@inetafrica/open-claudia 3.5.20 → 3.5.23

package/core/providers/utility-policy.js

@@ -84,13 +84,29 @@ function parseProviderFallbacks(value) {
   return result;
 }
 
+// The provider of work with a person behind it is that person's; work with
+// nobody behind it (the dream, introspection, a check outside any chat) runs
+// on the bot's own provider: the one its owner chats on (/backend and /login
+// set it). It used to take the first provider that did not look signed out,
+// so on 9 Oct 2026 every Codex bot's dream ran on a signed-out Claude.
+function ownerActiveProvider() {
+  try {
+    const owner = require("../identity").ownerCanonical();
+    if (!owner) return null;
+    const state = require("../state");
+    return state.getActiveProvider(state.getUserState(owner));
+  } catch (_) {
+    return null;
+  }
+}
+
 function defaultActiveProvider(env = process.env) {
   const inherited = String(env?.OC_PROVIDER || process.env.OC_PROVIDER || "").trim().toLowerCase();
   if (PROVIDER_ID_SET.has(inherited)) return inherited;
+  let canonicalUserId = null;
+  try { canonicalUserId = require("../context").currentCanonicalUserId(); } catch (_) { canonicalUserId = null; }
+  if (!canonicalUserId) return ownerActiveProvider();
   try {
-    const { currentCanonicalUserId } = require("../context");
-    const canonicalUserId = currentCanonicalUserId();
-    if (!canonicalUserId) return null;
     const state = require("../state");
     return state.getActiveProvider(state.getUserState(canonicalUserId));
   } catch (_) {
@@ -98,6 +114,16 @@ function defaultActiveProvider(env = process.env) {
   }
 }
 
+// With no active provider at all: the one a new chat starts on (DEFAULT_PROVIDER,
+// else the first installed), as for a chat turn; then the first runnable.
+function registryDefaultProvider(registry) {
+  try {
+    const selected = typeof registry.selectDefaultProvider === "function" ? registry.selectDefaultProvider()?.providerId : null;
+    if (selected && PROVIDER_ID_SET.has(selected) && runnableStatus(registry, selected).runnable) return selected;
+  } catch (_) { /* fall through */ }
+  return registryProviders(registry).find((providerId) => runnableStatus(registry, providerId).runnable) || null;
+}
+
 function registryProviders(registry) {
   try {
     const listed = registry.listProviders();
@@ -189,9 +215,7 @@ function createUtilityPolicy(options = {}) {
       if (active) preferred = normalizeProvider(active);
       else {
         const globalDefault = envValue(env, "DEFAULT_PROVIDER");
-        preferred = globalDefault
-          ? normalizeProvider(globalDefault)
-          : (registryProviders(registry).find((providerId) => runnableStatus(registry, providerId).runnable) || null);
+        preferred = globalDefault ? normalizeProvider(globalDefault) : registryDefaultProvider(registry);
       }
     }
     if (!preferred) {
@@ -267,6 +291,7 @@ module.exports = {
   UtilityPolicyError,
   createUtilityPolicy,
   defaultActiveProvider,
+  ownerActiveProvider,
   exactModelOverride,
   normalizePurpose,
   normalizeTier,

package/core/runner.js

@@ -15,7 +15,7 @@ const {
 const {
   currentState, saveState, recordSession,
   resetSessionUsage, admitLane, cancelTargets, getActiveProvider, getProjectKey,
-  laneFor, laneForRun, peekLane, laneBusy, runLaneKey, waitingLanes, slotBlocker, pruneIdleLanes,
+  laneFor, laneForRun, peekLane, laneBusy, runLaneKey, waitingLanes, slotBlocker, pruneIdleLanes, findQueued,
   getProviderSession, setProviderSession, clearProviderSession, quarantineProviderSession, getUsageForSession, commitProviderCompaction, commitBranchCompaction,
   resolveProviderSettings, getProjectSessions,
 } = require("./state");
@@ -26,7 +26,7 @@ const usageLimits = require("./usage-limits");
 const limitPickup = require("./limit-pickup");
 const { getProvider, resolveProviderForRun } = require("./providers");
 const { validateInvocation } = require("./providers/contract");
-const { selectTerminalText } = require("./providers/events");
+const { providerFailureCode, selectTerminalText } = require("./providers/events");
 const {
   bindRunInputs,
   captureRunContext,
@@ -581,7 +581,7 @@ async function executeProviderInvocation(options = {}) {
     const event = rawErrors[0];
     failure = stableRunError(
       event.message || "Provider reported an error",
-      event.refusal ? "PROVIDER_REFUSAL" : (event.authError ? "PROVIDER_UNAUTHENTICATED" : (event.usageLimit ? "PROVIDER_USAGE_LIMIT" : "PROVIDER_EVENT_ERROR")),
+      providerFailureCode(event, "PROVIDER_EVENT_ERROR"),
       event,
     );
   } else if (closeInfo.code !== 0) failure = stableRunError(`Provider process exited with code ${closeInfo.code}`, "PROVIDER_NONZERO_EXIT", { exitCode: closeInfo.code });
@@ -620,6 +620,9 @@ async function executeProviderInvocation(options = {}) {
     delivery,
     timings: { startedAt, finishedAt: null, durationMs: null },
   };
+  // Every run, whatever its purpose, keeps the limit record current: a limit
+  // hit marks the provider used up until its reset, a run that worked clears it.
+  noteRunLimit(result, runContext);
 
