry the live-pane census on the payload instead, so the count survives without costing 34 ring slots. Same treatment for WebGL diagnostics, which were worse off: context-loss and atlas-reset crumbs only reached a DevTools-only ring (`window.n()`), so a renderer that dies takes them with it. That bundle had three GPU-process deaths in the 65s before the renderer OOM and zero WebGL evidence - absence of instrumentation, not absence of the event. Mirror them into the crash report, coalesced per kind so a routine atlas reset cannot mask a context loss. Evidence-only: no behavior, rendering, or lifecycle path changes. Co-authored-by: Orca <help@stably.ai> * perf(pane-manager): count panes without materializing public views The census runs on the crash path; getPanes() allocates a full ManagedPane projection per pane just to read .length. Co-authored-by: Orca <help@stably.ai> * test(crash-reporting): pin the fit-retry burst against the 30-entry ring Reproduces the F0BKR84AHEH ring loss directly: 10 pre-crash crumbs plus a 34-crumb per-pane burst. Uncoalesced, the burst takes all 30 slots and zero pre-crash crumbs survive; coalesced, it takes one slot, all 10 survive, and the pane count rides on the payload instead of on the crumb multiplicity. Co-authored-by: Orca <help@stably.ai> * fix(crash-reporting): name the WebGL census the same as the fit-retry census The context-loss crumb spread getLivePaneCensus() raw, so one ring described one measurement two ways: managers/panes here, livePanes/livePaneManagers on the fit crumb. Spreading also meant renaming the census return keys would silently reshape the crumb. Name the fields at the call site and pin them. Co-authored-by: Orca <help@stably.ai> * fix(crash-reporting): keep a hot coalesce key from being the first LRU eviction The suppression path returned before the delete-then-set that re-anchors recency, so a key hit continuously never moved from its original insertion slot and became the first eviction candidate — the inverse of the LRU's stated intent. `renderer_error` keys carry message+stack identity, so one noisy render loop mints unbounded distinct keys. Within a single 30s window that churn evicted the `terminal_safe_fit_retry_exhausted` key mid-burst, un-suppressing it and re-arming the exact ring flush the coalescing exists to prevent. Re-anchor position only; `recordedAt` is left alone so the suppression window still expires on schedule rather than renewing on every hit. Found while adversarially probing the LRU claim in #10729's own description, which asserted these keys "cannot evict live keys". * fix(crash-reporting): report the newest census of a coalesced burst The suppression path wrote nothing to the ring, so a coalesced burst froze its FIRST event. Panes mount progressively, so pane 1 exhausting alone legitimately measures livePanes: 1 -- and the 33 later crumbs, each carrying a truer census, were dropped. A 34-pane wave was recorded as `livePanes: 1` with no count: the exact "one pane looping" misread that coalescing by name was introduced to prevent. The existing burst test missed this because it fed a constant census on every crumb, making frozen-first and newest-wins indistinguishable. Stash the newest payload and fold it into the ring entry the key already owns: still one slot, now reading livePanes: 34 + suppressedSinceLast: 33. Resolution is deferred to snapshot time -- sanitizing per suppressed hit of a 1459/min crash loop measured 2194 ns/op vs 185 ns/op deferred. Two follow-on defects fixed alongside: an expiring key dropped its pending payload (it loses its only handle on the ring entry), and resolving the re-emitting key's own old slot double-counted a burst. --------- Co-authored-by: Orca <help@stably.ai> * fix(speech): download verified model artifacts directly (#10735) * perf(renderer): give owner-routed settings a stable identity (#10743) Co-authored-by: Orca <help@stably.ai> * perf(agent-status): validate hook payloads without the JSON round trip (#10752) * fix(gpu-fallback): make the crash window rolling, not launch-anchored (#10707) * fix(gpu-fallback): make the crash window rolling, not launch-anchored Software-rendering fallback only ever considered GPU child crashes in the first 30s after launch: `if (msSinceLaunch > this.windowMs) return`. Session 12e6ee64 crashed the GPU child 4 times (242s / 920s / 926s / 946s since launch). The last three span 26.0s — inside windowMs, exactly threshold — but every one was rejected because the burst began 920s in. The renderer died of process OOM (0xE0000008) 39s later. GPU work is demand-driven, so the first heavy compositing often happens minutes into a session. What distinguishes a broken driver from normal Chromium churn is that the crashes *cluster*, not when the cluster starts. Keep a sorted array of recent crash times pruned to windowMs behind the newest, and engage when the count reaches threshold. Measured against real field telemetry (341 distinct win32 launches with >=1 GPU crash, from process_gone_suppressed breadcrumb trails): the rolling window engages on 2/341 launches (0.59%), one of which is 12e6ee64. Max GPU crashes in any single launch is 4. The closest non-firing sequence ([0, 29531, 55136, 74178] — consecutive gaps that each fit the window but never put 3 inside it) is pinned as a regression test. Also destroy the Windows tray before app.exit(0) on this path, matching the app:relaunch IPC handler — app.exit skips before-quit, and this can now fire deep into a session rather than only in the first 30s. Mutation-tested: 6 mutants (launch-anchored gate, dropped pruning, dropped monotonic clamp, cutoff </<=, threshold >=/>, dropped engaged latch), all killed by the suite. Co-authored-by: Orca <help@stably.ai> * fix(gpu-fallback): ask before restarting --------- Co-authored-by: Orca <help@stably.ai> * feat(sidebar): add a filter to hide detached-HEAD workspaces (#10786) Adds "Hide detached HEAD" alongside the existing sidebar filters, wired through the same pipeline as Hide CLI-created: sidebar list, Cmd+J empty-query list, workspace board, active-filter badges, Clear/Reset Filters, and persisted UI state. The predicate reuses getWorktreeGitIdentityDisplay so the filter targets exactly what the card renders a Detached HEAD badge for. Requiring a real head (not just an empty branch) keeps folder workspaces and SSH-synthesized rows — which carry both empty — out of the filter. Activating a hidden detached workspace clears the filter, matching the existing reveal escape hatch for automation- and CLI-created workspaces. Splits the filter-state describes out of visible-worktrees.test.ts into sidebar-filter-state.test.ts to stay under the max-lines budget. Co-authored-by: Orca <help@stably.ai> * feat(daemon): add daemon_lifecycle replaced/retired telemetry event (#10058) * feat(daemon): add daemon_lifecycle replaced/retired telemetry event Implements STA-2376. Adds track('daemon_lifecycle', {transition, reason, live_session_count_bucket, version_skew?}) covering 'replaced' (unhealthy_resolver / stale_bundle / different_app_path / failed_health_check at daemon-init launcher sites) and 'retired' (died_respawn at the adapter respawn closures). Enum-only + .strict() + bucketed counts keep paths, versions, and raw counts off the wire; preserve-path transitions emit nothing. Cross-platform and SSH-safe; no-op in non-official builds. Test plan: affected vitest (158) green; typecheck/lint clean except pre-existing unrelated failures. * fix(daemon): prevent false lifecycle telemetry * test(daemon): restore once-ness on respawn reason assertions Keep STA-2376 reason checks without dropping concurrent-respawn coalescing coverage that prevents double died_respawn telemetry. * fix(daemon): emit replaced telemetry on runtime unhealthy_resolver respawn CodeRabbit: adapter-driven macOS resolver replacements forked a new daemon without a lifecycle event. Emit trackDaemonReplaced (not retired) so field diagnosis of #7936 covers the runtime path without mislabeling it as death. * fix(daemon): stop double-counting resolver replaces; drop redundant version_skew Three telemetry-correctness fixes to the STA-2376 daemon_lifecycle event. 1. The runtime macOS resolver respawn double-counted. doRespawn() disconnects but never kills the daemon, so the ensureRunning() that follows re-enters createOutOfProcessLauncher, which re-detects healthy + resolver-unhealthy + 0 sessions and emits the replace itself. The closure emitted a second one. It also emitted before the outcome was known, so a resolver that recovered mid-flight (or a session appearing) left a 'replaced' on the wire for a daemon the launcher went on to preserve. The launcher's emit is gated on a confirmed kill, so it is the correct sole emitter; this reverts the emit added in 1e60ca87a4. The reason plumbing stays -- it is what keeps a resolver respawn from being mislabelled died_respawn. 2. version_skew carried no information and lied to one cohort. It was present iff reason === 'stale_bundle' and always true, so it was a deterministic function of reason. isDaemonStaleForCurrentBundle also returns true when the pid file has appVersion: null -- a replace-once heuristic for pre-marker builds, where no version comparison happened at all -- so the field asserted skew for exactly the upgrade cohort the event exists to illuminate. Dropped from the schema, emitter, and call site, along with the dead branching. 3. track() is now failure-isolated in both emitters. Both call sites sit on the daemon launch/respawn path, where a throw costs the user every terminal. Tests: once-ness (toHaveBeenCalledTimes) on every emit assertion -- the old toHaveBeenCalledWith-only assertions passed under a doubled call; a regression guard that the resolver respawn closure stays silent; and a throwing-client test. Note the unit tests mock DaemonSpawner and never invoke the launcher, so no test could observe the double-emit; the once-ness assertions bound each emitter within its own seam. Known limitation, unchanged: a wedged-but-alive daemon (#8689) can still report died_respawn from the adapter and failed_health_check from the launcher -- the app cannot distinguish wedged from dead at that point. * fix(daemon): attribute the runtime resolver replace so it is not lost Round-2 review found the previous commit over-corrected. Removing the emit from the respawn closures was right about the premature emit but wrong about where the event would come from instead. doRespawn() does not kill the daemon, but it does drop its only authenticated client, and that is enough: the last fully-authenticated disconnect sets retirementRequested, and reevaluateIdleShutdown -> beginIdleShutdown runs with no grace timer, unlinking the token and PID files. So by the time ensureRunning() re-enters the launcher, the daemon is already gone -- killStaleDaemon finds no PID file, confirmedReplacement stays false, and the gate suppresses the emit. Net effect of the previous commit: zero events for a runtime macOS resolver replacement, the common case. The double-emit round 1 found was real but narrow: it needs a daemon holding non-alive sessions, which keeps host.listSessions() non-empty so isIdle() is false and the daemon survives the disconnect to be killed by the launcher. Fix: the adapter attributes the reason rather than emitting it, and the launch it triggers consumes the attribution and reports it. One emit point, exactly one event, correct reason -- whether the daemon self-retired or survived to be killed. The attribution is one-shot so a later unrelated launch cannot inherit it, and it is preferred over the launcher's own inference, which would otherwise mislabel this as failed_health_check. Also: suppress died_respawn while a manual restart is in flight. runRestartDaemon kills the daemon while the outgoing adapter is still live and undisposed, so a pane respawning on its synthetic exit billed a user action to the crash bucket. Tests: a regression test that drives the closure and the launcher across the seam the DaemonSpawner mock normally hides, with killStaleDaemon returning false to model the self-retired daemon, plus the one-shot assertion. Verified load-bearing by mutation (neutering the handoff fails it). Also reset killStaleDaemonMock's implementation in beforeEach -- mockClear left a previous test's mockResolvedValue in place, which silently disarmed the confirmedReplacement gate for every test after it. * fix(daemon): let a proven replacement reason outrank the attributed one Round-3 review. The attribution was preferred unconditionally, so a launch that independently proved a different cause reported the wrong one: resolver unhealthy at the adapter check, daemon survives the client drop (non-alive sessions keep isIdle() false), resolver recovers milliseconds later, and the launcher then proves a stale bundle or a different app path and kills on that basis -- but the event said unhealthy_resolver. A proven kill is grounded in post-kill truth, so it now wins; the attribution covers only what the gate cannot see, a daemon that self-retired leaving nothing to kill and no reason to infer. Every other case is unchanged: self-retired still reports unhealthy_resolver, and the surviving-daemon case reaches the same reason through the launcher's own inference. Also pins the invariant that makes the module-scoped one-shot safe -- the write reaches the launcher with no await in between -- at both the write and the consume, since the DaemonSpawner mock lets tests drive the two halves with an arbitrary gap and would not catch an await being introduced. Corrects the beforeEach comment from the previous commit: there was never a plain mockResolvedValue on killStaleDaemonMock in this file, so it did not silently disarm the gate for later tests. mockReset is still right -- it drops an unconsumed *Once queue, which mockClear does not. Tests: a guard that the launcher's proven reason wins over the attribution, verified load-bearing by mutation (restoring the old ordering fails it). * fix(daemon): don't let the residual health bucket absorb the resolver reason Round-4 review caught a regression from the previous commit. Letting any confirmed kill outrank the attribution was too broad: failed_health_check is not an identification, it is the residual bucket that also absorbs wedges and crashes, so preferring it discards the more specific reason the adapter already established. This is the likely shape of the incident, not a corner case. The dead macOS login session that fails the resolver probe also fails the PTY spawn probe, so checkDaemonHealth returns pty-spawn-unhealthy rather than healthy. The resolver branch is then never evaluated, and with zero live sessions the degraded preserve does not apply either, so the launch falls through to failed_health_check and kills a daemon that survived the adapter's disconnect (non-alive sessions keep it non-idle). Before this commit that reported failed_health_check and dropped unhealthy_resolver -- burying the flagship signal in the catch-all. Rank by how well each reason is evidenced instead: a confirmed kill that positively identified the daemon wins, the attribution beats the residual bucket, and the residual bucket is still reported when there is nothing better. Round 3's motivating case (a proven stale bundle must not be billed to the resolver) is unaffected and still covered. Tests: a guard for the pty-spawn-unhealthy shape, verified load-bearing by mutation (removing the residual-bucket exclusion fails it). * test(daemon): cover the confirmation path production actually uses Round-5 review. No runtime defect, but the three identified reasons were only ever proven through a mechanism the field never takes. confirmedReplacement is `(await killStaleDaemon(...)) || cleanupResult.cleaned`, and the two halves are disjoint in practice. unhealthy_resolver, stale_bundle, and different_app_path all require health === 'healthy', so cleanup reaches the daemon over RPC, shuts it down, and unlinks its pid file -- leaving nothing for killStaleDaemon to find. Production therefore confirms exclusively via .cleaned. Every test confirmed exclusively via killStaleDaemon, because the net.connect stub always errors, so cleanup always returned cleaned:false. The consequence was a silent trapdoor: simplifying the gate to `confirmedReplacement = await killStaleDaemon(...)` stops all three identified reasons from ever emitting in the field, and the whole suite stays green. Confirmed by flipping the killStaleDaemon default to false -- five tests fail, none of which are meant to be about the kill. Adds the missing case: cleanup confirms, the kill finds nothing, and different_app_path is still reported once. Verified load-bearing by mutation -- dropping the .cleaned half now fails this test specifically. Scoped the new test's mocks to *Once so the identity override cannot leak into the packaged-bundle test that follows, and hands probeSocketExists back on the way out since beforeEach only mockClear()s it. * test(daemon): cover the manual-restart retirement guard Round-6 review returned land-ready with one note: removing the !restartInFlight guard from both respawn closures left the whole suite green. That is the same silent-trapdoor shape the previous commit closed for the .cleaned gate, on a guard this PR introduced, so it gets the same treatment. The guard matters because runRestartDaemon tears the daemon down while the outgoing adapter is still live and undisposed; a pane respawning on its synthetic exit reaches the death path for what was a user action, and would bill a manual restart to the crash bucket. Drives the death from inside the restart's ensureRunning so restartInFlight is genuinely set by the code under test, rather than asserting against a flag the test poked itself, and then repeats the respawn after the restart settles to show the suppression is scoped rather than permanent. Verified load-bearing by mutation: removing the guard fails this test and nothing else. * test(daemon): close the two surviving telemetry mutations Round-7 review returned land-ready with two test-only gaps, both found by mutation and both the same trapdoor shape as the last two commits. The manual-restart guard exists in two respawn closures and only the first was covered. That is the wrong half: the restart installs its own adapter, so from the second restart onward the copy in runRestartDaemon is the one that actually runs in the field, and it could be deleted with the suite green. The test now drives a second restart through the adapter the first one installed. The privacy-invariant test only built 'replaced' payloads, so .strict() on the 'retired' member was never exercised -- someone adding a field to trackDaemonRetired after that .strict() was dropped would have reached PostHog with the test still passing. It now runs the leak set over both transitions, plus a sanity assertion that each base payload is itself valid so the rejections prove the leak and not a malformed base. Both verified load-bearing: neutering the second guard copy, and dropping .strict() from the retired member, each now fail exactly one test. * fix(daemon): respawn on PTY write dropped to a dead daemon socket (STA-2373) (#10065) * fix(daemon): respawn on PTY write dropped to a dead daemon socket (STA-2373) DaemonPtyAdapter.write() sends keystrokes via fire-and-forget client.notify(). When the daemon dies (retirement, crash, kill), the socket disconnects and the notify is silently dropped — no rejection reaches withDaemonRetry, so the dead-endpoint respawn never fires and the attached pane freezes. Only a request/reply RPC (e.g. createOrAttach from opening a new terminal) detected the death and forked a replacement. DaemonClient.notify() now reports delivery; a dropped write to a still-active session drives the shared respawn coalescer directly (reconnecting the permanent client before releasing the temporary adoption lease, mirroring withDaemonRetry's ordering), so the pane self-heals like the createOrAttach path. Cross-platform + SSH-safe: no platform assumptions, pure adapter logic. Complements (does not duplicate) #8426, which fixes the adjacent in-daemon bug where a thrown node-pty write no longer marks the handle dead. That is daemon-side; this is the app-side dropped-notify that never triggered respawn. * fix(daemon): restore adapter state after dropped-write respawn * fix(daemon): recover writes after endpoint respawn * fix(terminal): remount panes after daemon death * fix(daemon): recover sibling panes after daemon death, not just the written one When a daemon dies, its dropped-write respawn only remounted the pane whose write detected the dead endpoint. Sibling panes (alive at death but not typed into) were left frozen: stale prompt pixels, silently-dropped input, no live child, and no recovery even on later keystrokes — the exact STA-2373 frozen-typing symptom on non-triggering panes. DaemonPtyAdapter now fans a write-unavailable signal out to every active session when it recovers from a dead endpoint, emitted while the sessions are still in activeSessionIds so the renderer's liveness gate still reads them live. pty.ts forwards each to the existing pty:writeUnavailable channel, so all panes remount + re-attach through the same path the written pane already used. Adds a revert-sensitive regression test: with two sessions and only one written after the daemon dies, the sibling must also be signaled to recover. * revert(format): drop repo-wide oxfmt churn unrelated to STA-2373 A review pass ran `oxfmt --write .` across the tree, pulling seven files with no bearing on the dead-daemon respawn fix into the PR diff. Restored to origin/main byte-for-byte so the diff carries only the respawn change. * fix(daemon): snapshot active sessions before the write-unavailable fan-out A listener that kills a pane mutates activeSessionIds mid-iteration, which can skip the very sibling the fan-out exists to reach. Matches the snapshot fanoutSyntheticExits already takes. * fix(daemon): re-arm dead-endpoint recovery on every daemon death The respawn-storm latch was only released once every awaiting session rebound. Background sessions have no mounted pane, so nothing ever calls createOrAttach for them and they hold the awaiting set non-empty forever — latching the fan-out off after the first death and silently making the whole fix one-shot. Re-arm on the disconnect event instead, which fires once per established connection, so the storm guard still holds within a single incident. * fix(daemon): route the write-unavailable fan-out through the pty router Main subscribes on the routed provider, and DaemonPtyRouter is the live localProvider whenever a legacy daemon socket exists — the common case when an in-place update bumps PROTOCOL_VERSION with terminals running. It forwarded write but not onWriteUnavailable, so the fan-out reached no listener and only the written pane recovered: STA-2373 unfixed, silently. Also stop rejecting writes on adapters that cannot respawn. Legacy adapters have no respawn, so the remount reattaches to nothing and rebuilds the pane empty, losing scrollback the user could still read — worse than the pre-existing silent drop. And guard the renderer's write-unavailable handler on ptyId like its sibling data/replay handlers, so a transport that rebinds without detaching cannot remount a healthy pane. * fix(daemon): route the write-unavailable fan-out through the degraded provider DegradedDaemonPtyProvider is the live localProvider in degraded launch mode and main subscribes on it, but it forwarded onData/onExit/onReplay/ onBackgroundStreamEvent and not onWriteUnavailable — so the fan-out reached no listener and siblings stayed frozen. Same defect as the router, one provider over. The file sat at its max-lines ceiling, so make room by reusing one combineUnsubscribes helper across the three places that already repeated that loop rather than bumping the limit. Forward to the daemon adapters only: the local fallback has no dead-socket problem. * refactor(daemon): share the listener-fanout unsubscribe combination Adding onWriteUnavailable to both provider wrappers left each file at exactly 300/300 lines, so the next line anyone added would have broken max-lines with no sanctioned escape hatch. Both already repeated the same combine-unsubscribes loop, so lift it into one module: duplication drops and each file gets its headroom back. * fix(test): stop the fake emitter colliding with the private adapter emitter DaemonPtyAdapter.emitWriteUnavailable is private, so declaring a public member of the same name on a mock intersected with DaemonPtyAdapter collapsed the whole type to never — one collision produced 54 typecheck errors, taking out pre-existing assertions in both files too. Rename the fake to triggerWriteUnavailable and declare onWriteUnavailable on ProviderMock, which IPtyProvider does not carry on this branch. vitest does not typecheck, which is why a red build sat behind a green suite. * fix(quick-commands): show pointer cursor on hover (#10223) * fix(terminal): limit pre-paint WebGL resume to macOS (#10794) Run terminal visibility transitions pre-paint only on macOS. Restore passive disposal and recreation on Windows/Linux, remove the Windows retained-context LRU machinery, and preserve the normal 128-context startup ceiling. * fix(ssh): connect to Linux hosts that cannot compile node-pty (#10776) * fix(ssh): connect to Linux hosts that cannot compile node-pty node-pty ships no Linux prebuilt at any architecture, so it is compiled on the remote. On a host without a C/C++ toolchain that build fails, and because both native deps install in one npm command it also took down @parcel/watcher — which does have a working Linux prebuilt — and failed the whole connection. Every Linux image without build tools was unusable. node-pty only backs remote terminals; files, git, and the editor do not need it, and a missing native dep is already non-fatal further down the deploy. So when the existing toolchain probe confirms the compiler is missing, reinstall without node-pty instead of aborting. The manifest has to drop it too — npm reconciles every dependency in package.json, not just the ones named on the command line, so naming only @parcel/watcher still rebuilds node-pty. If that reinstall also fails the actionable build-tools error is rethrown, so a host broken for some other reason still reports the toolchain gap. The relay's PTY error now names the fix rather than saying only that node-pty is unavailable. Verified on a stock Rocky Linux 10.2 aarch64 container (openssh-server, git, nodejs, npm, no compiler): connect succeeds, /etc lists over SSH, node-pty is absent while @parcel/watcher installs its linux-arm64-glibc prebuilt, and spawning a terminal reports the install hint. * fix(ssh): keep the node-pty skip path honest about platform and watcher The PTY unavailable message named build tools unconditionally, but only Linux compiles node-pty — the deploy-side skip is gated on linux and the toolchain probe returns null on Windows. A Windows or macOS remote, where node-pty ships prebuilds, was told to install make/g++/python3. Pick the remedy by the relay's own platform. The skip path returned before the install probe, so a @parcel/watcher that installs but cannot require() (glibc below the floor) connected with dead file watching and nothing logged. Probe before returning and warn; no rebuild, since node-pty provably cannot compile on that host, and never fatal. Also log the pty-less reinstall's own failure and attach it as cause — the rethrown toolchain message is built from the original npm error, so an unrelated retry failure (registry, ENOSPC, EACCES) was lost. The reinstall now keeps the caller's resetDeps as well, so a repair reconnect still clears every dep the probe found broken. Tests: the skip-success fixture queued a chmod/probe/rebuild sequence production never runs, and the surplus slots were absorbed by launchRelay's readiness poll (1817ms vs 3-9ms for its peers). It now emits exactly the 12 execs production performs, and pins that no rebuild is issued. Adds the missing negative case: a gyp-shaped failure on a host whose probe reports a complete toolchain must still hard-fail rather than silently degrade. * fix(ssh): hedge the node-pty remedy and keep repair resets on the skip path * perf(terminal): bound the PR-link carry scan to the trailing window (#10741) * fix(codex): treat non-Codex transcript as stale resume metadata (#10538) When a pane is mislabeled agent:codex but still holds a Claude transcriptPath, the Codex resume guard threw and blocked relaunch. Only hard-fail when the path claims Codex's dated rollout layout (sessions/YYYY/MM/DD/rollout-*.jsonl), under any home and without requiring the file to exist. Paths that never claimed Codex provenance return null so the pane can relaunch. Keying on rollout shape rather than trusted-home membership matters: returning null only declines to override CODEX_HOME, and the renderer has already baked 'codex resume <id>' into the command. A real rollout under an untrusted home would otherwise resume under whichever account is selected — and once the session bridge hardlinks rollouts across homes, codex would find that id and resume silently under the wrong account. Trust is decided upstream by findTrustedCodexSessionResume. Co-authored-by: Wooseong Kim <innocarpe@users.noreply.github.com> Closes #10517 * fix(codex): cache weekly-only accounts when switching Codex accounts (#10467) * fix(codex): cache weekly-only accounts when switching Codex accounts refreshForCodexAccountChange snapshotted the outgoing account only when this.state.codex.session was populated. Weekly-only plans report no session window, so their snapshot was dropped and the account switcher's inline bars rendered empty for exactly those accounts. Accept a populated weekly window as well. #10136 made this reachable: before duration-based classification, a weekly-only quota landed in the session slot, so the gate happened to pass. Claude is intentionally untouched; it has no weekly-only plan shape. * test(rate-limits): pin that a windowless outgoing Codex account is not cached The widened weekly-only gate had no test for its lower bound: replacing it with a bare truthy check on state.codex passed all 70 tests, which would cache an empty fetching placeholder and render a blank inline bar row in the switcher. * release: v1.4.159-rc.0 * fix(terminal): kill floating, setup, and folder-workspace PTYs on tab close (#10810) * perf(terminal): coalesce per-keystroke input stamps + add typing-latency self-diagnostic (#10784) * perf(terminal): coalesce per-keystroke input stamps + add typing-latency diagnostic A user reports keystroke-echo lag on v1.4.156 that vanishes in Ghostty on the same machine, at a scale we cannot reproduce locally (nested worktrees, ~20 agents each). Static analysis across the 155..156 renderer diff found no perceptible regression, so this adds the instrument to measure it where it actually happens. Diagnostic (`window.