Orca v0.5.12

Orca v0.5.12

Changes since v0.5.11:

• In full-auto, computer use no longer asks for app approval: that mode
  already runs commands on the host. Typing into a password field still asks
  every time, deny and prompt rules still apply, and apps blocked by default
  stay blocked.
• The app approval panel offers two more choices: 3 Allow all apps this
  session and 5 Always allow all apps (saved), which saves
  pattern = "*". Neither covers password entry.
• Outside full-auto, terminals and IDEs still need approval for that app
  itself, because they can run commands outside Orca's sandbox. Grants and
  allow rules for every app (wildcards or a rule without a pattern) do not
  cover them.
• A key action accepts a separate modifiers array, as click does.
• Three tests that failed only in parallel runs now isolate their state.

Changes

Computer use approvals

full-auto lets an app call through without asking for app approval. An app
call in plan, suggest or auto-edit asks as before, unless an applicable
rule or grant already allows it. These still ask in every mode:

• text entry into a password field;
• a call that matches a prompt rule.

A matching deny rule still refuses the call. Apps blocked by default stay
blocked, and Orca still never operates the terminal it runs in.

The approval panel for an app now offers six choices:

• 1 Allow once
• 2 Allow this app this session
• 3 Allow all apps this session
• 7 Always allow this app (saved)
• 5 Always allow all apps (saved)
• 4 Deny

5 writes this rule to the user configuration:

[[permissions.rules]]
tool = "computer"
pattern = "*"
decision = "allow"

Neither all-app choice covers password entry. The session grant skips
password-field calls, and allow rules with a pattern never preapprove them.
A whole-tool allow rule without a pattern is still the only rule that
preapproves password entry.

Terminals (Terminal, iTerm2, Ghostty, Warp, kitty, Alacritty, WezTerm, cmux)
and IDEs (VS Code, apps under com.todesktop. or com.jetbrains., Xcode,
Zed) can run commands outside Orca's sandbox. Outside full-auto they need
an approval for that app itself:

• 1, 2 or 7;
• an allow rule whose pattern is the app's exact bundle id.

Neither the all-app grants nor wildcard and whole-tool allow rules cover
them, and their panel does not offer the two all-app choices.

The risk warning for terminals, IDEs, Finder, System Settings and browsers now
also starts the app's first result in each session. Calls that run without a
panel, in full-auto or under a rule or grant, therefore still show it.

Key shortcuts

key accepts a modifiers array next to keys. It accepts cmd, shift,
option, alt and ctrl. {"keys":["t"],"modifiers":["cmd","shift"]}
sends the same shortcut as {"keys":["cmd","shift","t"]}. The password-field
check sees the combined shortcut, so modifiers: ["cmd"] with keys: ["v"]
is checked as a paste.

Tests

Three tests that failed only when the suites ran in parallel now isolate their
state:

• the resumed-workflow token test holds the test environment lock;
• the workflow reaper test gets a private executable and synchronizes on a
  FIFO instead of a timer;
• the TUI surface-cancel test runs in a child process with its own
  ORCA_HOME.

Compatibility

• Allow rules for terminals and IDEs. Outside full-auto, a wildcard or
  whole-tool computer allow rule no longer preapproves terminals and IDEs.
  Those apps ask again. Add an allow rule with the app's exact bundle id to
  keep them preapproved.
• Unchanged. Configurations and sessions from v0.5.11 remain readable, and
  existing exact app rules keep working.
• Platforms. Computer use is still available only on macOS 14 or later, in
  the interactive TUI's main session.

Verification

On the release commit, macOS 26.6.2 on Apple Silicon:

• Static checks and validators: all pass.
  • cargo fmt --all -- --check
  • cargo clippy --workspace --all-targets --locked -j 1: exit 0; no warning on lines this release adds.
  • The runtime-surface, Windows platform-boundary, execution-broker and HTTP-client validators, the validator tests, and the repository hygiene test.
  • scripts/release/verify-version-sync.mjs (0.5.12) and the version-sync, npm staging and publish-verification script tests.
  • npm --prefix site run build, npm --prefix site run check:seo and git diff --check.
• TUI library: cargo nextest run -p orca-tui --lib --locked --profile ci-serial --retries 0: 1818 passed.
• Workspace: cargo nextest run --workspace --all-targets --locked --profile ci --no-fail-fast --retries 0: 4324 of 4329 passed.
  • Four failures are MCP-startup timing tests in runtime_host. They fail only when the test binary sits in this checkout under ~/Documents; the same binary copied to /tmp passes all four.
  • workflow_runner_pauses_and_resumes_from_control_file failed once in the full run and passes alone.
• Contracts: cargo test --test public_docs_contract --locked: 13 passed. python3 -m unittest discover -s terminal_bench -p 'test_*.py': 20 passed.
• Real-Mac computer use: not rerun. This release changes the approval policy, the TUI panel and argument parsing, not the macOS driver.
• CI: release.yml requires Linux linux-full and Windows native-x64 and native-arm64 to pass for the tagged commit.

Upgrade

After v0.5.12 is published:

npm install -g @blade-ai/orca@0.5.12
orca --version