Changelog · orc

0.8.2 2026-11-10

This release adds four features and fixes two problems. Peer reviews start on the change; Keys easier to find; See a plan's diagrams. The other changes touch plans, the TUI, agents and hooks.

Features

A peer review's plan session opens on the review, not on open questions. It says how far the author's branch moved, orients you on the change and asks where to start; findings and draft comments are recorded as you settle them.
The help draws a key glyph beside Space, Tab, Shift-Tab and Enter: ␣ Space, ⇥ Tab, ↵ Enter. The which-key card does the same, the Glyphs and words page lists them, and the bottom border keeps its compact hints.
The rendered plan view shows each Mermaid diagram as a labelled block that the quote key's labels reach. Its card draws the diagram locally and opens the picture, opens it in the online Mermaid editor, or copies its source.
Plan rows leave more room for the title. A rating always shows as the short ★3, and a narrowing pane drops the branch cell before the gate letters.

Fixes

Codex workers now start with --no-daemon, so their hooks see the worker's own plan and environment. Before, a Codex daemon started by another session could make orc miss a worker or file a hand-run session under a plan. A queued wake still reaches the worker within seconds.
Opening a large Mermaid diagram no longer freezes the screen while it is drawn. The draw runs in the background and the picture opens when it lands, unless the diagram changed or another project was opened meanwhile.

0.8.1 2026-11-10

This release adds seven features and fixes three problems. Run heavy checks on a faster machine over ssh; Pick a model per worker start; Copy a suggested command without retyping it.

The other changes touch plans, the TUI, checks and agents.

Features

Checks can run on another machine you list in [checks] hosts, for projects whose checks say remote = true. orc ships the tree with its uncommitted work, streams the log back, and runs the checks here instead, saying why, whenever the host cannot.
orc agent start and orc agent open take --model and --effort for one worker. They replace the worker role's config for that start, checked the same way; a resume of that worker keeps them, and orc status and the agent detail show what each worker runs on.
y then the quote key labels the orc commands a toast, the message history or the detail suggests. A label copies its command, drawn as code; toasts hold still meanwhile, and in the message history y y now copies a message.
orc config show prints the project's config with secrets masked, and says whether it is approved. It works from a plan's worktree as well as the main checkout and changes nothing, so a worker can read the project's settings without leaving its worktree.
# on the Plans and Agents tabs shows relative row numbers, so 6j and 3k are no longer guesses. A count being typed shows them too and picks out where it would land; = keeps them on, and a few quick j or k moves show them for a moment.
orc capacity lists each check host with its runs and why a check ran where it did, and orc doctor checks each host. Pruning a plan also clears its files on each host, and an approved remote check run through orc capacity run, such as a mise run check, can go to a host too.
orc capacity tune and the TUI's C review recent checks and suggest one setting to change, with its reason. Each change is one step, made only after you say yes, and written to your global config; with too few runs it says so instead.

Fixes

Every dependency warning now ends with the exact orc plan set command that fixes it. In the TUI, F on a plan held by a stale dependency offers d to drop it or f to pick the plan it means.
On macOS a check or gate no longer stops now and then because no leash could be started. orc now prepares the system state that a child started beside another thread could crash on, and it reads tmux's session lists correctly without a UTF-8 locale, as when checks run on another machine.
The TUI's pull request poll no longer fails on large, busy repositories with an oversized or cut-off reply. It now asks GitHub only about the pull requests your plans link to, and only for the few fields orc reads.

0.8.0 2026-11-09

This release makes one breaking change, adds 19 features and fixes 21 problems. See blocked plans at a glance and land them in order; See what a chord will act on; Review a change against what it says it does.

The other changes touch plans, the TUI, agents and worktrees.

Breaking

Blocked plans show an orange ⧗ in the list, and hide blocked in the filter menu lists only what is ready. A blocked plan starts at once with a note, but orc plan finish and F refuse it until its dependencies complete; --ignore-deps finishes anyway.

Features

A chord's which-key card keeps the selected row lit and dims the rest, so it shows what the chord acts on. Chords with no row target, such as n, dim everything, and the jump and link chords keep their own labels. Typing a chord straight through changes nothing on screen.
A peer review of a pull request now starts with the author's description in the plan, marked as a claim to check. The session checks the diff against it, and nothing in the description can act as feedback, a section or a comment.
The export and import panels browse files and folders like the project picker, and every text field takes a paste. A pasted newline never submits, and a file dropped on the terminal arrives as its plain path.
The plan list and status JSON now say which plans are ready, what blocks each and how deep it sits. Unknown, ambiguous or cancelled dependencies and cycles are warned about, and orc plan new and orc plan set refuse an unknown or ambiguous name or a cycle.
Plan and refine sessions left detached and idle for 12 hours now close on their own; o a resumes them. Set [agents] idle_close to change the time or turn it off; the TUI checks every few minutes, a few sessions at a time, and orc agent sessions --prune --idle does it by hand.
Codex workers now show working, waiting on you and done from their hooks, as Claude Code workers do. Once the Codex hooks are installed and approved, a Codex worker also hears when its plan changes, mid-turn or at the end of a turn.
orc hooks install --tool codex adds orc's hooks to Codex's hooks file, with a diff, a backup and an atomic write. orc never approves them itself: orc hooks list --tool codex shows which still need approving in Codex, and an uninstall names each of your hooks that moved and needs approving again.
An idle Codex worker now wakes when its plan changes, as a Claude Code worker does. Its turn-end hook leaves a waiter that queues orc's fixed sentence with codex queue once the session is idle, so nothing is typed into the pane, and a draft or an open prompt is left alone.
Every chord shows its card of follow-up keys after a short pause. The bottom border names the basic keys in one order on both tabs, ↵ agent and Space zoom first, keeps F finish and R vetted whenever they apply, puts ? help at the far right and draws each key bold beside its dim words.
x e exports the marked plans, or the selected one, and n i imports plans from a file, each after a preview. The panel shows what cleaning did or why it refuses, and writes nothing until Enter.
n P pins a plan's pull request that came from another machine or checkout, after showing what orc pr relink shows. Its row shows a red p until then, and o p, y p and r name n P when they refuse it.
Stacked plans now finish: a plan made with --parent lands in its parent's branch, then on the trunk once that merges. Its pull request targets the same branch and lists the stack, and a broken parent link is refused with the reason.
orc stack shows a plan's stack, or every stack, as a tree with each plan's branch, status and where it lands. It only reads: a missing parent or a cycle is reported under its plan, and --json gives the same tree.
With the related lens on, j and k step through its related plans, and = makes it follow the selection. A following lens re-anchors once the selection settles; = locks it again. A jump outside ends a locked lens, and Ctrl-o restores it.
Messages that arrive together now stack in the status line: the newest shows with a +N count of the others. When it fades, the older ones still live come back, dimmed, and M lists the last 20, the live ones lit.
Web links in a plan's detail are now terminal hyperlinks in Ghostty, iTerm2, kitty, WezTerm and tmux 3.4. A modifier-click opens one; hyperlinks in the global config turns them on or off anywhere.
z d lists the plans as a dependency tree, each nested under the blocker that finishes last. Its other blockers are named on its row. h and l fold and unfold a node (H and L every node), a folded node shows how many plans it hides, and a jump to a plan unfolds just enough to show it.
orc plan export writes plans, cleaned, into one file to send, and orc plan import reads it on another machine. Imported plans wait in the imported status until accepted, and an export never replaces an earlier file.
A new toast flashes reversed as it arrives, and the +N count of toasts waiting beside it is bold. Toasts that roll back in stay dim in their own colour.