__orcaTypingDiagnostic`, dev-console only, no shipped UI): reports keydown->paint percentiles from real typing plus a scale census — agent rows store-total vs mounted-DOM, store listener count, worktree nesting depth, the settings gating suspect paths, and the focused pane's agent and buffer mode. Nothing attaches to the keystroke path until start(), so it does not perturb the latency it measures. Coalescing: recordTerminalInput wrote the whole lastTerminalInputAtByPaneKey map on every keystroke, waking every zustand subscriber. Hibernation is a >=60s idle timeout, so the leading edge of a burst writes immediately and the rest collapse into one trailing flush. Imperative readers merge the pending stamp, and a late flush never revives a pane key teardown deleted. This write path is byte-identical in v1.4.155 and v1.4.156, so the coalescing is a general perf win, not a fix for the reported regression — the measured saving (~0.02ms/keystroke) is well below perception. * fix(diagnostic): count React store subscriptions in the listener census The census wrapped `subscribe` on the bound hook after `create()` had already run. zustand's `useStore()` reads the INNER `api.subscribe`, and `create()` copies subscribe onto the hook as a separate property slot — so patching the hook's copy counted only the 16 imperative `useAppStore.subscribe()` call sites and missed all ~2.2k React hook subscriptions, i.e. exactly the ones that scale with agent rows. The metric would have read a near-constant ~16 regardless of scale, which would have made "latency tracks listener count" read as false no matter the truth. The inner api is only reachable as the state creator's third argument, so the counter now installs there and lives in the store rather than the probe. Still per-subscribe (component mount), never per-setState: zustand notifies by iterating its listener Set directly, so this never touches the keystroke path. Tests pin both subscribe paths; reverting to the old wiring fails 3 of the 5. * fix(ssh): stop remote terminals fail-opening to local PTY (#10778) * fix(ssh): stop remote terminals fail-opening to local PTY Docker SSH watcher isolation failed because an unhydrated remote worktree spawned through the local daemon with a container-only cwd. Fail closed while the SSH owner is still loading, ignore non-PTY mux notifications before mapping params.id, and harden the Docker SSH e2e connect helper so the repo connectionId is present before terminal activation. Co-authored-by: Orca <help@stably.ai> * fix(terminal): keep host-agnostic terminals off the hydration guard The unresolved-owner guard also caught floating and inline setup terminals, which have no repo row by design, regressing #10151. Scope it to repo-backed worktrees and cover the SSH hydration window with a regression test. Co-authored-by: Orca <help@stably.ai> * fix(terminal): treat a local-stamped worktree as a resolved host The hydration guard keyed off "no repo row", which also withheld spawn for a local worktree whose own hostId already proves its host. Key it off "nothing names the host" instead, and cover the local-stamped case with a test. Co-authored-by: Orca <help@stably.ai> * fix(terminal): recover parked panes when their host hydrates Withholding the spawn stopped the wrong-host PTY but left the pane inert: nothing bumped its generation once the repo row merged, so a remote terminal still never opened. Remount PTY-less tabs when repos:changed resolves their owner, and drop the e2e helper workaround that was masking this. Co-authored-by: Orca <help@stably.ai> * fix(terminal): scope hydration remounts to panes that actually parked Keying recovery off "tab has no PTY" also matched tabs whose shell merely exited, remounting them on every repos:changed. Track the panes that withheld their spawn and consume each entry once, so recovery cannot churn a live terminal or spin on repeated refreshes. Co-authored-by: Orca <help@stably.ai> * test(terminal): cover the repos:changed parked-pane remount wiring The recovery predicate was unit-tested, but nothing proved useIpcEvents actually calls it — the existing suite stubs repos.onChanged as a no-op. Drive the real listener and assert a parked pane is remounted only after its host resolves. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai> * fix(memory): clarify Resource Manager accounting (#10821) * perf(agent-status): scan Command Code transcripts backward from EOF (#10742) Co-authored-by: Orca <help@stably.ai> * fix(terminal): quarantine input after a replaced PTY endpoint (STA-2373) (#10811) Follow-up to #10065, which merged with this failure mode known and deferred. Recovery from a dead daemon socket reattaches to a fresh shell. Keystrokes in flight during the ~1.1s window are dropped, but everything typed after reattach lands on the new shell, so the surviving tail of a half-sent line is submitted by the user's own Enter: `echo hi; rm -rf x` arrives as `cho hi; rm -rf x` — zsh fails `cho` and still runs `rm -rf x`. Before #10065 the whole line was lost, so the executing tail is new. Quarantine the remainder of the interrupted line instead. Keyed by tab, not pane: recovery destroys the xterm being typed into and the successor pane receives the tail. Armed only from the onWriteUnavailable path; a stalled-pipeline remount keeps the same live shell, where quarantining would eat a real command. Disarms on the line terminator (CR/LF/Ctrl-C, dropped too since that is the byte that would submit the mangled line), a 700ms idle gap, or a 5s cap. The cap must not be shortened: the tail itself takes ~2.5s to type, so a shorter cap fires mid-tail and delivers the dangerous remainder to the fresh shell. The onData check sits after the query-reply branch so CPR/DSR replies still reach the shell. Live A/B QA on macOS: the bug reproduces verbatim without the fix (marker file created by the surviving tail) and is suppressed with it, with the next command still working — proving suppression rather than a dead pane. * perf(agent-status): keep the shared transcript reader's carry linear (#10777) readLastTextFromTranscriptOnce re-joined its carry buffer on every block that held no newline, so a transcript whose tail is one oversized line copied O(line^2). It backs three readers — the Claude/Codex user prompt, the Command Code assistant message, and the shared assistant-text reader — so every agent that resolves turn text from a transcript paid it. Same chunk-list carry the Command Code prompt reader already uses. Measured on a transcript whose tail is one big line: 15.24 ms -> 8.87 ms at 3.9 MB, and the gap widens with the line, which is the quadratic signature. * perf(ai-vault): keep the JSONL line carry linear (#10783) consumeCompleteJsonlLines re-joined its held-over partial line with every stream chunk, so one oversized record — a large tool result — cost O(record^2). It backs the incremental parse for every resumable agent transcript, so the whole AI Vault corpus paid it. Hold the pieces in a list and join once, when a newline finally arrives. Measured on a transcript with a single oversized record: 2.13 ms -> 1.17 ms at 1 MB and 68.22 ms -> 4.35 ms at 8 MB, with byte-identical output. A transcript of ordinary records never reaches the branch. * perf(git): read both diff blobs concurrently (#10781) * perf(git): read both diff blobs concurrently The diff loaders awaited their two sides in series, so the second `git show` could not start until the first had returned. The reads are independent, so that was pure added latency on every diff the review panel opens: ~47 ms sequential vs ~24 ms concurrent, a saving of ~23 ms per diff. Covers the merge-base, commit, and staged loaders, plus the unstaged path where the working-tree read is independent of the index->HEAD chain. The unstaged left chain itself stays sequential because its second step depends on the first. The staged coalescing test asserted the sequential shape (one spawn, then the next); it now pins the contract that actually matters — eight identical reads still collapse to two spawns, one per side. * test(perf): interleave the diff-blob benchmark arms Running one strategy's whole batch before the other's lets cache warming, CPU frequency drift, and background load correlate with the strategy being measured. Alternate the arms per iteration, alternate which goes first, and report medians so that drift stays common to both. Also reject malformed env settings rather than truncating them — Number.parseInt accepts "10foo" and 3.5. Interleaved result confirms the original: 1.90x-2.03x, ~24 ms saved per diff. * perf(mobile-sync): memoize the agent-status projection per entry (#10787) * perf(mobile-sync): memoize the agent-status projection per entry buildRuntimeMobileAgentStatusProjection re-serialized every live agent on every status ping. setAgentStatus replaces one entry and re-spreads the map, which defeats the reference-equality skip gate, so each ping paid for every other agent's prompt, 20-entry history, and 8 KB assistant message to discover they had not changed. Memoize each row's JSON by entry identity, the cachedTabsProjection pattern already used a few functions above. Per ping: 0.18 ms -> 0.014 ms at 8 agents, 0.88 ms -> 0.063 ms at 40. The output is byte-identical — joining pre-serialized rows matches whole-array stringify, which the new test pins against a verbatim copy of the old implementation. * test(perf): stop inflating the projection benchmark baseline The pre-fix arm stringified each row and parsed it back before stringifying the array, a per-row roundtrip the original never paid. That made the baseline artificially slow: the reported 5.9x-14.0x is really 2.1x-5.0x. Share one row builder between both arms, and check equivalence after a ping as well as on the cold call — a stale-row bug can only surface once the cache is actually exercised, which the cold-path check could never catch. * perf(startup): stop parsing qrcode and @linear/sdk at launch (#10788) Both are reachable only from features most users never touch, but both were in the main bundle's eager top-level require block. @linear/sdk is the sharper case: linear-sdk.ts exists solely to load that ~2.6 MB CJS bundle lazily, and a single value import in issue-relation-write.ts defeated it for everyone. That file now imports the type and goes through the loader. qrcode is only reachable from mobile pairing, and both call sites were already async, so they take a dynamic import. * fix(codex): rank the Codex resume rescan by selected account, not settings order (#10801) The legacy Codex session-id rescan (used when a persisted record has no transcriptPath) returned the FIRST trusted home holding a rollout with that id. That home becomes the pane's CODEX_HOME — i.e. it picks the ACCOUNT — and the list ended in per-account homes ordered by settings INSERTION order, so the account was decided by whichever one the user happened to add first. Ranks instead: selected account -> real system home -> shared runtime mirror -> everything else by normalized path. Both ranking inputs are required (an optional one would silently degrade to pure path order), and the selection arrives as a thunk so the common provenance-present resume never stats the ownership marker for a ranking it never runs. The mirror needs its own tier: prepareLegacySharedCodexSessionResume's guard only fires when the resolved home IS the mirror, and that guard is what migrates the rollout into ~/.codex. Without it a system-default selection silently resumed under an arbitrary account and stayed pinned there permanently once the hook stamped a transcript path. Reviewed over two independent rounds; every tier individually mutation-proved. Live-validated in a real Orca dev build by reading the spawned PTY's actual CODEX_HOME across three builds (head, base, and head-minus-the-mirror-tier). Note: fixes none of #10757's user-visible symptoms on its own — it is a correctness precondition. Verified on macOS only; Windows coverage is fixture-only. * fix(sidebar): make worktree drag reorder follow the card, not the pointer (#10845) * fix(mobile): harden native chat send budgets, streams, and stop (#10814) Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * perf(source-control): share one path collator across the projection (#10850) * lint: guard the two perf bug shapes we fixed repeatedly (#10851) * fix(agent-history): match non-ASCII workspace paths to Claude sessions (#10841) * fix(terminal): avoid flash while restoring parked terminals (#10871) * Fix diff notes overlapping following lines (#7803) Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(terminal): clear search highlights when the find bar closes (#10872) Closing Ctrl+F left one match highlighted until the window was minimized and restored. xterm's DecorationService keys its SortedList on `decoration.marker.line`, but `SortedList.delete()` only records an index and defers compaction, while `Marker.dispose()` sets `line = -1` — mutating that same sort key. After the first disposal the array is no longer sorted, so the binary search inside `delete()` can miss a decoration that is present. It returns false, `onDecorationRemoved` never fires, and the decoration stays live and keeps painting. Repaints don't help; they faithfully re-paint a live decoration, which is why only a window cycle appeared to fix it. `clearDecorations()` disposes the active match before the match highlights, which is exactly the order that trips this. Patch `delete()` to retry once after compacting pending deletions, on the miss path only, so the common bulk delete keeps its O(log n) search and deferred batching. A 3000-trial randomized differential against upstream semantics shows no behavior change for well-ordered lists. * perf(cli): load only the handler group a command dispatches into (#10883) Co-authored-by: Orca <help@stably.ai> * perf(ssh): normalize watch event paths once per fs.changed batch (#10881) Co-authored-by: Orca <help@stably.ai> * feat(plugins): Orca plugin system — kernel, content packs, panels, workers, marketplace v0 (experimental) (#8549) * feat(plugins): Orca plugin system — kernel, content packs, panels, workers, marketplace v0 (experimental) Adds Orca's experimental plugin system behind a settings flag: a supervised kernel, declarative content packs (VM recipes, commands and keybindings, language packs), sandboxed iframe panels, forked worker hosts, and a Git-backed m…
Contributor
|
Partially reverting, makes text too hard to read: Notice grey text is hard to read |
3 tasks done
nwparker
added a commit
that referenced
this pull request
Jul 28, 2026
…11139) #8321 mixed the selected card's wash into the opaque --worktree-sidebar surface, lifting dark mode to 16% (#4b4b4b). Card text lost too much contrast against it. Return both modes to a translucent wash (light 8%, dark 10%) so the brighter selection border added by #8321 carries the selected state instead of the fill. Co-authored-by: Orca <help@stably.ai>
zpyoung
pushed a commit
to zpyoung/orca
that referenced
this pull request
Jul 29, 2026
…tablyai#11139) stablyai#8321 mixed the selected card's wash into the opaque --worktree-sidebar surface, lifting dark mode to 16% (#4b4b4b). Card text lost too much contrast against it. Return both modes to a translucent wash (light 8%, dark 10%) so the brighter selection border added by stablyai#8321 carries the selected state instead of the fill. Co-authored-by: Orca <help@stably.ai>
nwparker
added a commit
that referenced
this pull request
Jul 31, 2026
…#11065) * fix(worktree): use local base after offline refresh failure * docs: add git worktree bug queue report * fix(skills): require updater registration (#11051) * fix(skills): require updater registration * fix(skills): reject incomplete updater registrations --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * test(worktree): satisfy changed-code quality gate * docs: record #11065 CI repair status * docs: record CI rate-limit evidence * chore: keep bug category report out of product diff * release: v1.4.160-rc.3 * fix(quality): enforce performance-safe lint baseline (#11074) * fix(quality): clear safe existing lint findings * fix(quality): keep lint cleanup allocation-free * fix(quality): enforce performance-safe baseline * test(terminal): drain deferred confirmation cleanup * fix(preflight): refresh Windows PATH on forced CLI checks (#10091) Refresh the persisted Windows PATH during preflight without blocking Electron's main thread. Bound and deduplicate registry reads, preserve the last good cache on failure, skip host refresh for WSL, and add Windows regression coverage. * feat(new-workspace): type-ahead Project and Run-on pickers (#11062) * feat(new-workspace): make the project picker a type-ahead field The Create-worktree Project slot read as bulky and unpolished: a label row, an add-project icon, a 36px outline trigger and a chevron, all spent before choosing anything — then a popover carrying its own *second* search box, two-line rows, and a footer that scrolled out of reach. The field is now the search. Typing filters in place, so the nested search box is gone. Exactly one row is armed at any time and Enter takes it; hovering arms, so pointer and keyboard drive one cursor rather than two competing highlights. Armed is tracked by row key, not index, so a list arriving late over SSH cannot slide a different project under a keypress the user already aimed. Rows are single-line at 28px with an on-row Enter cap that takes space only while armed, and "Add a new project" is pinned to the popover edge so it survives every state — scrolled, filtered to nothing, or no projects at all. Long names and deep paths degrade deliberately: the name keeps up to half the row and the path elides from its middle, so two monorepo siblings stay distinguishable as …/services/checkout-api vs -web where a flat truncate rendered both identically. Recency is derived from when each project last had a workspace created, which is the action this picker is about to repeat — no new store field. The shell keeps data-project-combobox-root + role=combobox and stays focusable, so the composer's initial-focus and project-required handlers still land on it. * fix(new-workspace): align, scroll and loosen the project picker Five fixes to the type-ahead picker, three reported and two found while checking for related breakage. Alignment: the name and its smaller detail line were centred as boxes, so the 12px path sat visibly high against the 14px name. Both now share a baseline, in the committed field and in every row. The dot mark and the Enter cap are chips rather than text, so they stay centred on the row. Scrolling: the mouse wheel did nothing over the list. The composer is a Radix Dialog, and react-remove-scroll cancels wheel events for portaled content outside the dialog's DOM tree — the scrollbar dragged fine but the wheel was dead. The old cmdk list carried a shim for exactly this; the plain scroll pane that replaced it did not, so it has its own now. Density: rows go 28px -> 32px, row text 13px -> 14px and detail 11px -> 12px, with a taller Add row and more air above section headings. Escape stranded a query: with the list closed but text still typed, Escape was ignored (it was gated on the list being open), leaving the field showing text that matched nothing and hid the committed project. Escape now always restores the committed display, and only bubbles when there is nothing to undo. Listbox ownership: options sat inside unroled section and scroll wrappers, which breaks the listbox -> option relationship assistive tech relies on. Sections are groups carrying the heading as their label, and the scroll pane is presentational. Both new behaviours are covered by tests verified to fail without the fix. * chore(tools): keep the project-picker design lab The exploration harness behind the picker rewrite: 16 interactive design variants rendered against the app's real tokens and shadcn primitives, so a prototype is a drop-in ProjectCombobox rather than a mockup. Worth keeping because the frames encode bugs that only reproduce in context. DialogFrame renders the picker inside a real Radix Dialog, which is the only way the react-remove-scroll wheel bug shows up; the fixtures carry duplicate display names and deep sibling paths that a naive truncate renders identically. Run with: npx vite --config tools/wt-picker-lab/vite.config.ts * fix(new-workspace): stop the project list flashing open, shrink its empty state Opening the picker read as a double flash. The shared popover surface is translucent and fades 0 -> 1, which is right over the app canvas but wrong here: this popover lands directly on the composer dialog, so for the length of the fade the Name field underneath showed straight through the list and you saw two layers at once. The list now uses an opaque surface and zooms without fading, so it is solid from the first frame. Every other popover keeps the blur and fade. The "No projects match your search." state was a 60px centred block sitting next to 32px rows, which read as a different kind of surface and made an empty result feel like an error. It is now sized and aligned like a row. The lab's dialog frame focused whatever Radix picked first, which popped the Add-project tooltip on open and masked the real problem; it now focuses the name field the way the real composer does. * fix(new-workspace): square mark, centred empty state, and keep the list open on tab-focus Four fixes, three reported and one found while sweeping for others. Square mark: the option dot had a `rounded-full` override, so a project read as a circle here and a square everywhere else (jump palette, sidebar). Drop the override and use RepoBadgeMark's own shape. Centred empty state: "No projects match your search." was left-aligned after being shrunk to row height; centre it. Tab-focus blinked the list shut: the field lives in the popover's anchor, not inside its content, so Radix's dismissable layer saw focus land "outside" and closed the list the instant you tabbed in. Focus and pointer events within this control no longer dismiss it; genuine outside events still do. Junk text could strand the field: typing a query that matched nothing and then clicking away left the text sitting there with the list closed, showing no project and no error. A query only means something while the list is open, so closing without committing now clears it. On pressing Create with no project: no change needed. The create gate has not depended on project selection since #4991, and both submit paths already call showProjectRequiredError(), which sets the inline message and turns the field red via aria-invalid. Verified end to end: the button is pressable, the press paints the field destructive, and the message appears beneath it. * feat(new-workspace): rebuild the Run-on picker to match the project picker "Run on" was the last composer field still built the old way: an outline trigger wrapping a cmdk list, two-line rows, and no way to search. It now matches the project picker, so the two fields in the same form read as one control. The field is the search — type to filter hosts, paths and recipes with no nested search box. Exactly one row is armed at a time and Enter takes it; hovering arms, so pointer and keyboard drive one cursor. Rows are 32px with the label and its path on a shared baseline, the path eliding from its middle so two deep sibling paths stay distinguishable. The popover surface is opaque and unfaded because it lands on the composer dialog, where a translucent fade shows the form underneath. Two behaviours the project picker doesn't have are preserved. Disconnected hosts keep their inline Connect action, tracked per host so one stalled connect never blocks the others, and the list stays open so the connecting state is visible. Two rows open nested lists rather than committing: VM recipes, and "Add host" pinned to the popover edge so it survives every state — scrolled, filtered to nothing, or with no hosts at all. Enter and ArrowRight open a submenu; Escape backs out one layer at a time. Extracted from NewWorkspaceComposerCard (-563 lines) into files that each stay under the line limit without a suppression. Tests: the run-target cases asserted cmdk internals (`[cmdk-item]`, aria-disabled, cmdk-separator) that no longer exist. Rewritten against behaviour and the listbox roles instead. All 22 composer tests pass, plus a live sweep of 11 interactions in a real dialog. * fix(new-workspace): drop the Enter cap, fix submenu hover, match the Add rows Three follow-ups on the two composer pickers. The ↵ cap on the hovered row is gone from both. On a run-target row it sat next to the Connect action and read as a second, competing affordance; the highlight already says what Enter will take. Submenu rows never highlighted under the pointer. They passed a hardcoded `armed={false}`, so the recipe list and the Add-host choices were the only rows in either picker with no hover state. They now track their own hover. "Add a new project" used a chunky FolderPlus where "Add host" uses a plain Plus. Both rows were already the same height and type, so matching the glyph is the whole difference. * fix(new-workspace): restore the folder glyph, two-line Add-host cards, quiet Connect rows Three follow-ups. "Add a new project" goes back to FolderPlus — matching "Add host"'s plain Plus made the two consistent but lost the glyph that says which kind of thing is being added. A disconnected host row no longer repeats its status. The Connect button already says the host isn't connected, so "Connect this host to set up projects" beside it was saying it twice. Rows without a Connect action keep their detail, since there it explains why the host can't run. The Add-host choices go back to two-line cards. Their descriptions explain what you're picking ("Use an existing machine over SSH" vs "Pair another Orca runtime"), unlike a host row's detail, which just labels a host you already recognise. RunTargetRow grows a `stacked` variant for that rather than making the single-line row do both jobs. * fix(new-workspace): give Run on the same vertical rhythm as the other fields Run on is nested inside the Project block so the two share its error and empty states, which also put it on that block's 4px internal spacing. It reads as its own field, so it sat noticeably tighter than the 16px gap every other field in the composer gets. Pad it to match. * refactor(new-workspace): share the type-ahead machinery between both pickers Project and Run on were built one after the other, so each grew its own copy of the same mechanics: query and open state, arming by row key, the arrow-key walk, scroll-the-armed-row-into-view, the react-remove-scroll wheel shim, and the closes-drops-the-query rule. Two copies of subtle behaviour is two places for it to drift. useTypeAheadCombobox now owns all of it. Callers pass a function that turns a query into row keys and get back the query, the armed key, and the movement helpers. Run on layers its submenu state on top by wrapping `close`, which is the only part that isn't shared. The two long class strings both files repeated verbatim — the field shell and the opaque unfaded popover surface — are named constants now, so the reason they differ from the stock popover recipe is written down once instead of implied by a duplicated literal. No behaviour change: 16,456 renderer tests pass, plus the 22-check live interaction sweep across both pickers in a real dialog. * fix(new-workspace): drop aria-expanded from option rows, remove the design lab `aria-expanded` isn't a supported prop on `role="option"`, so the submenu rows were claiming a state screen readers can't interpret there. `aria-haspopup` alone already says the row opens a menu. Removes tools/wt-picker-lab. It was the harness for exploring this redesign — 12 interactive variants — and it did its job, but the 11 that lost are dead code, and its prototypes were the only thing failing the react-doctor gate (5 errors, all in throwaway variants; the shipped pickers had none). * fix(workspaces): support emoji-only names * feat(workspaces): derive readable emoji identifiers * feat(workspaces): add emoji shortcode picker * fix(terminal): gate the developer menu behind Option and unblock manual parking (#11091) The Developer submenu shipped visible on every worktree right-click, and its Park terminal action always refused with "These terminals cannot be parked safely." - reveal the Developer submenu only when Option/Alt is held at right-click, captured at open time so it can't shift rows mid-menu - stop a settled pendingActivationSpawn tag from refusing a manual park: first activation stamps it on every tab and only a fresh updateTabPtyId consumes it, so a reattached tab kept it forever - resolve the single leaf of a rootless layout for parked watcher coverage, so a workspace whose panes never mounted is no longer permanently uncoverable - restore the !isVisible park guard dropped in #11016, which let the workspace being viewed unmount its own terminals - split manual-park eligibility out of the automatic cold-park policy module * fix(workspaces): hide false repo error for remote servers (#11050) * i18n: translate orchestration page and workflow messages (#11097) Add translations for OrchestrationPage coordinator and child PR names, plus agent workflow status messages (initial states and progress beats) across all supported languages (English, Spanish, Japanese, Korean, Simplified Chinese). * fix(skills): stop reporting a failed update when the CLI succeeded (#11105) The Update skills dialog showed "The update didn't finish" / "Some skills could not be updated" with an armed Retry, directly above the runner's own log line saying "All global skills are up to date" — on a clean exit 0. `skills update` compares its lock's recorded hash against the source and never reads disk (dist/cli.mjs: `latestHash !