* feat(feedback): attach images to feedback submissions
Users pasting screenshots into the feedback dialog were silently dropped:
the textarea had no paste handler, the IPC payload had no image field, and
the endpoint had nowhere to put one. Reports arrived saying "images
attached" with nothing attached, which is why feedback-sourced tickets
never have a screenshot to work from.
Adds paste, drag-drop, and a file picker with thumbnail previews (up to 4
images, 8 MB each, png/jpeg/webp/gif). Rejected files raise a toast rather
than disappearing — silent loss is the bug being fixed.
Images ride the existing multipart lane, which previously activated only
for crash diagnostic bundles. Crash submissions still drop images; that
lane already carries bundles and the server rejects them there.
When the server reports imagesDelivered: false the dialog says the
feedback sent but the images did not, instead of a blanket success. A 2xx
without the field counts as delivered so this keeps working against a
server that predates the field.
Requires the marketing-site half to deploy first.
* copy(feedback): shorten attachment hint to 'Attach up to 4 screenshots'
* fix(feedback): make dropped screenshots actually attach
Three defects that discarded a user's image without telling them — the exact
failure this feature exists to fix.
Drag-and-drop never worked. `DataTransfer.files` is empty until the drop
lands, so the dragenter guard always saw zero files and the highlight never
armed. Worse, preload consumes native file drops on document capture with
`stopPropagation()` and routes the paths to the editor, so React's `onDrop`
never ran at all: dropping a screenshot on the dialog opened it in an editor
behind the modal. The drop is now claimed one phase earlier on window capture
and scoped to the dialog element, and the highlight keys off the drag types
the OS advertises — matching useComposerFileDragOver and useSidebarProjectDrop.
`crypto.randomUUID()` is undefined in non-secure browser contexts (the LAN web
client over plain HTTP), so building draft ids with it rejected the read and
dropped every image in the batch with no message and an unhandled rejection.
Use createBrowserUuid, the repo's fallback for exactly this.
`readFeedbackImageFiles` had no rejection handler, so any read failure (file
removed after picking, permission error) silently lost the whole batch.
Also: capacity was checked against a ref mirroring committed state, so two
pastes landing during an in-flight read both saw room for four and the main
process then rejected the entire submission; in-flight batches now count
against capacity. And the non-en catalogs still carried the pre-amendment
English copy for the attachment hint.
* fix(feedback): close the prototype-chain hole in the image allow-list
`contentType in FEEDBACK_IMAGE_EXTENSIONS` walks the prototype chain, so
"constructor", "__proto__", "toString", "valueOf" and "hasOwnProperty" all
cleared the allow-list. feedbackImageFilename then indexed the same object and
named the upload after the inherited value — "feedback-image-1.function
Object() { [native code] }" — and the part went out with that content type.
Only reachable by invoking feedback:submit directly (the renderer screens
types with Array.includes), which is exactly the threat model this function's
own doc comment claims to cover. Object.hasOwn matches the 54 other uses in
the repo and is identical for the four real types.
The inherited values carry no quotes or CRLF, so this was a bypassed allow-list
and a malformed upload, not multipart header injection.
Adds unit coverage for the module, which had none, plus an IPC-level case; all
six new assertions fail against `in`.
* fix(feedback): accept the drag on dragover so the drop can fire
The window-capture drop interception only fires if something first
preventDefaults `dragover`. In Electron that comes free from preload's
document-capture handler, but the same renderer is served to browsers as
web-index.html, where `installWebPreloadApi` builds `window.api` in JS and
installs no drag listeners at all. Nothing else in the renderer
preventDefaults dragover for a native file drag.
So on the web client the dialog is not a valid drop target: `drop` never
fires and the browser falls back to its default action for a file dropped
on a page — it navigates the tab to the file, taking the user's typed
feedback with it. The new types-based dragenter guard makes this worse
than before, because the highlight now arms and invites the drop that the
old `files`-based guard could never light up.
Mirrors useSidebarProjectDrop.onDragOver, which the drop rework already
claimed to match. In Electron it is a harmless duplicate of the
preventDefault preload already applied.
* fix(feedback): revoke batch previews when a read rejects partway
readFeedbackImageFiles creates the object URL for each accepted file as it
goes. If a later file in the same batch fails `arrayBuffer()` — the
removed-after-picking case the new rejection handler was added for — the
whole promise rejects and the already-built drafts are never returned, so
nothing ever revokes their previews.
Each leaked URL pins its blob for the life of the renderer, up to three at
8 MB. Release them before rethrowing; the caller's rejection handler is
unaffected.
* fix(feedback): cancel non-image drops the dialog already accepted
dragover advertises copy for every native file drag over the dialog, but
drop only cancelled for images. On the web client an uncancelled drop
navigates the tab to the file, taking the typed feedback with it.
* fix(feedback): stop image validation from aborting crash reports
buildSubmitBody drops images on the crash lane, but validation ran
unconditionally, so a crash submission carrying an invalid image would
have failed outright over attachments that were never going to be sent —
losing a crash report the user needs delivered. Gate validation the same
way body construction is gated.
Not reachable today (the IPC handler forces submissionType 'feedback' and
internal crash callers pass no images), but the two gates disagreeing is a
trap for the next caller. Raised by CodeRabbit.
Also documents why the image lane deliberately skips the 5xx retry the
text lane performs: replaying up to 32 MiB on a flaky link costs more than
it saves, and the dialog preserves the draft and thumbnails on failure.
* fix(feedback): stop mutating the image-count ref during render
React Doctor fails CI on "Ref mutated during render": the count was
assigned in the component body, where React can discard or replay work
that never commits.
Read the committed count from the callback closure instead of a ref.
Syncing the ref in an effect (the suggested fix) would reintroduce the
race a previous commit removed — right after an add, the ref is stale-low
until the effect flushes, so a paste in that window over-accepts and the
main process rejects the whole submission. The closure value is always the
committed count, and pendingImageReadsRef still covers in-flight reads.
Costs a re-registration of the drop listeners per attach, which is the
same teardown the hook already does when the dialog opens or closes.
* fix(feedback): stop an unsupported pasted image from eating co-pasted text
The paste handler consumed the event whenever the clipboard held any
image/* file, but only the four allow-listed types can actually attach.
Pasting text alongside an SVG or BMP therefore lost the text and attached
nothing — a silent loss of the user's own input, in the dialog where they
are mid-sentence.