   const runStage = async (name, hook) => {
     if (!hook) return;
@@ -1773,6 +1776,23 @@ function limitPlanFor(result, runContext) {
   return keepOnResult(result, "limitPlan", plan);
 }
 
+// The limit record (core/usage-limits.js) background work reads: a run a
+// limit stopped marks the provider used up until the reset; a run that
+// worked clears it. Never throws.
+function noteRunLimit(result, runContext) {
+  try {
+    const provider = runContext?.provider || result.provider;
+    if (result.ok) { usageLimits.clearLimitBlock(provider, { model: runContext?.providerSettings?.model || null }); return; }
+    if (result.error?.code !== "PROVIDER_USAGE_LIMIT") return;
+    const hit = usageLimits.limitHitDetails({
+      provider, error: result.error, rateLimit: result.rateLimit, windows: planLimitWindows(result, runContext || {}),
+    });
+    if (hit?.resetsAt) usageLimits.noteLimitHit({ provider, limitType: hit.limitType, resetsAt: hit.resetsAt });
+  } catch (error) {
+    console.warn(`[usage-limits] limit record: ${redactSensitive(String(error.message || error))}`);
+  }
+}
+
 // Remember each window's use; the warnings now due (80% / 95%, once per
 // window). A run that cannot show them only updates the use, so the warning
 // is still due on the next turn that can.
@@ -2637,16 +2657,18 @@ function cancelQueuedCallOnAbort(lane, item) {
 
 // Admit waiting lanes into free slots: every lane with queued work and no run,
 // oldest waiting message first, as far as the caps allow. An admitted lane runs
-// its next queued message (one at a time within a lane) in that message's own
-// captured context. Called whenever a run, a compaction or a /stop frees a
-// lane, and synchronous up to the admission, so no newcomer can take a freed
-// slot ahead of a lane that was already waiting. Every state's lanes are
-// considered (the global cap is shared); the argument is kept for callers.
+// what waits in it as ONE turn: the person's queued messages together (see
+// takeQueueBatch), in the first message's captured context. Called whenever a
+// run, a compaction or a /stop frees a lane, and synchronous up to the
+// admission, so no newcomer can take a freed slot ahead of a lane that was
+// already waiting. Every state's lanes are considered (the global cap is
+// shared); the argument is kept for callers.
 function drainQueuedMessages(_state) {
   for (const { state, lane } of waitingLanes()) {
     if (laneBusy(lane) || !lane.messageQueue.length) continue;
     if (slotBlocker(state)) { lane.waitingForSlot = true; continue; }
-    const item = lane.messageQueue.shift();
+    const batch = takeQueueBatch(lane);
+    const item = batch.length > 1 ? mergeQueueBatch(lane, batch) : batch[0];
     item.disposeCallListener?.();
     lane.preparingRun = true;
     lane.waitingForSlot = false;
@@ -2666,6 +2688,163 @@ function queueInLane(lane, item) {
   return item;
 }
 