== entry.skillFolderHash`). Once the lock has advanced past the installed bytes it prints up-to-date, exits 0 and writes nothing. The copy left behind is a recognised older revision, so the post-run re-scan sees `outdated`, skillUpdateFailedNames counted that as a failed run, and skill-update-run settled to state 'error'. Retry re-ran the same command, which no-op'd again — a closed loop. Reclassify `outdated` as "the command did not converge this", not "the run failed". The freshness badge still marks the copy not-current, so nothing is hidden; the run just stops being blamed for it. A botched write is still caught: a half-written bundle hashes to `unrecognized`, a wholly-degraded or removed copy leaves no convergent placement, and process-level failure still surfaces via the spawn error. Reachable by anyone who updated during the stub conversion window — every bundled skill has a stub -> full -> stub oscillation in its last three registry revisions. * perf(terminal): eliminate adverse control and frame-gate cases (#11045) * perf(terminal): eliminate dense control and frame gate regressions * test(terminal): keep gate labels in valid expect shape * test(terminal): expose the surviving sub-threshold control-density case The only adverse strip fixture sat at 50% control density, which is exactly where the fallback fires and wins. A shape at 31 controls per 64-unit block evades the trigger and still loses to the per-character legacy (0.67x), so the benchmark structurally could not show it. Add that fixture, pin both density literals in the staleness guard so a retune fails loudly instead of silently measuring a boundary that moved, and export the probe constant the equivalence test was hardcoding. * fix(opencode): harden lifecycle status delivery (#11017) * fix(agent-status): show Codex v2 subagents (#11059) * fix(agent-status): track Codex rollout subagents * fix(agent-status): resolve cross-day Codex child rollouts and unblock CI gate Codex files each rollout under its own local start date, so a session that runs past midnight spawns children into a sibling day directory. Scanning only the parent's directory left 13% of real subagent spawns (48/371 across local rollouts) permanently unresolved, which pinned a phantom "working" row and re-ran readdirSync every poll tick forever. Resolve the child's own day directory from occurred_at_ms, and time-box a child whose rollout stays unreadable so a deleted or never-written file can't leak a working row. Also make the hook HTTP handler return void: the changed-code quality gate keys findings by span overlap, so this PR's added line inside the pre-existing async createServer callback resurfaced no-misused-promises as a new finding. Tests cover cross-day resolution, grace-period retirement, and that the poll re-arms across successive roster changes (the prior tests passed even when the poll died after its first change). * fix(agent-status): keep the Codex subagent poll alive across nested hooks A nested non-codex CLI inherits its parent's ORCA_PANE_KEY, so its hook POST reached scheduleCodexSubagentPoll and tore the timer down before the source guard, silently ending polling while a rollout child was still live. * fix(skills): stop offering an update the CLI provably cannot perform (#11110) * Revert "fix(skills): stop reporting a failed update when the CLI succeeded (#11105)" This reverts commit a8660839ee734714d4236fd00d960cfde9d97353. * fix(skills): stop offering an update the CLI provably cannot perform The Update skills dialog reported "The update didn't finish" / "Some skills could not be updated" with an armed Retry, directly above the runner's own "All global skills are up to date" log line, on a clean exit 0. `skills update` decides what to do by comparing its lock's `skillFolderHash` against the source tree and never reads disk (published CLI, dist/cli.mjs: `latestHash !== entry.skillFolderHash`). So once the lock records a revision the filesystem does not actually have, it reports up-to-date, exits 0 and writes nothing. No retry converges it. Gate eligibility on that instead of blaming the run afterwards: a name stays updatable only while the lock's hash and the revision the DISK hashes to agree. Those that disagree fall through to `needs-attention`, which skill-freshness-display-status.ts already documents as the state for a copy "out of date somewhere the update command cannot reach". The dialog no longer offers them, so it can neither claim failure nor claim success. Deliberately compared against disk, not the bundled manifest: the updater pulls from the source repo, which legitimately runs ahead of what a build ships, and gating on the bundle would withhold real updates. Both sides must also be positively identified — an unplaceable lock hash is not evidence. Also reverts a8660839ee, which forgave `outdated` post-run. That turned the false failure into a false success ("Updated 2 skills" over copies nothing wrote) and let an empty verdict swallow spawnError, so an offline run published green. Reachable by anyone who updated during the stub-conversion window — every bundled skill has a stub -> full -> stub oscillation in its last three registry revisions. * fix(skills): do not gate a skill when a placement is unidentifiable `diskTreeShas` drops digests matching no known revision, so `every` ran over only the resolved half — one stale copy beside one unidentifiable copy gated the name, contradicting the unknown-stays-eligible rule the function documents. Require every observed digest to resolve before treating all placements as mismatched. Caught by CodeRabbit on #11110. * fix(skills): judge convergence only over placements the update command writes A same-name plugin-cache or repo copy could defeat the gate two ways: an unidentifiable repack read as an unresolved placement, and a cache copy parked at the lock's own revision read as an anchor — both re-arming the unwinnable update on a drifted canonical. Filter to SUPPORTED_GLOBAL_SKILL_TOPOLOGIES, matching eligibility and outcome. * perf(lint): consolidate code-quality gates into Oxlint (#11117) Consolidate standalone code-quality scanners into Oxlint, preserve focused native/type-aware enforcement, add custom plugin coverage, and harden deferred PTY test cleanup. * fix(browser): keep the address bar editable in a narrow toolbar (#11098) * fix(browser): keep the address bar editable in a narrow toolbar Every other browser toolbar control is shrink-0, so the address bar was the only flexible item and absorbed the entire squeeze: below roughly 420px of pane width it collapsed to the leading globe icon with a zero-width input. Clicking it only opened the suggestion dropdown, which inherits `--radix-popover-trigger-width` and so rendered at icon width — there was no way to type or edit a URL in that tab. Focusing a squeezed bar now lifts the form out of the toolbar flow and overlays the row edge to edge, giving a full-width editable field that navigates on Enter (and a full-width suggestion list for free). A measured slot stays in flow so the overlay cannot feed back into its own width, and the slot keeps a min width so the globe remains a real hit target instead of being overlapped by neighbouring buttons. Fixes #11090 Claude-Session: https://claude.ai/code/session_01Mx53f7erbtw5NraS8HdXKE * fix(browser): use the documented floating shadow for the expanded bar STYLEGUIDE.md defines exactly three elevation levels and forbids a fourth; shadow-md was not one of them. The overlaid address bar is a floating surface, so it takes the documented floating shadow already used by the other floating surfaces in this pane. Claude-Session: https://claude.ai/code/session_01Mx53f7erbtw5NraS8HdXKE * test(browser): make the narrow-toolbar regression deterministic The spec passed only from a clean profile. Two preconditions it set once are actively undone by the app: - BrowserPane re-focuses a blank tab's address bar across several animation frames plus the blank-url did-finish-load handler, so a single blur() was reverted and the bar never reached its squeezed resting state. - Startup paths re-open the right sidebar. At a fixed 700px window that leaves the pane ~70px, so the overlay had nowhere to go and the field measured 0px. Settling these separately let whichever settled first drift back while the next one ran. Re-assert them in one loop until they hold simultaneously, and size the window from the chrome actually measured instead of assuming a fixed 700px. Verified 8/8 green, and still fails at the overlay assertion when the fix is disabled, so the regression coverage stays real. --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * Improve orchestration migration safety for live legacy workers (#11107) * fix(orchestration): clarify legacy migration safety * fix(cli): sanitize legacy formatted messages * test(runtime): allow near-cap fuzz under shard load --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(lint): restore nested config discovery in changed-code gate (#11130) * docs: add WeChat group 6 QR with overflow guidance Show group 5 and group 6 QR codes side by side so people can join group 6 if group 5 is full. * fix(sidebar): restore legible selected-workspace fill in dark mode (#11139) #8321 mixed the selected card's wash into the opaque --worktree-sidebar surface, lifting dark mode to 16% (#4b4b4b). Card text lost too much contrast against it. Return both modes to a translucent wash (light 8%, dark 10%) so the brighter selection border added by #8321 carries the selected state instead of the fill. Co-authored-by: Orca <help@stably.ai> * fix(macos): avoid scene deadlock on app reactivation (#11055) * fix(macos): avoid redundant focus on app activation * test(macos): cover passive app activation --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(memory): retune image and orca.yaml ceilings that rejected valid input (#10815) * fix(orchestration): reveal worker terminals reliably (#11142) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * ci(pr): run E2E when a PR touches tests/e2e paths (advisory) (#11131) * ci(pr): run E2E when a PR touches tests/e2e paths Regression specs under tests/e2e never ran on PR CI — only schedule and release called e2e.yml — so a red regression test could merge green. Path-filter and workflow_call the E2E suite when E2E-relevant files change. Use merge-base diffs so base-branch drift does not false-trigger E2E, fail the detector when git diff cannot compute the PR range, and pin least-privilege contents:read on both the detector and reusable E2E workflow. Closes #10518 Co-authored-by: Wooseong Kim <innocarpe@gmail.com> Co-authored-by: Orca <help@stably.ai> * ci(pr): make the E2E path gate actually block, and match the real config path Two fixes to the new path-filtered E2E job. The gate did not gate. pr.yml's `verify` job is the required check, and it enumerates its dependencies explicitly — `e2e` was in neither `needs` nor the result list, so a failing shard left `verify` green. That reproduces the exact hole this job exists to close: a red spec merges green, just with a red box further down the page. Add `e2e` to both. Because the job is path-filtered, `skipped` is the normal result on a PR that touches no E2E files and has to keep passing. That allowance is checked after the strict loop rather than inside it, so it can never leak to the six jobs that are always required. The `playwright.` pattern matched nothing. The config is tests/playwright.config.ts — beside tests/e2e/, not inside it — so no tracked file starts with `playwright.` and editing the runner config would silently skip E2E. Anchor it at `tests/playwright.`. Adds a contract test alongside the existing release-e2e one. Verified it fails when either fix is reverted, and simulated the gate across success/skipped/failure/cancelled plus the skip-must-not-mask-a-real-failure case. * test(ci): close two gaps in the E2E gate contract CodeRabbit was right on both counts — verified by reverting each and watching the contract stay green. The path filter was unasserted, so `e2e` could lose its `if:` and run on every PR — the cost the filter exists to avoid — without failing anything. The strict-loop check hardcoded four of the six required jobs, so dropping GIT_COMPATIBILITY or SHELL_CONTRACTS left them unenforced while the contract passed. Derive the list from verify.needs instead, so a newly added required job that misses the loop fails here rather than silently going unchecked. * ci(pr): land the E2E path gate advisory instead of blocking The E2E suite is currently failing every scheduled run on main — 22 of the last 22 — so making verify depend on it would block any PR touching tests/e2e/**, including the PRs that fix the suite. This PR's own run reproduced that: 3 of 12 shards failed on specs unrelated to it (agent-session resume, Jira linking, plugin containment, terminal artifacts). So the job runs and reports on E2E-path PRs but is left out of verify.needs for now. The detector, the tests/playwright. path fix, and the contract tests are unaffected — those stand on their own and were the substance of the review. Flipping to blocking is a three-line change once the suite is green; the exact wiring, including why the skipped allowance must sit outside the strict loop, is recorded on verify's Require-successful-checks step. The contract test pins the advisory choice so it reads as deliberate rather than as the unwired-gate bug it originally caught, and still fails if the path filter, the strict-loop coverage, or the config path regress. --------- Co-authored-by: Wooseong Kim <innocarpe@gmail.com> Co-authored-by: Orca <help@stably.ai> * fix(orchestration): repair version-skewed run schemas (#11150) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(i18n): translate automation cadence labels (#11068) The cadence picker now resolves Hourly, Daily, Weekdays, Weekly, and Custom cron through the renderer i18n catalog, with corrected zh/ko/es translations. Supersedes #10044 (thanks @innocarpe) and #10045 (thanks @fsdwen). Fixes #10043 * chore(i18n): drop orphaned cadence catalog keys (#11154) Removes the lowercase hourly/weekly/custom entries from the AutomationSchedulePicker catalog node in all five locales. They were superseded by keys derived from the rendered labels in #11068, and the extractor only adds keys, so they stayed behind unreferenced. Follow-up to #11068. * test(cli): lock CLI-compatible timeout parse contract (#11206) parsePositiveSafeIntegerNumericText mirrors the CLI's own Number() coercion on purpose: text like `600000.000000000000001` is the budget the CLI will actually wait on, so rejecting it here would leave the relay and SSH kill timers shorter than the CLI's and cut the request short. Document that and pin it with regression cases. * fix(diff): stop file-tree navigation remounting combined diffs; make tree resizable (#11088) * feat: add Trae CLI as a supported TUI agent (#10763) * feat: [AI-GEN] add Trae CLI as a supported TUI agent Closes #10579. Wire trae-cli into the desktop and mobile agent catalogs following the same integration pattern as other CLI agents (e.g. Ante, Devin): - src/shared/types.ts, tui-agent-config.ts: register 'trae' with detectCmdAliases (traecli/trae-agent) and argv prompt injection, matching trae-cli's `trae-cli [prompt]` contract. The CLI's own third documented alias `ta` is intentionally excluded — too generic a 2-letter name to use as a PATH-existence detection signal without false-positiving on unrelated tools. - src/shared/trae-headless-command.ts: recognize `--print`/`-p` and `--output-format json|stream-json` as one-shot headless invocations (same shape as claude-headless-command.ts) so they aren't mistaken for a live interactive session. - agent-kind.ts, telemetry-events.ts, agent-status-types.ts, agent-type-label.ts, tui-agent-display-names.ts, tui-agent-permissions.ts (YOLO via trae-cli's own --yolo flag), tui-agent-selection.ts: standard per-agent registrations. - agent-catalog.tsx, agent-favicon-assets.ts, mobile/src/tasks/mobile-tui-agents.ts, mobile/src/components/mobile-agent-icon-assets.ts: catalog entries and bundled favicon (fetched from docs.trae.cn, required by mobile's offline-icon invariant test). - i18n: add the "Trae" label to all five locale catalogs (en/es/ja/ko/zh). - Tests: agent-process-recognition, agent-status, tui-agent-startup. Verified with `pnpm typecheck` (desktop + mobile), the relevant vitest suites (869 tests across 12 files, all green), oxlint (clean), and a real end-to-end launch of the actual trae-cli binary through Orca's pty.spawn IPC path (confirmed via the OS process table). * fix: [AI-GEN] point Trae catalog entry at the real CLI quick-start doc docs.trae.cn/cli (what the installed CLI's own --help text prints as its "User manual" link) soft-404s — the docs site restructured and the working page is docs.trae.cn/cli_get-started-with-trae-cli (confirmed by HTTP fetch: real page title "TRAE CLI 快速开始" vs the old path's "404 - 页面不存在"). Addresses CodeRabbit's homepageUrl review comment. * fix: [AI-GEN] detect Trae on traecli, not the ambiguous trae-cli name Per @AmethystLiang's review: the open-source bytedance/trae-agent project (MIT, ~12k stars) registers its own console script as `trae-cli` (pyproject.toml: `trae-cli = "trae_agent.cli:main"`), an entirely unrelated CLI with a different contract (`trae-cli run "task"`, `-p` short for `--provider`). Detecting on bare `trae-cli` would false-positive on that project's installs and break launch for anyone who has it instead of the actual TRAE CN CLI. - tui-agent-config.ts: detectCmd/launchCmd/expectedProcess -> `traecli` (TRAE CN's own installer symlinks this alias too, but the other project does not ship it). Dropped the `trae-agent` alias entirely — it's the colliding project's literal repo name, the highest false-positive string available. - agent-catalog.tsx: cmd -> `traecli` to match; faviconDomain -> `www.trae.cn` (bare `trae.cn` 404s on Google's favicon service; `www.trae.cn` is the product-root domain that actually resolves). - mobile-tui-agents.ts: faviconDomain -> `www.trae.cn` to match. - Tests updated: agent-process-recognition now asserts `trae-cli` and `trae-agent` are NOT recognized as Trae (regression guard against reintroducing the collision); tui-agent-startup updated for the new launch command. promptInjectionMode stays `argv` and the headless-command file stays as-is — both verified against the real TRAE CN CLI's actual --help output (pasted in the PR review thread), not assumptions. * refactor: [AI-GEN] share one print-mode headless matcher across agents trae-headless-command.ts was a rename-only fork of claude-headless-command.ts, and ante-headless-command.ts carried a third copy of optionName. Collapse both print-mode files into print-mode-headless-command.ts, dispatch from a Partial<Record<TuiAgent, ...>> table instead of an if-chain, and compress the Trae comments to the repo's one-line style. * fix: [AI-GEN] terminate Trae flag parsing before the positional prompt `traecli` is a Cobra CLI with subcommands, so an argv prompt starting with `help`, `config`, `-…` was dispatched as a subcommand or flag instead of being run as the task. Add `argvPromptSeparator: '--'` (same reason Grok has it), and stop the shared print-mode headless matcher at `--` so a prompt that reads like `--print` no longer drops the pane out of agent recognition. * docs: [AI-GEN] name both Trae CLIs explicitly in the detect-name comment Co-authored-by: Orca <help@stably.ai> * docs: [AI-GEN] drop the vendor tag from the Trae union comment Co-authored-by: Orca <help@stably.ai> * fix: [AI-GEN] guard the nullable startup plan in the Trae separator test Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: 陈泽榜 <chenzebang@jianzhikeji.com> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Orca <help@stably.ai> * chore: remove orchestration structured-output draft design doc from repo root * fix(codex): re-confirm spurious shell readings before skipping the restart card (#11076) An account switch decides pane eligibility from a single cached inspectProcess read. When that read reports the pane's shell for a live Codex session, the pane silently loses its restart card - no error, no retry. Re-check shell readings on Orca-launched Codex panes with the existing fresh-scan confirmForegroundProcess before trusting them; only an affirmative codex answer flips the decision, so a genuine exit to the shell stays uncarded and unsupported providers keep today's behavior. * feat(dictation): add stop button and shortcut hint to Listening indicator (#11152) * feat: bound direct SSH reconnect fan-out and recovery (#11003) * docs: design for direct SSH reconnect fan-out Capture the implementation-ready plan for host-qualified, epoch-fenced SSH reconnect recovery after two rounds of multi-model LLM counsel review. * docs: reconcile SSH reconnect fan-out design * docs: close reconnect design consistency gaps * feat: implement bounded direct SSH reconnect recovery * fix: bound direct SSH retry settlement * fix: harden direct SSH reconnect authority * fix: preserve split SSH retry ownership * fix: preserve SSH split continuation authority * docs: record final SSH reconnect validation * fix: preserve SSH authority through retained and detached state * fix: retain SSH authority across delayed split mounts * fix: close SSH authority recovery gaps * fix: fence stale SSH transport replacement * fix: serialize SSH target teardown * fix: settle SSH teardown failures before reconnect * fix: retire failed SSH reset sessions * test: reconcile current main E2E contracts * fix: close direct SSH reconnect review gaps * fix: fence stale SSH reconnect side effects * fix: close final SSH reconnect lifecycle gaps * test: stabilize current-main reliability gates * test: prove plugin navigation containment * test: make plugin navigation oracle authoritative * test: make plugin navigation oracle deterministic * ci: allow sharded e2e suite to finish * test: wait for runtime pane publication * test: classify pane readiness by error code * test: select close persistence terminal by tab identity * docs: mark reconnect implementation validated --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * Improve translations for resource manager and related UI elements (#11205) * Improve translations for resource manager and related UI elements Standardize terminology ("daemon" vs "service"), complete missing translations, and refine wording across Spanish, Japanese, Korean, and Chinese locales for consistency and clarity. * Improve translations for resource manager and related UI elements * fix(test): update zh name-mode label expectation after translation fix The resource-manager translation pass correctly changed the Chinese "Name" label from 姓名 to 名称; update the localized options unit test to match so CI passes. * fix(native-chat): surface draft launch context in desktop and mobile chat composers (#9802) * fix(native-chat): surface draft launch context in chat composers Creating a workspace from a GitHub issue delivers the issue link only into the agent TUI's input buffer (argv prefill or startup paste), so the chat view showed no trace of it on desktop or mobile. Desktop: draft launches now seed an in-memory launch draft keyed by tab id (direct work-item launches, background GitHub work-item creates, quick-create composer, and new-tab draft deliveries). The chat composer adopts the seed once as its editable draft, declines permanently if the composer already has text, and drops an untouched copy when any user turn lands (the one-line TUI input means the prefill was submitted or deliberately cleared) or on its own send, whose existing input pre-clear retires the TUI copy. Mobile: the host publishes the draft as an optional launchDraft field on the mobile terminal tab snapshot (additive, no protocol bump) and the mobile composer adopts it with the same once-only/decline/resolve semantics. Mobile chat sends now also pre-clear the TUI input line (Ctrl+U, desktop parity) so a pending prefill cannot concatenate with the sent message. Completion seeding resolves the launch tab from the synced store tabs when the backend spawned the terminal and activation reports no primaryTabId. Split the Windows shell-quoting tests into their own file to stay within the max-lines budget. * revert(mobile): drop incidental pnpm-lock churn from the launch-draft branch The libc binding fields and the @typescript-eslint peer re-resolution came from a local install, not from this change; mobile/package.json is untouched. * fix(native-chat): resolve launch drafts without trusting cross-host clocks The rule required a user turn stamped at or after the seed. Grok omits row timestamps, so a Grok launch draft never resolved; and the seed time is a renderer clock while the stamp comes from the executing host's JSONL, so a remote workspace whose clock trailed never resolved either. Both left the composer adopting an already-submitted prefill, which re-sends it as a duplicate turn. Resolve on any user turn that is not PROVABLY older than the seed (a launch draft's session starts with zero user turns), with the existing cross-host skew slack, plus a timestamp-free backstop for wider skew: a new tail user turn since the draft was first observed. "Load earlier" prepends, so it cannot move the tail and cannot over-resolve. Split out of native-chat-pending.ts to stay under the max-lines ratchet. * fix(worktrees): seed the launch draft on the agent's own tab, never on tabs[0] Two defects in the completion seed: - The tab was resolved by array position. buildStartupOpt returns undefined on the backend-spawn path, so applyDefaultTerminalTabs stamps launchAgent on no tab and the launchAgent guard was dead there. A repo with default terminal tabs ("dev server", "logs", ...) got the draft on a tab that runs no agent, and then published it to mobile as THAT tab's launchDraft. Correlate on the backend startup tab, then on a launchAgent-stamped tab, then on primaryTabId (which is the agent tab whenever the renderer owns startup); never tabs[0]. - Runtime-owned worktrees mirror their session tabs async, so tabsByWorktree was empty at seed time and the seed was silently dropped for that whole host class. Defer to the first mirrored tab via the existing delayed-delivery queue, which now holds every pending delivery for a worktree instead of one (setup/issue commands and the seed both wait on the same first tab). * fix(store): evict nativeChatLaunchDraftByTabId on every teardown path The new map was absent from all four paths its sibling nativeChatLaunchPromptByTabId participates in: tab close, the orphan terminal sweep, the bulk worktree purge, and the removeWorktree teardown. A stranded entry is worse than a plain leak here because sync-runtime-graph keeps publishing it to mobile as that tab's launchDraft. * fix(native-chat): only seed single-line unsubmitted launch drafts The unsubmitted-delivery branch seeded on every draft delivery, which also caught the agent-session-fork path whose prompt is multi-line scraped context. The chat send pre-clears the TUI with Ctrl+U (kill-to-start-of-LINE), so a multi-line prefill cannot be fully cleared and its earlier lines would glue onto the next message. The GitHub work-item draft this feature targets is a bare issue URL, so narrowing costs it nothing. Also assert the composer retires the seed after a send — deleting that call previously failed no test. * fix(mobile): stop the chat pre-clear from wiping a just-pasted image The text write set clearInputFirst unconditionally. On the image path that Ctrl+U lands AFTER pasteMobileNativeChatImagePaths already pasted the image, so the agent receives the text alone while acceptSend still renders the thumbnail on the sent bubble — silent image loss. Desktop's image path clears exactly once, before the paste, and never again; mobile now matches: pre-clear only when nothing was deliberately pasted first. The image paste already leads with its own Ctrl+U, so a launch-draft prefill parked on the input line still cannot glue onto the message. Pinned at both levels: the controller test drives the real send hook and asserts clearInputFirst per branch, and the send module asserts the wire text carries no leading \x15. The image-attachments test injects its own baseSend, so it structurally could not observe this. * fix(mobile): hold the launch-draft prefill until the transcript settles session.tabs delivers launchDraft before the transcript read resolves, so the seed effect could run against an empty in-flight message list and miss the user-turn decline. Launching from an issue, submitting the prefill in the TUI, and never opening desktop chat (nothing else clears the host seed) then prefilled the mobile composer with the already-sent issue link — a send tapped before it retracted duplicated it to the agent. Thread the session's loading state through and skip the seed while the read is in flight. idle/waiting-session still seed: no session means no user turns. * fix(runtime): publish a launch draft to mobile only for the tab's own agent The publish had no agent check while the desktop consumer declines on mismatch. The seed is keyed by tab id, which survives a pane's agent switch, so mobile could adopt a draft desktop refuses — seed for claude, never