Consume the paste only when something is attachable. Unsupported types
still route through readFeedbackImageFiles for their rejection toast, so
nothing is dropped silently; the difference is that the default paste is
left alone when we have nothing to offer in exchange.
Extraction deliberately stays broad. Narrowing it there (as suggested by
review) would skip handleAddFiles entirely, and a file paste into a
textarea does nothing visible — the image would vanish with no feedback.
The drop path is untouched: it must keep cancelling every native file drop
or the browser navigates the tab to the file.
* fix(feedback): stop the dialog accepting more than the endpoint will take
The endpoint rejects reports over 5000 characters with a 400, which the
dialog surfaces as a generic "Failed to submit feedback. Please try again."
Nothing said length was the problem, so retrying could not help — the draft
survived but the user had no way to know what to change.
Cap the textarea at the same 5000 and show a counter once 500 characters
remain, so the limit is visible before it bites rather than after. The
counter stays hidden until then; an always-on count reads as a word limit
to hit.
Extracted rather than inlined: the dialog is already past the 300-line mark
React Doctor warns on.
* fix(feedback): prevent silent attachment loss
* fix(feedback): improve attachment failure feedback
* fix(feedback): bound attachment response parsing
* fix(feedback): surface response body timeouts
* fix(feedback): harden image delivery
* fix(feedback): bound image preview resources
* fix(feedback): honor atomic image delivery response
Production’s single-message feedback endpoint uploads text and images atomically, then returns 202 {"ok":true} without an imagesDelivered field. Treating that omission as false warned users that every successful production attachment had failed.
Treat a settled successful JSON response with ok: true and no image field as delivered. Explicit imagesDelivered: false still surfaces partial delivery, while malformed, oversized, aborted, and stalled bodies remain unconfirmed or fail through the existing response bound and timeout path.
Prevent setup prompt inspection, caching, dismissal, saves, telemetry, and settings navigation from leaking across local, direct SSH, and runtime-relayed hosts.
* Link Jira issues from workspace create dialog
Add Jira issue linking to workspace creation, matching existing GitHub and Linear workflows. Users can paste Jira issue URLs in the smart name field to auto-populate workspace names and link the issue to the created workspace/worktree.
Linked Jira issues appear on workspace cards via the new 'jira-issue' card property. Implements cancellable searches and summary reads to prevent stalled requests from blocking the shared Jira pool. Persists paired issue + source context metadata with validation of provider/site identity.
Fixes git-username rate-limit handling to reject malformed JSON responses so garbage never becomes branch prefixes.
* feat(jira): link issues during workspace creation
- Display linked Jira issues on worktree cards
- Fetch issue summaries and timestamps via Jira API
- Gate Jira linking behind runtime capability check
- Preserve user-typed names during async lookups
* Enforce git check-ref-format rules in login validation
Extend isBranchSafeHostedLogin to reject usernames that git rejects as
invalid branch components: trailing dots, consecutive dots, and .lock
suffix. Prevents invalid branch names from login usernames.
* Enforce filesystem filename cap for branch-safe logins
Loose refs store logins as single filenames, so the real constraint is the
255-byte filesystem cap, not git check-ref-format rules. This allows longer
provider-agnostic logins while staying platform-safe.
* fix(runtime): avoid immediate WebSocket heartbeat sweep
Defer the first heartbeat sweep until the interval tick.
The immediate sweep can close a newly accepted WebSocket before the E2EE handshake completes on Linux ARM64.
* test(runtime): update heartbeat expectations for deferred sweep
* docs(runtime): update heartbeat initialization comment
Clarified comment regarding socket pinging during heartbeat.
* fix(runtime): arm heartbeat after socket listeners
* test(runtime): pin shared heartbeat cadence
* chore(runtime): preserve reliability gate formatting
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(mobile): keep a proxied wss host on :443 when editing
A host paired through a reverse proxy is stored as `wss://desk.example.com`
with no explicit port. Editing it — even to only change the display name —
rewrote the endpoint to `wss://desk.example.com:6768` and stranded the host,
with no warning.
`endpointPort` intentionally reports only explicitly written ports, so it
returns undefined for that endpoint. The edit screen passed that undefined
straight through as `fallbackPort`, where `resolveFallbackPort` substituted
the LAN `DEFAULT_PORT`.
Add `endpointPortOrSchemeDefault`, which falls back to the scheme's implicit
port for wss and leaves bare ws alone so LAN pairings keep landing on
DEFAULT_PORT, and use it for the edit screen's fallback. `normalizeHostEndpoint`
is untouched — filling a missing port from `fallbackPort` is its documented
contract and stays covered by its existing tests.
* review(mobile): preserve untouched host endpoints
* fix(mobile): preserve routed endpoint edits
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Allow setup when the selected project exists only on another host by carrying its validated provider identity with the request instead of reverse-parsing project IDs. Preserve host-qualified provider identity and reject mismatched payloads before linking.
Make linking atomic for local and runtime imports, including clone setup: roll back only newly registered repos and invalidate the same caches as canonical removal. Cover local, runtime, host-qualified identity, mismatch, clone rollback, and renderer routing paths.
Co-authored-by: fanyunqian.1 <fanyunqian.1@bytedance.com>
The payload prune had only its miss side covered, so the bound could be raised
or lowered by a refactor without anything failing. Both directions are now
pinned: a skill is found through 2 intermediate directories below a package and
missed at 3.
Raising the bound spends the entry budget on vendor payload — the cost that made
ordinary caches collapse and pin every skill amber (#10865). Missing a deeper
copy costs only a Details row, since a plugin-cache placement is not convergeable
by any update command. Recording the tradeoff on the constant so the next person
to touch it knows which direction is the safe one.
No behavior change.
Closes#11454
* fix(native-chat): make the launch-draft mirror reachable
Seed the chat-composer copy of unsent launch context on every originating
draft path, then let those launches open in chat by default.
Three paths delivered a draft to the TUI without mirroring it into chat:
folder-workspace create, the local argv-prefill branch of launchAgentInNewTab,
and the web-host equivalent. The first was invisible; the other two were hidden
only because draft launches were forced into terminal view.
The view-mode decision now gates on the same predicate as seeding
(canMirrorLaunchDraftToNativeChat), so a draft can never open in chat with a
composer chat would refuse to fill.
* fix(native-chat): gate draft view mode on argv-prefill launches too
The draft view-mode gate read `startup.draftPrompt`, which only the
post-ready-paste delivery sets. An argv-prefill launch carries its draft
inside `launchCommand`, so the gate never saw one and the tab opened in
chat unconditionally — a multi-line draft was correctly not seeded yet
still opened chat, leaving an empty composer beside a filled TUI input.