+// ── The queue: run together, remove one ────────────────────────────────
+// Messages a person sends while their conversation is busy used to run one
+// turn each, in series, every one answering without the others. Now, when the
+// lane frees, the queued messages run as one turn (QUEUE_BATCH=off restores
+// one at a time). Only plain chat messages from the same person, in the same
+// session, project, provider and model join; anything else (a scheduled run,
+// a side chat's follow-up, a limit pick-up, a live call) runs on its own, in
+// order. Up to QUEUE_BATCH_MAX (10) per turn.
+const QUEUE_BATCH_MAX = 10;
+function queueBatchOn() {
+  return !/^(off|false|0|no)$/i.test(String(process.env.QUEUE_BATCH ?? config.QUEUE_BATCH ?? "on").trim());
+}
+
+function queuedSender(item) {
+  return String(item?.store?.canonicalUserId || item?.runContext?.canonicalUserId || "");
+}
+
+function batchable(item) {
+  const runContext = item?.runContext;
+  return !!runContext
+    && !item.pendingSideChat
+    && !item.followMainRunId
+    && runContext.purpose === "foreground"
+    && !runContext.liveCall
+    && !runContext.limitPickup
+    && item.store?.adapter?.liveCall !== true;
+}
+
+function sameBatch(a, b) {
+  const x = a.runContext;
+  const y = b.runContext;
+  return !!queuedSender(a)
+    && queuedSender(a) === queuedSender(b)
+    && x.provider === y.provider
+    && (x.project?.dir || null) === (y.project?.dir || null)
+    && (x.sessionId || null) === (y.sessionId || null)
+    && (x.providerSettings?.model || null) === (y.providerSettings?.model || null);
+}
+
+// The next turn's messages, taken off the front of the lane's queue.
+function takeQueueBatch(lane) {
+  const first = lane.messageQueue.shift();
+  const batch = [first];
+  if (!queueBatchOn() || !batchable(first)) return batch;
+  while (lane.messageQueue.length && batch.length < QUEUE_BATCH_MAX) {
+    const next = lane.messageQueue[0];
+    if (!batchable(next) || !sameBatch(first, next)) break;
+    batch.push(lane.messageQueue.shift());
+  }
+  return batch;
+}
+
+function queueClock(ms) {
+  return new Date(ms).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit", hour12: false });
+}
+
+function batchPrompt(batch) {
+  const n = batch.length;
+  const parts = [`[${n} messages arrived while you were busy. Read them all, then reply once: answer each, and where a later one changes or cancels an earlier one, the later one wins.]`];
+  batch.forEach((item, index) => {
+    const at = Number(item.queuedAt);
+    const when = Number.isFinite(at) && at > 0 ? ` (${queueClock(at)})` : "";
+    parts.push(`--- Message ${index + 1} of ${n}${when} ---\n${item.runContext.userPrompt}`);
+  });
+  return parts.join("\n\n");
+}
+
+// One queue item for the whole batch: the first message's captured context
+// (its session and lineage), every message's text, images and files, and the
+// newest message as the one the reply answers. Every sender's caller gets the
+// one result; the journal keeps the batch as the first message's turn.
+function mergeQueueBatch(lane, batch) {
+  const first = batch[0];
+  const last = batch[batch.length - 1];
+  for (const item of batch.slice(1)) {
+    try { item.disposeCallListener?.(); } catch (_) {}
+  }
+  const runContext = deepFreeze({
+    ...bindRunInputs(first.runContext, {
+      userPrompt: batchPrompt(batch),
+      imagePaths: batch.flatMap((item) => item.runContext.imagePaths || []),
+      attachments: batch.flatMap((item) => item.runContext.attachments || []),
+      lastInputWasVoice: !!last.runContext.lastInputWasVoice,
+      voiceStream: !!last.runContext.voiceStream,
+    }),
+    replyToMsgId: last.runContext.replyToMsgId ?? first.runContext.replyToMsgId ?? null,
+  });
+  try { turnJournal.dropQueued(lane.key, batch.slice(1).map((item) => item.runContext.runId).filter(Boolean)); } catch (_) {}
+  const words = batch.map((item) => String(item.store?.inboundText || "").trim()).filter(Boolean);
+  const store = last.store ? { ...last.store, inboundText: words.join("\n\n") } : first.store;
+  console.log(`[queue] ${lane.key}: ${batch.length} queued messages run as one turn (run ${runContext.runId || "?"})`);
+  return {
+    runContext,
+    store,
+    queuedAt: first.queuedAt,
+    seq: first.seq,
+    text: batch.map((item) => item.text).filter(Boolean).join(" / "),
+    deferred: {
+      resolve: (result) => { for (const item of batch) item.deferred?.resolve(result); },
+      reject: (error) => { for (const item of batch) item.deferred?.reject(error); },
+    },
+  };
+}
+