open desktop chat, switch the pane to Codex, and mobile prefills the Codex chat with the Claude-era issue link. Align publish with the consumer. * fix(native-chat): take the launch-draft baseline only after the transcript loads The timestamp-free backstop snapshotted the transcript's user turns on first observation of the draft, which can happen while the read is still in flight and `messages` is []. A pane bound to a session that already had user turns then backfilled above that zero baseline with a different tail id, so clause 2 resolved and silently dropped the seed — the launch context never appeared, and the feature no-oped for exactly the panes it was meant to serve. Clause 1 was already correct there (that history is provably older than the seed). Gate baseline capture and resolution on the transcript read settling, the same shape mobile's drafts hook uses. Clause 1 is unchanged; while loading the merged list is empty anyway, and a pane with live appends is never reported 'loading'. Also restore clause 1's short-circuit: it scans with .some() again and only allocates the user-turn list when falling through to the backstop. NativeChatView sat at exactly the 400-line cap, so the composer's two launch-draft props are now spread from the hook result they already mirror. * fix(native-chat): reject multi-line launch drafts inside the seed helper The single-line guard lived in deliverLaunchPromptToAgentTab, so the two other seeding entry points (worktree create, direct work-item launch) bypassed it — and every Linear launch is multi-line by construction ("Linked Linear issue: STA-…" + url). The chat send pre-clears the TUI with Ctrl+U, which kills to start of LINE, so those earlier lines stay parked to glue onto the next message. * fix(worktrees): keep the deferred agent seed off ambiguous mirrored tabs The runtime-owned deferred path fell back to tabs[0], which the module's own docstring forbids: with repo default tabs ("dev server", "logs") the seed lands on a tab running no agent, where mobile withholds it and desktop's agent check ignores it — the feature is silently dead for that create and the entry leaks until tab close. The queue entry is consumed before delivery, so there is no retry to fall back on; accept the first mirrored tab only when it is the worktree's only one and so unambiguously the agent's. * fix(mobile): treat a launch-draft-only session-tab frame as a change mobileSessionTabEqual's terminal branch never compared launchDraft, and the route keeps `prev` when tabs compare equal — so a publish whose only delta is the draft appearing or retracting was discarded and never reached the composer. Live QA passed only because agentStatus happened to change in the same frame. MobileSessionTab's terminal variant did not declare the field either (the controller read it through the structurally wider MobileNativeChatTab), which is why TypeScript never flagged it. * fix(mobile): judge a launch prefill only from its own settled transcript Two ways the drafts hook was reading a transcript that was not the active chat's: - transcriptLoading came from `status`, a plain useState written by a passive effect declared before the drafts hook. On the commit where the tab identity changes it still holds the previous tab's value, so the guard was off on exactly the render that seeds: first entry saw status 'idle' with an empty list and seeded an already-submitted link, and a tab switch declined the new tab's prefill from the old tab's turns. The session hook now tracks the identity its messages describe and reports transcriptLoading until they agree; the retire effect gates on it too. - Leaving chat view nulled launchDraft while draftKey stayed the same, which the hook could not tell from a host retraction — it declined the prefill permanently, so peeking at the terminal dropped the context. The controller now passes the raw field plus an explicit chatActive flag, and both effects hold their state when the tab is not on chat. The controller wiring was previously unasserted: replacing both props with constants left all 795 mobile session tests green. * fix(native-chat): keep the launch-draft baseline across a transcript reload baselineKey went null whenever the transcript was loading, and the null branch DISCARDED an already-valid baseline taken from a settled read. It was then re-taken from the fuller list, swallowing the very user turn that resolves the draft — so a stale prefill gets re-adopted as a duplicate turn. Key the baseline on draft identity alone and gate only the capture. session.status is also not a truthful read-in-flight signal: a live 'working' hook outranks 'loading', so the guard could be off over an in-flight empty list. Expose the read phase itself and gate on that. * test: cover the launch-draft reducers and the sync-key skip gate Every consumer test injects the three launch-draft reducers as bare vi.fn()s, so reducing markNativeChatLaunchDraftAdopted to a no-op left 2609 tests green — while in the app the composer would resurrect the prefill after every manual clear. canSkipRuntimeMobileSessionSyncKeyBuild had no launch-draft case either: when it skips, the sync key is never even built, so the existing getRuntimeMobileSessionSyncKey case cannot catch its removal. * fix(native-chat): hold the launch-draft baseline in state, not a render-mutated ref react-compiler rejects reading or writing a ref during render. Adjust the held baseline with the sanctioned render-time setState instead, keeping the local copy so the render that first sees a settled transcript resolves against it. * fix(mobile): carry the transcript identity in the session read state react-doctor flags the separate loadedIdentity state as an extra render for a derivable value. Hold status alongside the identity it describes in one state written by the subscription effect, so transcriptLoading derives from it. * test(native-chat): assert the readPhase contract without the hook-status race The test asserted status === 'working', which depends on liveStatusOverride winning over ambient transcript state — green locally, red under CI load. The contract is that readPhase stays 'loading' once live content unmasks status, so assert exactly that; it still fails if readPhase derives from status. * fix(mobile): derive pre-read chat status instead of writing it from the effect react-doctor's no-derived-state-effect flags idle/waiting-session/loading being set in the subscription effect: all three are pure functions of the props. Derive them during render and keep state only for the genuinely async outcome, tagged with the identity it describes. The tag now gates `messages` too, so a just-switched tab never sees the previous tab's transcript at all rather than seeing it behind a loading flag. * fix(mobile): drop a settled chat read once its subscription is torn down The settled outcome was only ever replaced by a newly arriving frame, so any effect re-run that landed back on an already-settled identity resurfaced it over a list the same effect had just cleared: 'ready' with no messages and transcriptLoading false. Toggling out of chat view and back hit this every time (the agent goes null, then returns), flashing the "start a chat" empty state over a real conversation and opening the launch-draft seed's decline check on an empty transcript. A reconnect did the same via the client dep. Identity and client are the effect's only inputs, so tagging the read with both and dropping it during render when either moves covers every re-run. * fix: pr-bug-scan validated finding from #6471 (#6512) * fix: address pr-bug-scan validated finding from #6471 stripTags now removes real markup (closing/self-closing/attributed/custom tags) outside the allow-list; only bare identifier-glued generics like Array<string> are kept. Blocks svg/center/custom leak a * fix: address pr-bug-scan validated finding from #6471 stripTags now removes real markup (closing/self-closing/attributed/custom tags) outside the allow-list; only bare identifier-glued generics like Array<string> are kept. Blocks svg/center/custom leak a * fix(mobile): harden markdown preview tag stripping * fix(mobile): preserve angle-bracket prose while stripping tags --------- Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * feat(worktrees): support project-level worktree.sharedDirectories in orca.yaml (#10459) * feat(worktrees): support project-level worktree.sharedDirectories in orca.yaml Follow-up to #7549: `.worktreeinclude` copies gitignored paths into each new worktree, which is right for `.env`/`.vscode/` but wrong for large rebuildable directories. Copying `node_modules` per worktree is slow and duplicates disk, and each worktree's install then diverges. Adds `worktree.sharedDirectories` to `orca.yaml` — a versioned, in-repo list of gitignored directories that are symlinked (shared) into every new local worktree, so one install serves them all. Adds to, never replaces, the per-user Worktree Shared Paths setting. `createWorktreeSharedPaths` uses a new 'share' materialization mode that always symlinks. The existing 'link' mode APFS clone-copies on macOS, which would give each worktree an independent node_modules and defeat the point; 'link' and 'copy' behavior are unchanged. Entries must exist as gitignored directories in the primary checkout; absolute paths, `..` traversal, and `.git` are rejected. Resolution never throws, so a malformed orca.yaml cannot block worktree creation. Remote (SSH) creation skips this, as it does symlink paths and `.worktreeinclude`. Closes #10451 * fix(worktrees): keep worktrees deletable after sharing a directory A directory-only ignore rule (`node_modules/`, the common spelling) matches the primary checkout's real directory, so the shared directory resolves and gets symlinked — but it never matches the worktree's symlink, so Git reports that link as untracked. Deletion only tolerated the per-user shared paths, so every worktree in such a repo became permanently dirty: the clean preflight threw "uncommitted or untracked changes" and `git worktree remove` refused without --force. Feed the configured `orca.yaml` shared directories into the same tolerate-and-unlink machinery the per-user shared paths already use, at both deletion call sites. The names are read unfiltered, since the create-time resolver drops exactly the entry deletion needs most. * test(worktrees): register createWorktreeSharedPaths in the runtime symlink mock orca-runtime.ts imports createWorktreeSharedPaths, but the vi.mock factory for ../ipc/worktree-symlinks never listed it. Vitest resolves omitted exports lazily, so this only stays green because no runtime test configures a repo with worktree.sharedDirectories — the first one that does would fail on a mock resolution error rather than on its own assertion. * fix(source-control): don't count shared symlinks as uncommitted changes A directory-only ignore rule (`node_modules/`) matches the primary checkout's real directory but never the worktree's symlink, so Git reports the shared link as untracked for the life of the worktree. That made every affected worktree read as dirty: a phantom row in the diff view, and Create PR blocked with `blockedReason: 'dirty'` telling the user to commit an entry they cannot commit, because it is a symlink Orca created. Status and the review-creation preflight now drop untracked entries that are both declared shared (per-user shared paths or orca.yaml sharedDirectories) and actually symlinks on disk. Both conditions are required, so a regular file at a declared name, or a symlink nobody declared, still counts as user work. The decision fails closed: anything not positively identified stays dirty. The preflight moves to `--porcelain -z` so paths with spaces or non-ASCII bytes are compared raw rather than C-quoted, with a parser that consumes the origin field a rename emits instead of reading it as its own record. Symlink detection moves to a leaf module: importing it from ipc/worktree-symlinks would pull APFS cloning, and its child_process dependency, into the status graph. SSH is unaffected and left alone — remote worktree creation skips the symlink and shared-directory passes, so a remote worktree never has one. * fix(source-control): wire shared links into local status * fix(worktrees): resolve the status repo once and reject uncollapsed shared paths `git:status` resolved the registered worktree's repo twice per call — once inside `getLocalGitOptionsForRegisteredWorktree` and again for the shared-link lookup — walking every repo's worktree meta on a polling path. `apps/./web` also survived `sharedDirectories` normalization: `resolve()` collapses it when the symlink is created but Git reports the collapsed path, so every later comparison misses and the link reads as permanent untracked work. Also stop resolving shared links for SSH repos in review creation: `repo.path` names a path on the remote host. Adds the missing wiring coverage for review creation and runtime status, plus the untracked-only conjunct in both filters — all four were mutation-verified to leave the suite green before these tests. * test(worktrees): pin the resolver-to-status seam for shared directories The resolver's output and the status filter were only tested apart — status used a hardcoded `['node_modules']`. Feed the resolved directories back through `getWorktreeSharedLinkPaths` into a real `getStatus` so a resolver that ever returned a differently-spelled path can no longer leave the link showing as a phantom untracked row. * fix(worktrees): try a directory junction before a symlink on Windows A plain `fs.symlink` needs Developer Mode or admin on Windows, so an ordinary Windows user got EPERM, the per-path catch logged and continued, and the worktree came up with no shared directory and no signal. A directory junction needs no privilege, and the rest of the codebase already uses one for win32 directory links. The symlink stays as a fallback rather than being replaced: a junction cannot target a UNC path, and a WSL project's repo lives behind one, so replacing it outright would trade the local-volume bug for a WSL regression. Safe for the removal path either way — Windows reports a junction as both a symlink and a directory, so the `isSymbolicLink()` unlink that runs before `git worktree remove` still fires and still refuses to follow it. * fix(worktrees): keep NUL bytes and tolerated links out of the removal error The removal preflight switches to `git status --porcelain -z` whenever it has shared links to tolerate, then attached that raw stdout to the error. `.trim()` does not strip interior NULs, so the message reached the user as `?? node_modules<NUL>?? precious.txt<NUL>` — raw control bytes, and it named the shared link, the one entry that is not the user's work and cannot be committed away. Parse the NUL-delimited output once and use it for both the clean verdict and the error text, so the two can never disagree about what blocks removal. The `-z` switch stays: it is what keeps paths with spaces or non-ASCII names comparable against the configured entry. * chore(worktrees): drop stray reformatting and note why the SSH guard exists Committing the merge staged 792 files, so lint-staged ran the formatter across all of them and rewrapped three renderer files that were already unformatted on main. Nothing was lost — they were byte-identical to main ignoring whitespace — but they showed up in the pull request as unrelated changed files. Restored to main's exact bytes. Committed with --no-verify on purpose: the pre-commit formatter is what introduced the rewrapping, so letting it run again would simply reapply it. Every check it would have run was run by hand instead — lint, typecheck, and the IPC and source-control suites all pass, and the three restored files are expected to fail a format check because that is main's current state. Also records why the connection guard on the shared-link lookup is not dead code: the remote dirty check ignores those paths, so the guard's only effect is avoiding a stray local read and the bad cache entry it would leave behind. * refactor(source-control): drop a scan-everything guard and freeze the cached list The dirty check built a filtered array only to read its length, so it always scanned every status record; asking whether any record is untracked stops at the first one and reads the same either way. The cached shared-directory list was also handhanded out by reference, so a caller that mutated it would corrupt every read for the rest of the cache window. Marking the return readonly prevents that at compile time; copying on return would work too but would allocate on the status-polling path, and there is exactly one caller, which only spreads it. * fix(mobile): exclude proxy fake-ip addresses from pairing QR (#10498) * fix(mobile): exclude proxy fake-ip addresses from pairing QR Clash/mihomo TUN interfaces in 198.18.0.0/15 were enumerated as pairing candidates and could become the default QR endpoint. Phones then retry an unroutable address forever. Drop those addresses from the pickable list (#10404). * refactor(mobile): keep fake-ip filtering local * test(mobile): cover fake-ip range boundaries --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * Bug floating workspace shortcuts route to main w (#10433) * fix(floating-workspace): route panel shortcuts to the floating panel, not the main window Floating-workspace close/index keyboard shortcuts leaked to the main window behind the panel. Route them through the floating panel across all four keydown layers via an atomic focus signal, panel-owned indexed switching with a tri-state outcome, an event-target-aware close guard, and a floating-scoped guest IPC bridge. Changes A-E and findings F2/F3/F4/F6/F7/F8/F9/F11/F-adv/F-dl/F-feas. Co-authored-by: Orca <help@stably.ai> Co-authored-by: feelgom <littlestork4@gmail.com> Co-authored-by: Wooseong Kim <innocarpe@gmail.com> * fix(review): clear stale floating-panel reclaim intent on panel close The module-singleton reclaim intent (F3) is armed at an emptying-close but only consumed by the visibleFloatingItemCount->0 effect. If a concurrent tab-create keeps the panel from reaching 0, the intent stays armed and could survive to a later empty-panel mount and steal keyboard focus. The !open release effect now clears it (defense-in-depth), matching the outside-pointerdown/window-blur paths. Flagged by 4 review personas (correctness, adversarial, julik-races, maintainability). Co-authored-by: Orca <help@stably.ai> * test(floating-workspace): cover L1 index-chord yield and deferred-close reclaim-arm timing Two additive R2-review tests for the #10288 floating-workspace shortcut routing change set: - createMainWindow: assert L1 yields the initial indexed-switch chord (tab-index and worktree-index) to the floating panel without preventDefault or dispatch, and contains held-key auto-repeats in main (preventDefault, no dispatch). Closes the untested Change B (F4) path. - FloatingTerminalPanel: assert an emptying, panel-owned close whose closeTerminalTab defers/cancels (onClosed never fires) leaves the reclaim intent unarmed, so no later empty-panel mount can reclaim focus for a close that never happened. The prior mock fired onClosed unconditionally, so this arm-timing (F3) branch was uncovered. Co-authored-by: Orca <help@stably.ai> * fix(review): resolve round-1 findings F-1..F-6 - F-1: re-derive panel emptiness from live store at arm time; clear stale reclaim intent on repopulating create so an unrelated later close can't consume it and steal keyboard focus from the main workspace. - F-2/F-5a: single-source the panel's non-creation shortcut claims via matchFloatingWorkspacePanelShortcut(); shared isTerminalPaneCloseChord() predicate for L2/L3; App.tsx gate + both FloatingTerminalPanel call sites now call the SSOT so index/rename/max-min ownership can't drift. - F-4: L2 keydown gate is event-target-aware (matches L1 yield) so an L1-yielded chord is still consumed during a transient panel blur. - F-5b: export clearReportedFloatingFocusCache() + reset it in test setup. - F-5c: split floating-workspace-item-actions.ts into focus-reclaim + guest-bridge modules (AGENTS.md file-naming). - F-6: trim verbose design-code comments to single-line WHY. Co-authored-by: Orca <help@stably.ai> * fix(floating-workspace): remove finding reference labels These internal review labels (F1–F7) and change identifiers were used during development and are no longer needed in the code. * fix(…
3 tasks done
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
…tablyai#10697) * fix(browser): retry a transient Windows lock on the Chromium cookie snapshot copy The snapshot attempt loop only reacts to a `false` return, so a throwing copy escaped it entirely. On Windows, AV/EDR briefly opens a file literally named "Cookies" with FILE_SHARE_NONE, which turns an otherwise-fine copyFileSync into `EBUSY errno -4082 syscall=copyfile` and aborts the whole import (#9355). Route the main-database copy through the existing `copyFileWithWindowsRetry`, already used for the same AV window in #1507. It is a no-op off Windows (maxAttempts=1), so POSIX still fails fast and ENOENT is never retried on any platform. * fix(browser): degrade the cookie-import staging DB instead of aborting the import Staging exists only to back the cold-restart replay for cookies the in-memory path rejects, but three points in it were fatal to the whole import (#9355): - the staging copy from the live partition DB — also a file named "Cookies", so the same AV/EDR handle blocks it; - opening/PRAGMA-ing that staged file; - both were unguarded, so a throw escaped to the catch-all and returned `ok: false` even when every cookie could load in memory. Each is now non-fatal and diagnosed. Two invariants keep the degraded path honest: `imported++` moved out of the staging insert so the summary counts importable cookies rather than staged rows, and `setPendingCookieImport` is never called when staging is unavailable — registering a path that was never written would replay a missing or partial DB over the live partition on cold start. * fix(browser): stop a degraded cookie import from replaying a stale staged database Review round 1 found the staging-degradation path could leave an older pendingCookieImports entry registered while the import rewrote the live session, so the next cold start replayed the stale DB over fresh cookies. - add clearPendingCookieImport so a degraded import retires the old entry - degrade staging on BEGIN/insert/COMMIT failure instead of aborting the import - discard the staged cookie copy on every non-registering path - pin the stagingAvailable guard, which previously survived mutation Co-authored-by: Orca <help@stably.ai> * fix(browser): report a degraded cookie import honestly instead of as a clean success Making the staging failure non-fatal introduced a silent-loss path: the import clears the live jar before loading cookies, so when staging was unavailable AND Electron rejected cookies, the user lost their old jar, got none of the new cookies, and still saw "Imported N cookies". Adds an optional `warning` to the import summary, set only on that degraded branch, and routes every cookie-import toast through a shared emitter that raises a warning toast instead of an unqualified success. Also closes three test holes found in review: - clearPendingCookieImport had no direct tests; deleting the wrong partition key survived all 10 registry persistence tests. Now covered, mutation killed. - The staging-insert-failure test was vacuous (memoryFailed === 0 suppressed registration on its own). It now forces a memory failure. - No test pinned the success-path clear; removing it survived. Now covered. * fix(github): resolve owner/repo through SSH Host aliases (#10284) (#10361) * fix(github): resolve owner/repo through SSH Host aliases (#10284) Expand OpenSSH Host → HostName via ssh -G before classifying github.com identity so PR merge works when origin is git@alias:owner/repo.git. Transport URLs stay unchanged so IdentityFile selection is preserved. Do not long-negative-cache indeterminate ssh -G failures. * fix(github): harden SSH alias resolution * Update README downloads badge * fix(persistence): fsync state writes so a rename is actually durable (#10631) * fix(persistence): fsync state writes so a rename is actually durable `Store` wrote `orca-data.json` to a temp file and renamed it. rename() is atomic for readers but says nothing about durability: without an fsync the directory entry can reach disk before the data does. After power loss or a hard crash the file can come back holding the previous state or, worse, zero bytes — and `JSON.parse('')` throws, so an empty file takes the full corrupt-file path rather than degrading. This is the same empty-file symptom as #1158 from a different cause. That issue fixed a logic path that persisted empty state and added the .bak ring as a safety net; the ring also catches this, which is why it went unnoticed. Recovery costs up to an hour of tabs/layouts/session state (backups are throttled to >=1h spacing), and a user in their first hour has no backup slot yet, so they land on defaults indistinguishable from a fresh install. Both write paths now fsync the temp file *before* the rename, then fsync the containing directory. Directory fsync is best-effort by design: Windows cannot open a directory for fsync and some filesystems reject it, so it is swallowed. The file fsync is the load-bearing part and works everywhere. Measured cost on a 3 MB payload: ~0.2 ms per write, against a 1s debounce. The async path does not block the main thread. The syscall-order test mocks `node:fs` and counts fsync targets at the module boundary, asserting ['file', 'directory'] — proving the ordering rather than inferring it from reading the implementation, since a fsync after the rename would still pass every content assertion. * test(persistence): make the syscall proof platform-aware and actually prove the order Two problems, both found from CodeRabbit's Windows observation. The assertion hardcoded ['file', 'directory']. Directory fsync is deliberately best-effort — Windows cannot open a directory for fsync and some filesystems reject it — so on Windows the helper swallows the failure, only the file fsync is observed, and the test fails. The expectation now probes the real platform instead of assuming, keeping the guarantee tight where directory fsync works rather than dropping it everywhere. Worse, the test did not prove what its name claimed. Moving the fsync to *after* the rename still passes: the file is fsynced either way, and only fsyncs were recorded, so the correct and broken orders produced an identical log. Mutation-testing the "before rename" claim is what surfaced this — the mutation passed. The rename is now recorded in the same sequence, since it is the boundary the ordering is defined against. Re-running the same mutation fails, so the ordering claim is now backed by the test rather than asserted in a comment. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(window): stop burning macOS GPU on an invisible blur effect (#8482) (#10682) Co-authored-by: Orca <help@stably.ai> * feat(sidebar): distinguish and filter CLI-created workspaces (#10712) * perf(relay): stop snapshotting the whole pending-PTY map every drain tick (#10670) * perf(sidebar): share one worktree-keyed agent orchestration index (#10678) Co-authored-by: Orca <help@stably.ai> * fix(mobile): recover unreliable relay connections (#10709) * fix(mobile): recover unreliable relay connections * test(mobile): use valid raster preview fixtures --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * release: v1.4.157-rc.0 * docs(relay): trim the pending-output drain comment (#10714) Co-authored-by: Orca <help@stably.ai> * fix(history): quarantine unreadable recovery generations. (#10713) * fix(history): quarantine unreadable recovery files * fix(history): preserve mixed recovery generations * fix(history): reanchor reconciled live sessions * fix(history): serialize final checkpoint queue * fix(history): drain sleep shutdowns before disconnect * fix(history): restore legacy wide sessions * fix(history): preserve malformed mixed logs * fix(history): preserve malformed log tails * refactor tests to reduce file size * refactor(history-recovery): extract freeze helper and improve test robus - Extract takeRecoveryFreeze to eliminate duplicated freeze-and-clear pattern across five call sites - Skip permission-mode tests on root CI containers (chmod 0o500 doesn't block root writes) - Replace fixed sleep with deterministic wait for queued exclusive checkpoints - Distinguish ENOENT (missing) from corrupt in history metadata reads - Add ceiling-dimension restore test and torn-tail exclusion assertion - Wrap chmod operations in try/finally to prevent leaked permissions from masking test failures - Add .catch() to checkpoint promise to prevent unhandled rejections from finally re-throws * test(history-recovery): consolidate checkpoint assertions Wait for both the checkpoint call and set clear atomically to avoid a timing race where the spy fires before the set is cleared. * fix(persistence): unbreak main by expecting the new 'cli' card property in fresh defaults (#10722) Co-authored-by: Orca <help@stably.ai> * fix(sidebar): stop worktree drag from spazzing when cards resize mid-drag (#10725) * fix(sidebar): make Cmd/Ctrl+1-9 match the rendered card order when the sidebar is closed (#10693) * fix(native-chat): wrap question text and option descriptions instead of truncating (#10025) * fix(mobile): pop to home when leaving a host so the back chevron animates backward (#9723) * fix(i18n/zh): correct technical literals and clear sense errors (#10048) * feat(speech): add Korean streaming zipformer STT model (#9893) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(source-control): add copy relative path (#9018) * fix(gitlab): stop refresh button overlapping dialog close X (#9445) * fix(gitlab): stop refresh button overlapping dialog close X The GitLab item dialog's SheetContent renders its own close (X) at absolute right-4, but the header refresh button sat at the header's px-5 right padding and overlapped it. Reserve pr-10 on the header so the refresh button clears the close X, and lift it -mt-1.5 so its icon aligns with the close X on the same line. * fix(gitlab): integrate sheet controls into header --------- Co-authored-by: viniciussilva <vinicius.silva@plus10.de> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * fix(sidebar): raise selected workspace contrast in dark mode (#8321) * feat(editor): toggle Word Wrap from file tab actions and Alt+Z (#10086) * feat(editor): toggle Word Wrap from file tab actions and Alt+Z Long single-line and structured files wrap by default and misalign. Surface Word Wrap on the editor more-actions menu for normal file tabs (diff already had it) and add editor.toggleWordWrap (Alt+Z) so users can unwrap without opening Settings. Closes #9974 * fix(editor): toggle diffWordWrap for diff surfaces on Alt+Z CodeRabbit: Alt+Z previously always flipped editorWordWrap, leaving diff panes out of sync with the markdown actions menu. * test(editor): verify word wrap shortcut routing Cover editor/diff setting callbacks and the cross-platform Alt+Z binding. --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(repo-icon): detect Tauri and WebP icons (#7942) Expand repository icon auto-detection to conventional Tauri and public/icon paths with PNG/WebP magic and dimension validation. Bound SSH probing while preserving candidate priority and PNG-only user uploads; SVG remains rejected. * Add bulk tab closing to mobile long-press sheets (Close Others / Left / Right) and complete the desktop tab context menus (#9323) * Add Close Tabs to the Left and complete Close Others across tab menus and mobile long-press sheets * Fold the per-sheet Close action into the bulk-close module (session route max-lines) * fix(mobile): preserve pinned tabs during bulk close --------- Co-authored-by: Tom de Bres <tomdebres@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * feat: implement Cmd+Enter as commit shortcut in Source Control (#9773) * feat: implement Cmd+Enter as commit shortcut in Source Control * test: add unit tests for commit shortcut and tooltip formatting * fix: address review feedback on modifier keys and test coverage * test: split mac and windows/linux shortcut and keydown tests --------- Co-authored-by: Andres Van Reepingen <andres.vanreepingen@datacamp.