Adds `launchDraftText` to the activation startup payload as a view-mode-only
field, deliberately distinct from `draftPrompt` so it cannot double-deliver
the draft through pty-connection's bracketed paste, and sets it at all four
originating producers.
* fix(native-chat): reconcile backend draft launch tabs
* fix(worktrees): prevent deletion from blocking Orca
* test(worktrees): loosen async history-delete event-loop bound for CI
The main-thread safety check failed on a loaded runner when a single
timer gap hit ~48ms under the prior 30ms threshold. Keep the bound well
below a recursive sync-rm stall without treating CI jitter as a block.
* test(worktrees): measure history-delete critical path, not timer gaps
setInterval gaps during async rm of thousands of files still flake under
CI scheduling. deleteWorktreeHistoryDir is sync and must only rename, so
assert that critical-path wall time stays well below a recursive walk.
* fix(worktrees): prevent deletion from blocking Orca
Add timeout-based draining of watcher closes so SSH round-trip delays don't
indefinitely block the worktree removal path. Also: order durable temp-file
sweeps ahead of writes to reclaim orphans before accumulation, skip own-process
temps to avoid deleting live writes, swallow persistence errors so disk failures
don't cascade to query callers, and measure history-deletion progress by loop
turns rather than timer gaps to detect blocking on CI runners.
* fix(worktrees): prevent deletion from blocking Orca
Worktree deletion can now proceed even if filesystem watchers or history cleanup operations hang, preventing Orca from freezing. Changes:
- Fence install slots with tokens instead of counters so removals can abandon wedged installs without corrupting later removals
- Timeout-bound watcher unsubscribe operations with a shared drain budget
- Move JSON serialization of large usage caches from queue-time to write-time to avoid blocking main thread
- Async tombstone + schedule history tree deletion instead of blocking recursive rmSync during GC, preventing main-thread stalls ~10s after startup
* Extract usage cache writer into reusable durable snapshot class
Consolidates serialized durable-write and generation-veto logic from
three usage stores into UsageCacheSnapshotWriter. Eliminates duplication,
centralizes multi-MB JSON serialization on the main thread via write-queue
serialization, and vetoes superseded snapshots to avoid wasted rewrites.
* fix(worktrees): prevent deletion from blocking Orca
Worktree deletion used to recursively delete large session trees (hundreds
of MB) on the critical path, stalling the event loop. Instead, rename trees
into a `.pending-delete` tombstone queue and reclaim them asynchronously
off the removal's critical path.
Extracted host tree removal into a reusable helper (`removeHostTree`) that
centralizes Windows retry logic. Added usage-cache flush on quit to prevent
data loss when scans complete right before shutdown. Improved watcher
removal deadline management with reserved tail slices for the final
unsubscribe, and added retry logic for tombstone removals that fail once
under transient Windows locking.
* fix(history): retry failed session tree removals
Tombstoned session trees whose removal fails transiently (e.g., EBUSY
under Windows AV) are now re-queued in-process with bounded exponential
backoff instead of sitting until the next HistoryManager construction.
Prevents a single stuck tree from blocking the entire Orca process.
* feat: add search to workspace kanban board
Search filters workspace cards by display name, branch, repo, and comment. Lanes show match counts (e.g., "2 / 5") when filtered and reset to full counts when cleared. Drag-drop indices are mapped from rendered cards to the full lane so manual-order math is correct even when hidden. Query clears when the board closes to prevent stale filters on reopen. Includes keyboard shortcuts (Escape to clear), live region announcements for matches, and i18n support.
* feat: add search to workspace kanban board
Adds a search field to filter the kanban board by workspace name. Range selections now index rendered cards only, preventing silent selection of hidden items when filtering. Selection badges count only the visible cards that drag/context-menu actions will move. Lane totals distinguish between empty-by-definition and filtered-away cards. Drop operations commit against the full lane while displaying filtered indices. Whitespace-only queries don't show match counts, since they don't narrow the board.
* fix(kanban-search): let the board search field own Escape
The board's Escape handler is a capture-phase listener on document, so it
runs before React's handlers and the search field's stopPropagation could
never reach it — pressing Escape to clear a query dismissed the whole board
instead, and the reopen reset then discarded the query too.
useWorkspaceBoardPanel now defers Escape to editable targets inside the
board sheet, and the field handles both outcomes itself: clear when it has
text, close the board when it does not.
Also: keep focus in the field when the clear button unmounts itself,
reserve counter width from the rendered text so three-digit counts cannot
overlap typed text, and align the icon centering, X size, and placeholder
with the sibling search fields.
Co-authored-by: Orca <help@stably.ai>
* perf(kanban-search): defer the filter and stabilize its derived identities
Clearing a query re-mounts every hidden card, so it costs roughly what
opening the board costs. The input stays controlled and undebounced, but
the filter now reads a deferred query so React can interrupt that work and
the caret stays responsive.
The match set also keeps its identity when the matched ids are unchanged.
Board worktree identities churn on agent-status ticks, and a fresh Set on
every tick cascaded new identities through the lane views, the rendered
selection, and every memoized card.
Also harden the lane full-id channel: the identity guard in
resolveFullLaneDropIndex compares membership rather than length, so a stale
lane of equal size no longer skips translation; serialization declines ids
containing the newline delimiter instead of inventing phantom lane members;
the sidebar drop path scans lane cards once instead of twice; and the
unfiltered full-id fallback is no longer offsetParent-filtered, restoring
the pre-branch notion of lane membership.
Adds coverage for the stale-equal-length lane, the full-id round trip,
regex metacharacters and non-ASCII queries, and the over-bound query at the
drawer level.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): leave mid-composition Escape to the IME
Escape during an IME composition cancels the in-progress reading. The
search field was clearing the query behind it instead, matching the
isComposing guard other keyboard handlers in the app already use.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): stop a hidden anchor from collapsing a shift-click
A query can hide the selection anchor while leaving the rest of the
selection on screen. updateWorktreeSelection reads an anchor missing from
visibleIds as "no anchor" and replaces the selection with the clicked card,
so shift-clicking dropped the still-visible cards too. Re-anchor onto the
first still-rendered selected card, and carry hidden selections through a
range so the query cannot silently discard them. A plain click still clears
everything.