+// The ✕ on a "Queued." notice takes that one message out of its queue
+// (callback "qx:<boot>:<seq>"). The boot id keeps a button from before a
+// restart from naming a message that got the same number since.
+const QUEUE_BOOT = crypto.randomBytes(3).toString("hex");
+
+function queueRemoveKeyboard(item) {
+  if (!item?.runContext || item.runContext.liveCall || !Number.isSafeInteger(item.seq)) return null;
+  return { inline_keyboard: [[{ text: "✕ Remove from queue", callback_data: `qx:${QUEUE_BOOT}:${item.seq}` }]] };
+}
+
+function queuedWords(item) {
+  const text = String(item?.text || item?.runContext?.userPrompt || "").replace(/\s+/g, " ").trim();
+  return text.length > 40 ? `${text.slice(0, 39)}…` : (text || "…");
+}
+
+// Only the person whose message it is, or the owner, in the chat it was sent in.
+function mayRemoveQueued(envelope, item, opts = {}) {
+  const channelId = item.store?.channelId || item.runContext?.channelId || "";
+  if (String(envelope?.channelId || "") !== String(channelId)) return false;
+  if (opts.isOwner === true) return true;
+  const sender = queuedSender(item);
+  return !!sender && String(envelope?.canonicalUserId || "") === sender;
+}
+
+async function handleQueueRemove(data, envelope, opts = {}) {
+  const [, boot, seqText] = String(data || "").split(":");
+  const seq = Number(seqText);
+  const noticeId = envelope?.action?.sourceMessageId || null;
+  const answer = (text) => (noticeId ? editMessage(String(noticeId), text) : send(text));
+  const hit = boot === QUEUE_BOOT && Number.isSafeInteger(seq) ? findQueued((item) => item.seq === seq) : null;
+  if (!hit) return answer("No longer queued: it already started (or was dropped). /stop cancels a running turn.");
+  const { lane, item } = hit;
+  if (!mayRemoveQueued(envelope, item, opts)) return send("That button belongs to another person.");
+  const index = lane.messageQueue.indexOf(item);
+  if (index >= 0) lane.messageQueue.splice(index, 1);
+  try { item.disposeCallListener?.(); } catch (_) {}
+  try { turnJournal.dropQueued(lane.key, [item.runContext?.runId].filter(Boolean)); } catch (_) {}
+  if (!lane.messageQueue.length) {
+    lane.waitingForSlot = false;
+    if (!laneBusy(lane)) stopLaneTyping(lane);
+  }
+  item.deferred?.resolve({
+    ok: false,
+    status: "cancelled",
+    runId: item.runContext?.runId || null,
+    provider: item.runContext?.provider || null,
+    project: item.runContext?.project || null,
+    error: { code: "QUEUE_REMOVED", message: "Removed from the queue" },
+  });
+  console.log(`[queue] ${lane.key}: removed queued message ${seq} (${lane.messageQueue.length} left)`);
+  return answer(`Removed from the queue: "${queuedWords(item)}"`);
+}
+
 // A refusal on a RESUMED session is almost always the safety classifier
 // rejecting flagged material in the old context — which every resume re-sends
 // — not the user's new message. Recovery: quarantine the poisoned session so
@@ -2781,6 +2960,16 @@ async function runAdmitted(runContext, state, store, capture, ownsAdmissionLock,
   const persistCapture = executionOptions.persistCapture !== false;
   const internalCapture = capture && !persistCapture;
   if (tracksMainRun) lane.activeRunContext = runContext;
+  // The turn after a /stop: the stopped request is in the session's history
+  // looking cut off, so this turn opens with a note that it was cancelled.
+  if (tracksMainRun && runContext.purpose === "foreground" && !runContext.liveCall) {
+    const stopped = turnJournal.takeStopped(runLaneKey(runContext));
+    if (stopped) {
+      const noted = bindRunInputs(runContext, { userPrompt: `${turnJournal.stoppedNote(stopped)}\n\n${runContext.userPrompt}` });
+      if (lane.activeRunContext === runContext) lane.activeRunContext = noted;
+      runContext = noted;
+    }
+  }
   // Turn journal "lock": a foreground chat turn that a restart cuts short is
   // resumed after boot (core/turn-journal).
   if (tracksMainRun) turnJournal.begin(runContext);
@@ -3010,7 +3199,8 @@ function runAgent(prompt, cwd, replyToMsgId, opts = {}) {
       const notice = admission.reason === "busy"
         ? (lane.isCompacting ? "Compacting context, will pick this up next…" : queuedNotice(lane.activeRunContext))
         : waitingNotice(admission.running);
-      send(notice, { replyTo: replyToMsgId }).catch(() => {});
+      const keyboard = queueRemoveKeyboard(item);
+      send(notice, keyboard ? { replyTo: replyToMsgId, keyboard } : { replyTo: replyToMsgId }).catch(() => {});
     }
     return deferred.promise;
   }
@@ -3110,6 +3300,9 @@ function runAgentSilent(prompt, cwd, label, opts = {}) {
 