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * Add SenseVoice speech-to-text model (Korean/Japanese support) (#7436) * Add SenseVoice speech-to-text model (Korean/Japanese support) SenseVoice (zh/en/ja/ko/yue) is the only bundled local STT model with Korean and Japanese support. The existing local models cover only English and Chinese (Parakeet, Zipformer, Paraformer); Whisper Tiny is multilingual but trades accuracy for breadth. - Add 'senseVoice' to SpeechModelType - Register the sherpa-onnx SenseVoice archive in the model catalog (pinned SHA-256, single-file model.int8.onnx + tokens.txt layout) - Handle the senseVoice type in the STT worker via createOfflineRecognizer with the senseVoice model config (auto language detection + ITN) - Add model-catalog regression tests for the new entry Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(speech): use int8-only SenseVoice archive * fix(speech): refresh SenseVoice catalog metadata --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: LauraGPT <LauraGPT@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(settings): show a way back to local accounts when a remote server owns provider-account scope (#8188) Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * feat(speech): add Parakeet TDT-CTC 0.6B JA voice model (#8207) * Add SenseVoice speech-to-text model (Korean/Japanese support) SenseVoice (zh/en/ja/ko/yue) is the only bundled local STT model with Korean and Japanese support. The existing local models cover only English and Chinese (Parakeet, Zipformer, Paraformer); Whisper Tiny is multilingual but trades accuracy for breadth. - Add 'senseVoice' to SpeechModelType - Register the sherpa-onnx SenseVoice archive in the model catalog (pinned SHA-256, single-file model.int8.onnx + tokens.txt layout) - Handle the senseVoice type in the STT worker via createOfflineRecognizer with the senseVoice model config (auto language detection + ITN) - Add model-catalog regression tests for the new entry Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(speech): add Parakeet TDT-CTC 0.6B JA to the speech model catalog * test(speech): cover stt-worker-model-config file resolution incl. single-file models * feat(speech): decode Parakeet TDT-CTC JA via sherpa-onnx nemoCtc offline recognizer * fix(speech): use int8-only SenseVoice archive * fix(speech): refresh SenseVoice catalog metadata --------- Co-authored-by: xsacdw <xsacdw@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: LauraGPT <LauraGPT@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(terminal): stop switch bold flash and Windows lag (#10692) * fix(terminal): stop bold flash on worktree switch Worktree hide disposes WebGL and falls back to xterm's DOM renderer. On reveal, resume ran after paint and flushed backlog against DOM first, so the first frame used heavier CSS-AA glyphs before WebGL settled. Resume in useLayoutEffect and reattach WebGL before backlog flush so the first painted frame stays on the GPU path. No cold-park policy change. Co-authored-by: Orca <help@stably.ai> * fix(terminal): fit WebGL grid before backlog flush on resume Adversarial review: resume-before-flush alone wrote TUI backlog onto the transient DOM↔WebGL one-column-off metrics window. Order is now resume → fitAllRevealedPanes → flush on heavy reveal and window wake. Co-authored-by: Orca <help@stably.ai> * fix(terminal): latch viewport intent before WebGL wake resume Adversarial review: wake path synced intents after resume/fit, which can re-latch a pinned viewport as followOutput. Capture before reattach and drop the post-resume re-sync on heavy reveal (outer path already latched). Co-authored-by: Orca <help@stably.ai> * fix(terminal): complete visibility bookkeeping before PaneManager exists useLayoutEffect runs before the passive lifecycle creates PaneManager, so the mount-visible path never set hasCompletedVisibleResume. The first intra-worktree hide then wrongly suspended WebGL. Bookkeep completion even when managerRef is still null (extracted helper for max-lines). Co-authored-by: Orca <help@stably.ai> * fix(terminal): re-sync pin geometry after resume backlog flush Keep the pre-resume intent latch (reattach must not re-latch pins as followOutput), then re-sync after flush with preservePinnedAtBottom so scrollback trim updates absolute pin lines before enforce. Co-authored-by: Orca <help@stably.ai> * fix(terminal): drop same-tick post-flush intent re-sync flushTerminalOutput only queues terminal.write and returns before parse, so a same-tick re-sync read pre-parse resume/fit geometry and could overwrite pre-resume pins. Keep pre-resume latch + enforce only. Co-authored-by: Orca <help@stably.ai> * fix(test): expect default worktree card properties to include cli #10712 added 'cli' to DEFAULT_WORKTREE_CARD_PROPERTIES, but the fresh default-profile assertion still omitted it and fails verify. Co-authored-by: Orca <help@stably.ai> * perf(terminal): retain Windows WebGL across worktree hides * perf(terminal): bound retained WebGL contexts * fix(terminal): harden retained WebGL lifecycle * fix(terminal): preserve healthy WebGL on wake * fix(terminal): preserve reveal recovery ordering --------- Co-authored-by: Orca <help@stably.ai> * fix(mobile): clear native-chat composer optimistically at send time (#10226) * fix(mobile): clear native-chat composer optimistically at send time Over relay the send RPC round trip is visible and a lost ack (or a relay/direct cutover) could strand the sent prompt in the composer forever: the unconfirmed-send deadline dropped its tracking entry, so a late transcript echo could never clear the draft. Clear the draft at send time and restore it only on a definite rejection. holdUnconfirmedSend now only manages the delivery-unconfirmed notice; it no longer touches drafts. * fix(mobile): isolate question answers from composer drafts * fix(cli): bound orchestration ask timeouts (#10689) * fix(cli): bound orchestration ask timeouts * fix(cli): harden remote timeout boundaries * fix(crash-reporting): stop fit-retry bursts from erasing the pre-crash trail (#10729) * fix(crash-reporting): stop fit-retry bursts from erasing the pre-crash trail Windows renderer OOM F0BKR84AHEH (0xE0000008) arrived with a 30-entry breadcrumb ring in which two `terminal_safe_fit_retry_exhausted` bursts consumed 26-90% of the slots. Every hidden pane is `display:none` -> 0x0 -> unmeasurable, so one post-reload reattach wave exhausts the retry budget once per mounted pane inside ~60ms. The bursts were also uninterpretable: `pane.id` restarts at 1 per PaneManager and there is one manager per tab, so 34 identical `paneId: 1` crumbs cannot distinguish one pane looping from 34 panes firing once. Coalesce the crumb by name and carry the live-pane census on the payload instead, so the count survives without costing 34 ring slots. Same treatment for WebGL diagnostics, which were worse off: context-loss and atlas-reset crumbs only reached a DevTools-only ring (`window.n()`), so a renderer that dies takes them with it. That bundle had three GPU-process deaths in the 65s before the renderer OOM and zero WebGL evidence - absence of instrumentation, not absence of the event. Mirror them into the crash report, coalesced per kind so a routine atlas reset cannot mask a context loss. Evidence-only: no behavior, rendering, or lifecycle path changes. Co-authored-by: Orca <help@stably.ai> * perf(pane-manager): count panes without materializing public views The census runs on the crash path; getPanes() allocates a full ManagedPane projection per pane just to read .length. Co-authored-by: Orca <help@stably.ai> * test(crash-reporting): pin the fit-retry burst against the 30-entry ring Reproduces the F0BKR84AHEH ring loss directly: 10 pre-crash crumbs plus a 34-crumb per-pane burst. Uncoalesced, the burst takes all 30 slots and zero pre-crash crumbs survive; coalesced, it takes one slot, all 10 survive, and the pane count rides on the payload instead of on the crumb multiplicity. Co-authored-by: Orca <help@stably.ai> * fix(crash-reporting): name the WebGL census the same as the fit-retry census The context-loss crumb spread getLivePaneCensus() raw, so one ring described one measurement two ways: managers/panes here, livePanes/livePaneManagers on the fit crumb. Spreading also meant renaming the census return keys would silently reshape the crumb. Name the fields at the call site and pin them. Co-authored-by: Orca <help@stably.ai> * fix(crash-reporting): keep a hot coalesce key from being the first LRU eviction The suppression path returned before the delete-then-set that re-anchors recency, so a key hit continuously never moved from its original insertion slot and became the first eviction candidate — the inverse of the LRU's stated intent. `renderer_error` keys carry message+stack identity, so one noisy render loop mints unbounded distinct keys. Within a single 30s window that churn evicted the `terminal_safe_fit_retry_exhausted` key mid-burst, un-suppressing it and re-arming the exact ring flush the coalescing exists to prevent. Re-anchor position only; `recordedAt` is left alone so the suppression window still expires on schedule rather than renewing on every hit. Found while adversarially probing the LRU claim in #10729's own description, which asserted these keys "cannot evict live keys". * fix(crash-reporting): report the newest census of a coalesced burst The suppression path wrote nothing to the ring, so a coalesced burst froze its FIRST event. Panes mount progressively, so pane 1 exhausting alone legitimately measures livePanes: 1 -- and the 33 later crumbs, each carrying a truer census, were dropped. A 34-pane wave was recorded as `livePanes: 1` with no count: the exact "one pane looping" misread that coalescing by name was introduced to prevent. The existing burst test missed this because it fed a constant census on every crumb, making frozen-first and newest-wins indistinguishable. Stash the newest payload and fold it into the ring entry the key already owns: still one slot, now reading livePanes: 34 + suppressedSinceLast: 33. Resolution is deferred to snapshot time -- sanitizing per suppressed hit of a 1459/min crash loop measured 2194 ns/op vs 185 ns/op deferred. Two follow-on defects fixed alongside: an expiring key dropped its pending payload (it loses its only handle on the ring entry), and resolving the re-emitting key's own old slot double-counted a burst. --------- Co-authored-by: Orca <help@stably.ai> * fix(speech): download verified model artifacts directly (#10735) * perf(renderer): give owner-routed settings a stable identity (#10743) Co-authored-by: Orca <help@stably.ai> * perf(agent-status): validate hook payloads without the JSON round trip (#10752) * fix(gpu-fallback): make the crash window rolling, not launch-anchored (#10707) * fix(gpu-fallback): make the crash window rolling, not launch-anchored Software-rendering fallback only ever considered GPU child crashes in the first 30s after launch: `if (msSinceLaunch > this.windowMs) return`. Session 12e6ee64 crashed the GPU child 4 times (242s / 920s / 926s / 946s since launch). The last three span 26.0s — inside windowMs, exactly threshold — but every one was rejected because the burst began 920s in. The renderer died of process OOM (0xE0000008) 39s later. GPU work is demand-driven, so the first heavy compositing often happens minutes into a session. What distinguishes a broken driver from normal Chromium churn is that the crashes *cluster*, not when the cluster starts. Keep a sorted array of recent crash times pruned to windowMs behind the newest, and engage when the count reaches threshold. Measured against real field telemetry (341 distinct win32 launches with >=1 GPU crash, from process_gone_suppressed breadcrumb trails): the rolling window engages on 2/341 launches (0.59%), one of which is 12e6ee64. Max GPU crashes in any single launch is 4. The closest non-firing sequence ([0, 29531, 55136, 74178] — consecutive gaps that each fit the window but never put 3 inside it) is pinned as a regression test. Also destroy the Windows tray before app.exit(0) on this path, matching the app:relaunch IPC handler — app.exit skips before-quit, and this can now fire deep into a session rather than only in the first 30s. Mutation-tested: 6 mutants (launch-anchored gate, dropped pruning, dropped monotonic clamp, cutoff </<=, threshold >=/>, dropped engaged latch), all killed by the suite. Co-authored-by: Orca <help@stably.ai> * fix(gpu-fallback): ask before restarting --------- Co-authored-by: Orca <help@stably.ai> * feat(sidebar): add a filter to hide detached-HEAD workspaces (#10786) Adds "Hide detached HEAD" alongside the existing sidebar filters, wired through the same pipeline as Hide CLI-created: sidebar list, Cmd+J empty-query list, workspace board, active-filter badges, Clear/Reset Filters, and persisted UI state. The predicate reuses getWorktreeGitIdentityDisplay so the filter targets exactly what the card renders a Detached HEAD badge for. Requiring a real head (not just an empty branch) keeps folder workspaces and SSH-synthesized rows — which carry both empty — out of the filter. Activating a hidden detached workspace clears the filter, matching the existing reveal escape hatch for automation- and CLI-created workspaces. Splits the filter-state describes out of visible-worktrees.test.ts into sidebar-filter-state.test.ts to stay under the max-lines budget. Co-authored-by: Orca <help@stably.ai> * feat(daemon): add daemon_lifecycle replaced/retired telemetry event (#10058) * feat(daemon): add daemon_lifecycle replaced/retired telemetry event Implements STA-2376. Adds track('daemon_lifecycle', {transition, reason, live_session_count_bucket, version_skew?}) covering 'replaced' (unhealthy_resolver / stale_bundle / different_app_path / failed_health_check at daemon-init launcher sites) and 'retired' (died_respawn at the adapter respawn closures). Enum-only + .strict() + bucketed counts keep paths, versions, and raw counts off the wire; preserve-path transitions emit nothing. Cross-platform and SSH-safe; no-op in non-official builds. Test plan: affected vitest (158) green; typecheck/lint clean except pre-existing unrelated failures. * fix(daemon): prevent false lifecycle telemetry * test(daemon): restore once-ness on respawn reason assertions Keep STA-2376 reason checks without dropping concurrent-respawn coalescing coverage that prevents double died_respawn telemetry. * fix(daemon): emit replaced telemetry on runtime unhealthy_resolver respawn CodeRabbit: adapter-driven macOS resolver replacements forked a new daemon without a lifecycle event. Emit trackDaemonReplaced (not retired) so field diagnosis of #7936 covers the runtime path without mislabeling it as death. * fix(daemon): stop double-counting resolver replaces; drop redundant version_skew Three telemetry-correctness fixes to the STA-2376 daemon_lifecycle event. 1. The runtime macOS resolver respawn double-counted. doRespawn() disconnects but never kills the daemon, so the ensureRunning() that follows re-enters createOutOfProcessLauncher, which re-detects healthy + resolver-unhealthy + 0 sessions and emits the replace itself. The closure emitted a second one. It also emitted before the outcome was known, so a resolver that recovered mid-flight (or a session appearing) left a 'replaced' on the wire for a daemon the launcher went on to preserve. The launcher's emit is gated on a confirmed kill, so it is the correct sole emitter; this reverts the emit added in 1e60ca87a4. The reason plumbing stays -- it is what keeps a resolver respawn from being mislabelled died_respawn. 2. version_skew carried no information and lied to one cohort. It was present iff reason === 'stale_bundle' and always true, so it was a deterministic function of reason. isDaemonStaleForCurrentBundle also returns true when the pid file has appVersion: null -- a replace-once heuristic for pre-marker builds, where no version comparison happened at all -- so the field asserted skew for exactly the upgrade cohort the event exists to illuminate. Dropped from the schema, emitter, and call site, along with the dead branching. 3. track() is now failure-isolated in both emitters. Both call sites sit on the daemon launch/respawn path, where a throw costs the user every terminal. Tests: once-ness (toHaveBeenCalledTimes) on every emit assertion -- the old toHaveBeenCalledWith-only assertions passed under a doubled call; a regression guard that the resolver respawn closure stays silent; and a throwing-client test. Note the unit tests mock DaemonSpawner and never invoke the launcher, so no test could observe the double-emit; the once-ness assertions bound each emitter within its own seam. Known limitation, unchanged: a wedged-but-alive daemon (#8689) can still report died_respawn from the adapter and failed_health_check from the launcher -- the app cannot distinguish wedged from dead at that point. * fix(daemon): attribute the runtime resolver replace so it is not lost Round-2 review found the previous commit over-corrected. Removing the emit from the respawn closures was right about the premature emit but wrong about where the event would come from instead. doRespawn() does not kill the daemon, but it does drop its only authenticated client, and that is enough: the last fully-authenticated disconnect sets retirementRequested, and reevaluateIdleShutdown -> beginIdleShutdown runs with no grace timer, unlinking the token and PID files. So by the time ensureRunning() re-enters the launcher, the daemon is already gone -- killStaleDaemon finds no PID file, confirmedReplacement stays false, and the gate suppresses the emit. Net effect of the previous commit: zero events for a runtime macOS resolver replacement, the common case. The double-emit round 1 found was real but narrow: it needs a daemon holding non-alive sessions, which keeps host.listSessions() non-empty so isIdle() is false and the daemon survives the disconnect to be killed by the launcher. Fix: the adapter attributes the reason rather than emitting it, and the launch it triggers consumes the attribution and reports it. One emit point, exactly one event, correct reason -- whether the daemon self-retired or survived to be killed. The attribution is one-shot so a later unrelated launch cannot inherit it, and it is preferred over the launcher's own inference, which would otherwise mislabel this as failed_health_check. Also: suppress died_respawn while a manual restart is in flight. runRestartDaemon kills the daemon while the outgoing adapter is still live and undisposed, so a pane respawning on its synthetic exit billed a user action to the crash bucket. Tests: a regression test that drives the closure and the launcher across the seam the DaemonSpawner mock normally hides, with killStaleDaemon returning false to model the self-retired daemon, plus the one-shot assertion. Verified load-bearing by mutation (neutering the handoff fails it). Also reset killStaleDaemonMock's implementation in beforeEach -- mockClear left a previous test's mockResolvedValue in place, which silently disarmed the confirmedReplacement gate for every test after it. * fix(daemon): let a proven replacement reason outrank the attributed one Round-3 review. The attribution was preferred unconditionally, so a launch that independently proved a different cause reported the wrong one: resolver unhealthy at the adapter check, daemon survives the client drop (non-alive sessions keep isIdle() false), resolver recovers milliseconds later, and the launcher then proves a stale bundle or a different app path and kills on that basis -- but the event said unhealthy_resolver. A proven kill is grounded in post-kill truth, so it now wins; the attribution covers only what the gate cannot see, a daemon that self-retired leaving nothing to kill and no reason to infer. Every other case is unchanged: self-retired still reports unhealthy_resolver, and the surviving-daemon case reaches the same reason through the launcher's own inference. Also pins the invariant that makes the module-scoped one-shot safe -- the write reaches the launcher with no await in between -- at both the write and the consume, since the DaemonSpawner mock lets tests drive the two halves with an arbitrary gap and would not catch an await being introduced. Corrects the beforeEach comment from the previous commit: there was never a plain mockResolvedValue on killStaleDaemonMock in this file, so it did not silently disarm the gate for later tests. mockReset is still right -- it drops an unconsumed *Once queue, which mockClear does not. Tests: a guard that the launcher's proven reason wins over the attribution, verified load-bearing by mutation (restoring the old ordering fails it). * fix(daemon): don't let the residual health bucket absorb the resolver reason Round-4 review caught a regression from the previous commit. Letting any confirmed kill outrank the attribution was too broad: failed_health_check is not an identification, it is the residual bucket that also absorbs wedges and crashes, so preferring it discards the more specific reason the adapter already established. This is the likely shape of the incident, not a corner case. The dead macOS login session that fails the resolver probe also fails the PTY spawn probe, so checkDaemonHealth returns pty-spawn-unhealthy rather than healthy. The resolver branch is then never evaluated, and with zero live sessions the degraded preserve does not apply either, so the launch falls through to failed_health_check and kills a daemon that survived the adapter's disconnect (non-alive sessions keep it non-idle). Before this commit that reported failed_health_check and dropped unhealthy_resolver -- burying the flagship signal in the catch-all. Rank by how well each reason is evidenced instead: a confirmed kill that positively identified the daemon wins, the attribution beats the residual bucket, and the residual bucket is still reported when there is nothing better. Round 3's motivating case (a proven stale bundle must not be billed to the resolver) is unaffected and still covered. Tests: a guard for the pty-spawn-unhealthy shape, verified load-bearing by mutation (removing the residual-bucket exclusion fails it). * test(daemon): cover the confirmation path production actually uses Round-5 review. No runtime defect, but the three identified reasons were only ever proven through a mechanism the field never takes. confirmedReplacement is `(await killStaleDaemon(...)) || cleanupResult.cleaned`, and the two halves are disjoint in practice. unhealthy_resolver, stale_bundle, and different_app_path all require health === 'healthy', so cleanup reaches the daemon over RPC, shuts it down, and unlinks its pid file -- leaving nothing for killStaleDaemon to find. Production therefore confirms exclusively via .cleaned. Every test confirmed exclusively via killStaleDaemon, because the net.connect stub always errors, so cleanup always returned cleaned:false. The consequence was a silent trapdoor: simplifying the gate to `confirmedReplacement = await killStaleDaemon(...)` stops all three identified reasons from ever emitting in the field, and the whole suite stays green. Confirmed by flipping the killStaleDaemon default to false -- five tests fail, none of which are meant to be about the kill. Adds the missing case: cleanup confirms, the kill finds nothing, and different_app_path is still reported once. Verified load-bearing by mutation -- dropping the .cleaned half now fails this test specifically. Scoped the new test's mocks to *Once so the identity override cannot leak into the packaged-bundle test that follows, and hands probeSocketExists back on the way out since beforeEach only mockClear()s it. * test(daemon): cover the manual-restart retirement guard Round-6 review returned land-ready with one note: removing the !restartInFlight guard from both respawn closures left the whole suite green. That is the same silent-trapdoor shape the previous commit closed for the .cleaned gate, on a guard this PR introduced, so it gets the same treatment. The guard matters because runRestartDaemon tears the daemon down while the outgoing adapter is still live and undisposed; a pane respawning on its synthetic exit reaches the death path for what was a user action, and would bill a manual restart to the crash bucket. Drives the death from inside the restart's ensureRunning so restartInFlight is genuinely set by the code under test, rather than asserting against a flag the test poked itself, and then repeats the respawn after the restart settles to show the suppression is scoped rather than permanent. Verified load-bearing by mutation: removing the guard fails this test and nothing else. * test(daemon): close the two surviving telemetry mutations Round-7 review returned land-ready with two test-only gaps, both found by mutation and both the same trapdoor shape as the last two commits. The manual-restart guard exists in two respawn closures and only the first was covered. That is the wrong half: the restart installs its own adapter, so from the second restart onward the copy in runRestartDaemon is the one that actually runs in the field, and it could be deleted with the suite green. The test now drives a second restart through the adapter the first one installed. The privacy-invariant test only built 'replaced' payloads, so .strict() on the 'retired' member was never exercised -- someone adding a field to trackDaemonRetired after that .strict() was dropped would have reached PostHog with the test still passing. It now runs the leak set over both transitions, plus a sanity assertion that each base payload is itself valid so the rejections prove the leak and not a malformed base. Both verified load-bearing: neutering the second guard copy, and dropping .strict() from the retired member, each now fail exactly one test. * fix(daemon): respawn on PTY write dropped to a dead daemon socket (STA-2373) (#10065) * fix(daemon): respawn on PTY write dropped to a dead daemon socket (STA-2373) DaemonPtyAdapter.write() sends keystrokes via fire-and-forget client.notify(). When the daemon dies (retirement, crash, kill), the socket disconnects and the notify is silently dropped — no rejection reaches withDaemonRetry, so the dead-endpoint respawn never fires and the attached pane freezes. Only a request/reply RPC (e.g. createOrAttach from opening a new terminal) detected the death and forked a replacement. DaemonClient.notify() now reports delivery; a dropped write to a still-active session drives the shared respawn coalescer directly (reconnecting the permanent client before releasing the temporary adoption lease, mirroring withDaemonRetry's ordering), so the pane self-heals like the createOrAttach path. Cross-platform + SSH-safe: no platform assumptions, pure adapter logic. Complements (does not duplicate) #8426, which fixes the adjacent in-daemon bug where a thrown node-pty write no longer marks the handle dead. That is daemon-side; this is the app-side dropped-notify that never triggered respawn. * fix(daemon): restore adapter state after dropped-write respawn * fix(daemon): recover writes after endpoint respawn * fix(terminal): remount panes after daemon death * fix(daemon): recover sibling panes after daemon death, not just the written one When a daemon dies, its dropped-write respawn only remounted the pane whose write detected the dead endpoint. Sibling panes (alive at death but not typed into) were left frozen: stale prompt pixels, silently-dropped input, no live child, and no recovery even on later keystrokes — the exact STA-2373 frozen-typing symptom on non-triggering panes. DaemonPtyAdapter now fans a write-unavailable signal out to every active session when it recovers from a dead endpoint, emitted while the sessions are still in activeSessionIds so the renderer's liveness gate still reads them live. pty.ts forwards each to the existing pty:writeUnavailable channel, so all panes remount + re-attach through the same path the written pane already used. Adds a revert-sensitive regression test: with two sessions and only one written after the daemon dies, the sibling must also be signaled to recover. * revert(format): drop repo-wide oxfmt churn unrelated to STA-2373 A review pass ran `oxfmt --write .