Also, in the drop-index translation:
- a lane filtered down to nothing now appends rather than always prepending
(an empty rendered lane reports index 0 for every pointer position, so the
old branch could only prepend, disagreeing with the document-drop path)
- an unresolvable rendered id falls back toward the end of the lane its
branch was aiming at, instead of sending every head drop to the bottom
- the full-id channel uses NUL, the one character no path can contain, so
serialization can no longer be defeated by a newline in a repo path.
Dropping the channel was the wrong fallback: under a query the reader
would scan the DOM and see only the matched cards.
Tests now build the channel through its own serializer rather than
hardcoding the delimiter.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): explain a query discarded for length
Past the palette byte bound the query is dropped and the board stays
unfiltered, which looks identical to a query that matched everything — full
field, untouched board, no counter. The field now marks itself invalid,
shows a "Too long" badge carrying the full reason, and announces it.
Whitespace-only text stays silent: it is also non-filtering, but self-
evidently so.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): derive the too-long badge from the deferred query
The badge describes the board, so reading the live query made it flip a
frame before the filter it is describing.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): let a range replace a hidden selection like every other gesture
Carrying hidden cards through a shift-click made it the only replace-shaped
gesture that did so — a plain click and a non-additive marquee both drop
them. It also left the user unable to narrow a selection: shift-clicking the
two visible matches silently re-added the six hidden ones, and the badge
counts only rendered cards, so nothing disclosed it. Re-anchoring onto the
first still-rendered selected card, which is what actually fixed the
collapse, is kept.
Also state the Escape contract where a reader will look: SheetContent now
declines Radix's dismiss explicitly instead of depending on
handleSheetOpenChange quietly dropping the request, and the overlay reserve
is capped so a wide counter in a narrow drawer cannot squeeze the typed text
to nothing. The reserve is exported and tested directly — happy-dom cannot
parse min(), so it could not be read back off a style.
Co-authored-by: Orca <help@stably.ai>
* fix(kanban-search): stop mutating match-set ref during render
React Doctor blocks ref writes during render; keep match-set identity
stable with setState-during-render so discarded renders cannot leak it.
---------
Co-authored-by: Orca <help@stably.ai>
Move native macOS helper process ownership into Electron main while preserving the sidecar as the authenticated socket peer. Add fixed lifecycle IPC, bounded claim and release handling, confirmed-exit tracking, sidecar and helper force-kill escalation, cleanup across failure paths, and focused lifecycle coverage.
* feat(mobile): add session.tabs.list handler to mock server
The mock WebSocket server had no handler for session.tabs.list, so the
session screen of a paired dev client hung on 'Loading tabs' forever —
the terminal pane, live input, and command input could never be
exercised against the mock. Respond with a single ready terminal tab
wired to the existing term-1 fixture so the whole session surface works
offline.
* fix(mobile): complete the session.tabs.list mock contract
The new mock response omitted four non-optional fields of
RuntimeMobileSessionTabsResult: publicationEpoch and activeGroupId on the
result, and parentTabId and leafId on the terminal tab. Nothing caught it —
the object literal had no type annotation, and MobileSessionTabsStreamHealth
is generic over both result and tab. A shape-incomplete mock yields
untrustworthy repros for exactly the bugs it gets used for (session tabs,
split panes, pane-to-tab attribution).
Fill the fields with host-realistic values: a per-process publisher epoch, a
layout UUID leaf id, and the `${parentTabId}::${leafId}` surface id
mobileTerminalSurfaceId actually emits. Pin the shape with an explicit return
type so a future required field fails typecheck instead of silently drifting.
Move the fixture into its own module: inlining it pushed
mock-server-rpc-handlers.ts to 317 lines against a 300-line max-lines cap,
which broke `pnpm lint` on the parent commit. It registers through the file's
existing delegation chain, after the native-chat scenario so MOCK_NATIVE_CHAT=1
keeps ownership of the method.
Co-authored-by: Hanjoon Choe <hanjoonchoe@gmail.com>
* test(mobile): pin session tabs mock fidelity
Normalize the selector-backed worktree ID like the real runtime and cover the complete terminal surface response so future contract drift fails the mobile suite.
* fix(mobile): share terminal.list worktree resolution with session tabs
Main added `terminalListWorktreeId`, which the rebased session-tabs fixture
duplicated with a different no-selector fallback — `terminal.list` resolved to
the active fake worktree while `session.tabs.list` returned a literal 'mock',
so a session repro saw two different worktree ids for one screen.
* test(mobile): cover the bare session-tabs worktree selector
Answers the review note that only the `id:`-prefixed path was exercised.
* fix(mobile): make the mock publication epoch unique per process
Date.now() can repeat across a sub-millisecond restart, so the epoch did not
actually guarantee the fresh-publisher identity its comment claimed.
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(new-workspace): stop UI flashing when typing ahead of search
Hold branch results while queries settle, show the spinner only on
initial load, use stable cmdk values, and guard selections against
stale rows. This prevents the highlight from jumping around when
typing faster than the debounced search settles.
* fix(new-workspace): keep dropdown visible while typing within settled qu
Hold the last search results while the user extends or trims the query,
only hiding them when the query diverges completely. This prevents the
dropdown from flashing empty between debounced keystrokes and removes the
guard that made provider rows unselectable during typing.
* fix(new-workspace): align held provider results with live typing
Cap prefix hold by length delta, hide GitHub/GitLab/Linear rows when the
field is cleared ahead of debounce, and re-sync the cmdk arm when search
settles so the highlight cannot lag the resolved selection.
* fix(sidebar): move project header grab cursor to title surface only
Prevent grab cursor appearing over action buttons (…, +, chevron) which
should show cursor-pointer, not the reorder hand.
- Grab cursor scoped to icon + label surface only
- Row retains data-repo-header-drag-handle for indent/padding drag targets
- Actions excluded via [data-repo-header-actions] selector
- Add lockstep test to keep action selectors synchronized
* fix(sidebar): share project header action selector across drag contracts
Address Greptile feedback: drop the format-sensitive regex lockstep parse and
import one shared REPO_HEADER_ACTION_SELECTOR for repo and group headers.
* fix(hibernation): reap restored subagent rows with no live agent process
A pane whose Claude session had a subagent in flight can be locked out of
agent hibernation for good. A PTY that dies while Orca is down never runs
the teardown that clears pane state, so hydrate rebuilds a subagent roster
that nothing can retire: the existing reap needs the parent to emit a
complete `background_tasks` inventory, and a parent that went idle before
the restart never emits one. The restored row keeps gating the pane
'working', and hibernation only accepts 'done'.