Fixes

A prune that cannot empty a worktree's folder says so, and the next orc wt prune offers to remove it. Only a finished plan's folder whose work landed is offered, and a worktree an orc check runs in waits for it.
A TUI action refused over an unapproved project config now opens the trust review, not just a toast. Approving there runs nothing else, so you run the action again; content too long to show still points to orc trust.
A Codex worker that runs /clear now shows as one agent, not two. The cleared conversation's record goes at once, and Codex's late session-end signal, which only means its thread went idle, no longer removes a live worker's record. After an Esc, a plan change reaches it once, not twice.
Enter's start dialog now defaults to work now when the plan's exited worker can be resumed, even with open questions. Refine first stays the default only before any worker, and stays offered either way.
A gate no longer refuses to run for want of a check slot when the slot was free and only being looked at. Several tests that failed only on a busy machine now pass there too.
A jump-list move past several deleted plans or finished agents shows one toast, not one per place. It says 2 gone places skipped; a move past a single gone place still names what it was.
Two orc commands saving the same plan at once no longer silently lose one of the saves. The check that the plan is unchanged and the write now take turns under a short lock shared by every worktree; a save that waits more than 2 s is refused and asks you to run it again.
A message said again in a row shows once, with a count such as ×3, in the gutter and in the message history. An automatic gate run is announced once, when it actually starts: a start refused at once is not said, and a plan whose finish holds its gate lock in another orc is left alone.
A worktree whose path holds a newline can no longer pose as another worktree or change the branch orc sees for it. orc plan draft refuses a peer review's worktree from inside it and through --pick, and the TUI's detail pane escapes commit subjects and branches.
Saving a plan never writes through a symlink, and refuses when the file changed since orc read it, so no edit is lost. Parking refuses an oversized plan before stopping its agent, and setup and the picker refuse temporary and system directories by every spelling, and a project another user owns.
The TUI's trust prompt offers approval only for project commands it can show whole, and sends the rest to orc trust. Finishing a plan refuses an unapproved project config before it updates, stops or merges anything.
Claude Code's worktree hooks refuse to hand out or remove a plan's worktree, so naming it cannot delete its work. orc sync escapes git's messages and paths, a hook command of your own that starts like orc's stays yours, and two reads no longer wait on a FIFO.
Branch updates, pull request commands and peer posts refuse an unapproved project config before reaching git or GitHub. A new worktree's start ignores an unapproved landing branch and asks instead.
A stacked plan shows its finish waiting until its parent merges, and the TUI no longer offers F for it. Finishing it early says to finish the parent first, and names the branch the plan lands in after.
The message history under M lists the newest toast at the bottom, oldest at the top. On a short terminal it opens on the newest, and the scroll keys show older ones.
In the message history, Enter reads a toast in full and y copies its whole text. M opens on the newest toast and the scroll keys move the selection; a toast keeps its line breaks, and two long announcements are shorter, so a narrow gutter keeps what matters.
The gutter no longer repeats the which-key card. Until the card appears, it shows only the chord's name and Esc cancel; once the card shows, the gutter goes back to its toasts.
The worktree hook never hands an agent a finished plan's unmerged branch or a name still being cleaned up. Every worktree step takes one lock per repository, and the hook prunes a finished plan's clean, merged leftover before reusing its name.
The worktree hook no longer refuses a branch name just because a finished plan once used it. A branch that still carries a plan's mark, or a directory a plan records, is refused as before, whatever the plan's status.
The x chord's card keeps the marked plans lit, or the selected one when none are marked, instead of dimming every row. While the related lens is on, the Plans list's bottom border offers = unlock lens or = lock lens.
x / writes the plan's short name, and the search text stays on the list's top border however long it gets. The related lens reads locked or unlocked, as the feedback pane does, and the x card's labels say what each key acts on.

0.7.0 2026-11-08

This release makes two breaking changes, adds two features and fixes ten problems. Fetches work with a chosen ssh key; One rule for which plans get a worktree; The wheel and the same keys in every panel.

The other changes touch the TUI, plans, terminals and checks.

Breaking

A fetch from orc now uses the ssh command in your global git config, or one you export, and still cannot prompt. The TUI push no longer takes one from a repository's config, which an agent could write: orc doctor names the ways to set a per-repository key.
orc wt up, orc wt adopt and w u work only on an active plan. At a terminal orc offers to make it active, open questions gate included; elsewhere it refuses and prints the command, so a script runs orc plan set-status first.

Features

The mouse wheel now works in panels, and every panel of text takes the same scroll keys. The help, What's new, Update and the pull request and ticket cards scroll by line, 3 lines, half a page or a page, and menus move a row a notch. The wheel never selects, confirms or closes.
y t now copies the ticket ID and y p the pull request number, with y T and y P for their URLs. The title moves to y n, the plan file path to y f, and the pull request URL from y u to y P.

Fixes

orc check and w g run on a parked plan again, instead of saying the plan is no longer active. A check started by hand runs on any plan that is not completed or cancelled; automatic runs and finishing still need an active plan.
orc plan list stays quick in a project with hundreds of finished plans. It works out where every plan landed from a few git calls for the whole list instead of several for each plan, with the same answers, and the TUI's merge badges load the same way.
A check that gets its slot after its plan has merged no longer starts, and the passing log stands. A gate writes its log aside until it ends, and a run whose worktree was removed under it says so instead of reporting a build failure.
The TUI ends when its terminal goes away, instead of using a full CPU core for as long as it stays running. It quits the normal way, and a terminal that is only slow or has stopped reading keeps it running.
Ctrl-l no longer ends the TUI when the terminal is slow to answer. The repaint now asks the terminal nothing.
A repository's git config no longer starts a program when orc reads, or fetches on its timer. orc doctor and the TUI's refresh are covered. orc sync runs no repository hooks now, and only your own git config can add a transport.
orc init now writes the .gitignore that keeps .__orc out of git, and says so. It refuses what the picker's setup refuses, including a subdirectory of a project, where it used to make a nested project; a rerun at the project's root still succeeds and adds what is missing.
The project picker ignores the letters of your home directory, so a short query lists only the directories it fits. A directory under home matches on its name and the path its row shows; one outside home matches on its whole path.
The Update panel renders a new release's notes as Markdown instead of showing raw markers. Headings, lists, code and links read as they do in What's new, and the unsigned text stays escaped.
orc agent sessions --prune ends a killed test run's tmux server whose socket has gone, instead of reporting a failure. A hook beside another that took the same plan-change request no longer prints an error.

