Orca v0.5.8

Orca v0.5.8

Changes since v0.5.7:

• A shell command that outlives its bash call no longer reads still running
  for good. Its row shows how the command ended (exit 2, timed out,
  stopped, ...) once it ends, also when nothing reads it and Orca is idle.
• HTTPS certificates are checked against the operating system's trust store,
  so a company CA installed there works with no Orca setting. A minimal Linux
  system needs the ca-certificates package.
• Configuration files may use TOML 1.1 syntax.
• In the input box, moving or deleting by word keeps underscores inside the
  word, and Up/Down keep the screen column.
• Dependencies move to their current releases, among them ratatui 0.30,
  crossterm 0.29, reqwest 0.13, toml 1.1 and rusqlite 0.40 with SQLite 3.53.2;
  the website moves to Vite 8, TypeScript 7 and React 19.3.
• The Skills & Plugins documentation page renders again.

Changes

Shell commands that outlive their call

A bash call returns when its yield window closes, even if the command is
still running; the command goes on in the background. Its row used to keep
saying still running after the command had ended. Now the row follows the
command:

• When the command ends on its own, its row shows the end shortly after,
  whether or not the model looks at it, and while Orca is idle too.
• When the model reads or waits on it (task_read_output, task_wait), the
  row takes the end those report, with the exit code.
• The label is empty for exit 0, and otherwise says exit N, timed out,
  stopped, cancelled, interrupted, or failed when no exit code is
  known. Only the label changes; the row's output stays as the call returned
  it.
• In a resumed conversation, a row whose command ended before Orca exited
  shows how it ended. A row whose command was still running when that Orca
  exited shows state unknown.
• Shell commands do not appear in the task dock or the task lists.
• A command that was blocked on a network request and then allowed now gets
  its end reported too, to the model as well.

Network and certificates

• HTTPS certificates are checked against the operating system's trust store:
  the keychain on macOS, the system certificate store on Windows, and the
  system CA bundle on Linux. Before, Orca used Mozilla's roots compiled into
  the binary. A company proxy's CA installed in the system store now works
  with no setting of Orca's own.
• On a minimal Linux system, such as a slim container image, install
  ca-certificates first. With no CA certificates at all, Orca cannot build
  an HTTP client, so every request fails, plain HTTP included (a local
  http:// MCP server, or a base_url that starts with http://). The
  error says No CA certificates were loaded from the system; install the ca-certificates package.
• On Linux, SSL_CERT_FILE and SSL_CERT_DIR point Orca at a CA bundle or a
  directory of certificates instead of the system locations. What they point
  at replaces those locations, so it must hold every root you need.
• When Orca cannot build an HTTP client, it keeps running and says why: the
  update check is skipped, a turn ends with a provider error, and an MCP
  server reports that it could not start an HTTP client.
• HTTP requests look up both a host's IPv4 and IPv6 addresses and try IPv6
  first. On macOS the DNS servers now come from the system's network
  configuration instead of /etc/resolv.conf. If the system's DNS
  configuration cannot be read, Orca's HTTP client falls back to Google
  Public DNS; before, its requests failed. The sandbox's network proxy keeps
  looking IPv4 up first.
• HTTPS_PROXY, HTTP_PROXY and NO_PROXY work as before. Orca keeps the
  ring crypto library.

Configuration files

• config.toml and Orca's other TOML files accept TOML 1.1: multi-line
  inline tables, trailing commas in inline tables, the \e and \xHH
  escapes, and times without seconds. Orca v0.5.7 and older cannot read a
  file that uses them.
• Files Orca writes stay TOML 1.0, so older versions read them.
• A file saved with Windows line ends (CRLF) reads as before: line breaks
  inside a multi-line string are LF.
• Some syntax error messages are worded differently. A duplicate key is
  still named.

Terminal UI

• Moving or deleting by word (Alt+B/F, Ctrl+W, vim w/b/e) keeps
  underscores inside the word, as Vim does: Ctrl+W after foo_bar deletes
  foo_bar, not bar.
• In a multi-line draft, Up/Down, Ctrl+P/N and vim j/k keep the screen
  column instead of the character index, so across Chinese text, emoji and
  tabs the cursor stays above or below where it was. It never lands inside
  a character.
• Newer emoji (Unicode 16 and 17) take two columns, so rows that hold them
  no longer overflow.

Storage

• The bundled SQLite is 3.53.2 (was 3.46.0). The session index, goals, the
  memory index and stored task output read and write as before.

Terminal-Bench adapter

• The adapter copies a CA bundle (from Harbor's certifi) into each task
  container and points Orca at it when the image has no CA bundle of its
  own. See terminal_bench/README.md.

Website and documentation

• The Skills & Plugins page crashed in both languages because of an
  unescaped {{arg}}; it renders again.
• The configuration page has a "Network and certificates" section.
• The Terminal UI page no longer says that long-running commands appear in
  the tasks dock, and explains how a shell command that outlives its call
  shows in the conversation.
• The site builds with Vite 8 and TypeScript 7 and runs on React 19.3. The
  pages look as before.

Compatibility

• Orca no longer carries its own root certificates; see Network and
  certificates.
• A configuration file that uses TOML 1.1 syntax cannot be read by v0.5.7 or
  older.
• Sessions written by v0.5.8 still open in v0.5.7, which shows their shell
  rows as still running, as it always did.

Configurations and sessions from v0.5.7 remain readable.

Verification

cargo fmt --all -- --check
node --test scripts/test-validate-runtime-surface-contract.mjs
node scripts/validate-runtime-surface-contract.mjs
node --test scripts/test-validate-windows-platform-boundaries.mjs
node scripts/validate-windows-platform-boundaries.mjs
node --test scripts/test-validate-execution-broker-boundary.mjs
node scripts/validate-execution-broker-boundary.mjs
node --test scripts/test-validate-http-client-boundary.mjs
node scripts/validate-http-client-boundary.mjs
node scripts/release/verify-version-sync.mjs
node scripts/release/test-verify-version-sync.mjs
node scripts/release/test-stage-npm.mjs
node scripts/release/test-verify-published.mjs
node scripts/test-repository-hygiene.mjs
node --test tests/npm_launcher_contract.test.mjs
python3 -m unittest discover -s terminal_bench -p 'test_*.py'
cargo nextest run --workspace --all-targets --locked --profile ci --no-fail-fast --retries 0
cargo nextest run -p orca-tui --lib --locked --profile ci-serial --retries 0
cargo nextest run --test tui_pty_contract --locked --profile ci-serial --retries 0
npm --prefix site run build
npm --prefix site run check:seo

Upgrade

npm install -g @blade-ai/orca@0.5.8
orca --version