Observed locally: six panes parked at SubagentStop in state 'working' for
17 to 145 hours, each still holding a working child row.
Adds a second reap path. Hydrate seeds are marked `restoredFromSnapshot`,
cleared by any live lifecycle event or an id-exact running inventory entry.
One post-restore sweep drops the rows still unconfirmed when the pane's PTY
is absent from the live local inventory, then re-derives the child-gated
'working' to 'done'.
The scan is local-only by construction: panes with a relay connection id are
skipped and SSH-scoped PTY ids resolve as live, since a remote agent runs on
the far host and could never appear in a local listing. An unreadable
inventory is not evidence that anything exited, so it is a no-op. Panes that
have reported to this runtime are left alone.
`stateStartedAt` and `stateHistory` are untouched, so a draft typed while
the pane was working still blocks hibernation.
* fix(hibernation): prove local ownership before restored reap
* fix(hibernation): require authoritative restored PTY absence
* fix(hibernation): probe restored PTY liveness authoritatively
* fix(hibernation): restart idle window after restored reap
* fix(hibernation): type restored reconciliation timing
* fix(hibernation): respect worktree host ownership
* fix(hibernation): preserve same-id restored PTY rebinds
* fix(hibernation): fence batched restored PTY probes
Two fixes to installed-skill discovery in the renderer.
**Stops one discovery IPC per unrelated store write.** `refresh`'s `useCallback` depended on the `discoveryTarget` *object*, which callers rebuild inside a store-backed `useMemo`. Any unrelated store write handed the hook a fresh identity, recreated `refresh`, and re-fired `useEffect(() => void refresh(false), [refresh])`. On a cache hit that is only extra renders — but on a *rejecting* scan nothing is cached and the pending entry is cleared, so it becomes one discovery IPC per store write, indefinitely. That is the remote-runtime-unreachable and SSH case. Measured 6 scans where 1 was correct.
This dep also exists on `main`, so this repairs a pre-existing bug rather than only one introduced here. Fixed with a render-phase `useState` latch keyed on the already-present `discoveryTargetKey` string — deliberately not a `useMemo` (React documents those as discardable, so a discarded one silently restores the regression while the test stays green) and not a ref (react-doctor correctly flags a render-phase ref mutation).
**Bounds the discovery cache.** The module-level maps were unbounded, cleared only wholesale by `notifyInstalledAgentSkillsChanged`. Now a 256-entry LRU keyed by `getRuntimeScopedSkillDiscoveryKey`, with a `discoveryGeneration` guard and a read/peek split so only the unforced cache-serving path promotes recency.
This matters more after #6887 than before it. Local keys are bounded by project count (~47 KB/entry, ~240 KB for 5 repos), but once remote scans key on `runtime:<environmentId>`, ephemeral VMs mint `orca-${randomUUID()}` per start (`ephemeral-vm-runtime-service.ts` + `ephemeral-vm-recipe-runner.ts`), so every VM start creates a permanently-retained entry — ~18.8 KB each, ~1.8 MB after ~100 starts, and it does not stop.
Scoped down during review: an `executionHostId` change touching 8 production files was removed as a second feature (host-awareness landed in #6887 instead), taking this from 17 files to 6. New tests pin that the cap keys off the runtime-scoped key, that two environments never share an entry, and that one environment collapses to a single entry across differing client target shapes.
Known gap, not addressed here: cache entries are not evicted when a runtime environment is removed, so a removed environment's skill list is retained until LRU pressure or an install notification clears it. That needs a store subscription to `runtimeEnvironments` removals and is filed separately.
Co-authored-by: nwparker <4138956+nwparker@users.noreply.github.com>
* fix(settings): guide Windows skill setup when npx is missing
* fix(settings): resolve npx by PATHEXT and keep the preflight off POSIX shells
Review fixes on the Windows npx preflight:
- Probe and run bare `npx` instead of pinning `npx.cmd`. cmd.exe resolves both
through PATHEXT, so shims that ship `npx.exe` (Volta) no longer get told
"npx was not found" on a machine where npx works.
- Force the skill terminal to PowerShell when the configured Windows shell is
POSIX-family. Git Bash rewrites the leading `/d /s /c` arguments as MSYS
paths, which would break a command that runs fine there today.
- Drop the "restart Orca" advice. Every new PTY merges the persisted Windows
PATH, so a new setup terminal already picks up a fresh Node install.
- Fall back to the plain command on the two newly routed call sites when the
project runtime is repair-required, matching the eight existing callers.
Those sites otherwise emitted a wsl.exe command for a missing distro.
Adds coverage for the Git Bash override and for cmd.exe block safety.
* fix(settings): apply the skill-terminal shell override on every wrapped path
The Windows npx wrapper is emitted whenever buildSkillCommandForRuntime falls
back to the local host, but three paths never consulted the shell override, so
a Git Bash user still got the cmd.exe string pasted into MSYS:
- useActiveProjectSkillRuntime returned an empty result whenever no local
project runtime resolved (no repo yet, or an SSH/remote repo) while the
command builder kept wrapping. It now resolves the override for that same
host fallback, so the wrap gate and the shell gate agree.
- The Linear setup prompt carried a third copy of the override that was still
on the old wsl.exe-only check. It now delegates, as does the settings copy,
leaving one implementation.
- MobileEmulatorAgentControlRow built wrapped commands but passed no override.
Also drops the unreachable WSL guard inside the wrapper; the only caller is
already on the non-WSL branch.
* fix(settings): keep the npx preflight off remote runtimes and finish the emulator row
- Skill setup terminals spawn on the focused runtime environment, so a Windows
client was handing a cmd.exe command to a remote Linux host where the plain
npx command used to run. Skip the wrapper whenever a runtime environment is
focused.
- MobileEmulatorAgentControlRow was left half routed: it took the project
runtime's shell override while still building a Windows host command, so a
WSL project got the cmd.exe wrapper inside a WSL shell. Build its commands
from the same runtime, matching MobileEmulatorAgentSetupGuideSteps.
* fix(settings): match the terminal router when skipping the npx preflight
- The remote check used settings.activeRuntimeEnvironmentId, but the setup
terminal routes through getSingleFocusedRuntimeEnvironmentId, which keeps the
terminal local unless exactly one saved environment is focused. Users with
two or more environments lost the preflight while still running locally.
