orchestration.ask blocks server-side until a reply lands or its timeout
(default 600s) elapses, holding the RPC open — but isLongPollRequest never
classified it as a long-poll. So the keepalive that resets the 30s
RUNTIME_RPC_SOCKET_IDLE_TIMEOUT_MS was never armed, and any ask left
unanswered for 30s died with a misleading runtime_unavailable ("The Orca
runtime closed the connection"), regardless of --timeout-ms. The same
omission left the handler's abort signal unwired (it is only passed for
long-polls), so the client-disconnect release path guarded by
signal?.aborted was dead code.
Add orchestration.ask to isLongPollRequest so it gets the keepalive, the
abort signal, and long-poll admission. The client already extends its
per-call socket timeout for ask (handlers/orchestration.ts passes
timeoutMs + 5s at the call site), so only the server-side classification
was missing.
The web client persists its workspace session (activeWorktreeId,
lastVisitedAtByWorktreeId, ...) in localStorage and, unlike the main-process
Store, gets no load-time orphan GC. `pruneLastVisitedTimestamps` already drops
stale focus-recency entries on hydration, but the persisted `activeWorktreeId`
pointer is not reconciled — so a pointer to a worktree the server no longer
reports lingers (the main-process path clears it via removeWorkspaceSessionOwner
when a repo is removed; the web has no equivalent), and can surface a phantom /
duplicate workspace that survives reloads.
Extend the hydration reconcile to also clear `activeWorktreeId` once its repo is
hydrated and the worktree is confirmed gone, mirroring the existing per-repo
defer rule (a not-yet-hydrated repo, e.g. SSH pre-connect, keeps its pointer).
Co-authored-by: fanyunqian.1 <fanyunqian.1@bytedance.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`hydrateHeadlessMobileSessionTabsFromWorkspaceSession` iterates
`workspaceSession.tabsByWorktree` with no repo gate. Those keys are
`${repoId}::${path}` and are not pruned when a repo disappears from this
client's view, so a stale key re-materializes a phantom "unknown"/duplicate
workspace with no live repo behind it, on boot, with no `session-created` event.
Skip entries whose parsed repoId is not in the live `repos`; leave unparseable
keys alone (conservative). Defensive complement to the delete-path (#9025) and
load-time (#9200) fixes — this closes the mobile/headless hydration path.
Co-authored-by: fanyunqian.1 <fanyunqian.1@bytedance.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`worktrees:persistSortOrder` (ipc/worktrees.ts) and `persistManagedWorktreeSortOrder`
(orca-runtime.ts) call `store.setWorktreeMeta(id, { sortOrder })` for every id the
renderer sends. `setWorktreeMeta` has no repo-existence check, so a stale id the
client still lists — e.g. a removed repo's `${repoId}::${path}` that lingers in the
renderer's order — gets a brand-new `worktreeMeta` entry minted on every sidebar
snapshot, resurrecting an orphan/duplicate workspace on the next launch.
A sort-order snapshot must only reorder worktrees that already exist, never create
one. Guard both call sites with `getWorktreeMeta` so absent ids are skipped.
Co-authored-by: fanyunqian.1 <fanyunqian.1@bytedance.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The managed token refresh is deferred while a live claude session owns
the credentials, but nothing reacted to the last live PTY exiting: the
deferred result is a terminal-classified error whose retry lane backs
off to the 15-minute cadence and is window-focus-gated, so the usage
panel stayed on "Waiting for Claude session" long after the blocker was
gone.
Notify on the live-PTY 1->0 transition (covering both markClaudePtyExited
and confirmSeededClaudeLivePtys releasing the last dead seeded id) and
force a claude-only refetch iff the current state is deferred.
Closes#9324
The Windows CLI shim is delivered via extraResources to
resources/bin/orca.cmd, beside the native resources/bin/orca.exe, and
resolves the launcher adjacent to itself (%SCRIPT_DIR%orca.exe) — which
works.
But nothing in `files` excluded resources/win32/, so its source copy was
also packed into app.asar and then extracted by asarUnpack:['resources/**']
to app.asar.unpacked/resources/win32/bin/orca.cmd. That duplicate has no
adjacent orca.exe, so invoking it fails with "Unable to locate the native
Orca CLI launcher", breaking orchestration skills that reach for the
unpacked shim.
Exclude the win32 shim source tree from app.asar so only the working
extraResources copy ships. Add a regression guard to the electron-builder
config test.
Closes#7351
* fix: prune workspace session state when a project is removed
removeProject → pruneWorktreeStateForRepo cleared worktreeMeta, lineage,
and workspace lineage, but left the removed repo's worktrees behind in
workspaceSession (lastVisitedAtByWorktreeId, sleepingAgentSessionsByPaneKey,
tab state, …) and in every workspaceSessionsByHostId partition.