 module.exports = {
   queuedNotice,
+  handleQueueRemove,
+  takeQueueBatch,
+  mergeQueueBatch,
   waitingNotice,
   deliverForegroundResult,
   drainQueuedMessages,

package/core/scheduler.js

@@ -44,6 +44,10 @@ const { providerStatus: defaultProviderStatus } = require("./providers");
 const { redactSensitive } = require("./redact");
 
 const MISSED_WAKEUP_GRACE_MS = 60 * 60 * 1000;
+// A new occurrence starts with no usage-limit wait behind it.
+const LIMIT_WAIT_CLEARED = Object.freeze({
+  limitWaitCount: 0, limitWaitUntil: null, limitWaitType: null, limitWaitProvider: null, limitFirstHitAt: null,
+});
 const RETRY_DELAY_MS = 30 * 1000;
 const BUSY_DELAY_MS = 30 * 1000;
 // A watch alarm that has waited this long behind a busy room says so in the
@@ -247,6 +251,9 @@ function createSchedulerService(dependencies = {}) {
     ? (dependencies.jobsStore ? null : CRONS_FILE)
     : dependencies.legacyCronsFile;
   const runInProvider = dependencies.runAgent || ((...args) => require("./runner").runAgent(...args));
+  // What a run a usage limit stopped does (core/limit-pickup.js planFor): the
+  // same rule and wording as a chat message the limit stopped.
+  const planLimit = dependencies.planLimit || ((...args) => require("./limit-pickup").planFor(...args));
   const admit = dependencies.admitRunContext || ((...args) => require("./runner").admitRunContext(...args));
   const projectSessions = dependencies.getProjectSessions || getProjectSessions;
   const timers = new Map();
@@ -510,6 +517,9 @@ function createSchedulerService(dependencies = {}) {
     }
     const polled = job.check ? pendingPollNote(job) : null;
     if (polled) lines.push(polled);
+    if (Number(job.limitWaitCount) > 0 && Number.isFinite(Number(job.limitFirstHitAt))) {
+      lines.push(`[A usage limit stopped this run at ${new Date(Number(job.limitFirstHitAt)).toISOString()}; it waited for the reset and runs now. Check what still applies before acting.]`);
+    }
     if (target.fallbackFrom) {
       lines.push(`[Archived provider-neutral brief: the originating ${target.fallbackFrom} provider is unavailable. Its native session is not being resumed; this explicitly configured fallback starts fresh.]`);
     } else if (target.revertedFrom) {
@@ -653,6 +663,7 @@ function createSchedulerService(dependencies = {}) {
         watchLastHitAt: null,
         watchLastClearAt: null,
         advisoryOccurrenceId: null,
+        ...LIMIT_WAIT_CLEARED,
       };
       const advanced = jobsStore.update(job.id, advance) || { ...latest, ...advance };
       unscheduleJob(job.id);
@@ -705,6 +716,41 @@ function createSchedulerService(dependencies = {}) {
     return { ok: false, deferred: true, status: updated.status, job: updated };
   }
 