- LinearAgentSkillPane memoized its commands on the project runtime alone. The
built command now also depends on the focused runtime environment, and
Settings panes stay mounted, so the memo could serve a stale Windows command
after a runtime switch. Compute it inline like every sibling pane.
* fix(settings): keep emulator skill setup installing where detection looks
The mobile emulator surfaces detect the Orca CLI skill with a local-host scan
that takes no discovery target, so building their commands from the project
runtime made a WSL project install into the distro while detection kept
scanning Windows: the panel stayed "Not installed" with no way out. Build host
commands there again, as the surrounding comment already documented, and keep
only the terminal shell override those surfaces actually needed.
Also narrow the remote check back to the focused environment id. Matching the
terminal router exactly meant reading runtimeEnvironments, which nothing on
these surfaces subscribes to, so adding or removing an environment mid-session
could leave a stale decision. The focused id alone over-skips instead, which
degrades to the previous behavior rather than sending cmd.exe to a remote host.
* fix(feature-tips): keep the npx preflight on the repair-required fallback
installDisabledReason is only ever set on Windows, so dropping the whole
command builder on that branch stripped the npx preflight exactly where it is
needed. This terminal auto-pastes with no install gate, so that fallback put
the bare npx command straight back in front of the user #10438 describes. Drop
to the host runtime instead, which still avoids the missing WSL distro.
Pins the two call-site invariants that were unguarded: the emulator surfaces
must build host commands because their detection scans the host only, and the
Linear prompt's shell override must cover POSIX-family Windows shells.
* fix(settings): reach the npx preflight from the ephemeral VMs pane too
This pane was the only one of eight requiring a resolved project runtime
before building its command, so a Windows user with no repo added yet — the
state issue #10438 was reported from — got the bare npx command and the same
dead end. An absent runtime already resolves to the local host, which is what
the sibling panes rely on.
Also pins the repair-required host fallback added in the previous commit; the
existing assertions all passed against the old form.
* test(settings): pin the ephemeral VMs pane to the host-resolving command
Reverting the previous commit left the whole suite green, and this is a PR
where several regressions came from an earlier fix, so guard it the same way
the emulator call sites are guarded.
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(skills): read installed skills from the connected remote runtime
The "Not installed" badge stayed on in Settings even after a skill was
installed against a remote `orca serve`. Skill discovery always ran through
the local `skills:discover` IPC, so it scanned the client's home dir while
the install (and the skill files) landed on the server. The skills browser
had the same blind spot.
Route discovery to the runtime that owns it, mirroring git/hooks/terminal:
local IPC by default, remote runtime RPC (`skills.discover`) when an Orca
runtime environment is active. The discovery cache is now scoped per runtime
so local and remote results never collide.
Extract the discovery cache/transport into a store-free module
(`installed-agent-skill-discovery.ts`) and a shared runtime-target hook, so
the React hook stays under `max-lines` and store slices can import the
change-notifier without pulling the app store into a circular import.
Independent of the terminal selector fix (#6816); addresses the still-broken
install-status half of #6789.
* fix(skills): runtime-agnostic scan-error toast + docstrings
Address review on #6887:
- The skills-scan error toast said "Could not scan local skills", but
discovery can now target a remote runtime; drop "local" (source + locales).
- Add short JSDoc to the discovery helpers and skill hooks to clear the
docstring-coverage gate.
* fix(skills): route discovery through the active runtime and scope its cache
Rebuilt on the repo's standard runtime-client pattern (getActiveRuntimeTarget +
callRuntimeRpc) instead of a bespoke transport, and keeps the renderer discovery
cache keyed per runtime so a remote result never leaks into the local host's
badge after switching environments.
* fix(skills): keep the discovery cache store-free to break the import cycle
Reading the active runtime from the app store inside the hook module closed a
cycle (store -> repos slice -> hook -> store) that broke module init in three
suites. The cache/transport moves to a store-free module the repos slice can
import; only the hook itself touches the store.
* fix(skills): scan the host the install actually lands on
Reviewer round 1 found the badge could scan a different machine than the Install
button writes to: skill install terminals route through
getSingleFocusedRuntimeEnvironmentId, which declines to guess an owner while
several runtimes are saved, so a two-environment user installed locally while
discovery scanned the remote and the badge never flipped. Discovery now resolves
through that same resolver, and holds a loading state until settings and the
runtime catalog have hydrated instead of flashing 'Not installed'.
Also drops the unreachable cwd/worktreeId forwarding (no caller can produce it)
and retires three SkillsPage strings that a remote scan makes false.
* fix(skills): close the round-2 review findings
- SkillsPage had no generation guard, so a slow local scan could land after a
newer remote scan and silently redisplay the client's skills.
- The round-2 selector took a useShallow object including runtimeEnvironments,
whose identity churns on every status refresh; that re-fired every consumer's
scan. Select the resolved id instead.
- A failed runtime-environment catalog read never set the hydrated flag, so
discovery would have spun for the whole session with no retry affordance.
An unreadable catalog is settled, which is what terminal routing assumes.
- Remote cache keys no longer fragment on a client-side target the remote call
discards, which was issuing the same RPC once per target shape.
- Cover each hydration conjunct separately; the combined test covered neither.
- First tests for SkillsPage, which had none.
* fix(skills): settle the runtime catalog without loosening host routing
Round 3 set runtimeEnvironmentCatalogHydrated on a failed catalog read so skill
discovery would stop waiting. That flag also gates fail-closed host routing
(worktree-operation-route mayBeLegacyLocal), so flipping it on failure would have
routed ownerless legacy worktrees — including removals — to the local host off a
stale empty list. Add a separate 'settled' flag for surfaces that only need to
stop waiting, and leave 'hydrated' meaning what its doc says.
fetchSettings now probes the catalog even when the settings read fails, so a
rejected settings.get cannot strand every skill badge on a spinner.
* test(skills): pin the settings-failure runtime catalog probe
The only hunk in the review no mutation could kill.
---------
Co-authored-by: vladmesh <vladmesh@gmail.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: JeongUk Park <jeongph.dev@gmail.com>
Settings → Orchestration → Agent coverage decided whether each detected agent had the orchestration skill by matching a skill's single `rootPath` against a hand-maintained table of path segments. Skill discovery dedups by canonical file path, so when one provider home is a symlink onto another agent's skills directory — which `npx skills add --global` does — the two collapse into one row and the absorbed roots survive only in `rootPaths`, which the old matcher ignored. With `~/.grok/skills` symlinked onto `~/.claude/skills`, Claude read Ready and Grok read Missing even though Grok loads the same files.