Those dangling references caused the runtime to treat the deleted repo's
worktrees as recently-active on the next launch and re-materialize their
worktreeMeta. With no owning project left, the UI rendered them as an
orphaned "unknown" workspace that returned after every restart.
Reuse the existing removeWorkspaceSessionOwner cleanup (already used by
removeFolderWorkspace and deleteProjectGroup) against the legacy session
blob and each per-host partition, collecting owner keys before the
worktreeMeta delete loop so host classification still works.
Fixes#9024
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: scope session cleanup to the removed host in removeProjectForHost
The workspace-session cleanup applied every collected owner key to the legacy
(local) session blob AND every workspaceSessionsByHostId partition. Owner keys
are `${repoId}::${path}` and carry no host, so a host-scoped removal
(removeProjectForHost) of one host wrongly wiped a surviving host's session for
a shared repo id/path — discarding its lastVisitedAt, tabs, sleeping-agent
state, and active-worktree pointer.
Scope the session prune to the removed host: prune the legacy blob only when the
target host is local (or on a full removeProject where hostId is null), and
prune only the matching workspaceSessionsByHostId partition for a non-local
host; a full removal still clears every partition. Collect session owner keys by
`${repoId}::` prefix (not belongsToHost, which is worktreeMeta-host-classified)
so a partition-only key is still prunable.
Adds regression tests for a shared repo id + path across local and an SSH host,
covering removeProjectForHost on the SSH host (local session survives) and on
the local host (SSH session survives).
Addresses review feedback on #9024.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: cover third surviving host in removeProjectForHost session prune
Add a regression case where a shared repo id + path exists on local and two
SSH hosts. Removing one non-local host must prune only that host's session
partition, leaving both the legacy/local session and the other surviving SSH
host's partition intact. Locks in that the host-scoped cleanup never touches a
non-targeted third partition (per review feedback on #9024).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* perf: prune workspace session in a single clone+scan per partition
Project removal collected every owner key to prune, then called
removeWorkspaceSessionOwner once per owner AND per host partition. Each
call structuredClones and scans the entire session, so removal was
O(worktrees x hosts x session size) in full-session clones on the main
thread.
Add removeWorkspaceSessionOwners(session, ownerKeys) which clones once
and scans each collection once for the whole set, and route
pruneWorktreeStateForRepo through it. The per-owner O(1) field deletes
and the single-scan pane-key passes are factored into shared functions
so removeWorkspaceSessionOwner keeps identical behavior for its other
callers. No behavior change.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: PannenetsF <fanyunqian.1@bytedance.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): stop middle-click primary paste inserting twice on X11
When "Middle-click Paste from Selection" is enabled, the integrated
terminal reads the X11 PRIMARY selection on mousedown and writes it to
the PTY itself. It calls preventDefault on the mousedown, but Chromium's
native X11 middle-click primary paste fires on mouse release regardless,
landing in xterm's helper textarea, which xterm then forwards to the PTY
a second time. The result is the selection pasted twice.
The global primary-selection hook already suppresses the follow-up native
paste, but only for editable DOM targets it owns via a pending-target
handle; it deliberately excludes xterm, so the terminal path had no
suppression at all.
Arm a short shared suppression window when the terminal handles a
middle-click, and have the global hook's capture-phase beforeinput/paste
suppressor honor it. This swallows the single native paste event so the
selection reaches the PTY exactly once. Ctrl+Shift+V and right-click
paste are unaffected: they use the CLIPBOARD and never emit a native
primary-paste event.
Closes#8860
* docs(terminal): clarify native middle-click paste suppression
* fix(terminal): scope primary-selection native-paste suppression to Linux xterm
Gate the armed native-paste suppression window to Linux (X11 primary-selection
path) and scope it to xterm's helper textarea so unrelated document pastes and
non-Linux platforms are never affected. Re-arm on auxclick for slow releases.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
When the macOS Computer Use helper app is missing (e.g. a dev build that
never ran `pnpm build:computer-macos`), getComputerUsePermissionStatus
reports helperUnavailableReason alongside all permissions set to
not-granted. The onboarding runner only checked the permissions, so it
called openSetup, which throws a RuntimeClientError in the
computerUsePermissions:openSetup IPC handler and logs an alarming error
to the main process console.
Guard on helperUnavailableReason first: surface the reason as a warning
and skip openSetup, so onboarding degrades gracefully instead of
triggering an IPC handler error.
The "Add a setup script" card cached its inspection result and only re-ran
on activeRepo/settings/sidebarOpen/dismiss/retry changes. A shared orca.yaml
setup hook that became effective on disk — edited externally, or run during
worktree creation — left the stale prompt visible until a full sidebar reopen.
