orca - Moses Yebei

Abstract

Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop and mobile.

The Problem

Running multiple coding agents (Codex, ClaudeCode, OpenCode) side-by-side is chaotic. Each agent needs its own worktree, terminal, and context, and there's no unified way to monitor them once they're running. Orca solves this by giving you one desktop app to orchestrate a fleet of parallel agents, plus a mobile companion to check on them remotely.

What This Does

Orca is a desktop application (Electron + React) that lets you fan a single prompt across multiple agents, each in its own isolated git worktree. It provides a terminal with WebGL rendering, a "Design Mode" that captures HTML/CSS/screenshots from a Chromium window into agent prompts, and a mobile companion app (Expo/React Native) for remote monitoring and follow-ups.

The repo is actually a collection of four self-contained projects: src/ (the desktop app, 5,321 files), mobile/ (the companion app, 505 files), config/ (build/CI scripts, 125 files), and native/ (17 files). The desktop app is the substantial one; the mobile app is a thin client that talks to it.

How It Is Wired

The desktop app's entry point is src/cli/index.ts, which boots the Electron shell. The core orchestration lives in src/ — this is where worktree management, agent spawning, and terminal handling happen. The mobile/app/index.tsx and mobile/app/h/[hostId]/index.tsx files handle the mobile client's navigation, connecting to a host machine running the desktop app.

The system talks to the outside world in a few ways: it spawns agent processes (the node-pty patch in config/patches/ handles pseudo-terminals), it uses git worktrees for isolation, and it exposes a relay for mobile connectivity (config/scripts/build-relay.mjs). The src/cli/runtime/index.ts is the runtime entry point that wires these together.

The widest blast radius is in src/ — it's the hub everything routes through. Changing how agents are spawned or how worktrees are managed affects the entire desktop experience. The mobile app is deliberately thin; it delegates orchestration to the desktop host.

How To Use It

Setup: The repo uses pnpm. Install dependencies with:

pnpm install

Running: The desktop app entry point is src/cli/index.ts. For development, you'd typically run the Electron app via the package scripts in package.json. The mobile app has its own mobile/package.json and uses Expo.

Configuration: There's no documented .env file or required API keys in the repo structure. The config/ directory holds build scripts and Electron builder config, not runtime secrets.

Missing: There's no Dockerfile and no documented setup steps in the README excerpt. The actual run commands would come from the scripts field in package.json, which isn't in the visible file list.

Real-World Use

A practical workflow: you're building a feature and want three approaches evaluated. You write one prompt, fan it across three agents in separate worktrees, and let them run in parallel. Orca shows you the results side-by-side, you pick the winner, and merge its worktree. Meanwhile, you step away — the mobile app notifies you when each agent finishes, and you can send follow-up prompts from your phone.

Code Health & Issues

Static analysis found 9 issues (0 critical, 2 high, 6 medium, 1 low):

High - Pin third-party GitHub Actions to commit SHAs - .github/workflows uses pnpm/action-setup@v6, maxim-lobanov/setup-xcode@v1, ruby/setup-ruby@v1, nick-fields/retry@v4. Tags can be moved, which is how tj-actions/changed-files leaked secrets.
High - Open a PR instead of pushing to main - .github/workflows/release-cut.yml runs git push origin "HEAD:refs/heads/main", bypassing test gates.
Medium - Declare least-privilege permissions for GITHUB_TOKEN - mobile-ios-release.yml references secrets without declaring permissions.
Medium - Enable Dependabot/Renovate - 4 manifests, no update bot.
Medium - Add dependency vulnerability scan to CI - no dependency-review-action or osv-scanner.
Medium - Move docs/assets/readme-feature-showcase.gif (8.2MB) to Git LFS.
Medium - Remove generated build output from resources/ (5 files committed).
Medium - Set persist-credentials: false on checkout in computer-e2e.yml.
Low - Add timeout-minutes to workflow jobs (3 workflows lack it).

The repo has tests (2,391 test files), CI, a license, and a lockfile. No committed secrets were found.

The Bottom Line

Orca is a well-structured, serious tool for a real pain point: managing parallel coding agents. The desktop app is substantial and the mobile companion is a sensible extension. The CI hygiene issues are fixable and worth addressing before this becomes a production dependency. If you run multiple agents daily, this is worth a look; if you're a one-agent shop, the complexity may not pay off.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

6,335 files

TypeScript4857
TSX1061
Markdown67
JSON44
YAML22
Swift18

ReactExpressRails

Dependencies

25 of 50 declared dependencies are a major version behind. Resolved 48 of 50 against the registry.

Package	Declared	Latest	Behind
`expo`	^55.0.23	57.0.13	2 major
`expo-build-properties`	^55.0.13	57.0.13	2 major
`expo-camera`	^55.0.18	57.0.4	2 major
`expo-clipboard`	^55.0.13	57.0.1	2 major
`expo-constants`	^55.0.16	57.0.11	2 major
`expo-crypto`	^55.0.14	57.0.1	2 major
`expo-dev-client`	~55.0.35	57.0.14	2 major
`expo-document-picker`	^55.0.13	57.0.1	2 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium6

low1

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

pnpm/action-setup@v6, maxim-lobanov/setup-xcode@v1, ruby/setup-ruby@v1, nick-fields/retry@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Open a pull request instead of pushing to the default branchhigh

.github/workflows/release-cut.yml

git push origin "HEAD:refs/heads/main"

Automated commits land on the branch that deploys, with no test having run against the result.

Fix: Push to a bot branch and open a pull request, or restrict the push to a tag ref.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/mobile-ios-release.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

4 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

docs/assets/readme-feature-showcase.gif

1 blobs over 5MB: readme-feature-showcase.gif 8.2MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Remove generated build output from version controlmedium5 occurrences

resources

5 generated files committed

The reviewer reads src, production runs dist, and a stale bundle means the fix that was reviewed is not the code that executes.

Fix: Gitignore the output directory and build in CI.

Set persist-credentials: false on checkoutmedium

.github/workflows/computer-e2e.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/computer-e2e.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.