` across the tree, pulling seven files with no bearing on the dead-daemon respawn fix into the PR diff. Restored to origin/main byte-for-byte so the diff carries only the respawn change. * fix(daemon): snapshot active sessions before the write-unavailable fan-out A listener that kills a pane mutates activeSessionIds mid-iteration, which can skip the very sibling the fan-out exists to reach. Matches the snapshot fanoutSyntheticExits already takes. * fix(daemon): re-arm dead-endpoint recovery on every daemon death The respawn-storm latch was only released once every awaiting session rebound. Background sessions have no mounted pane, so nothing ever calls createOrAttach for them and they hold the awaiting set non-empty forever — latching the fan-out off after the first death and silently making the whole fix one-shot. Re-arm on the disconnect event instead, which fires once per established connection, so the storm guard still holds within a single incident. * fix(daemon): route the write-unavailable fan-out through the pty router Main subscribes on the routed provider, and DaemonPtyRouter is the live localProvider whenever a legacy daemon socket exists — the common case when an in-place update bumps PROTOCOL_VERSION with terminals running. It forwarded write but not onWriteUnavailable, so the fan-out reached no listener and only the written pane recovered: STA-2373 unfixed, silently. Also stop rejecting writes on adapters that cannot respawn. Legacy adapters have no respawn, so the remount reattaches to nothing and rebuilds the pane empty, losing scrollback the user could still read — worse than the pre-existing silent drop. And guard the renderer's write-unavailable handler on ptyId like its sibling data/replay handlers, so a transport that rebinds without detaching cannot remount a healthy pane. * fix(daemon): route the write-unavailable fan-out through the degraded provider DegradedDaemonPtyProvider is the live localProvider in degraded launch mode and main subscribes on it, but it forwarded onData/onExit/onReplay/ onBackgroundStreamEvent and not onWriteUnavailable — so the fan-out reached no listener and siblings stayed frozen. Same defect as the router, one provider over. The file sat at its max-lines ceiling, so make room by reusing one combineUnsubscribes helper across the three places that already repeated that loop rather than bumping the limit. Forward to the daemon adapters only: the local fallback has no dead-socket problem. * refactor(daemon): share the listener-fanout unsubscribe combination Adding onWriteUnavailable to both provider wrappers left each file at exactly 300/300 lines, so the next line anyone added would have broken max-lines with no sanctioned escape hatch. Both already repeated the same combine-unsubscribes loop, so lift it into one module: duplication drops and each file gets its headroom back. * fix(test): stop the fake emitter colliding with the private adapter emitter DaemonPtyAdapter.emitWriteUnavailable is private, so declaring a public member of the same name on a mock intersected with DaemonPtyAdapter collapsed the whole type to never — one collision produced 54 typecheck errors, taking out pre-existing assertions in both files too. Rename the fake to triggerWriteUnavailable and declare onWriteUnavailable on ProviderMock, which IPtyProvider does not carry on this branch. vitest does not typecheck, which is why a red build sat behind a green suite. * fix(quick-commands): show pointer cursor on hover (#10223) * fix(terminal): limit pre-paint WebGL resume to macOS (#10794) Run terminal visibility transitions pre-paint only on macOS. Restore passive disposal and recreation on Windows/Linux, remove the Windows retained-context LRU machinery, and preserve the normal 128-context startup ceiling. * fix(ssh): connect to Linux hosts that cannot compile node-pty (#10776) * fix(ssh): connect to Linux hosts that cannot compile node-pty node-pty ships no Linux prebuilt at any architecture, so it is compiled on the remote. On a host without a C/C++ toolchain that build fails, and because both native deps install in one npm command it also took down @parcel/watcher — which does have a working Linux prebuilt — and failed the whole connection. Every Linux image without build tools was unusable. node-pty only backs remote terminals; files, git, and the editor do not need it, and a missing native dep is already non-fatal further down the deploy. So when the existing toolchain probe confirms the compiler is missing, reinstall without node-pty instead of aborting. The manifest has to drop it too — npm reconciles every dependency in package.json, not just the ones named on the command line, so naming only @parcel/watcher still rebuilds node-pty. If that reinstall also fails the actionable build-tools error is rethrown, so a host broken for some other reason still reports the toolchain gap. The relay's PTY error now names the fix rather than saying only that node-pty is unavailable. Verified on a stock Rocky Linux 10.2 aarch64 container (openssh-server, git, nodejs, npm, no compiler): connect succeeds, /etc lists over SSH, node-pty is absent while @parcel/watcher installs its linux-arm64-glibc prebuilt, and spawning a terminal reports the install hint. * fix(ssh): keep the node-pty skip path honest about platform and watcher The PTY unavailable message named build tools unconditionally, but only Linux compiles node-pty — the deploy-side skip is gated on linux and the toolchain probe returns null on Windows. A Windows or macOS remote, where node-pty ships prebuilds, was told to install make/g++/python3. Pick the remedy by the relay's own platform. The skip path returned before the install probe, so a @parcel/watcher that installs but cannot require() (glibc below the floor) connected with dead file watching and nothing logged. Probe before returning and warn; no rebuild, since node-pty provably cannot compile on that host, and never fatal. Also log the pty-less reinstall's own failure and attach it as cause — the rethrown toolchain message is built from the original npm error, so an unrelated retry failure (registry, ENOSPC, EACCES) was lost. The reinstall now keeps the caller's resetDeps as well, so a repair reconnect still clears every dep the probe found broken. Tests: the skip-success fixture queued a chmod/probe/rebuild sequence production never runs, and the surplus slots were absorbed by launchRelay's readiness poll (1817ms vs 3-9ms for its peers). It now emits exactly the 12 execs production performs, and pins that no rebuild is issued. Adds the missing negative case: a gyp-shaped failure on a host whose probe reports a complete toolchain must still hard-fail rather than silently degrade. * fix(ssh): hedge the node-pty remedy and keep repair resets on the skip path * perf(terminal): bound the PR-link carry scan to the trailing window (#10741) * fix(codex): treat non-Codex transcript as stale resume metadata (#10538) When a pane is mislabeled agent:codex but still holds a Claude transcriptPath, the Codex resume guard threw and blocked relaunch. Only hard-fail when the path claims Codex's dated rollout layout (sessions/YYYY/MM/DD/rollout-*.jsonl), under any home and without requiring the file to exist. Paths that never claimed Codex provenance return null so the pane can relaunch. Keying on rollout shape rather than trusted-home membership matters: returning null only declines to override CODEX_HOME, and the renderer has already baked 'codex resume <id>' into the command. A real rollout under an untrusted home would otherwise resume under whichever account is selected — and once the session bridge hardlinks rollouts across homes, codex would find that id and resume silently under the wrong account. Trust is decided upstream by findTrustedCodexSessionResume. Co-authored-by: Wooseong Kim <innocarpe@users.noreply.github.com> Closes #10517 * fix(codex): cache weekly-only accounts when switching Codex accounts (#10467) * fix(codex): cache weekly-only accounts when switching Codex accounts refreshForCodexAccountChange snapshotted the outgoing account only when this.state.codex.session was populated. Weekly-only plans report no session window, so their snapshot was dropped and the account switcher's inline bars rendered empty for exactly those accounts. Accept a populated weekly window as well. #10136 made this reachable: before duration-based classification, a weekly-only quota landed in the session slot, so the gate happened to pass. Claude is intentionally untouched; it has no weekly-only plan shape. * test(rate-limits): pin that a windowless outgoing Codex account is not cached The widened weekly-only gate had no test for its lower bound: replacing it with a bare truthy check on state.codex passed all 70 tests, which would cache an empty fetching placeholder and render a blank inline bar row in the switcher. * release: v1.4.159-rc.0 * fix(terminal): kill floating, setup, and folder-workspace PTYs on tab close (#10810) * perf(terminal): coalesce per-keystroke input stamps + add typing-latency self-diagnostic (#10784) * perf(terminal): coalesce per-keystroke input stamps + add typing-latency diagnostic A user reports keystroke-echo lag on v1.4.156 that vanishes in Ghostty on the same machine, at a scale we cannot reproduce locally (nested worktrees, ~20 agents each). Static analysis across the 155..156 renderer diff found no perceptible regression, so this adds the instrument to measure it where it actually happens. Diagnostic (`window.__orcaTypingDiagnostic`, dev-console only, no shipped UI): reports keydown->paint percentiles from real typing plus a scale census — agent rows store-total vs mounted-DOM, store listener count, worktree nesting depth, the settings gating suspect paths, and the focused pane's agent and buffer mode. Nothing attaches to the keystroke path until start(), so it does not perturb the latency it measures. Coalescing: recordTerminalInput wrote the whole lastTerminalInputAtByPaneKey map on every keystroke, waking every zustand subscriber. Hibernation is a >=60s idle timeout, so the leading edge of a burst writes immediately and the rest collapse into one trailing flush. Imperative readers merge the pending stamp, and a late flush never revives a pane key teardown deleted. This write path is byte-identical in v1.4.155 and v1.4.156, so the coalescing is a general perf win, not a fix for the reported regression — the measured saving (~0.02ms/keystroke) is well below perception. * fix(diagnostic): count React store subscriptions in the listener census The census wrapped `subscribe` on the bound hook after `create()` had already run. zustand's `useStore()` reads the INNER `api.subscribe`, and `create()` copies subscribe onto the hook as a separate property slot — so patching the hook's copy counted only the 16 imperative `useAppStore.subscribe()` call sites and missed all ~2.2k React hook subscriptions, i.e. exactly the ones that scale with agent rows. The metric would have read a near-constant ~16 regardless of scale, which would have made "latency tracks listener count" read as false no matter the truth. The inner api is only reachable as the state creator's third argument, so the counter now installs there and lives in the store rather than the probe. Still per-subscribe (component mount), never per-setState: zustand notifies by iterating its listener Set directly, so this never touches the keystroke path. Tests pin both subscribe paths; reverting to the old wiring fails 3 of the 5. * fix(ssh): stop remote terminals fail-opening to local PTY (#10778) * fix(ssh): stop remote terminals fail-opening to local PTY Docker SSH watcher isolation failed because an unhydrated remote worktree spawned through the local daemon with a container-only cwd. Fail closed while the SSH owner is still loading, ignore non-PTY mux notifications before mapping params.id, and harden the Docker SSH e2e connect helper so the repo connectionId is present before terminal activation. Co-authored-by: Orca <help@stably.ai> * fix(terminal): keep host-agnostic terminals off the hydration guard The unresolved-owner guard also caught floating and inline setup terminals, which have no repo row by design, regressing #10151. Scope it to repo-backed worktrees and cover the SSH hydration window with a regression test. Co-authored-by: Orca <help@stably.ai> * fix(terminal): treat a local-stamped worktree as a resolved host The hydration guard keyed off "no repo row", which also withheld spawn for a local worktree whose own hostId already proves its host. Key it off "nothing names the host" instead, and cover the local-stamped case with a test. Co-authored-by: Orca <help@stably.ai> * fix(terminal): recover parked panes when their host hydrates Withholding the spawn stopped the wrong-host PTY but left the pane inert: nothing bumped its generation once the repo row merged, so a remote terminal still never opened. Remount PTY-less tabs when repos:changed resolves their owner, and drop the e2e helper workaround that was masking this. Co-authored-by: Orca <help@stably.ai> * fix(terminal): scope hydration remounts to panes that actually parked Keying recovery off "tab has no PTY" also matched tabs whose shell merely exited, remounting them on every repos:changed. Track the panes that withheld their spawn and consume each entry once, so recovery cannot churn a live terminal or spin on repeated refreshes. Co-authored-by: Orca <help@stably.ai> * test(terminal): cover the repos:changed parked-pane remount wiring The recovery predicate was unit-tested, but nothing proved useIpcEvents actually calls it — the existing suite stubs repos.onChanged as a no-op. Drive the real listener and assert a parked pane is remounted only after its host resolves. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai> * fix(memory): clarify Resource Manager accounting (#10821) * perf(agent-status): scan Command Code transcripts backward from EOF (#10742) Co-authored-by: Orca <help@stably.ai> * fix(terminal): quarantine input after a replaced PTY endpoint (STA-2373) (#10811) Follow-up to #10065, which merged with this failure mode known and deferred. Recovery from a dead daemon socket reattaches to a fresh shell. Keystrokes in flight during the ~1.1s window are dropped, but everything typed after reattach lands on the new shell, so the surviving tail of a half-sent line is submitted by the user's own Enter: `echo hi; rm -rf x` arrives as `cho hi; rm -rf x` — zsh fails `cho` and still runs `rm -rf x`. Before #10065 the whole line was lost, so the executing tail is new. Quarantine the remainder of the interrupted line instead. Keyed by tab, not pane: recovery destroys the xterm being typed into and the successor pane receives the tail. Armed only from the onWriteUnavailable path; a stalled-pipeline remount keeps the same live shell, where quarantining would eat a real command. Disarms on the line terminator (CR/LF/Ctrl-C, dropped too since that is the byte that would submit the mangled line), a 700ms idle gap, or a 5s cap. The cap must not be shortened: the tail itself takes ~2.5s to type, so a shorter cap fires mid-tail and delivers the dangerous remainder to the fresh shell. The onData check sits after the query-reply branch so CPR/DSR replies still reach the shell. Live A/B QA on macOS: the bug reproduces verbatim without the fix (marker file created by the surviving tail) and is suppressed with it, with the next command still working — proving suppression rather than a dead pane. * perf(agent-status): keep the shared transcript reader's carry linear (#10777) readLastTextFromTranscriptOnce re-joined its carry buffer on every block that held no newline, so a transcript whose tail is one oversized line copied O(line^2). It backs three readers — the Claude/Codex user prompt, the Command Code assistant message, and the shared assistant-text reader — so every agent that resolves turn text from a transcript paid it. Same chunk-list carry the Command Code prompt reader already uses. Measured on a transcript whose tail is one big line: 15.24 ms -> 8.87 ms at 3.9 MB, and the gap widens with the line, which is the quadratic signature. * perf(ai-vault): keep the JSONL line carry linear (#10783) consumeCompleteJsonlLines re-joined its held-over partial line with every stream chunk, so one oversized record — a large tool result — cost O(record^2). It backs the incremental parse for every resumable agent transcript, so the whole AI Vault corpus paid it. Hold the pieces in a list and join once, when a newline finally arrives. Measured on a transcript with a single oversized record: 2.13 ms -> 1.17 ms at 1 MB and 68.22 ms -> 4.35 ms at 8 MB, with byte-identical output. A transcript of ordinary records never reaches the branch. * perf(git): read both diff blobs concurrently (#10781) * perf(git): read both diff blobs concurrently The diff loaders awaited their two sides in series, so the second `git show` could not start until the first had returned. The reads are independent, so that was pure added latency on every diff the review panel opens: ~47 ms sequential vs ~24 ms concurrent, a saving of ~23 ms per diff. Covers the merge-base, commit, and staged loaders, plus the unstaged path where the working-tree read is independent of the index->HEAD chain. The unstaged left chain itself stays sequential because its second step depends on the first. The staged coalescing test asserted the sequential shape (one spawn, then the next); it now pins the contract that actually matters — eight identical reads still collapse to two spawns, one per side. * test(perf): interleave the diff-blob benchmark arms Running one strategy's whole batch before the other's lets cache warming, CPU frequency drift, and background load correlate with the strategy being measured. Alternate the arms per iteration, alternate which goes first, and report medians so that drift stays common to both. Also reject malformed env settings rather than truncating them — Number.parseInt accepts "10foo" and 3.5. Interleaved result confirms the original: 1.90x-2.03x, ~24 ms saved per diff. * perf(mobile-sync): memoize the agent-status projection per entry (#10787) * perf(mobile-sync): memoize the agent-status projection per entry buildRuntimeMobileAgentStatusProjection re-serialized every live agent on every status ping. setAgentStatus replaces one entry and re-spreads the map, which defeats the reference-equality skip gate, so each ping paid for every other agent's prompt, 20-entry history, and 8 KB assistant message to discover they had not changed. Memoize each row's JSON by entry identity, the cachedTabsProjection pattern already used a few functions above. Per ping: 0.18 ms -> 0.014 ms at 8 agents, 0.88 ms -> 0.063 ms at 40. The output is byte-identical — joining pre-serialized rows matches whole-array stringify, which the new test pins against a verbatim copy of the old implementation. * test(perf): stop inflating the projection benchmark baseline The pre-fix arm stringified each row and parsed it back before stringifying the array, a per-row roundtrip the original never paid. That made the baseline artificially slow: the reported 5.9x-14.0x is really 2.1x-5.0x. Share one row builder between both arms, and check equivalence after a ping as well as on the cold call — a stale-row bug can only surface once the cache is actually exercised, which the cold-path check could never catch. * perf(startup): stop parsing qrcode and @linear/sdk at launch (#10788) Both are reachable only from features most users never touch, but both were in the main bundle's eager top-level require block. @linear/sdk is the sharper case: linear-sdk.ts exists solely to load that ~2.6 MB CJS bundle lazily, and a single value import in issue-relation-write.ts defeated it for everyone. That file now imports the type and goes through the loader. qrcode is only reachable from mobile pairing, and both call sites were already async, so they take a dynamic import. * fix(codex): rank the Codex resume rescan by selected account, not settings order (#10801) The legacy Codex session-id rescan (used when a persisted record has no transcriptPath) returned the FIRST trusted home holding a rollout with that id. That home becomes the pane's CODEX_HOME — i.e. it picks the ACCOUNT — and the list ended in per-account homes ordered by settings INSERTION order, so the account was decided by whichever one the user happened to add first. Ranks instead: selected account -> real system home -> shared runtime mirror -> everything else by normalized path. Both ranking inputs are required (an optional one would silently degrade to pure path order), and the selection arrives as a thunk so the common provenance-present resume never stats the ownership marker for a ranking it never runs. The mirror needs its own tier: prepareLegacySharedCodexSessionResume's guard only fires when the resolved home IS the mirror, and that guard is what migrates the rollout into ~/.codex. Without it a system-default selection silently resumed under an arbitrary account and stayed pinned there permanently once the hook stamped a transcript path. Reviewed over two independent rounds; every tier individually mutation-proved. Live-validated in a real Orca dev build by reading the spawned PTY's actual CODEX_HOME across three builds (head, base, and head-minus-the-mirror-tier). Note: fixes none of #10757's user-visible symptoms on its own — it is a correctness precondition. Verified on macOS only; Windows coverage is fixture-only. * fix(sidebar): make worktree drag reorder follow the card, not the pointer (#10845) * fix(mobile): harden native chat send budgets, streams, and stop (#10814) Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * perf(source-control): share one path collator across the projection (#10850) * lint: guard the two perf bug shapes we fixed repeatedly (#10851) * fix(agent-history): match non-ASCII workspace paths to Claude sessions (#10841) * fix(terminal): avoid flash while restoring parked terminals (#10871) * Fix diff notes overlapping following lines (#7803) Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * fix(terminal): clear search highlights when the find bar closes (#10872) Closing Ctrl+F left one match highlighted until the window was minimized and restored. xterm's DecorationService keys its SortedList on `decoration.marker.line`, but `SortedList.delete()` only records an index and defers compaction, while `Marker.dispose()` sets `line = -1` — mutating that same sort key. After the first disposal the array is no longer sorted, so the binary search inside `delete()` can miss a decoration that is present. It returns false, `onDecorationRemoved` never fires, and the decoration stays live and keeps painting. Repaints don't help; they faithfully re-paint a live decoration, which is why only a window cycle appeared to fix it. `clearDecorations()` disposes the active match before the match highlights, which is exactly the order that trips this. Patch `delete()` to retry once after compacting pending deletions, on the miss path only, so the common bulk delete keeps its O(log n) search and deferred batching. A 3000-trial randomized differential against upstream semantics shows no behavior change for well-ordered lists. * perf(cli): load only the handler group a command dispatches into (#10883) Co-authored-by: Orca <help@stably.ai> * perf(ssh): normalize watch event paths once per fs.changed batch (#10881) Co-authored-by: Orca <help@stably.ai> * feat(plugins): Orca plugin system — kernel, content packs, panels, workers, marketplace v0 (experimental) (#8549) * feat(plugins): Orca plugin system — kernel, content packs, panels, workers, marketplace v0 (experimental) Adds Orca's experimental plugin system behind a settings flag: a supervised kernel, declarative content packs (VM recipes, commands and keybindings, language packs), sandboxed iframe panels, forked worker hosts, and a Git-backed m…
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
…tablyai#11139) stablyai#8321 mixed the selected card's wash into the opaque --worktree-sidebar surface, lifting dark mode to 16% (#4b4b4b). Card text lost too much contrast against it. Return both modes to a translucent wash (light 8%, dark 10%) so the brighter selection border added by stablyai#8321 carries the selected state instead of the fill. Co-authored-by: Orca <help@stably.ai>
enrick-dev
pushed a commit
to enrick-dev/orca
that referenced
this pull request
Oct 15, 2026
…stablyai#11065) * fix(worktree): use local base after offline refresh failure * docs: add git worktree bug queue report * fix(skills): require updater registration (#11051) * fix(skills): require updater registration * fix(skills): reject incomplete updater registrations --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * test(worktree): satisfy changed-code quality gate * docs: record #11065 CI repair status * docs: record CI rate-limit evidence * chore: keep bug category report out of product diff * release: v1.4.160-rc.3 * fix(quality): enforce performance-safe lint baseline (#11074) * fix(quality): clear safe existing lint findings * fix(quality): keep lint cleanup allocation-free * fix(quality): enforce performance-safe baseline * test(terminal): drain deferred confirmation cleanup * fix(preflight): refresh Windows PATH on forced CLI checks (#10091) Refresh the persisted Windows PATH during preflight without blocking Electron's main thread. Bound and deduplicate registry reads, preserve the last good cache on failure, skip host refresh for WSL, and add Windows regression coverage. * feat(new-workspace): type-ahead Project and Run-on pickers (#11062) * feat(new-workspace): make the project picker a type-ahead field The Create-worktree Project slot read as bulky and unpolished: a label row, an add-project icon, a 36px outline trigger and a chevron, all spent before choosing anything — then a popover carrying its own *second* search box, two-line rows, and a footer that scrolled out of reach. The field is now the search. Typing filters in place, so the nested search box is gone. Exactly one row is armed at any time and Enter takes it; hovering arms, so pointer and keyboard drive one cursor rather than two competing highlights. Armed is tracked by row key, not index, so a list arriving late over SSH cannot slide a different project under a keypress the user already aimed. Rows are single-line at 28px with an on-row Enter cap that takes space only while armed, and "Add a new project" is pinned to the popover edge so it survives every state — scrolled, filtered to nothing, or no projects at all. Long names and deep paths degrade deliberately: the name keeps up to half the row and the path elides from its middle, so two monorepo siblings stay distinguishable as …/services/checkout-api vs -web where a flat truncate rendered both identically. Recency is derived from when each project last had a workspace created, which is the action this picker is about to repeat — no new store field. The shell keeps data-project-combobox-root + role=combobox and stays focusable, so the composer's initial-focus and project-required handlers still land on it. * fix(new-workspace): align, scroll and loosen the project picker Five fixes to the type-ahead picker, three reported and two found while checking for related breakage. Alignment: the name and its smaller detail line were centred as boxes, so the 12px path sat visibly high against the 14px name. Both now share a baseline, in the committed field and in every row. The dot mark and the Enter cap are chips rather than text, so they stay centred on the row. Scrolling: the mouse wheel did nothing over the list. The composer is a Radix Dialog, and react-remove-scroll cancels wheel events for portaled content outside the dialog's DOM tree — the scrollbar dragged fine but the wheel was dead. The old cmdk list carried a shim for exactly this; the plain scroll pane that replaced it did not, so it has its own now. Density: rows go 28px -> 32px, row text 13px -> 14px and detail 11px -> 12px, with a taller Add row and more air above section headings. Escape stranded a query: with the list closed but text still typed, Escape was ignored (it was gated on the list being open), leaving the field showing text that matched nothing and hid the committed project. Escape now always restores the committed display, and only bubbles when there is nothing to undo. Listbox ownership: options sat inside unroled section and scroll wrappers, which breaks the listbox -> option relationship assistive tech relies on. Sections are groups carrying the heading as their label, and the scroll pane is presentational. Both new behaviours are covered by tests verified to fail without the fix. * chore(tools): keep the project-picker design lab The exploration harness behind the picker rewrite: 16 interactive design variants rendered against the app's real tokens and shadcn primitives, so a prototype is a drop-in ProjectCombobox rather than a mockup. Worth keeping because the frames encode bugs that only reproduce in context. DialogFrame renders the picker inside a real Radix Dialog, which is the only way the react-remove-scroll wheel bug shows up; the fixtures carry duplicate display names and deep sibling paths that a naive truncate renders identically. Run with: npx vite --config tools/wt-picker-lab/vite.config.ts * fix(new-workspace): stop the project list flashing open, shrink its empty state Opening the picker read as a double flash. The shared popover surface