0.6.1 2026-11-06

This release adds 27 features and fixes nine problems. Ghostty opens on Linux without config; Finished peer reviews clean themselves up; Workers pick up plan edits on their own.

The other changes touch plans, the TUI, agents and GitHub.

Features

On a Linux desktop orc now opens agents and shells in Ghostty when it is installed, with no [terminal] to write. The config reference has checked recipes for GNOME Terminal, Konsole, kitty, WezTerm and foot, and orc doctor says which terminal orc will use and why.
A peer review now ends by itself once its pull request merges or closes, or the author's branch lands in the trunk. Anything pending holds it: the list shows held and names each item, and the next read ends it once nothing is left.
A Claude Code worker now hears that its plan changed when its turn ends, with nothing typed into its pane. Once an edit has settled for two minutes, the worker gets one fixed reminder to read and ack it, and the plan's stage: line says whether it is settling or told.
orc peer coauthor opts a peer review in to helping its author: a worker runs on the branch, and checks and R work. orc peer push then adds your commits to their branch, fast-forward only, after a confirm.
orc ticket create makes a Linear issue from a plan, and a rerun after a crash never makes a second. A plan's ticket and pull request now name each other in their descriptions, the offers carry a new link across, and the ticket gets Linear's own link to the pull request.
The project picker drops its zero counts and repeated tags, and shortens its counts to symbols when space is tight. The window title always uses the same shorthand, such as ⚒2 1→ · 3 plans, so a script that reads the title must match it.
orc peer done ends a peer review once nothing is pending, keeping the plan and removing its worktree and local branch. Prune and down delete that branch only when it holds nothing of yours, and never touch the author's branch.
Ctrl-o, [ j, ] j and Ctrl-i now work in plan zoom and agent zoom. The zoom stays open and shows the place you land on, switching tabs when that place is on the other one.
The project picker no longer jumps as you type: the query line stays put and the box only grows until you close it. Opening the picker again starts from the size of its list.
orc doctor warns when a Claude Code review command you wrote lets the reviewer read the branch's own rules. orc can also start a session on someone else's branch that follows your main checkout's rules and never loads the branch's rule files, hooks, MCP servers, skills or agents.
orc linear login over ssh copies the authorize link and finishes through a forwarded port or a pasted address. Where no keychain is reachable, orc doctor names the way to give orc the token on that machine: pass, secret-tool or an environment variable.
A peer review takes its local branch, worktree and short name from the branch it reviews, not its title. orc wt rename now moves a peer review, and terminal tab titles carry its ◇ or ◆ mark.
n P pushes a plan's branch and makes its draft pull request, and n T makes its Linear ticket, right in the TUI. Each shows the CLI's preview and question in a card, and nothing is sent or read from Linear until you press y.
The window title and the project picker now show the same status brief for a project: 1! 3◫ 1↥ 2→ ⚒1 ≡5. It counts what needs you now, what to vet, what to finish, what is on others, what is working, and the active plans.
orc doctor has a "This box" section: local, ssh or container, and what opening, copying and new terminals do here. It also shows where a Linear login is kept and whether keep-awake works, counts reparented shells on Linux, and says what it cannot check when HOME is unset.
orc refuses workers, gates, finishing, updates and pull request writes on a plan marked as a peer review. The mode is the stricter of the plan's authorship line and a record agents cannot edit; --json shows it.
orc peer patch writes your commits on a peer review as patch files for you to hand over, and prints their paths. --handed marks them given, and orc peer done waits until commits are exported and handed over.
Peer reviews show in the plan list with a ◇ (◆ co-authored) before the title and their own stage words. The v menu shows, isolates or hides them, keys a review refuses are not offered, and n p starts one.
A peer review's session now says how to review, in the same words for any tool or peer template. It reads the diff, then checks correctness, security, tests and what the change leaves inconsistent.
orc peer post sends a peer review's drafted comments to the pull request as one pending review. It shows them and asks once; you check and submit on GitHub, where o P opens any pinned pull request's files and pending review.
A worker hears about a plan edit at each turn's end until it acks with no @@ left, with no hook error label. After 3 tellings the plan reads told 3 times, not acked. u s is now u @, and o f is now o P.
orc peer start now takes a pull request's number or URL and starts a peer review of it; forks are refused for now. Refresh, threads, the poll and opening it work read-only on a pin of its author and head; every write stays refused.
orc peer start fetches someone else's branch and makes a peer review of it: a plan, a branch and a worktree. Nothing of the branch runs in the worktree, and its plan session works from your main checkout under your own rules.
orc plan sync and the u @ key tell a running worker its plan changed at its next tool use or turn end. They type nothing into its pane. An idle worker hears it at its next turn, and the command says so.
The window title now reads orc · ironmaw · 1! 2→ ⚒1 ≡5: on you, on others, working, then active plans last. Without the glyph it says the same in words in that order; scripts that read the title must match the new form.
[finish] require accepts "vetted" for your own read of a plan, and "review" keeps working as its older name. The TUI says a seen for marking agent turns, marked vetted at after R, and the help page for those keys is Vet.
A worker idle at its prompt now hears that its plan changed within 8 hours of its last turn, with no keystrokes. orc plan sync wakes it within seconds, [plan] wake_hours sets the hours, 0 turns it off, and orc hooks update installs the hook.

Fixes

The README takes you from install to a first merge in one read, and the TUI reference opens with a one-minute guide. The help pages name the right keys, and a co-author's hold after an author's rewrite names the way out that works.
Keep-awake on Linux now works without GNU tail, reads the battery and shows other systemd-inhibit holders. When logind is missing or polkit refuses the lock, a toast says so and the rule turns off, and keeping the screen on warns that a desktop may still blank it.
orc doctor fails again when orc has no state directory: neither HOME nor XDG_STATE_HOME is an absolute path. It names what stops working and the fix; with a relative HOME, orc no longer writes its logs below the current directory.
A peer review's detail pane now compares your local branch with the author's, not your trunk. It reads the last fetch and says when the comparison is unknown, and w d is offered only once the review is finished.
orc peer post sends exactly what it shows and knows its own comments on a rerun, even once edited. Each comment carries a hidden marker; a malformed draft line is refused by name, and a post that reached GitHub always says so.
A peer review's git: line says when the author rewrote their branch, instead of counting what it dropped as yours. to push and orc peer done now use one count, and w d is offered only when it would work.
The project picker's box now fits its rows and title instead of its full key list, and managed projects show ⌂. Keys that do not fit drop from the border, with Enter and help kept longest. The box is at least 46 columns wide.
The help shows u for updating orc on a row of its own and on every page's bottom border. It checks for a newer release, then y installs it.
A bounded command that ends just after it starts no longer leaves a stray sleep behind. The bound outside orc now says it is ready only once its timer is running, so ending it at once ends the timer too.

Other changes

One doctor line says where the Linear token comes from

0.6.0 2026-11-05

This release makes three breaking changes, adds ten features and fixes 11 problems. Pull-request settings read as one group; An agent cannot mark its own work vetted; An LLM review of the exact head before it merges.

The other changes touch merges, plans, GitHub and the TUI.