Extract the revalidation into useSetupScriptPromptRevalidation, which
re-inspects on window focus (external edits / terminal hook runs) and when a
worktree of the repo activates while the prompt still shows no effective setup.
Claude-Session: https://claude.ai/code/session_01C8RPZ1mhUCMWcojgD6jLaN
Co-authored-by: kaynan <kaynan.camargo@terceiro-sky.com.br>
* fix(agent-status): replay remote Codex startup snapshots
* fix(agent-status): move unattributed-track comment next to its call
The '// Why: ... track the adoption/routing failure separately' comment
was left above the new replay branch after the track() call moved into
the non-replay branch. Move it next to track('agent_hook_unattributed')
so the rationale sits with the code it explains.
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* ci(release-cut): add explicit version override to the cut dispatch
Kind-based computation derives the next version from the latest *published*
stable. When a shipped stable is deleted/rolled back, the release list
regresses to the prior stable, so a `kind` cut recomputes a number at or
below the deleted one — stranding every client that already installed it,
since electron-updater only moves forward. The existing package.json floor
only recovers this when the deleted version's bump commit is on the ref
being cut, which a hotfix cut from an older RC ref does not carry.
Add an optional `version` workflow_dispatch input that lets a human assert
the exact target (e.g. leapfrog a deleted 1.4.154 to 1.4.155), bypassing
kind-based computation. The updater-safety gate (must exceed the latest
published stable) and the existing tag-collision recovery still apply.
Empty by default, and forced empty for scheduled cuts, so normal automation
is unchanged.
* ci(release-cut): let explicit version override the package-floor recovery
Per review: the package.json floor block can recover_unpublished_tag and
exit 0 before the explicit-version branch runs, hijacking an explicit
request to recover a floor tag instead — the exact rollback scenario the
override targets. Skip floor-tag recovery when EXPLICIT_VERSION is set;
latest_stable is still raised to the floor for the safety gate, and the
requested tag's collision recovery runs later.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: PannenetsF <fanyunqian.1@bytedance.com>
* fix(tab-bar): open absolute local paths from worktree tab create entry
Local worktrees can paste absolute file paths into tab create; remote and
SSH workspaces stay blocked. Harden classifier ordering, ownership gating,
and render-time fail-closed behavior from review.
* fix(tab-bar): restore typecheck after worktree path refactor
Add the missing editor file-operation import, finish the global file
drop relative-path helper migration, and align the runtime env test mock.
* fix(tab-bar): fail closed for absolute local paths
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix: route folder workspaces in worktree operations (#10251)
Folder workspaces are not Git worktrees and never appear in the repo/worktree
catalogs, so they were falling through to unresolved cross-host routing and
failing closed on all owner-dependent operations. Extract folder workspace
ownership logic to a dedicated module and add dedicated routing for folder
workspace identifiers before checking Git worktree catalogs.
* persist folder workspace metadata on the FolderWorkspace record
Folder workspaces lack worktreeMeta rows; metadata updates (activity bumps, unread status, terminal focus) must call updateFolderWorkspace. Fixes routing so local folder workspaces resolve to 'local' even when unrelated runtimes exist (#10251).
* Fix folder workspace mutations routing through owners
Folder workspace updates and deletions were routing through the currently
focused runtime instead of the owning runtime. Add coordinators for
concurrent-update race prevention and activity-persistence coalescing.
Handle runtime-owned folders in editor file operations and terminal activity
tracking.
* fix(worktree): don't path-sweep sibling sessions when deleting a folder workspace (#10252)
Deleting one folder-workspace instance could kill terminal/agent sessions in
OTHER workspaces sharing the same checkout path — sibling instances, and even
worktrees of a different repo rooted under that directory. Both pi and Claude
Code agent sessions died at once with no recovery.
The `cwdOwned` path fallback in killAllProcessesForWorktree() derives its match
path via splitWorktreeIdForFilesystem(), which strips the `::workspace:<uuid>`
suffix and collapses a folder instance's path to the shared checkout dir. Every
untagged session under that dir then path-matched and got swept (worst case: a
home directory registered as a folder repo).
Disable the path fallback for folder-workspace instances — their filesystem
path can't identify a single instance. The exact `${worktreeId}@@` prefix and
authoritative `session.worktreeId` matches (both carrying the instance uuid)
still tear down the deleted instance's own sessions; normal git worktrees
(unique paths) keep the fallback. The runtime and registry sweeps already
matched by exact worktreeId.
Adds isFolderWorkspaceInstanceId() and regression tests. See
docs/delete-workspace-cwd-owned-sibling-kill.md.
