feat(agent-dashboard): persist hook status across Orca restart

[brennanb2025]

Summary

• Persists the hook server's per-pane lastStatusByPaneKey to userData/agent-hooks/last-status.json (atomic write, 250ms trailing debounce, sync flush on stop()). Fixes done, blocked, and quiet working rows winking out after restart.
• Adds an agentStatus:drop IPC so renderer dismissals (dropAgentStatus, dismissRetainedAgentsByWorktree) propagate to the main-process cache and the on-disk file, preventing dismissed rows from resurrecting on relaunch.
• Adds a bounded bootstrap queue in useIpcEvents so setListener() replay during window creation isn't dropped while App.tsx is still hydrating tabsByWorktree; drains on the workspaceSessionReady false→true transition.
• Hydrate path now cleans the stale on-disk file synchronously when sanitize drops entries (drift, TTL, schema mismatch), and logs a single [agent-hooks] last-status hydrate dropped N entries (kept M) warn for visibility. Pre-fix, corrupt/stale entries stayed on disk until a fresh hook event triggered a debounced write.
• Post-merge with main: persistence/hydration are unconditional (the old experimentalAgentDashboard runtime gate is gone — only remains in persistence migration code). agentStatus:set is forwarded from main unconditionally with receivedAt and stateStartedAt.

Test plan

• pnpm typecheck (pnpm run tc:node, pnpm run tc:web)
• pnpm test src/main/agent-hooks/server.test.ts (persistence/hydration tests)
• pnpm test src/main/ipc/agent-hooks.test.ts (IPC handler tests)
• pnpm test src/renderer/src/store/slices/agent-status-drop-ipc.test.ts (slice IPC fan-out)
• pnpm test src/renderer/src/hooks/agent-status-bootstrap-queue.test.ts (queue/drain/cap)
• Existing useIpcEvents.test.ts mocks updated for useAppStore.subscribe
• Focused agent-status test suite: 114 tests pass post-merge
• server.test.ts + agent-hooks.test.ts: 80/80 pass after hydrate-cleanup fix

Manual — verified via synthetic hook POSTs + CDP introspection on a dev build

Driven by sending real Claude-shaped payloads to the loopback hook server, then reading last-status.json and window.api.agentStatus.getSnapshot() to confirm behavior. Quit/relaunch was the actual quit/relaunch of an Electron dev instance.

• Synthetic event roundtrip: POST /hook/claude with a Stop payload writes a v2 envelope at last-status.json (mode 0o600); getSnapshot() returns the entry with receivedAt/stateStartedAt.
• agentStatus:drop IPC: renderer call removes the entry from both the snapshot and the on-disk file within ~250ms.
• Live overwrite of hydrated row: hydrated done entry + live UserPromptSubmit POST for the same paneKey → entry transitions to working with the new prompt and fresh receivedAt; on-disk file follows; no duplicate.
• Corrupt JSON: truncated file → single [agent-hooks] last-status file is not valid JSON; ignoring warn; empty snapshot; dashboard renders normally.
• Missing file: cold start with no file → no warns; empty snapshot.
• Old version field: "version": 1 envelope → version mismatch (1 != 2); ignoring; empty snapshot.
• tabId/paneKey drift rejected (with disk cleanup): file with one good entry + one entry whose tabId disagrees with the paneKey prefix → only the good one hydrates; drift entry purged from last-status.json synchronously during hydrate; single dropped 1 entries (kept 1) warn.
• TTL cap (with disk cleanup): 5 fresh entries + 5 entries with receivedAt 10 days old → only the 5 fresh entries hydrate (HYDRATE_MAX_AGE_MS = 7d); 5 stale entries purged from last-status.json synchronously during hydrate; single dropped 5 entries (kept 5) warn.

Manual — acknowledgedAgentsByPaneKey persistence + hydrate sanitizer (this branch's last two commits)

Verified the latest changes (d6827bd3 + bff99897) on a dev build with an isolated ORCA_DEV_USER_DATA_PATH=/tmp/orca-ack-restart-test, driving acknowledgeAgents and the persistence pipeline through CDP and inspecting orca-data.json directly.

• Fresh cold start: getDefaultUIState() writes ui.acknowledgedAgentsByPaneKey: {} to orca-data.json; in-memory map matches.
• Disk write through the existing debounced save: acknowledgeAgents(['tab-test-1:0', 'tab-test-2:0', 'tab-test-3:1']) → after the 150ms App.tsx debounce + 300ms persistence debounce, all 3 keys land under ui.acknowledgedAgentsByPaneKey with valid timestamps. Confirms the new field is wired into the existing window.api.ui.set effect.
• Round-trip restore across quit/relaunch: quit the dev process, relaunch with the same userData → hydratePersistedUI restores the exact same 3 keys with their pre-quit timestamps.
• Hydrate sanitizer drops bad/stale shapes: hand-edited orca-data.json to inject a mix of valid + malicious entries (TTL-expired @ 8d, negative, zero, non-numeric, __proto__ / constructor / prototype keys, plus 2 valid entries within the 7d TTL). After relaunch, only the 2 valid entries hydrated. No Object.prototype pollution from the __proto__ key.
• On-disk cleanup follows hydrate: triggering one new ack post-hydrate caused the next ui:set write to overwrite orca-data.json with only the sanitized + new entries — all injected garbage was gone from disk.

Manual — still requires a real agent to verify end-to-end (not yet done)

• Real done agent restart: row reappears within first dashboard frame.
• Real blocked Claude restart: row reappears with prompt + tool name.
• Real quiet working restart: last-known row reappears; updates naturally on next event.
• Dismiss stickiness via the X button across restart.
• Worktree archive purges entries from last-status.json across restart.
• Startup timing across many restored tabs/worktrees: no orphan rows for missing tabs.
• Cursor/opencode sidebar title/status indicators still animate from hook state.

Made with Orca 🐋