Breaking

Move require_approval and review_bots out of [finish] into its new pr table. Left where they were, either key is an error that says where it goes.
orc pr push and orc pr create now refuse until you mark the head read and the gates the project requires pass at it. The refusal names each missing gate and how to satisfy it, before anything is pushed or created.
An agent can no longer pass your review by editing its plan file. Your read mark (R) now lives in your private state directory, where the review gate, orc pr push and orc pr create read it. Marks made before the upgrade are dropped: press R again on plans you had vetted.

Features

A new opt-in merge-review gate has an agent tool review the changes at the head that would merge. Name the reviewer with [finish] merge_review; it runs headless and read-only and answers in one fixed block, and anything else, or a finding at or above merge_review_fail_on, fails the gate.
A loop on your machine can now merge a ready pull request with orc plan finish --yes. Set merge = "unattended" in the pr table of [finish] in your global config; a project or a plan can hold it to "confirm", and every other check still refuses.
New review threads on a pull request can now go back to the plan's agent. With rework = "offer" in the pr table of [finish], the TUI says when a refresh finds new threads and Enter sends the plan back; with "auto", orc sends bots' threads itself, at most twice per push.
orc plan finish merges an approved, green pull request on GitHub after one confirm. It reads GitHub's rules first and refuses early, naming what is missing, then records the merge and updates the main checkout; a pull request merged on the web gets only the record.
F in the TUI finishes a plan through its pull request, with the same preview and refusals as orc plan finish. The stage cell reads to finish when the stored pull request is ready to merge, and F on any other plan says the next step: push, create, ready, rework or wait for review.
With no terminal to open, orc opens agents, shells and editors in a new window of your own tmux, else on this screen. This covers ssh and Linux without [terminal], and the status line says which was used and how to detach.
orc doctor -v now shows the pull request merge rule orc plan finish --yes meets and where it comes from. It names the project config or plan that holds it to a confirm, and any ask for "unattended" that is ignored.
orc pr ready marks a plan's draft pull request ready for review after a preview and a confirm. It refuses, naming each gate, until the local gates hold, CI's required checks pass and no bot thread is open; ready = "offer" says when that is so.
Each project picker row now shows what that project needs of you. It counts plans that need you, have changes asked for or are ready to finish, and agents at work; a project whose folder is gone reads missing and is skipped.
The stage word now always names the work, and the agent cell shows what the agent does, with a new ○ for a wait. Bold means the move is on you, plain on the agent, dim on reviewers or nobody; the window title counts plans on you and on others.

Fixes

A merge review pass now goes stale when you approve changed review rules with orc trust. The review then runs again before a finish relies on it: each recorded review keeps a hash of the rules it ran under.
An unattended orc plan finish --yes merges a pull request only at a head you marked read with R. With no mark, or one a later commit made stale, it refuses before asking GitHub anything; a merge you confirm at a terminal needs no mark.
Copying in the TUI inside tmux now reaches the outer terminal's clipboard, and the toast says how it was sent. When tmux's set-clipboard blocks it, the toast names the setting to change.
The help now explains the project picker's counts, a blank cell included. It says to finish counts only the project you are in, a blank cell waits for a fresh read, and an agent that erred counts as on you.
orc pr push and the finish push now send the exact commit the preview named, by id. A commit that lands on the branch after the gates were judged is never sent with it: before the push it is refused, during the push it stays behind and orc says so.
orc pr ready puts a pull request back to draft when a push lands while it marks it ready. It reads the pull request back, compares its head with the one it judged, and says so; after a kill, the next run offers the undo first.
Prune and down now delete a branch GitHub squashed or rebased, instead of keeping it. They delete it only while it is still the head GitHub merged and the merge holds all its changes; otherwise they keep it and say why.
On Linux, orc now finds its own tmux server under a desktop's systemd --user and heals a lost socket there. It tells the server by its process name, and long-lived children no longer inherit descriptors orc itself was handed open.
The merge review now runs only with review rules you approved. orc trust covers the project's review rules like its other files: rules that are new, changed or removed since you approved them stop the review until you approve them, and orc doctor reports them.
Over ssh or with no display, orc copies and shows links and paths instead of opening them. No browser or file manager can take over the TUI. orc open prints the link, a GUI editor is refused with the reason, and every opener now runs with no access to orc's terminal.
orc's zsh completion advice now says where the fpath line goes: above compinit and anything that runs it for you. When _orc is on fpath but not loaded, orc completions check names a late fpath line as the usual cause before suggesting to remove the cached dump.

0.5.5 2026-11-03

This release adds 15 features and fixes 21 problems. Jumps always land, and going back restores your search; Check and update without leaving the TUI; Pick the model and effort per kind of session.

The other changes touch plans, agents, worktrees and the TUI.

Features

A jump to a plan the search or a filter hides now lands on it, clearing only what hides it and saying so. Going back with Ctrl-o, [ j or '' restores the search and filters you left, and going forward widens again.
The help's u checks for a newer orc now and shows its release notes. When one is out, y runs orc update on the terminal, with the same checks and question as the command.
Your config can now pick the model and effort for workers, plan sessions, reviews, describe and relate. Set them in a [roles] table; every start prints what it runs on and where each value came from, and project_models limits what a project's own config may choose.
The TUI's status menu has a delete item that shows what it would remove, or why it refuses, before you confirm. It is the same delete as orc plan delete, checked again at the confirm, and the toast names where the plan went in the trash.
orc plan delete removes a plan that never became work, with its sessions, worktree, empty branch, records and logs. It previews and asks first, keeps the plan file in a trash folder, and refuses anything with commits or references, pointing to cancelling instead.
A Claude Code session you start yourself inside an orc project now learns to manage plans with the orc CLI. With orc hooks installed, each session start adds one fixed paragraph, kept in orc itself, in a plain directory as in a git repository; nothing is written to the project.
The double-quote key in the plan detail or plan zoom labels every plan name in view, and a label key jumps to that plan. Slugs, short names, aliases, worktree and branch names all count, finished plans included, and the jump list takes you back.
A waiting merge now takes the next free check slot ahead of any waiting worker check or gate. Merges keep their own first come, first served order, and orc capacity lists them first.
The double-quote key now labels the files, folders and https links in the plan detail, one home-row letter each. A path is checked to sit inside the worktree, the project or orc's state, then a card opens it in your editor, a shell or the file manager; a link opens in the browser.
orc completions list and orc doctor now tell a script a shell has loaded from one only installed. orc completions check asks your shell why it skips the completion (not on fpath, a stale .zcompdump) and prints the fix; a bare orc completions shows its help.
The double-quote key now labels plan names, paths and web links in agent zoom and the release notes view too. Each label jumps or opens as it does in the plan detail, with the same checks when it is picked.
Tab titles, toasts and dialogs name a plan by its stored short name, and y s copies it (y y copies the slug). The detail pane lists the short name, a differing worktree name and old aliases, and a tab titled under an old name is still found.
A retitle now carries a plan's logs, gate records, reviews and references, and a rerun finishes one stopped part way. orc wt rename renames a worktree and its branch when nothing runs there, and a draft's stub-named worktree gets its proper name.
Tab completion offers each value on its own with a description and finds a plan by any part of its name. orc completions install puts the script where your shell looks, and orc update keeps it current.
Every plan gets a stored short name of two or three words, like notes-user-side, that commands and completion accept. Existing plans are named on upgrade; new worktrees and branches get a longer whole-word name, and a name two plans share is refused, never guessed.