is translucent and fades 0 -> 1, which is right over the app canvas but wrong here: this popover lands directly on the composer dialog, so for the length of the fade the Name field underneath showed straight through the list and you saw two layers at once. The list now uses an opaque surface and zooms without fading, so it is solid from the first frame. Every other popover keeps the blur and fade. The "No projects match your search." state was a 60px centred block sitting next to 32px rows, which read as a different kind of surface and made an empty result feel like an error. It is now sized and aligned like a row. The lab's dialog frame focused whatever Radix picked first, which popped the Add-project tooltip on open and masked the real problem; it now focuses the name field the way the real composer does. * fix(new-workspace): square mark, centred empty state, and keep the list open on tab-focus Four fixes, three reported and one found while sweeping for others. Square mark: the option dot had a `rounded-full` override, so a project read as a circle here and a square everywhere else (jump palette, sidebar). Drop the override and use RepoBadgeMark's own shape. Centred empty state: "No projects match your search." was left-aligned after being shrunk to row height; centre it. Tab-focus blinked the list shut: the field lives in the popover's anchor, not inside its content, so Radix's dismissable layer saw focus land "outside" and closed the list the instant you tabbed in. Focus and pointer events within this control no longer dismiss it; genuine outside events still do. Junk text could strand the field: typing a query that matched nothing and then clicking away left the text sitting there with the list closed, showing no project and no error. A query only means something while the list is open, so closing without committing now clears it. On pressing Create with no project: no change needed. The create gate has not depended on project selection since #4991, and both submit paths already call showProjectRequiredError(), which sets the inline message and turns the field red via aria-invalid. Verified end to end: the button is pressable, the press paints the field destructive, and the message appears beneath it. * feat(new-workspace): rebuild the Run-on picker to match the project picker "Run on" was the last composer field still built the old way: an outline trigger wrapping a cmdk list, two-line rows, and no way to search. It now matches the project picker, so the two fields in the same form read as one control. The field is the search — type to filter hosts, paths and recipes with no nested search box. Exactly one row is armed at a time and Enter takes it; hovering arms, so pointer and keyboard drive one cursor. Rows are 32px with the label and its path on a shared baseline, the path eliding from its middle so two deep sibling paths stay distinguishable. The popover surface is opaque and unfaded because it lands on the composer dialog, where a translucent fade shows the form underneath. Two behaviours the project picker doesn't have are preserved. Disconnected hosts keep their inline Connect action, tracked per host so one stalled connect never blocks the others, and the list stays open so the connecting state is visible. Two rows open nested lists rather than committing: VM recipes, and "Add host" pinned to the popover edge so it survives every state — scrolled, filtered to nothing, or with no hosts at all. Enter and ArrowRight open a submenu; Escape backs out one layer at a time. Extracted from NewWorkspaceComposerCard (-563 lines) into files that each stay under the line limit without a suppression. Tests: the run-target cases asserted cmdk internals (`[cmdk-item]`, aria-disabled, cmdk-separator) that no longer exist. Rewritten against behaviour and the listbox roles instead. All 22 composer tests pass, plus a live sweep of 11 interactions in a real dialog. * fix(new-workspace): drop the Enter cap, fix submenu hover, match the Add rows Three follow-ups on the two composer pickers. The ↵ cap on the hovered row is gone from both. On a run-target row it sat next to the Connect action and read as a second, competing affordance; the highlight already says what Enter will take. Submenu rows never highlighted under the pointer. They passed a hardcoded `armed={false}`, so the recipe list and the Add-host choices were the only rows in either picker with no hover state. They now track their own hover. "Add a new project" used a chunky FolderPlus where "Add host" uses a plain Plus. Both rows were already the same height and type, so matching the glyph is the whole difference. * fix(new-workspace): restore the folder glyph, two-line Add-host cards, quiet Connect rows Three follow-ups. "Add a new project" goes back to FolderPlus — matching "Add host"'s plain Plus made the two consistent but lost the glyph that says which kind of thing is being added. A disconnected host row no longer repeats its status. The Connect button already says the host isn't connected, so "Connect this host to set up projects" beside it was saying it twice. Rows without a Connect action keep their detail, since there it explains why the host can't run. The Add-host choices go back to two-line cards. Their descriptions explain what you're picking ("Use an existing machine over SSH" vs "Pair another Orca runtime"), unlike a host row's detail, which just labels a host you already recognise. RunTargetRow grows a `stacked` variant for that rather than making the single-line row do both jobs. * fix(new-workspace): give Run on the same vertical rhythm as the other fields Run on is nested inside the Project block so the two share its error and empty states, which also put it on that block's 4px internal spacing. It reads as its own field, so it sat noticeably tighter than the 16px gap every other field in the composer gets. Pad it to match. * refactor(new-workspace): share the type-ahead machinery between both pickers Project and Run on were built one after the other, so each grew its own copy of the same mechanics: query and open state, arming by row key, the arrow-key walk, scroll-the-armed-row-into-view, the react-remove-scroll wheel shim, and the closes-drops-the-query rule. Two copies of subtle behaviour is two places for it to drift. useTypeAheadCombobox now owns all of it. Callers pass a function that turns a query into row keys and get back the query, the armed key, and the movement helpers. Run on layers its submenu state on top by wrapping `close`, which is the only part that isn't shared. The two long class strings both files repeated verbatim — the field shell and the opaque unfaded popover surface — are named constants now, so the reason they differ from the stock popover recipe is written down once instead of implied by a duplicated literal. No behaviour change: 16,456 renderer tests pass, plus the 22-check live interaction sweep across both pickers in a real dialog. * fix(new-workspace): drop aria-expanded from option rows, remove the design lab `aria-expanded` isn't a supported prop on `role="option"`, so the submenu rows were claiming a state screen readers can't interpret there. `aria-haspopup` alone already says the row opens a menu. Removes tools/wt-picker-lab. It was the harness for exploring this redesign — 12 interactive variants — and it did its job, but the 11 that lost are dead code, and its prototypes were the only thing failing the react-doctor gate (5 errors, all in throwaway variants; the shipped pickers had none). * fix(workspaces): support emoji-only names * feat(workspaces): derive readable emoji identifiers * feat(workspaces): add emoji shortcode picker * fix(terminal): gate the developer menu behind Option and unblock manual parking (#11091) The Developer submenu shipped visible on every worktree right-click, and its Park terminal action always refused with "These terminals cannot be parked safely." - reveal the Developer submenu only when Option/Alt is held at right-click, captured at open time so it can't shift rows mid-menu - stop a settled pendingActivationSpawn tag from refusing a manual park: first activation stamps it on every tab and only a fresh updateTabPtyId consumes it, so a reattached tab kept it forever - resolve the single leaf of a rootless layout for parked watcher coverage, so a workspace whose panes never mounted is no longer permanently uncoverable - restore the !isVisible park guard dropped in #11016, which let the workspace being viewed unmount its own terminals - split manual-park eligibility out of the automatic cold-park policy module * fix(workspaces): hide false repo error for remote servers (#11050) * i18n: translate orchestration page and workflow messages (#11097) Add translations for OrchestrationPage coordinator and child PR names, plus agent workflow status messages (initial states and progress beats) across all supported languages (English, Spanish, Japanese, Korean, Simplified Chinese). * fix(skills): stop reporting a failed update when the CLI succeeded (#11105) The Update skills dialog showed "The update didn't finish" / "Some skills could not be updated" with an armed Retry, directly above the runner's own log line saying "All global skills are up to date" — on a clean exit 0. `skills update` compares its lock's recorded hash against the source and never reads disk (dist/cli.mjs: `latestHash !== entry.skillFolderHash`). Once the lock has advanced past the installed bytes it prints up-to-date, exits 0 and writes nothing. The copy left behind is a recognised older revision, so the post-run re-scan sees `outdated`, skillUpdateFailedNames counted that as a failed run, and skill-update-run settled to state 'error'. Retry re-ran the same command, which no-op'd again — a closed loop. Reclassify `outdated` as "the command did not converge this", not "the run failed". The freshness badge still marks the copy not-current, so nothing is hidden; the run just stops being blamed for it. A botched write is still caught: a half-written bundle hashes to `unrecognized`, a wholly-degraded or removed copy leaves no convergent placement, and process-level failure still surfaces via the spawn error. Reachable by anyone who updated during the stub conversion window — every bundled skill has a stub -> full -> stub oscillation in its last three registry revisions. * perf(terminal): eliminate adverse control and frame-gate cases (#11045) * perf(terminal): eliminate dense control and frame gate regressions * test(terminal): keep gate labels in valid expect shape * test(terminal): expose the surviving sub-threshold control-density case The only adverse strip fixture sat at 50% control density, which is exactly where the fallback fires and wins. A shape at 31 controls per 64-unit block evades the trigger and still loses to the per-character legacy (0.67x), so the benchmark structurally could not show it. Add that fixture, pin both density literals in the staleness guard so a retune fails loudly instead of silently measuring a boundary that moved, and export the probe constant the equivalence test was hardcoding. * fix(opencode): harden lifecycle status delivery (#11017) * fix(agent-status): show Codex v2 subagents (#11059) * fix(agent-status): track Codex rollout subagents * fix(agent-status): resolve cross-day Codex child rollouts and unblock CI gate Codex files each rollout under its own local start date, so a session that runs past midnight spawns children into a sibling day directory. Scanning only the parent's directory left 13% of real subagent spawns (48/371 across local rollouts) permanently unresolved, which pinned a phantom "working" row and re-ran readdirSync every poll tick forever. Resolve the child's own day directory from occurred_at_ms, and time-box a child whose rollout stays unreadable so a deleted or never-written file can't leak a working row. Also make the hook HTTP handler return void: the changed-code quality gate keys findings by span overlap, so this PR's added line inside the pre-existing async createServer callback resurfaced no-misused-promises as a new finding. Tests cover cross-day resolution, grace-period retirement, and that the poll re-arms across successive roster changes (the prior tests passed even when the poll died after its first change). * fix(agent-status): keep the Codex subagent poll alive across nested hooks A nested non-codex CLI inherits its parent's ORCA_PANE_KEY, so its hook POST reached scheduleCodexSubagentPoll and tore the timer down before the source guard, silently ending polling while a rollout child was still live. * fix(skills): stop offering an update the CLI provably cannot perform (#11110) * Revert "fix(skills): stop reporting a failed update when the CLI succeeded (#11105)" This reverts commit 9297ab6eefce847a19066c6508faa31c3e7595d3. * fix(skills): stop offering an update the CLI provably cannot perform The Update skills dialog reported "The update didn't finish" / "Some skills could not be updated" with an armed Retry, directly above the runner's own "All global skills are up to date" log line, on a clean exit 0. `skills update` decides what to do by comparing its lock's `skillFolderHash` against the source tree and never reads disk (published CLI, dist/cli.mjs: `latestHash !== entry.skillFolderHash`). So once the lock records a revision the filesystem does not actually have, it reports up-to-date, exits 0 and writes nothing. No retry converges it. Gate eligibility on that instead of blaming the run afterwards: a name stays updatable only while the lock's hash and the revision the DISK hashes to agree. Those that disagree fall through to `needs-attention`, which skill-freshness-display-status.ts already documents as the state for a copy "out of date somewhere the update command cannot reach". The dialog no longer offers them, so it can neither claim failure nor claim success. Deliberately compared against disk, not the bundled manifest: the updater pulls from the source repo, which legitimately runs ahead of what a build ships, and gating on the bundle would withhold real updates. Both sides must also be positively identified — an unplaceable lock hash is not evidence. Also reverts 9297ab6eef, which forgave `outdated` post-run. That turned the false failure into a false success ("Updated 2 skills" over copies nothing wrote) and let an empty verdict swallow spawnError, so an offline run published green. Reachable by anyone who updated during the stub-conversion window — every bundled skill has a stub -> full -> stub oscillation in its last three registry revisions. * fix(skills): do not gate a skill when a placement is unidentifiable `diskTreeShas` drops digests matching no known revision, so `every` ran over only the resolved half — one stale copy beside one unidentifiable copy gated the name, contradicting the unknown-stays-eligible rule the function documents. Require every observed digest to resolve before treating all placements as mismatched. Caught by CodeRabbit on #11110. * fix(skills): judge convergence only over placements the update command writes A same-name plugin-cache or repo copy could defeat the gate two ways: an unidentifiable repack read as an unresolved placement, and a cache copy parked at the lock's own revision read as an anchor — both re-arming the unwinnable update on a drifted canonical. Filter to SUPPORTED_GLOBAL_SKILL_TOPOLOGIES, matching eligibility and outcome. * perf(lint): consolidate code-quality gates into Oxlint (#11117) Consolidate standalone code-quality scanners into Oxlint, preserve focused native/type-aware enforcement, add custom plugin coverage, and harden deferred PTY test cleanup. * fix(browser): keep the address bar editable in a narrow toolbar (#11098) * fix(browser): keep the address bar editable in a narrow toolbar Every other browser toolbar control is shrink-0, so the address bar was the only flexible item and absorbed the entire squeeze: below roughly 420px of pane width it collapsed to the leading globe icon with a zero-width input. Clicking it only opened the suggestion dropdown, which inherits `--radix-popover-trigger-width` and so rendered at icon width — there was no way to type or edit a URL in that tab. Focusing a squeezed bar now lifts the form out of the toolbar flow and overlays the row edge to edge, giving a full-width editable field that navigates on Enter (and a full-width suggestion list for free). A measured slot stays in flow so the overlay cannot feed back into its own width, and the slot keeps a min width so the globe remains a real hit target instead of being overlapped by neighbouring buttons. Fixes #11090 Claude-Session: https://claude.ai/code/session_01Mx53f7erbtw5NraS8HdXKE * fix(browser): use the documented floating shadow for the expanded bar STYLEGUIDE.md defines exactly three elevation levels and forbids a fourth; shadow-md was not one of them. The overlaid address bar is a floating surface, so it takes the documented floating shadow already used by the other floating surfaces in this pane. Claude-Session: https://claude.ai/code/session_01Mx53f7erbtw5NraS8HdXKE * test(browser): make the narrow-toolbar regression deterministic The spec passed only from a clean profile. Two preconditions it set once are actively undone by the app: - BrowserPane re-focuses a blank tab's address bar across several animation frames plus the blank-url did-finish-load handler, so a single blur() was reverted and the bar never reached its squeezed resting state. - Startup paths re-open the right sidebar. At a fixed 700px window that leaves the pane ~70px, so the overlay had nowhere to go and the field measured 0px. Settling these separately let whichever settled first drift back while the next one ran. Re-assert them in one loop until they hold simultaneously, and size the window from the chrome actually measured instead of assuming a fixed 700px. Verified 8/8 green, and still fails at the overlay assertion when the fix is disabled, so the regression coverage stays real. --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * Improve orchestration migration safety for live legacy workers (#11107) * fix(orchestration): clarify legacy migration safety * fix(cli): sanitize legacy formatted messages * test(runtime): allow near-cap fuzz under shard load --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(lint): restore nested config discovery in changed-code gate (#11130) * docs: add WeChat group 6 QR with overflow guidance Show group 5 and group 6 QR codes side by side so people can join group 6 if group 5 is full. * fix(sidebar): restore legible selected-workspace fill in dark mode (#11139) #8321 mixed the selected card's wash into the opaque --worktree-sidebar surface, lifting dark mode to 16% (#4b4b4b). Card text lost too much contrast against it. Return both modes to a translucent wash (light 8%, dark 10%) so the brighter selection border added by #8321 carries the selected state instead of the fill. Co-authored-by: Orca <help@stably.ai> * fix(macos): avoid scene deadlock on app reactivation (#11055) * fix(macos): avoid redundant focus on app activation * test(macos): cover passive app activation --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(memory): retune image and orca.yaml ceilings that rejected valid input (#10815) * fix(orchestration): reveal worker terminals reliably (#11142) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * ci(pr): run E2E when a PR touches tests/e2e paths (advisory) (#11131) * ci(pr): run E2E when a PR touches tests/e2e paths Regression specs under tests/e2e never ran on PR CI — only schedule and release called e2e.yml — so a red regression test could merge green. Path-filter and workflow_call the E2E suite when E2E-relevant files change. Use merge-base diffs so base-branch drift does not false-trigger E2E, fail the detector when git diff cannot compute the PR range, and pin least-privilege contents:read on both the detector and reusable E2E workflow. Closes #10518 Co-authored-by: Wooseong Kim <innocarpe@gmail.com> Co-authored-by: Orca <help@stably.ai> * ci(pr): make the E2E path gate actually block, and match the real config path Two fixes to the new path-filtered E2E job. The gate did not gate. pr.yml's `verify` job is the required check, and it enumerates its dependencies explicitly — `e2e` was in neither `needs` nor the result list, so a failing shard left `verify` green. That reproduces the exact hole this job exists to close: a red spec merges green, just with a red box further down the page. Add `e2e` to both. Because the job is path-filtered, `skipped` is the normal result on a PR that touches no E2E files and has to keep passing. That allowance is checked after the strict loop rather than inside it, so it can never leak to the six jobs that are always required. The `playwright.` pattern matched nothing. The config is tests/playwright.config.ts — beside tests/e2e/, not inside it — so no tracked file starts with `playwright.` and editing the runner config would silently skip E2E. Anchor it at `tests/playwright.`. Adds a contract test alongside the existing release-e2e one. Verified it fails when either fix is reverted, and simulated the gate across success/skipped/failure/cancelled plus the skip-must-not-mask-a-real-failure case. * test(ci): close two gaps in the E2E gate contract CodeRabbit was right on both counts — verified by reverting each and watching the contract stay green. The path filter was unasserted, so `e2e` could lose its `if:` and run on every PR — the cost the filter exists to avoid — without failing anything. The strict-loop check hardcoded four of the six required jobs, so dropping GIT_COMPATIBILITY or SHELL_CONTRACTS left them unenforced while the contract passed. Derive the list from verify.needs instead, so a newly added required job that misses the loop fails here rather than silently going unchecked. * ci(pr): land the E2E path gate advisory instead of blocking The E2E suite is currently failing every scheduled run on main — 22 of the last 22 — so making verify depend on it would block any PR touching tests/e2e/**, including the PRs that fix the suite. This PR's own run reproduced that: 3 of 12 shards failed on specs unrelated to it (agent-session resume, Jira linking, plugin containment, terminal artifacts). So the job runs and reports on E2E-path PRs but is left out of verify.needs for now. The detector, the tests/playwright. path fix, and the contract tests are unaffected — those stand on their own and were the substance of the review. Flipping to blocking is a three-line change once the suite is green; the exact wiring, including why the skipped allowance must sit outside the strict loop, is recorded on verify's Require-successful-checks step. The contract test pins the advisory choice so it reads as deliberate rather than as the unwired-gate bug it originally caught, and still fails if the path filter, the strict-loop coverage, or the config path regress. --------- Co-authored-by: Wooseong Kim <innocarpe@gmail.com> Co-authored-by: Orca <help@stably.ai> * fix(orchestration): repair version-skewed run schemas (#11150) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * fix(i18n): translate automation cadence labels (#11068) The cadence picker now resolves Hourly, Daily, Weekdays, Weekly, and Custom cron through the renderer i18n catalog, with corrected zh/ko/es translations. Supersedes #10044 (thanks @innocarpe) and #10045 (thanks @fsdwen). Fixes #10043 * chore(i18n): drop orphaned cadence catalog keys (#11154) Removes the lowercase hourly/weekly/custom entries from the AutomationSchedulePicker catalog node in all five locales. They were superseded by keys derived from the rendered labels in #11068, and the extractor only adds keys, so they stayed behind unreferenced. Follow-up to #11068. * test(cli): lock CLI-compatible timeout parse contract (#11206) parsePositiveSafeIntegerNumericText mirrors the CLI's own Number() coercion on purpose: text like `600000.000000000000001` is the budget the CLI will actually wait on, so rejecting it here would leave the relay and SSH kill timers shorter than the CLI's and cut the request short. Document that and pin it with regression cases. * fix(diff): stop file-tree navigation remounting combined diffs; make tree resizable (#11088) * feat: add Trae CLI as a supported TUI agent (#10763) * feat: [AI-GEN] add Trae CLI as a supported TUI agent Closes #10579. Wire trae-cli into the desktop and mobile agent catalogs following the same integration pattern as other CLI agents (e.g. Ante, Devin): - src/shared/types.ts, tui-agent-config.ts: register 'trae' with detectCmdAliases (traecli/trae-agent) and argv prompt injection, matching trae-cli's `trae-cli [prompt]` contract. The CLI's own third documented alias `ta` is intentionally excluded — too generic a 2-letter name to use as a PATH-existence detection signal without false-positiving on unrelated tools. - src/shared/trae-headless-command.ts: recognize `--print`/`-p` and `--output-format json|stream-json` as one-shot headless invocations (same shape as claude-headless-command.ts) so they aren't mistaken for a live interactive session. - agent-kind.ts, telemetry-events.ts, agent-status-types.ts, agent-type-label.ts, tui-agent-display-names.ts, tui-agent-permissions.ts (YOLO via trae-cli's own --yolo flag), tui-agent-selection.ts: standard per-agent registrations. - agent-catalog.tsx, agent-favicon-assets.ts, mobile/src/tasks/mobile-tui-agents.ts, mobile/src/components/mobile-agent-icon-assets.ts: catalog entries and bundled favicon (fetched from docs.trae.cn, required by mobile's offline-icon invariant test). - i18n: add the "Trae" label to all five locale catalogs (en/es/ja/ko/zh). - Tests: agent-process-recognition, agent-status, tui-agent-startup. Verified with `pnpm typecheck` (desktop + mobile), the relevant vitest suites (869 tests across 12 files, all green), oxlint (clean), and a real end-to-end launch of the actual trae-cli binary through Orca's pty.spawn IPC path (confirmed via the OS process table). * fix: [AI-GEN] point Trae catalog entry at the real CLI quick-start doc docs.trae.cn/cli (what the installed CLI's own --help text prints as its "User manual" link) soft-404s — the docs site restructured and the working page is docs.trae.cn/cli_get-started-with-trae-cli (confirmed by HTTP fetch: real page title "TRAE CLI 快速开始" vs the old path's "404 - 页面不存在"). Addresses CodeRabbit's homepageUrl review comment. * fix: [AI-GEN] detect Trae on traecli, not the ambiguous trae-cli name Per @AmethystLiang's review: the open-source bytedance/trae-agent project (MIT, ~12k stars) registers its own console script as `trae-cli` (pyproject.toml: `trae-cli = "trae_agent.cli:main"`), an entirely unrelated CLI with a different contract (`trae-cli run "task"`, `-p` short for `--provider`). Detecting on bare `trae-cli` would false-positive on that project's installs and break launch for anyone who has it instead of the actual TRAE CN CLI. - tui-agent-config.ts: detectCmd/launchCmd/expectedProcess -> `traecli` (TRAE CN's own installer symlinks this alias too, but the other project does not ship it). Dropped the `trae-agent` alias entirely — it's the colliding project's literal repo name, the highest false-positive string available. - agent-catalog.tsx: cmd -> `traecli` to match; faviconDomain -> `www.trae.cn` (bare `trae.cn` 404s on Google's favicon service; `www.trae.cn` is the product-root domain that actually resolves). - mobile-tui-agents.ts: faviconDomain -> `www.trae.cn` to match. - Tests updated: agent-process-recognition now asserts `trae-cli` and `trae-agent` are NOT recognized as Trae (regression guard against reintroducing the collision); tui-agent-startup updated for the new launch command. promptInjectionMode stays `argv` and the headless-command file stays as-is — both verified against the real TRAE CN CLI's actual --help output (pasted in the PR review thread), not assumptions. * refactor: [AI-GEN] share one print-mode headless matcher across agents trae-headless-command.ts was a rename-only fork of claude-headless-command.ts, and ante-headless-command.ts carried a third copy of optionName. Collapse both print-mode files into print-mode-headless-command.ts, dispatch from a Partial<Record<TuiAgent, ...