Now classifies every entry in `rootPaths` and resolves each root through the `SkillDiscoverySource` the scanner already returns, accepting it when `sourceKind` is not `repo` and `owner` is either the agent's owner or `null`. Deletes `ORCHESTRATION_SKILL_LOCATIONS` and `ORCHESTRATION_SKILL_LOCATION_IDS_BY_AGENT` — a renderer-side mirror of `buildSkillDiscoverySources` that had to be hand-edited for every new provider root, which is what caused this class of bug.
No discovery roots change here; those landed in #8510.
Fixed during review:
- Restored the required `{ kind: 'local' }` argument to `useDetectedAgents`. Dropping it failed typecheck (TS2554) and pinned `detectedIds` to null, leaving the widget on "Checking installed agents and skill paths…" forever. It also reverted the remote-host scoping from #9790.
- Stopped a duplicate repo root from shadowing an owning home root. `SkillDiscoverySource.path` is not unique: when the scan cwd is the home directory, `~/.claude/skills` is scanned as both a home root and a repo root, and a path-keyed Map is last-write-wins — so every agent read Missing while the panel above said Installed. Guaranteed in Settings on a WSL project.
- Carried OMP coverage in the owner-based shape so #6422's coverage-table hunks could be dropped on merge.
Behavior note: an orchestration skill inside an enabled Claude plugin now counts for Claude. That is a deliberate consequence of trusting the scanner's ownership data, matches how the Codex plugin cache was already treated, and is pinned by a test.
Refs #8256
Co-authored-by: sdhilip200 <49802211+sdhilip200@users.noreply.github.com>
* test(skills): execute the plugin-cache entry limit instead of reasoning about it
The entry bound that ended a plugin-cache scan was never reached by any test.
Every existing `entry-limit` case builds a synthetic issue object at the display
layer, so both emission sites in scanKnownPluginSkillCandidates — the dirent read
loop and the declared-skill-root resolve — were verified by reading the code. The
real bound is 16,384 dirents, and the declared-root guard only fires when the count
lands in a one-entry window below it, which is why neither was ever fixtured.
Makes the entry bound injectable the way the candidate bound already was, folding
both into a `PluginSkillScanBounds` bag so a fourth positional number is not needed,
and adds:
- a case that truncates the dirent read and asserts the scan drops both real skills
and reports `entry-limit` at the root;
- a case that truncates while resolving declared roots, asserting the declared root
that exists was still walked so the guard under test is the resolve one;
- an inventorySkillFreshness case at the production 16,384 bound asserting a
truncated scan produces zero fabricated placements — the #10918 regression.
No bound value or scan behavior changes.
Refs #10918.
* docs(skills): state the declared-root guard's real window in the bounds comment
* test(skills): pin entry-limit to the scan root, not the crossing directory
Both entry-budget fixtures crossed the bound in the same directory they named,
so swapping recordIssue(rootPath) for recordIssue(directory) at either guard
passed the whole suite — the dialog would surface a nested path and no test
would say so. Cross the budget below the root instead.
* test(skills): assert the declared-root guard's threshold, not just its firing
The declared-root entry guard's ±1 boundary was left unasserted on the claim
that it is unkillable: admitting one more declared root was said to always cost
a dirent the read-loop guard then catches identically. It does not. A declared
root that does not exist reads no dirent, and when it is the last one the loop
simply ends — so the scan completes and reports nothing.
Restates both budgets against the fixture's exact entry count: one short of it,
where only the last root's resolve can cross, and exactly at it, where nothing
should be reported. `>` -> `>=` and `>` -> `> max + 1` now each fail a test.
* test(skills): assert the entry bound stops the walk, not just what it reports
Dropping `limitReached = true` at the dirent guard survived every case: the
already-read entries of the crossing directory are still descended, and the
scan reports a depth-limit for a path it never reached. A nine-level chain
whose deepest directory sits at the depth bound and crosses the budget on the
second of its two children kills that, with no symlink and no Windows skip.
* test(skills): derive the walk-stop fixture from the depth bound it depends on
The walk-stop case detects a dropped `limitReached` only because its chain is
exactly MAXIMUM_PLUGIN_SCAN_DEPTH deep, so the entries already read when the
entry bound trips are rejected on depth if the walk keeps going. That coupling
was a hardcoded 9. Raising the depth bound left the test passing while it
stopped killing the mutant it is the only cover for — verified by A/B: at
depth 12 the hardcoded fixture lets the mutant survive, the derived one does
not. Other tests in the file fail loudly on that change, which is exactly what
makes the silent one dangerous.
Exports the bound the way the file already exports its four siblings for the
same reason. No behavior change.
* Add OMP skill discovery source
* review: scope OMP discovery to the shared provider and cover orchestration
- Drop the `SkillProvider` widening: `~/.omp/agent/skills` is a provider home
like `~/.pi/agent/skills`, so it carries `agent-skills` and identifies OMP
through the source `owner`. That keeps every `Record<SkillProvider, ...>`
(including the Skills page label map) at a zero diff.
- Add the `omp-home` orchestration coverage location and map OMP to it, so the
Agent coverage panel stops reporting a real OMP install as missing.
* review: guard the Pi/OMP matcher anchors
Both roots end in agent/skills, so dropping either leading segment let one
agent's install mark the other with a green suite. Also corrects the OMP
owner assertion's rationale: no OMP native-chat profile exists, so owner
matters because a null owner leaks OMP-only skills into other pickers.
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Keep main-thread hang detection independent of the blocked Electron event loop while reducing watchdog memory from 47.1 MiB to 11.5 MiB. Preserve marker, recovery, and telemetry behavior with a bundled worker-thread entry.
Mobile Chat UI subscribes to an agent transcript by providerSession.id, so
losing that id blanks the chat: use-mobile-native-chat-session clears the
message list and then returns without subscribing when sessionId is null.
Two places dropped the id on a status ping that carried no session metadata,
both while the agent was idle at its prompt — exactly when mobile reads it:
- The renderer store refused to carry the id across `done`. A completed turn
does not end the provider session (the TUI stays alive and resumable), and
OSC 9999 repaints plus reconnect snapshot replays re-deliver a metadata-less
`done` onto an already-done row, so retention has to cover done -> done.