Fixes

An agent stop that is interrupted part way no longer leaves a record that counts as working for an hour. The agent's records go just before its session is killed, and come back if the kill fails.
Finishes waiting to merge into the same branch now take their turn in the order they asked. The waiting line says how many are ahead, and a later finish that polls sooner no longer overtakes one that has waited longer.
After a worktree is gone, orc wt down and prune delete its branch only when git shows orc made it for that plan. Any other branch is kept, and the output says how to delete it yourself.
TUI toasts name a plan by its title instead of its whole slug, drawn in a brighter shade of the toast's colour. Commands to paste and session names keep the slug.
A finished or stopped check no longer leaves a sleep running for twenty minutes. Long-running helpers that orc starts keep no pipe another part of orc opened, so the TUI no longer waits on them.
Starting an agent while orc's tmux server is busy no longer hides every running session. When the server's socket is gone anyway, orc doctor and the TUI say so and give the fix, kill -USR1 with the server's pid.
Running finish again after it was killed mid-merge now completes the plan instead of offering a rebase or refusing. A squash that landed is recorded, and a merge or squash orc left half done is undone and redone; anything else is refused with the git command that clears it.
A .__orc in your home folder or at / no longer gives every Claude Code session below it orc's rules. orc doctor points such a directory out, and [hooks] session_rules = false in the global config turns the rules off.
A note you add to a running plan now shows in its agent's orc plan changes and lights ±. Only the plan's own agent's notes move its snapshot, and the Outcome and Wrap-up sections never count as changes, except for @@ lines in them.
Checks, fetches and model commands now end with the orc that started them, even when it is killed outright. Ctrl-C to orc plan gates run stops its checks and records nothing.
When orc's tmux server loses its socket, orc now brings its sessions back itself instead of asking you to signal it. Each start records the server's pid and start time, so orc signals only its own server, and starts a fresh one beside a process that only looks like it.
orc hooks shows the diff it asks you to approve with every control character escaped. A project's settings file can no longer hide or forge lines of that diff with terminal escape sequences or a bare carriage return.
Pruning a finished plan deletes its merged branch even after a retitle or once git has expired the branch's reflog. Orc records the plan it made each branch for in git's branch config, which follows a rename and never expires.
Quote-key labels sit beside each name with the rest dimmed, and no longer label every plain word a short name matches. A name the wrap cuts over rows is labelled once, and a name several plans share shows a chooser of them.
A plan command that cannot ask tmux for its session names now says why it asked and how to recover. Restart tmux, or set host = "here" to stop hosting in tmux; without tmux or a server nothing fails.
A killed orc no longer leaves plan text or hook settings in the temp dir, or stray temp files beside what it writes. The next run removes the leftovers, a check no longer leaves a sleeping process behind, and a follow-up plan is written in one step.
A killed orc update, description or relate run no longer leaves scratch directories piling up. They now live in orc's own state directory, and the next run of the same kind removes any over an hour old.
A kill or a closed terminal no longer leaves the terminal broken after the TUI. Its modes, cursor and title are given back as on quit, so only kill -9 needs reset, and an orc update stopped after installing no longer reads as nothing installed.
A worktree setup stopped part way no longer leaves a truncated copy, a deleted tracked file or a link git sees. Copies and links are renamed into place whole, and running the setup again finishes the exclude rules and skip-worktree marks.
Running orc wt up, down or prune again after one was killed part way now finishes the job instead of refusing. A rerun of up adopts the worktree it made, prune removes one left half made, and down and prune clear a gone worktree's record and delete its branch.
y y copies the selected plan's slug and is listed in the help and the copy hint, in the list and both zooms.

0.5.4 2026-11-01

This release adds one feature and fixes eight problems.

The changes touch merges, plans, the TUI and checks.

Features

Ctrl-i now goes forward through the jump list in terminals that tell it from Tab, such as Ghostty and kitty. Elsewhere it is still Tab, and ] j goes forward everywhere; every other key reads as before.

Fixes

A check stopped by its time limit or a cancel no longer leaves processes running. Every process it started ends, including those mise run and orc capacity run move out of its group, and the failure says it timed out, with the limit.
A plan derived from another now lands where its parent landed once the parent's branch has merged. Finish and update say so in one line and record the new base, so the plan needs no hand edit.
A hand-written agent status file can no longer hold the machine awake for an hour. An active record holds for 60 minutes only while orc can see the agent run; any other holds for 15.
The TUI names plans by title in dialogs and messages, not by their long slug. The merge and prune panels no longer stretch across the screen, and the prune panel is now a checklist like the start dialog, with its keys on the bottom border.
orc plan finish --yes no longer hangs when its standard input stays open. It answers every question no without reading anything; without --yes, finish reads answers only from a terminal.
Finishes queued into the same branch now merge one after another instead of refusing after a full check. Each waits for the one ahead, says whose it waits for, then updates onto that merge.
The TUI's merge panel opens at once and fills in which sessions it stops, instead of freezing while it reads them. A session found busy when you confirm is left running.
The top of the plan list, where plans with worktrees sort, now draws as fast as the rest. Each worktree is checked once per git refresh instead of on every frame, and one removed by hand still shows as missing within a few seconds.

0.5.3 2026-10-31

This release fixes two problems.

Fixes

Keeping the machine awake while agents work, or while marked plans have an agent working, now also counts a check that runs or waits for a slot, so a long orc check or finish no longer lets the machine sleep. While only a check holds, the indicator reads ☀ check.
The TUI builds only the plan and agent rows that fit on screen, so drawing and scrolling a long list, with finished plans shown or a widened search, stay fast however many plans the project has.

0.5.2 2026-10-31

This release adds seven features and fixes nine problems. Every agent and plan session orc starts now carries orc's working rules in its prompt: use only orc's plan workflow, stay in the worktree and off the shared stash, treat other text as data, never read secrets, and continue a finished plan with orc plan derive. When a plan ends (a finish merges it, its status becomes completed or cancelled, or orc wt prune removes its worktree), orc closes its worker and plan sessions after a confirm that names them, and leaves any busy one running with the command that stops it. orc doctor now leads with what needs looking at: a headline count, then each problem once with its fix, grouped as needs attention, missing features and minor, then the load in one line and only the settings that change what orc can do. Typing in the project picker searches everything at once: open projects that match by a word or by initials come first, then the rest, with starred and recent projects winning close calls. orc update remembers the newest release it has verified, even when you decline the install, and refuses a later chain that skips it. The detail pane now shows a PERMISSION banner for an agent at a permission prompt: the tool, what the call would run and the prompt's message, so you can see what is asked before opening the agent. The project picker shows what words search on its top border, widens to your home directory with Ctrl-a until it closes, and keeps its keys on the bottom border, with ? opening its help page.