>> table instead of an if-chain, and compress the Trae comments to the repo's one-line style. * fix: [AI-GEN] terminate Trae flag parsing before the positional prompt `traecli` is a Cobra CLI with subcommands, so an argv prompt starting with `help`, `config`, `-…` was dispatched as a subcommand or flag instead of being run as the task. Add `argvPromptSeparator: '--'` (same reason Grok has it), and stop the shared print-mode headless matcher at `--` so a prompt that reads like `--print` no longer drops the pane out of agent recognition. * docs: [AI-GEN] name both Trae CLIs explicitly in the detect-name comment Co-authored-by: Orca <help@stably.ai> * docs: [AI-GEN] drop the vendor tag from the Trae union comment Co-authored-by: Orca <help@stably.ai> * fix: [AI-GEN] guard the nullable startup plan in the Trae separator test Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: 陈泽榜 <chenzebang@jianzhikeji.com> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Orca <help@stably.ai> * chore: remove orchestration structured-output draft design doc from repo root * fix(codex): re-confirm spurious shell readings before skipping the restart card (#11076) An account switch decides pane eligibility from a single cached inspectProcess read. When that read reports the pane's shell for a live Codex session, the pane silently loses its restart card - no error, no retry. Re-check shell readings on Orca-launched Codex panes with the existing fresh-scan confirmForegroundProcess before trusting them; only an affirmative codex answer flips the decision, so a genuine exit to the shell stays uncarded and unsupported providers keep today's behavior. * feat(dictation): add stop button and shortcut hint to Listening indicator (#11152) * feat: bound direct SSH reconnect fan-out and recovery (#11003) * docs: design for direct SSH reconnect fan-out Capture the implementation-ready plan for host-qualified, epoch-fenced SSH reconnect recovery after two rounds of multi-model LLM counsel review. * docs: reconcile SSH reconnect fan-out design * docs: close reconnect design consistency gaps * feat: implement bounded direct SSH reconnect recovery * fix: bound direct SSH retry settlement * fix: harden direct SSH reconnect authority * fix: preserve split SSH retry ownership * fix: preserve SSH split continuation authority * docs: record final SSH reconnect validation * fix: preserve SSH authority through retained and detached state * fix: retain SSH authority across delayed split mounts * fix: close SSH authority recovery gaps * fix: fence stale SSH transport replacement * fix: serialize SSH target teardown * fix: settle SSH teardown failures before reconnect * fix: retire failed SSH reset sessions * test: reconcile current main E2E contracts * fix: close direct SSH reconnect review gaps * fix: fence stale SSH reconnect side effects * fix: close final SSH reconnect lifecycle gaps * test: stabilize current-main reliability gates * test: prove plugin navigation containment * test: make plugin navigation oracle authoritative * test: make plugin navigation oracle deterministic * ci: allow sharded e2e suite to finish * test: wait for runtime pane publication * test: classify pane readiness by error code * test: select close persistence terminal by tab identity * docs: mark reconnect implementation validated --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> * Improve translations for resource manager and related UI elements (#11205) * Improve translations for resource manager and related UI elements Standardize terminology ("daemon" vs "service"), complete missing translations, and refine wording across Spanish, Japanese, Korean, and Chinese locales for consistency and clarity. * Improve translations for resource manager and related UI elements * fix(test): update zh name-mode label expectation after translation fix The resource-manager translation pass correctly changed the Chinese "Name" label from 姓名 to 名称; update the localized options unit test to match so CI passes. * fix(native-chat): surface draft launch context in desktop and mobile chat composers (#9802) * fix(native-chat): surface draft launch context in chat composers Creating a workspace from a GitHub issue delivers the issue link only into the agent TUI's input buffer (argv prefill or startup paste), so the chat view showed no trace of it on desktop or mobile. Desktop: draft launches now seed an in-memory launch draft keyed by tab id (direct work-item launches, background GitHub work-item creates, quick-create composer, and new-tab draft deliveries). The chat composer adopts the seed once as its editable draft, declines permanently if the composer already has text, and drops an untouched copy when any user turn lands (the one-line TUI input means the prefill was submitted or deliberately cleared) or on its own send, whose existing input pre-clear retires the TUI copy. Mobile: the host publishes the draft as an optional launchDraft field on the mobile terminal tab snapshot (additive, no protocol bump) and the mobile composer adopts it with the same once-only/decline/resolve semantics. Mobile chat sends now also pre-clear the TUI input line (Ctrl+U, desktop parity) so a pending prefill cannot concatenate with the sent message. Completion seeding resolves the launch tab from the synced store tabs when the backend spawned the terminal and activation reports no primaryTabId. Split the Windows shell-quoting tests into their own file to stay within the max-lines budget. * revert(mobile): drop incidental pnpm-lock churn from the launch-draft branch The libc binding fields and the @typescript-eslint peer re-resolution came from a local install, not from this change; mobile/package.json is untouched. * fix(native-chat): resolve launch drafts without trusting cross-host clocks The rule required a user turn stamped at or after the seed. Grok omits row timestamps, so a Grok launch draft never resolved; and the seed time is a renderer clock while the stamp comes from the executing host's JSONL, so a remote workspace whose clock trailed never resolved either. Both left the composer adopting an already-submitted prefill, which re-sends it as a duplicate turn. Resolve on any user turn that is not PROVABLY older than the seed (a launch draft's session starts with zero user turns), with the existing cross-host skew slack, plus a timestamp-free backstop for wider skew: a new tail user turn since the draft was first observed. "Load earlier" prepends, so it cannot move the tail and cannot over-resolve. Split out of native-chat-pending.ts to stay under the max-lines ratchet. * fix(worktrees): seed the launch draft on the agent's own tab, never on tabs[0] Two defects in the completion seed: - The tab was resolved by array position. buildStartupOpt returns undefined on the backend-spawn path, so applyDefaultTerminalTabs stamps launchAgent on no tab and the launchAgent guard was dead there. A repo with default terminal tabs ("dev server", "logs", ...) got the draft on a tab that runs no agent, and then published it to mobile as THAT tab's launchDraft. Correlate on the backend startup tab, then on a launchAgent-stamped tab, then on primaryTabId (which is the agent tab whenever the renderer owns startup); never tabs[0]. - Runtime-owned worktrees mirror their session tabs async, so tabsByWorktree was empty at seed time and the seed was silently dropped for that whole host class. Defer to the first mirrored tab via the existing delayed-delivery queue, which now holds every pending delivery for a worktree instead of one (setup/issue commands and the seed both wait on the same first tab). * fix(store): evict nativeChatLaunchDraftByTabId on every teardown path The new map was absent from all four paths its sibling nativeChatLaunchPromptByTabId participates in: tab close, the orphan terminal sweep, the bulk worktree purge, and the removeWorktree teardown. A stranded entry is worse than a plain leak here because sync-runtime-graph keeps publishing it to mobile as that tab's launchDraft. * fix(native-chat): only seed single-line unsubmitted launch drafts The unsubmitted-delivery branch seeded on every draft delivery, which also caught the agent-session-fork path whose prompt is multi-line scraped context. The chat send pre-clears the TUI with Ctrl+U (kill-to-start-of-LINE), so a multi-line prefill cannot be fully cleared and its earlier lines would glue onto the next message. The GitHub work-item draft this feature targets is a bare issue URL, so narrowing costs it nothing. Also assert the composer retires the seed after a send — deleting that call previously failed no test. * fix(mobile): stop the chat pre-clear from wiping a just-pasted image The text write set clearInputFirst unconditionally. On the image path that Ctrl+U lands AFTER pasteMobileNativeChatImagePaths already pasted the image, so the agent receives the text alone while acceptSend still renders the thumbnail on the sent bubble — silent image loss. Desktop's image path clears exactly once, before the paste, and never again; mobile now matches: pre-clear only when nothing was deliberately pasted first. The image paste already leads with its own Ctrl+U, so a launch-draft prefill parked on the input line still cannot glue onto the message. Pinned at both levels: the controller test drives the real send hook and asserts clearInputFirst per branch, and the send module asserts the wire text carries no leading \x15. The image-attachments test injects its own baseSend, so it structurally could not observe this. * fix(mobile): hold the launch-draft prefill until the transcript settles session.tabs delivers launchDraft before the transcript read resolves, so the seed effect could run against an empty in-flight message list and miss the user-turn decline. Launching from an issue, submitting the prefill in the TUI, and never opening desktop chat (nothing else clears the host seed) then prefilled the mobile composer with the already-sent issue link — a send tapped before it retracted duplicated it to the agent. Thread the session's loading state through and skip the seed while the read is in flight. idle/waiting-session still seed: no session means no user turns. * fix(runtime): publish a launch draft to mobile only for the tab's own agent The publish had no agent check while the desktop consumer declines on mismatch. The seed is keyed by tab id, which survives a pane's agent switch, so mobile could adopt a draft desktop refuses — seed for claude, never open desktop chat, switch the pane to Codex, and mobile prefills the Codex chat with the Claude-era issue link. Align publish with the consumer. * fix(native-chat): take the launch-draft baseline only after the transcript loads The timestamp-free backstop snapshotted the transcript's user turns on first observation of the draft, which can happen while the read is still in flight and `messages` is []. A pane bound to a session that already had user turns then backfilled above that zero baseline with a different tail id, so clause 2 resolved and silently dropped the seed — the launch context never appeared, and the feature no-oped for exactly the panes it was meant to serve. Clause 1 was already correct there (that history is provably older than the seed). Gate baseline capture and resolution on the transcript read settling, the same shape mobile's drafts hook uses. Clause 1 is unchanged; while loading the merged list is empty anyway, and a pane with live appends is never reported 'loading'. Also restore clause 1's short-circuit: it scans with .some() again and only allocates the user-turn list when falling through to the backstop. NativeChatView sat at exactly the 400-line cap, so the composer's two launch-draft props are now spread from the hook result they already mirror. * fix(native-chat): reject multi-line launch drafts inside the seed helper The single-line guard lived in deliverLaunchPromptToAgentTab, so the two other seeding entry points (worktree create, direct work-item launch) bypassed it — and every Linear launch is multi-line by construction ("Linked Linear issue: STA-…" + url). The chat send pre-clears the TUI with Ctrl+U, which kills to start of LINE, so those earlier lines stay parked to glue onto the next message. * fix(worktrees): keep the deferred agent seed off ambiguous mirrored tabs The runtime-owned deferred path fell back to tabs[0], which the module's own docstring forbids: with repo default tabs ("dev server", "logs") the seed lands on a tab running no agent, where mobile withholds it and desktop's agent check ignores it — the feature is silently dead for that create and the entry leaks until tab close. The queue entry is consumed before delivery, so there is no retry to fall back on; accept the first mirrored tab only when it is the worktree's only one and so unambiguously the agent's. * fix(mobile): treat a launch-draft-only session-tab frame as a change mobileSessionTabEqual's terminal branch never compared launchDraft, and the route keeps `prev` when tabs compare equal — so a publish whose only delta is the draft appearing or retracting was discarded and never reached the composer. Live QA passed only because agentStatus happened to change in the same frame. MobileSessionTab's terminal variant did not declare the field either (the controller read it through the structurally wider MobileNativeChatTab), which is why TypeScript never flagged it. * fix(mobile): judge a launch prefill only from its own settled transcript Two ways the drafts hook was reading a transcript that was not the active chat's: - transcriptLoading came from `status`, a plain useState written by a passive effect declared before the drafts hook. On the commit where the tab identity changes it still holds the previous tab's value, so the guard was off on exactly the render that seeds: first entry saw status 'idle' with an empty list and seeded an already-submitted link, and a tab switch declined the new tab's prefill from the old tab's turns. The session hook now tracks the identity its messages describe and reports transcriptLoading until they agree; the retire effect gates on it too. - Leaving chat view nulled launchDraft while draftKey stayed the same, which the hook could not tell from a host retraction — it declined the prefill permanently, so peeking at the terminal dropped the context. The controller now passes the raw field plus an explicit chatActive flag, and both effects hold their state when the tab is not on chat. The controller wiring was previously unasserted: replacing both props with constants left all 795 mobile session tests green. * fix(native-chat): keep the launch-draft baseline across a transcript reload baselineKey went null whenever the transcript was loading, and the null branch DISCARDED an already-valid baseline taken from a settled read. It was then re-taken from the fuller list, swallowing the very user turn that resolves the draft — so a stale prefill gets re-adopted as a duplicate turn. Key the baseline on draft identity alone and gate only the capture. session.status is also not a truthful read-in-flight signal: a live 'working' hook outranks 'loading', so the guard could be off over an in-flight empty list. Expose the read phase itself and gate on that. * test: cover the launch-draft reducers and the sync-key skip gate Every consumer test injects the three launch-draft reducers as bare vi.fn()s, so reducing markNativeChatLaunchDraftAdopted to a no-op left 2609 tests green — while in the app the composer would resurrect the prefill after every manual clear. canSkipRuntimeMobileSessionSyncKeyBuild had no launch-draft case either: when it skips, the sync key is never even built, so the existing getRuntimeMobileSessionSyncKey case cannot catch its removal. * fix(native-chat): hold the launch-draft baseline in state, not a render-mutated ref react-compiler rejects reading or writing a ref during render. Adjust the held baseline with the sanctioned render-time setState instead, keeping the local copy so the render that first sees a settled transcript resolves against it. * fix(mobile): carry the transcript identity in the session read state react-doctor flags the separate loadedIdentity state as an extra render for a derivable value. Hold status alongside the identity it describes in one state written by the subscription effect, so transcriptLoading derives from it. * test(native-chat): assert the readPhase contract without the hook-status race The test asserted status === 'working', which depends on liveStatusOverride winning over ambient transcript state — green locally, red under CI load. The contract is that readPhase stays 'loading' once live content unmasks status, so assert exactly that; it still fails if readPhase derives from status. * fix(mobile): derive pre-read chat status instead of writing it from the effect react-doctor's no-derived-state-effect flags idle/waiting-session/loading being set in the subscription effect: all three are pure functions of the props. Derive them during render and keep state only for the genuinely async outcome, tagged with the identity it describes. The tag now gates `messages` too, so a just-switched tab never sees the previous tab's transcript at all rather than seeing it behind a loading flag. * fix(mobile): drop a settled chat read once its subscription is torn down The settled outcome was only ever replaced by a newly arriving frame, so any effect re-run that landed back on an already-settled identity resurfaced it over a list the same effect had just cleared: 'ready' with no messages and transcriptLoading false. Toggling out of chat view and back hit this every time (the agent goes null, then returns), flashing the "start a chat" empty state over a real conversation and opening the launch-draft seed's decline check on an empty transcript. A reconnect did the same via the client dep. Identity and client are the effect's only inputs, so tagging the read with both and dropping it during render when either moves covers every re-run. * fix: pr-bug-scan validated finding from #6471 (#6512) * fix: address pr-bug-scan validated finding from #6471 stripTags now removes real markup (closing/self-closing/attributed/custom tags) outside the allow-list; only bare identifier-glued generics like Array<string> are kept. Blocks svg/center/custom leak a * fix: address pr-bug-scan validated finding from #6471 stripTags now removes real markup (closing/self-closing/attributed/custom tags) outside the allow-list; only bare identifier-glued generics like Array<string> are kept. Blocks svg/center/custom leak a * fix(mobile): harden markdown preview tag stripping * fix(mobile): preserve angle-bracket prose while stripping tags --------- Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * feat(worktrees): support project-level worktree.sharedDirectories in orca.yaml (#10459) * feat(worktrees): support project-level worktree.sharedDirectories in orca.yaml Follow-up to #7549: `.worktreeinclude` copies gitignored paths into each new worktree, which is right for `.env`/`.vscode/` but wrong for large rebuildable directories. Copying `node_modules` per worktree is slow and duplicates disk, and each worktree's install then diverges. Adds `worktree.sharedDirectories` to `orca.yaml` — a versioned, in-repo list of gitignored directories that are symlinked (shared) into every new local worktree, so one install serves them all. Adds to, never replaces, the per-user Worktree Shared Paths setting. `createWorktreeSharedPaths` uses a new 'share' materialization mode that always symlinks. The existing 'link' mode APFS clone-copies on macOS, which would give each worktree an independent node_modules and defeat the point; 'link' and 'copy' behavior are unchanged. Entries must exist as gitignored directories in the primary checkout; absolute paths, `..` traversal, and `.git` are rejected. Resolution never throws, so a malformed orca.yaml cannot block worktree creation. Remote (SSH) creation skips this, as it does symlink paths and `.worktreeinclude`. Closes #10451 * fix(worktrees): keep worktrees deletable after sharing a directory A directory-only ignore rule (`node_modules/`, the common spelling) matches the primary checkout's real directory, so the shared directory resolves and gets symlinked — but it never matches the worktree's symlink, so Git reports that link as untracked. Deletion only tolerated the per-user shared paths, so every worktree in such a repo became permanently dirty: the clean preflight threw "uncommitted or untracked changes" and `git worktree remove` refused without --force. Feed the configured `orca.yaml` shared directories into the same tolerate-and-unlink machinery the per-user shared paths already use, at both deletion call sites. The names are read unfiltered, since the create-time resolver drops exactly the entry deletion needs most. * test(worktrees): register createWorktreeSharedPaths in the runtime symlink mock orca-runtime.ts imports createWorktreeSharedPaths, but the vi.mock factory for ../ipc/worktree-symlinks never listed it. Vitest resolves omitted exports lazily, so this only stays green because no runtime test configures a repo with worktree.sharedDirectories — the first one that does would fail on a mock resolution error rather than on its own assertion. * fix(source-control): don't count shared symlinks as uncommitted changes A directory-only ignore rule (`node_modules/`) matches the primary checkout's real directory but never the worktree's symlink, so Git reports the shared link as untracked for the life of the worktree. That made every affected worktree read as dirty: a phantom row in the diff view, and Create PR blocked with `blockedReason: 'dirty'` telling the user to commit an entry they cannot commit, because it is a symlink Orca created. Status and the review-creation preflight now drop untracked entries that are both declared shared (per-user shared paths or orca.yaml sharedDirectories) and actually symlinks on disk. Both conditions are required, so a regular file at a declared name, or a symlink nobody declared, still counts as user work. The decision fails closed: anything not positively identified stays dirty. The preflight moves to `--porcelain -z` so paths with spaces or non-ASCII bytes are compared raw rather than C-quoted, with a parser that consumes the origin field a rename emits instead of reading it as its own record. Symlink detection moves to a leaf module: importing it from ipc/worktree-symlinks would pull APFS cloning, and its child_process dependency, into the status graph. SSH is unaffected and left alone — remote worktree creation skips the symlink and shared-directory passes, so a remote worktree never has one. * fix(source-control): wire shared links into local status * fix(worktrees): resolve the status repo once and reject uncollapsed shared paths `git:status` resolved the registered worktree's repo twice per call — once inside `getLocalGitOptionsForRegisteredWorktree` and again for the shared-link lookup — walking every repo's worktree meta on a polling path. `apps/./web` also survived `sharedDirectories` normalization: `resolve()` collapses it when the symlink is created but Git reports the collapsed path, so every later comparison misses and the link reads as permanent untracked work. Also stop resolving shared links for SSH repos in review creation: `repo.path` names a path on the remote host. Adds the missing wiring coverage for review creation and runtime status, plus the untracked-only conjunct in both filters — all four were mutation-verified to leave the suite green before these tests. * test(worktrees): pin the resolver-to-status seam for shared directories The resolver's output and the status filter were only tested apart — status used a hardcoded `['node_modules']`. Feed the resolved directories back through `getWorktreeSharedLinkPaths` into a real `getStatus` so a resolver that ever returned a differently-spelled path can no longer leave the link showing as a phantom untracked row. * fix(worktrees): try a directory junction before a symlink on Windows A plain `fs.symlink` needs Developer Mode or admin on Windows, so an ordinary Windows user got EPERM, the per-path catch logged and continued, and the worktree came up with no shared directory and no signal. A directory junction needs no privilege, and the rest of the codebase already uses one for win32 directory links. The symlink stays as a fallback rather than being replaced: a junction cannot target a UNC path, and a WSL project's repo lives behind one, so replacing it outright would trade the local-volume bug for a WSL regression. Safe for the removal path either way — Windows reports a junction as both a symlink and a directory, so the `isSymbolicLink()` unlink that runs before `git worktree remove` still fires and still refuses to follow it. * fix(worktrees): keep NUL bytes and tolerated links out of the removal error The removal preflight switches to `git status --porcelain -z` whenever it has shared links to tolerate, then attached that raw stdout to the error. `.trim()` does not strip interior NULs, so the message reached the user as `?? node_modules<NUL>?? precious.txt<NUL>` — raw control bytes, and it named the shared link, the one entry that is not the user's work and cannot be committed away. Parse the NUL-delimited output once and use it for both the clean verdict and the error text, so the two can never disagree about what blocks removal. The `-z` switch stays: it is what keeps paths with spaces or non-ASCII names comparable against the configured entry. * chore(worktrees): drop stray reformatting and note why the SSH guard exists Committing the merge staged 792 files, so lint-staged ran the formatter across all of them and rewrapped three renderer files that were already unformatted on main. Nothing was lost — they were byte-identical to main ignoring whitespace — but they showed up in the pull request as unrelated changed files. Restored to main's exact bytes. Committed with --no-verify on purpose: the pre-commit formatter is what introduced the rewrapping, so letting it run again would simply reapply it. Every check it would have run was run by hand instead — lint, typecheck, and the IPC and source-control suites all pass, and the three restored files are expected to fail a format check because that is main's current state. Also records why the connection guard on the shared-link lookup is not dead code: the remote dirty check ignores those paths, so the guard's only effect is avoiding a stray local read and the bad cache entry it would leave behind. * refactor(source-control): drop a scan-everything guard and freeze the cached list The dirty check built a filtered array only to read its length, so it always scanned every status record; asking whether any record is untracked stops at the first one and reads the same either way. The cached shared-directory list was also handhanded out by reference, so a caller that mutated it would corrupt every read for the rest of the cache window. Marking the return readonly prevents that at compile time; copying on return would work too but would allocate on the status-polling path, and there is exactly one caller, which only spreads it. * fix(mobile): exclude proxy fake-ip addresses from pairing QR (#10498) * fix(mobile): exclude proxy fake-ip addresses from pairing QR Clash/mihomo TUN interfaces in 198.18.0.0/15 were enumerated as pairing candidates and could become the default QR endpoint. Phones then retry an unroutable address forever. Drop those addresses from the pickable list (#10404). * refactor(mobile): keep fake-ip filtering local * test(mobile): cover fake-ip range boundaries --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * Bug floating workspace shortcuts route to main w (#10433) * fix(floating-workspace): route panel shortcuts to the floating panel, not the main window Floating-workspace close/index keyboard shortcuts leaked to the main window behind the panel. Route them through the floating panel across all four keydown layers via an atomic focus signal, panel-owned indexed switching with a tri-state outcome, an event-target-aware close guard, and a floating-scoped guest IPC bridge. Changes A-E and findings F2/F3/F4/F6/F7/F8/F9/F11/F-adv/F-dl/F-feas. Co-authored-by: Orca <help@stably.ai> Co-authored-by: feelgom <littlestork4@gmail.com> Co-authored-by: Wooseong Kim <innocarpe@gmail.com> * fix(review): clear stale floating-panel reclaim intent on panel close The module-singleton reclaim intent (F3) is armed at an emptying-close but only consumed by the visibleFloatingItemCount->0 effect. If a concurrent tab-create keeps the panel from reaching 0, the intent stays armed and could survive to a later empty-panel mount and steal keyboard focus. The !open release effect now clears it (defense-in-depth), matching the outside-pointerdown/window-blur paths. Flagged by 4 review personas (correctness, adversarial, julik-races, maintainability). Co-authored-by: Orca <help@stably.ai> * test(floating-workspace): cover L1 index-chord yield and deferred-close reclaim-arm timing Two additive R2-review tests for the #10288 floating-workspace shortcut routing change set: - createMainWindow: assert L1 yields the initial indexed-switch chord (tab-index and worktree-index) to the floating panel without preventDefault or dispatch, and contains held-key auto-repeats in main (preventDefault, no dispatch). Closes the untested Change B (F4) path. - FloatingTerminalPanel: assert an emptying, panel-owned close whose closeTerminalTab defers/cancels (onClosed never fires) leaves the reclaim intent unarmed, so no later empty-panel mount can reclaim focus for a close that never happened. The prior mock fired onClosed unconditionally, so this arm-timing (F3) branch was uncovered. Co-authored-by: Orca <help@stably.ai> * fix(review): resolve round-1 findings F-1..F-6 - F-1: re-derive panel emptiness from live store at arm time; clear stale reclaim intent on repopulating create so an unrelated later close can't consume it and steal keyboard focus from the main workspace. - F-2/F-5a: single-source the panel's non-creation shortcut claims via matchFloatingWorkspacePanelShortcut(); shared isTerminalPaneCloseChord() predicate for L2/L3; App.tsx gate + both FloatingTerminalPanel call sites now call the SSOT so index/rename/max-min ownership can't drift. - F-4: L2 keydown gate is event-target-aware (matches L1 yield) so an L1-yielded chord is still consumed during a transient panel blur. - F-5b: export clearReportedFloatingFocusCache() + reset it in test setup. - F-5c: split floating-workspace-item-actions.ts into focus-reclaim + guest-bridge modules (AGENTS.md file-naming). - F-6: trim verbose design-code comments to single-line WHY. Co-authored-by: Orca <help@stably.ai> * fix(floating-workspace): remove finding reference labels These internal review labels (F1–F7) and change identifiers were used during development and are no longer needed in the code. * fix(…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #6213 — in dark mode, the selected workspace card was hard to distinguish from the worktree sidebar.
Root cause: selected cards used a ~10% white wash (
dark:bg-white/[0.10]/color-mixinto transparent), which nearly vanishes on--worktree-sidebar(#2a2a2a).Fix:
color-mixinto--worktree-sidebar(16% foreground wash + clearer border) so the selected card reads cleanly in dark mode.Screenshots (dark mode)
Captured on Electron against the PR base vs this branch. Same workspace selected in each pair.
Selected inactive workspace (
pr-4415-…)Selected primary workspace (
orca)Measured selected-card background (dark):
color(srgb 0.98 0.98 0.98 / 0.10)— 10% white wash on transparent (nearly invisible on#2a2a2a)color(srgb 0.295 0.295 0.295)— token-basedcolor-mixinto--worktree-sidebarwith stronger borderTesting
pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx(26 passed)Notes
Claimed on the issue before starting; no other open PRs referenced #6213.