* rm design doc
* fix(terminal): stop the reveal fit from reflow-garbling inline TUIs
grok (and other inline-viewport TUIs like Codex) render garbled after the
floating terminal is minimized and brought back up. On reveal the resume path
fit xterm synchronously right after re-attaching WebGL, whose cell metrics
differ from the DOM renderer's — so it could propose a one-column-off grid,
reflow xterm, then snap back a frame later (a net-zero resize "wiggle"). xterm's
main-buffer wrap→unwrap is not a perfect inverse, and an inline TUI that
diff-paints its pinned region redraws over the corrupted buffer.
Replace the unconditional synchronous reveal fit (fitAllPanes) with a gated fit
(PaneManager.fitAllPanesStable → fitRevealedPane):
- fit synchronously only when the fit element's pixels actually changed while
hidden (a real resize the app must reflow for anyway, kept ahead of the async
PTY size reassert so it can't forward a stale grid);
- if the pixels are unchanged but the grid diverged while hidden (snapshot /
SSH-reattach direct terminal.resize, or an appearance/DPI change), repair it on
a steady grid (requestStablePaneFit) so a sustained mismatch refits while a
transient cell-metric wobble does not reflow;
- otherwise leave the pane alone.
The common minimize→restore is now a hard no-op with zero reflow. Also applied to
the window-wake reveal path.
* refactor(terminal): tighten reveal-fit comments + rename to fitAllRevealedPanes
Quality pass: make fitRevealedPane the single canonical explanation of the
reveal wobble and reduce the duplicated comments at the call sites to short
pointers; rename PaneManager.fitAllPanesStable -> fitAllRevealedPanes ("stable"
only described one of its three branches); symmetric early-returns in
fitRevealedPane. No behavior change.
* fix(workspace-board): sync Linear on context-menu Move to Status
The board's right-click "Move to Status" only wrote the local
workspaceStatus and silently dropped the Linear sync that drag-and-drop
performs. Thread an onAssignWorkspaceStatus callback from the drawer
through the kanban card chain into WorktreeContextMenu so the menu
funnels through the same local-first + Linear-sync path
(moveWorktreesToStatus) as drag-and-drop. Outside the board (sidebar
list) the menu keeps its local-only behavior.
* test(workspace-board): guard context-menu Move to Status routing
Extract the context-menu status-assign routing into a pure
planWorkspaceStatusAssignment helper (behavior-preserving) and unit-test
it, so the board Linear-sync vs sidebar local-only branch — the exact
path #10175 regressed on — cannot silently flip back unnoticed. Covers
board-sync-forwards-all-ids, local-only-writes-only-changed, and the
same-status no-op case.
Addresses code-review finding: the added drawer tests exercised the
sync wiring via a mocked LaneGrid but never the menu's routing branch.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: ElNelyo <ElNelyo@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Orca <help@stably.ai>
* fix(worktree): match created worktrees through symlink roots
On immutable Linux, /home is often a symlink to /var/home. git worktree
list reports the realpath while Orca still holds the /home request path,
so creation failed with "Worktree created but not found in listing".
After local worktree add, fall back to realpath when string comparison
misses. Keep WSL listings on string comparison only (host realpath is not
authoritative there).
Closes#10170
* test(worktree): harden symlink reconciliation authority
* fix(worktree): reconcile creation by Git branch identity
* test(worktree): reproduce symlink-root listing with real Git
* test(worktree): cover cross-platform reconciliation
* fix(worktree): keep reconciliation main-only
---------
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(terminal): re-verify cached macOS login-preflight rejections
A conclusive PAM rejection was cached for the process lifetime, so one false
verdict (the probe runs over pipes, not a PTY) disabled the login(1) TCC
attribution wrapper for a daemon that survives app quits and updates for
weeks — reintroducing the every-invocation AppData prompts #7003 fixed.
Rejections now re-verify after 30 minutes; accepted verdicts still cache
for the process lifetime.
Refs #9756
* fix(daemon): replace hosts with stale login preflight cache
Protocol 26 shipped the process-lifetime PAM rejection cache. Preserve its live sessions as a legacy generation, but route fresh terminals through protocol 27 so updating actually loads the expiring-cache fix.
Refs #9756
* fix(terminal): validate rejected login probes under a PTY
kazu-42
Avery Bloom
Yunqian Fan
Mark Xian
morluto
Kaynan Sampaio de Camargo
Rod Boev
Yu Sun
Matteo Musacchio
github-actions[bot]
Brennan Benson
BingZ
Wooseong Kim
Fazal Kadivar
余辉
Shahar Mor
s546126
microtaro
Trevin Chow
katspaugh
moseoh
Stanislav Markin
gatsby74
SeoYeonKim
Jinjing
Antonio Lourenco
Neil
ElNelyo
OrcaWin