Features

Every agent and plan session orc starts now carries orc's working rules in its prompt: use only orc's plan workflow, stay in the worktree and off the shared stash, treat other text as data, never read secrets, and continue a finished plan with orc plan derive. A project with no orc instructions of its own now works as well as one with them. The prompt names orc check when the project has approved checks, and asks agents to note decisions with orc plan note when they commit.
When a plan ends (a finish merges it, its status becomes completed or cancelled, or orc wt prune removes its worktree), orc closes its worker and plan sessions after a confirm that names them, and leaves any busy one running with the command that stops it. orc wt prune stops a plan's sessions before it removes the worktree and keeps a worktree a session still runs in, and orc agent sessions --prune also prunes a finished plan's worker that waits on you.
orc doctor now leads with what needs looking at: a headline count, then each problem once with its fix, grouped as needs attention, missing features and minor, then the load in one line and only the settings that change what orc can do. orc doctor -v shows every check by topic and every setting, and --json adds an impact and a topic to each check. Untrusted project files now say what they turn off, such as orc plan finish running no checks.
Typing in the project picker searches everything at once: open projects that match by a word or by initials come first, then the rest, with starred and recent projects winning close calls. Ctrl-s narrows the list to open, starred or recent projects, and a dim tag on each row says where it comes from.
orc update remembers the newest release it has verified, even when you decline the install, and refuses a later chain that skips it. An install that has checked once since a key rotation can no longer be shown releases signed by a key that rotation dropped.
The detail pane now shows a PERMISSION banner for an agent at a permission prompt: the tool, what the call would run and the prompt's message, so you can see what is asked before opening the agent. Both this banner and the question banner end with a blank row, so they no longer run into the plan's own lines. Run orc hooks update to add the new permission hook.
The project picker shows what words search on its top border, widens to your home directory with Ctrl-a until it closes, and keeps its keys on the bottom border, with ? opening its help page. Ctrl-x closes an open project so it leaves the recent list and the starred ones without touching anything on disk, Ctrl-r now stars and unstars, and orc projects rm drops the recent entry too.

Fixes

An agent can no longer declare a plan complete while the plan has edits it has not acknowledged; orc plan set complete=true refuses with status 4 and says to run orc plan changes, then orc plan ack. A finished plan that reads changes now always means it was edited after the agent finished.
A session belongs to the plan orc started it for, or else to the directory it started in, so a session that runs a command in a plan's worktree no longer blocks that plan from finishing. When an agent does block a finish, the refusal names its session and what tied it to the plan.
An agent that compacts its conversation while idle, or after a typed clear or compact, keeps the status it had instead of reading as working. A finished agent no longer blocks its plan from finishing just because its conversation was compacted.
The worktree mark and the check-queue clock no longer spill into the next character in Ghostty's default font: the worktree is now ⌥ and a waiting check ◶.
orc plan note reads the note from standard input when its text is a bare -, as --file - already did, instead of saving a literal dash. An empty note read this way is refused and the plan is left as it was.
The plan detail pane draws the highlighted plan's changes, latest-commit and merge values dim while a git refresh re-checks them, so facts from the previous refresh no longer look current; they draw normally once the fresh ones arrive.
The plan detail pane no longer jumps a line when the highlighted plan's git facts arrive: the latest-commit line is held with a placeholder while they load, and a git refresh keeps showing the previous facts until the new ones come.
The TUI stays responsive with many plans on a busy machine: its once-a-second refresh no longer prepares every plan's text for search, works out the plan list or rebuilds the links between plans again when nothing they depend on changed.
A Claude Code worker now starts with its plans folder added, so it reads and edits its plan file without stopping at a permission prompt. orc adds only that folder, and only when the worktree's link resolves to the main checkout's own plans folder.

0.5.1 2026-10-30

This release adds 19 features and fixes 11 problems. After /clear or /compact in a plan's worktree, the Claude Code hook now tells the session which plan it is on and where its state lives: the plan's Outcome and Wrap-up, the branch's commits and orc plan changes. The release task's final confirmation lists every key the release will trust and how the list changed since the previous release. A dev build's release notes open with an Unreleased section listing the changes since the last release, as of the commit it was built from, so orc changelog and the help's n show how far a local build has come. Each release now publishes its trusted-key list as an allowed_signers asset, and its signed SHA256SUMS gains a second line for it. Each release's signed checksums now name the release before it, and orc update follows those links from the newest release down to the one you run, so a release missing from the middle of the chain stops the update instead of being skipped. orc plan finish and the TUI's merge panel warn, by name, about every file in the release-keys folder that the merge would change, including renamed and deleted ones, so you see a change to the trusted release keys before it lands. A new resume_up_to_kb agent setting lets a follow-up or Wrap-up prompt resume the last Claude Code conversation only while its transcript is at most that many kilobytes; a bigger one starts a new session from the plan. In the TUI, o l and a key opens one of the plan's logs in your text editor in a new terminal, and o L opens it in this one: c the checks gate, s the security review, b the worktree's bootstrap, w the worker's own check, and l the one that matters now (a gate that failed, else the newest). Setting [update] check_every (for example "1d", at least an hour) in the global config makes the TUI ask GitHub for orc's newest release at most that often, after the screen is drawn, and show a quiet X.Y.Z available: orc update in the status gutter when one is out. orc changelog --unreleased reads the unreleased fragments of the orc checkout you are in as they are now, so a fragment that landed after your build shows without a rebuild. orc check runs the project's checks in a plan's worktree, agents included, and prints one result: a pass in one line, or the failing check with its exit status and the tail of its output, then the path of a private log that holds everything. orc update --check asks GitHub, through gh, whether a newer release of orc is out and shows that release's notes; it installs and writes nothing. orc update installs the newest release over the running binary. Each release now carries a signature over its checksums by a trusted release key; after the first signed release, only a key the previous release already trusts can sign. Each build of orc now carries the list of keys trusted to sign its releases, and orc version --json reports that list's hash as signers (null when a build has none). A checks or security gate, and the checks F runs, keep the run's output in a private log of up to 1 MiB, and orc plan gates names that log under a passed or failed answer (log in --json), so you can read why the checks failed at a head instead of running them again. The detail pane's bottom border now names the keys that change it: d for the body or the diff, m for rendered or raw, and the steps between changes in the diff view. While the checks gate has no fresh answer, the TUI's gates: line and orc plan gates show the agent's own last orc check at the current head as a hint, such as agent: passed at 1a2b3c4 6 minutes ago. Below 1.0 the release task proposes a patch release for features and fixes and a minor release only for a breaking change.