- The main-process OSC ingest overwrote the cached row without the id. The OSC
wire payload has no providerSession field, so an OSC observation is never
evidence the session ended. Dropping it there erased the id from persisted
rows (lost across restart) and from headless `orca serve`, which serves those
rows to mobile directly rather than through the renderer store.
Both keep the turn boundary: a new turn after `done` still starts clean, so a
reused pane cannot inherit a finished session.
Closes#10630
Revealing a live PTY from a paired phone passes the tab id baked into
its env, but the create-terminal handler only recognised ownership via
tab.ptyId and the live ptyIdsByTabId map. With the worktree closed on
the desktop no pane is mounted, so ptyIdsByTabId is empty and tab.ptyId
holds at most one leaf's PTY -- a split pane's second PTY lives only in
the persisted layout. Ownership missed, and createTab ran with an id
that already existed; it mints a fresh uuid on collision, so a second
tab appeared on the same session (#10486).
Resolve ownership through the persisted layout as well. Every binding
consulted is an exact match on the ptyId, so all of them outrank the
reveal's tab id hint: that hint is written once when the PTY spawns and
is never rewritten, so it goes stale as soon as a pane is dragged to
another tab. A mounted pane outranks a recorded one, same-tier
conflicts stay ambiguous so the mobile mount planner keeps failing
closed, and the hint is what resolves a reveal that nothing records
yet -- which is also what keeps paneKey hook attribution intact.
* feat(browser): let Shift invert link routing instead of always forcing the system browser
Shift+Cmd/Ctrl-click has always meant "open in the system browser", which is a
no-op when that is already where links go. Users who keep Link Routing off have
had no gesture to pull a single link into Orca's built-in browser.
Adds "Hold Shift to open in ___", a nested toggle under Link Routing that makes
the modifier open a link the opposite way from the setting. It ships off, so the
one-way escape hatch is unchanged for every existing user.
The title and description name the destination the modifier actually reaches and
flip with the parent setting, since "the opposite" is meaningless on its own.
- openHttpLink gains modifierHeld; resolveModifierRouting owns the decision so
every surface (terminal URLs, OSC 8, xterm web links, markdown preview) routes
identically. forceSystemBrowser stays for callers that must bypass settings.
- The terminal hover hint names Orca when the modifier would open there, and is
re-resolved per hover so toggling applies without recreating panes.
- Link Routing's own copy drops "always uses your system browser", which the new
toggle can falsify; the nested row states the live destination instead.
* fix(browser): route the Checks panel hosted-review link through the shared modifier
The "Open on GitHub" button had its own Shift+Cmd/Ctrl escape hatch that passed
forceSystemBrowser directly, so it kept the old one-way behavior while every
other surface honored the invert setting. Route it through modifierHeld like
the terminal and markdown paths.
Also wraps the modifier row's description in translate(); the title in the same
file was localized but the description returned raw English (caught in review).
* fix(browser): make link-routing modifier copy true in every state
Review follow-ups on the Shift-inverts-routing change.
- The nested row promised "⇧⌘+click opens one in Orca" in the present tense
while its own toggle was off, so the out-of-box state described behavior the
user did not have. Phrase it as enabled-state copy, matching sibling rows.
- The parent Link Routing description gained "opens a link the other way",
which is false in the default state and contradicts the child row when
inverting is on. No fixed sentence there is true in every state, so the child
row — which knows the live destination — now owns the claim. That leaves
getBrowserLinkRoutingShortcutLabel unused, so drop it.
- The rich markdown editor still forced the system browser while the preview of
the same file honored the modifier, so one link routed two ways depending on
which view it was clicked in.
- A remote runtime pins every link to the system browser, so the hover hint
could promise Orca for a click that lands elsewhere. Gate the hint on the same
condition openHttpLink uses.
- Index both modifier titles: the search entry is built with openLinksInApp
false, so the row was unfindable by the title it renders when routing is on.
- Drop the ariaLabel that shared no words with the visible label (WCAG 2.5.3)
and add the four missing settings-search keyword keys to all five catalogs.
* test(editor): pin the rich markdown Shift+click routing hop
The editor half of the modifier fix had no coverage — reverting it to
forceSystemBrowser left the suite green while the same link routed one way in
the markdown preview and the other way in the rich editor. Also pins that a
non-local source owner survives the hop, since that is what keeps an SSH file's
links out of Orca's browser.
* test(editor): cover the Ctrl chord for rich markdown link routing
This file is the only test of handleRichMarkdownEditorClick, and it exercised
metaKey alone, so the isMac branch of modKey had no coverage off macOS. Also
stop claiming the source-owner case proves SSH links stay out of Orca — it
proves the owner survives the hop; http-link-routing.test.ts enforces the rest.
* style: trim review comments to the one-line house rule
Both explained the change adequately in two lines; the extra lines were worked
examples, not information.
* fix(browser): keep Link Routing copy unchanged until inverting is enabled
Removing the "⇧⌘-click always uses your system browser" sentence outright
reworded the row for every user on upgrade, including everyone who never turns
the opt-in on. Restore it verbatim in the default state and only hand the chord
sentence to the nested row once inverting makes "always" untrue.
* revert(editor): keep rich markdown Shift+click on the system browser
Per Brennan: the editor's Shift path hands the link to the client OS and should
not follow the invert setting — the preview opening in Orca is the intended
divergence, not a bug. Restores main's call exactly; the test now pins the
divergence so a future consistency pass cannot erase it silently.
* fix(browser): surface the inverted modifier on the hosted-review link
The hosted-review click path now passes modifierHeld, so with inverting on and
Link Routing off the chord opens in Orca — but the hint stayed gated on
openLinksInApp, hiding a live gesture. Resolve the destination instead of a
boolean. Default-off output is unchanged.
* test(browser): pin the inert modifier hint when links already open in Orca
* refactor(terminal): require the pane link hint so dropping the wiring fails to build
The optional option fell back to a duplicated copy of the legacy hint string, so deleting the hook wiring reverted the tooltip silently with every test green.
* fix(browser): trim the runtime id before hiding the hosted-review modifier hint
openHttpLink and terminalUrlOpenHintOptionsFor both trim, so a blank runtime id hid the hint while the click still reached Orca.
OrcaWin
Neil
Brennan Benson
Jinjing
jmdall
ye4241
BingZ
Yunqian Fan
Sebastian
hanjoonchoe
Kevin Bravo
Vladislav Meshkorudnyj
Dhilip Subramanian
caioribeiroclw-pixel