Summary

Adds user-configurable keybindings backed by a hand-edited TOML file. Yes it's kind of a massive PR . . .

• Introduces a shared keybinding catalog with action IDs, platform defaults, shortcut surfaces, commands, chord parsing, matching, display labels, and conflict diagnostics.
• Loads overrides from ~/.orca/keybindings.toml on macOS/Linux and %USERPROFILE%\.orca\keybindings.toml on Windows.
• Wires the effective keymap through main-process IPC/preload and the window, browser, menu, terminal, paste, xterm bypass, and Settings surfaces.
• Updates Settings > Shortcuts to show effective bindings, source, diagnostics, and Open/Reveal/Reload actions.
• Creates a complete commented starter TOML from the catalog, so users can see every supported action without freezing current defaults as overrides.

Background and scope

This PR was not requested. Don't feel obligated to merge it if keyboard rebinding is out of scope for Orca right now, or if you would rather continue through another branch. I opened it as my best attempt to match the scope discussed in prior work and so that i could make orca functional on my linux system since the hardcoded keybindings were causing havoc.

• feat: display hot key mappings in settings #173 added Settings shortcut discoverability. This keeps Settings as the discovery surface instead of hiding the feature in docs only.
• feat: customizable keyboard shortcuts #499 showed a direct attempt at editable shortcuts. Maintainers noted there that keyboard shortcut rebinding is desired, but larger. This PR keeps v1 narrower with TOML plus explicit reload instead of a full in-app editor.
• fix: audit terminal shortcut interception #519 centralized shortcut interception and made the reservation surface auditable. This PR tries to preserve that by routing shortcut surfaces through one effective keymap instead of adding another ad hoc shortcut path.
• refactor(terminal): declarative shortcut chord table #859 moved terminal shortcuts toward declarative tables. This PR extends that direction with a catalog for the audited shortcut surfaces, including terminal-specific behavior.

Behavior notes

• Override values can be a single chord string, an array of chord strings, or "none".

[keybindings.linux]
# Single chord string
"terminal.clear" = "ctrl+k"

# Array of chord strings
"terminal.paste" = ["ctrl+v", "ctrl+shift+v", "shift+insert"]

# Unbind an action
"sidebar.left.toggle" = "none"

• A user override replaces the full chord set for that action on the active platform.
• Invalid TOML, unknown actions, invalid chords, and conflicts produce diagnostics while Orca keeps running with defaults.
• does not allow arbitrary PTY byte sequences; terminal input is configurable only through named catalog actions.

Visual change

Settings > Shortcuts now includes the config path, Open/Reveal/Reload actions, diagnostics, source labels, and the effective keybinding list.

AI code review summary

Cross-platform compatibility: checked shortcut platform handling, labels, and paths. The implementation maps Node platforms to macos, linux, and windows, uses path.join for the user config path, keeps Windows display paths explicit, preserves platform-specific defaults in the catalog, and keeps Electron menu accelerators on platform-aware paths.

Security: checked local file parsing and IPC exposure. The TOML file is read from the user's home directory only, parsed with smol-toml, never evaluated, and invalid entries are ignored with diagnostics. The new IPC surface returns keybinding snapshots, reloads the local config, and opens/reveals the local config file; it does not expose secrets or run user-supplied commands.

Testing

• pnpm lint (passes with existing warnings in unrelated GitHub project components)
• pnpm run typecheck:node
• pnpm run typecheck:web
• pnpm run build (build passed; local dev CLI symlink creation under /usr/local/bin reported permission denied but exited successfully)
• pnpm vitest run --config config/vitest.config.ts src/shared/keybindings/*.test.ts src/shared/window-shortcut-policy.test.ts src/main/keybindings/*.test.ts src/main/ipc/keybindings.test.ts src/main/menu/register-app-menu.test.ts src/main/browser/browser-guest-ui.test.ts src/renderer/src/components/terminal/app-shell-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-paste-keybinding.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts src/renderer/src/store/slices/keybindings.test.ts
• pnpm run test:e2e -- tests/e2e/keybindings-config.spec.ts
• pnpm test was attempted locally, but unrelated orchestration/runtime tests failed because the checked-out better-sqlite3 native module was built for a different Node ABI (NODE_MODULE_VERSION 145 vs local Node's 137). The keybinding-specific suite above passed.

X handle: @hampsonw