Features

After /clear or /compact in a plan's worktree, the Claude Code hook now tells the session which plan it is on and where its state lives: the plan's Outcome and Wrap-up, the branch's commits and orc plan changes. A cleared worker carries on from the plan and git instead of a summary.
The release task's final confirmation lists every key the release will trust and how the list changed since the previous release. The README explains how to verify a downloaded release against the trusted keys from the repository at its tag.
A dev build's release notes open with an Unreleased section listing the changes since the last release, as of the commit it was built from, so orc changelog and the help's n show how far a local build has come. The notes that open once after an upgrade still go to the newest release and ignore it; rebuild to refresh the section.
Each release now publishes its trusted-key list as an allowed_signers asset, and its signed SHA256SUMS gains a second line for it. A download whose list differs from the signed hash fails the checksum check, and a verified release's list can verify the next one.
Each release's signed checksums now name the release before it, and orc update follows those links from the newest release down to the one you run, so a release missing from the middle of the chain stops the update instead of being skipped. The checksums also name their format, so a release that needs a newer orc says so plainly.
orc plan finish and the TUI's merge panel warn, by name, about every file in the release-keys folder that the merge would change, including renamed and deleted ones, so you see a change to the trusted release keys before it lands. orc plan finish --status --json carries the same list as release_paths. It is a warning, not a refusal.
A new resume_up_to_kb agent setting lets a follow-up or Wrap-up prompt resume the last Claude Code conversation only while its transcript is at most that many kilobytes; a bigger one starts a new session from the plan. It is off unless set (always resume), and a plan with nothing under its Outcome is always resumed.
In the TUI, o l and a key opens one of the plan's logs in your text editor in a new terminal, and o L opens it in this one: c the checks gate, s the security review, b the worktree's bootstrap, w the worker's own check, and l the one that matters now (a gate that failed, else the newest). The chord lists only the logs that exist, with how each gate went and the log's age, and the detail pane names the key beside a failed gate's log.
Setting [update] check_every (for example "1d", at least an hour) in the global config makes the TUI ask GitHub for orc's newest release at most that often, after the screen is drawn, and show a quiet X.Y.Z available: orc update in the status gutter when one is out. It never installs anything, and is off unless set.
orc changelog --unreleased reads the unreleased fragments of the orc checkout you are in as they are now, so a fragment that landed after your build shows without a rebuild. It refuses outside a checkout of orc, and --json gives the section with the checkout and commit it read.
orc check runs the project's checks in a plan's worktree, agents included, and prints one result: a pass in one line, or the failing check with its exit status and the tail of its output, then the path of a private log that holds everything. It records nothing that finishing trusts, and skips a run that already passed at the same commit. Off a terminal, a wait for a check slot now prints one line when it starts and one when it ends, instead of a line every 15 seconds.
orc update --check asks GitHub, through gh, whether a newer release of orc is out and shows that release's notes; it installs and writes nothing. Only a published release can check: a build from source says to update with git pull and mise run install.
orc update installs the newest release over the running binary. It first verifies each release since yours, oldest first, against the release keys your build already trusts, so an install several key rotations behind still updates. It then shows what it verified and the release notes, asks before it installs, and checks that the new binary runs before it replaces the old one.
Each release now carries a signature over its checksums by a trusted release key; after the first signed release, only a key the previous release already trusts can sign. The release task compares the trusted keys with the previous release's and asks the maintainer to type the full fingerprint of every key added or removed.
Each build of orc now carries the list of keys trusted to sign its releases, and orc version --json reports that list's hash as signers (null when a build has none). A release build refuses to build without a valid list, so every release can verify the next one.
A checks or security gate, and the checks F runs, keep the run's output in a private log of up to 1 MiB, and orc plan gates names that log under a passed or failed answer (log in --json), so you can read why the checks failed at a head instead of running them again. orc wt prune removes the logs of plans that are gone, and of finished, pruned plans whose last run is over 14 days old, and lists what it would delete first.
The detail pane's bottom border now names the keys that change it: d for the body or the diff, m for rendered or raw, and the steps between changes in the diff view. Its title says only where you are, such as Changes since last ack · rendered · change 1/1. The plan list stops offering d and m while the detail pane is on screen, and plan zoom leads its border with the same keys.
While the checks gate has no fresh answer, the TUI's gates: line and orc plan gates show the agent's own last orc check at the current head as a hint, such as agent: passed at 1a2b3c4 6 minutes ago. It is advisory only: the gate letters, to finish and finishing never read it, and it disappears once the gate answers.
Below 1.0 the release task proposes a patch release for features and fixes and a minor release only for a breaking change. The review offers a major release at [M] major, which proposes 1.0.0 from 0.x.

Fixes

Stopping an idle worker before an update, a park or a prune no longer refuses when the agent's process names itself after its version, as a native Claude Code install does. orc marks the pane it starts an agent in and knows that pane by the mark, for any agent tool, and kills a lone pane only while it is still in the session orc resolved.
A plan that reads reply now says how to clear it: the bottom border offers a reviewed, the stage: line reads reply (a marks it seen; Enter opens the agent), and the finish: line says ready (F), after the reply (a). The merge confirm puts y merges ... first and the way back to review after it, so it no longer reads as if F were the next key.
When orc cannot tell which pane of a worker's tmux session is the agent's, the TUI no longer stops at a refusal: S, parking, the update and the prune after a finish offer to stop the whole session, naming what its other panes run, and carry on after y. orc agent stop --session lists those programs too, and asks first at a terminal.
A plan whose agent writes its Wrap-up or an Outcome note with orc plan note no longer reads changes in the TUI and is no longer held back from to finish: the note moves the "last read" snapshot by exactly the text it writes, so edits nobody has acknowledged still show and the note does not. When it cannot do that cleanly, it leaves the snapshot alone and warns.
When a newer release uses a checksum format this orc cannot read, orc update now offers the newest release it can read and names the one that needs it first, instead of refusing every update for good; a failed check still refuses outright. The release task now finishes a release whose upload failed even after main has moved past its tag.
With the related lens on, ] r and [ r now stop on the lens's anchor as well as its related plans, so [ r always undoes ] r. A count counts the anchor as one stop.
The check no longer reports passed for a failed run when it cannot write its log, as on a full disk. A step passes only when its own exit status comes back as 0 and its output reached the log; otherwise the check says it could not write the log and exits non-zero.
The release, its dry run and a dev package now check and build cold in a target directory of their own, so nothing another process leaves in a shared build directory can end up in a published binary. They also turn off compiler wrappers and never install a toolchain mid-run, and a dev package no longer speaks of publishing.
An error running tmux shows the program name with its control characters escaped. The doctor accepts an absolute program path up to the platform's own limit, so a long path that Linux can run is no longer refused as unusable.
Loading a trust record over its size limit no longer checks every project directory it names, so a hung network mount cannot stall orc status, finish, hooks or the TUI. orc trust --prune looks at each directory again after you answer y and keeps one that was recreated meanwhile, and an approve that would overflow the record suggests pruning only when something would be removed. An approve now refuses, instead of silently dropping it, a top-level key in the record that orc does not write.
A gate, orc check or a relations sweep now frees its plan lock the moment it ends. Before, a command another part of orc was starting at that instant could keep the lock held briefly, so a finish or a second gate started right after it could refuse with "already running".

Other changes

real_tmux_forks_only_the_panes_processes races a short-lived tmux child under load
tab_title_cli's plan-session test races the tmux server's exit under load
Name the resume limit for what it does: resume_up_to_kb, and a new session from the plan

0.5.0 2026-10-27

This release adds 13 features and fixes 12 problems. The TUI's status line shows the check queue as a chip, ⚙1 ◷2 (checks running and waiting for a slot), and a plan's detail says when its check runs or waits for a slot and who holds it. orc agent stop now reaches a plan's refine session (--refine PLAN or PLAN+refine), stops a session by its exact name with --session, and closes every idle, detached refine session of the project with --refine-idle [--idle-for 10m] after a preview. With the related lens on, ] r and [ r select the next and previous related plan in the list, skipping the unrelated rows, while the lens keeps its anchor. Leaving a search with Esc keeps the plan you were on selected in the full list, instead of moving to another row. Plan zoom's f view lists the plan's open questions above its @@ feedback, with the same counts as the plan list's ?N and @@N cells, so Space f shows both at any terminal width, including a narrow one with no detail pane. On a terminal under 100 columns, ' opens a card over the list with the Related rows and their jump labels, so ' and a label jumps as it does on a wide terminal. orc doctor lists every program orc may run: git, tmux, mise, gh, fzf, your editor and the agent CLIs your templates name, each with where it was found or that it is missing. orc projects list shows each project registered in the global config with its state (ok, MISSING or NOT A PROJECT), so a moved or deleted project no longer just disappears from the TUI. orc trust --prune removes the approvals of project directories that no longer exist, so a trust record that grew past its size limit can be repaired without editing it by hand. Each build carries its release notes: orc changelog prints them, newest first, and orc version --json gives a release's date. S on the Plans and Agents tabs stops a plan's worker or refine session from the TUI. A plan session's tab title now ends in main or wt, so you can tell whether a refine runs in the main checkout or in the plan's worktree. The TUI's help opens with the build's version, and its n key shows the release notes in a read-only view.

Features

The TUI's status line shows the check queue as a chip, ⚙1 ◷2 (checks running and waiting for a slot), and a plan's detail says when its check runs or waits for a slot and who holds it. The status line's right end is reordered so items keep their places as it narrows, the pty warning is shorter, and a relate sweep says when it starts and ends in messages instead of a status-line item.
orc agent stop now reaches a plan's refine session (--refine PLAN or PLAN+refine), stops a session by its exact name with --session, and closes every idle, detached refine session of the project with --refine-idle [--idle-for 10m] after a preview. Every stop now leaves another project's sessions and the user's other panes alone, and stopping a refine session removes the records it left behind.
With the related lens on, ] r and [ r select the next and previous related plan in the list, skipping the unrelated rows, while the lens keeps its anchor. A count goes that many related plans on, and a message says how many related plans the filter hides when there are none left to reach.
Leaving a search with Esc keeps the plan you were on selected in the full list, instead of moving to another row. A jump list takes you back through the places you jumped from: Ctrl-o or [ j goes back and ] j goes forward, on the Plans and Agents tabs.
Plan zoom's f view lists the plan's open questions above its @@ feedback, with the same counts as the plan list's ?N and @@N cells, so Space f shows both at any terminal width, including a narrow one with no detail pane.
On a terminal under 100 columns, ' opens a card over the list with the Related rows and their jump labels, so ' and a label jumps as it does on a wide terminal. '' still goes back, and Esc closes the card without moving the selection.
orc doctor lists every program orc may run: git, tmux, mise, gh, fzf, your editor and the agent CLIs your templates name, each with where it was found or that it is missing. A program found only in a PATH entry orc leaves out, or configured inside a worktree, is named with the reason. A missing git fails the check; the others warn.
orc projects list shows each project registered in the global config with its state (ok, MISSING or NOT A PROJECT), so a moved or deleted project no longer just disappears from the TUI. orc projects add DIR registers a set-up git checkout, and orc projects rm DIR (or the project's name) forgets an entry even when its directory is gone. Edits to the project list from the TUI and the command line at the same moment no longer lose one of them.
orc trust --prune removes the approvals of project directories that no longer exist, so a trust record that grew past its size limit can be repaired without editing it by hand. The refusal for an oversized record and orc doctor now point at it.
Each build carries its release notes: orc changelog prints them, newest first, and orc version --json gives a release's date.
S on the Plans and Agents tabs stops a plan's worker or refine session from the TUI. A panel names the session, says whether its agent is working and who is attached, and only y stops it; a session that changed since you were asked is left alone.
A plan session's tab title now ends in main or wt, so you can tell whether a refine runs in the main checkout or in the plan's worktree. The plan's detail, the agent detail and orc agent list say the same, from where tmux started the session.
The TUI's help opens with the build's version, and its n key shows the release notes in a read-only view. After an upgrade, the TUI opens those notes once at the new release; [hints] whats_new = false keeps them closed.

Fixes

When orc cannot find git, tmux, gh or an agent program, the error now names the program and ends with "run orc doctor", which says what is missing and where orc looked. A working directory that has gone away is reported as such instead of being blamed on a missing program. orc doctor also accepts absolute program paths longer than 255 bytes.
The release notes build again: a project command's placeholders no longer read as HTML. The full check now reads every release-note fragment, so a bad one fails the check instead of the release.
A release-note fragment may now be named after any plan slug, however long the plan's title, so a long title no longer stops the release notes from building.
A sub-bullet indented under a question's text, such as two spaces under * Decided: ..., now belongs to that question instead of counting as a new open one, so the plan list no longer shows phantom ?N counts and Enter no longer offers a refinement such a plan does not need.
Stopping an agent's worker session (orc agent stop, S in the TUI, parking, an update or a finish's prune) now frees its place under the agent cap at once, instead of holding it for up to two minutes after the start.
Agents hosted in tmux and commands opened in the Terminal app now always run under the system's POSIX sh, so their quoting holds when your login shell is fish or another non-POSIX shell. Your shell's own start-up files, such as zsh's .zshenv or fish's config file, are no longer read before an agent starts, though the agent still inherits the environment you exported. A window you open yourself in an orc tmux session still uses your own shell; orc is tested with tmux 3.x.
Refusals, hints, agent prompts and the docs now consistently call the person running orc "the user".
orc now leaves out PATH entries inside worktrees (orc's and Claude Code's) and the context dir, and entries with . or .., so a program an agent plants there never runs for you or another agent. Every agent starts with orc's own cleaned PATH, even on a tmux server started earlier, and orc doctor lists what was left out.
orc version --json now gives a date for every build, release or development, taken from the built commit's date in UTC, with date_source saying so. A build without a changelog, or with an undated one, no longer loses its date.
The release check no longer fails on the staged release tree, which has no release-note fragments left once the changelog replaces them.
When the trust record cannot be read, the finish checks, the security review, the start prompt and Linear writes now say why, and a record over its size limit names its size and how to fix it. Approving refuses rather than grow the record past that limit, and the app's tests no longer write to your trust record.
A hosted agent now starts in exactly its worktree when the path holds # or ends in ;: tmux no longer rewrites the directory, runs a command named in it, or splits the start command there. A tool name ending in ; is recorded as it is.

0.4.0 2026-10-26

First versioned release.