+  // The usage-limit plan of a failed run, or null (the runner keeps it on the
+  // result; a run that never reached delivery is planned here).
+  function limitPlanOf(result, runContext) {
+    if (result?.error?.code !== "PROVIDER_USAGE_LIMIT") return null;
+    if (result.limitPlan !== undefined) return result.limitPlan;
+    try { return planLimit(result, runContext, { now: now() }); }
+    catch (_) { return null; }
+  }
+
+  // A usage limit is not a failed attempt: the occurrence waits for the reset,
+  // as a chat message does (core/limit-pickup.js), and never moves to another
+  // provider (it may not be signed in, or be used up too). The notice was
+  // posted with the run's result.
+  function markLimitWait(job, plan, result) {
+    const latest = jobsStore.get(job.id) || job;
+    const patch = {
+      status: "deferred",
+      disabled: false,
+      attemptCount: Math.max(0, (Number(latest.attemptCount) || 1) - 1),
+      nextAttemptAt: plan.runAt,
+      lastFireAt: now(),
+      lastFireOk: false,
+      lastError: stableFailure(result),
+      limitWaitCount: (Number(latest.limitWaitCount) || 0) + 1,
+      limitWaitUntil: plan.runAt,
+      limitWaitType: plan.hit?.limitType || null,
+      limitWaitProvider: plan.hit?.provider || null,
+      limitFirstHitAt: Number(latest.limitFirstHitAt) || now(),
+    };
+    const updated = jobsStore.update(job.id, patch) || { ...latest, ...patch };
+    armRetry(updated);
+    console.log(`[scheduler] ${job.id}: ${patch.limitWaitProvider || "provider"} ${patch.limitWaitType || "usage limit"} used up; waits until ${new Date(plan.runAt).toISOString()} (wait ${patch.limitWaitCount})`);
+    return { ok: false, status: "deferred", limitWait: true, runAt: plan.runAt, job: updated, result };
+  }
+
   async function settleSuccess(job, result, target) {
     const successPatch = {
       status: "succeeded",
@@ -759,6 +805,7 @@ function createSchedulerService(dependencies = {}) {
       watchLastHitAt: null,
       watchLastClearAt: null,
       advisoryOccurrenceId: null,
+      ...LIMIT_WAIT_CLEARED,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
     return reset
@@ -909,6 +956,11 @@ function createSchedulerService(dependencies = {}) {
         occurrenceId: job.occurrenceId,
         scheduledJobId: job.id,
         originRunId: job.originRunId || null,
+        // A run that waited for a limit's reset: a new hit says "still used up"
+        // and counts towards the most waits (limit-pickup MAX_ATTEMPTS).
+        ...(Number(job.limitWaitCount) > 0 ? {
+          limitPickup: { attempts: Number(job.limitWaitCount), firstHitAt: Number(job.limitFirstHitAt) || null, limitType: job.limitWaitType || null },
+        } : {}),
       };
       // Admission is synchronous and precedes all notification delivery. A
       // refusal is a failed attempt, never a rejection that drops the job.
@@ -978,6 +1030,11 @@ function createSchedulerService(dependencies = {}) {
         catch (persistError) { return keepRetrying(running, persistError); }
       }
       if (!terminalRunSucceeded(result)) {
+        const limitPlan = limitPlanOf(result, runContext);
+        if (limitPlan?.waits && Number.isFinite(limitPlan.runAt)) {
+          try { return markLimitWait(running, limitPlan, result); }
+          catch (error) { return { ...keepRetrying(running, error), result }; }
+        }
         try { return markFailure(running, result, { attemptAlreadyCounted: true }); }
         catch (error) { return { ...keepRetrying(running, error), result }; }
       }

package/core/state.js

@@ -1045,6 +1045,19 @@ function waitingLanes() {
   });
 }
 
+// A queued message anywhere (every person's state, every conversation), for
+// the ✕ on its "Queued." notice. Returns { state, lane, item } or null.
+function findQueued(predicate) {
+  for (const state of statesWithLanes()) {
+    if (!(state.lanes instanceof Map)) continue;
+    for (const lane of state.lanes.values()) {
+      const item = lane.messageQueue.find(predicate);
+      if (item) return { state, lane, item };
+    }
+  }
+  return null;
+}
+
 // /stop arms lane.cancelRequested with the id of the run it stops (true only
 // when no run context is known), and a run acts on the flag only when it names
 // that run. A bare boolean let a stop outlive its run and cancel the next one.
@@ -1898,6 +1911,7 @@ module.exports = {
   runningLanes,
   slotBlocker,
   waitingLanes,
+  findQueued,
   pruneIdleLanes,
   maxParallelTurns,
   maxParallelTurnsGlobal,

package/core/system-prompt.js

@@ -382,7 +382,7 @@ Notes: a background daemon persists between commands, so navigation state carrie
 
 If you tell the user "I'll check back in N minutes" or "I'll run this every morning", you MUST schedule it with one of the commands above in the same turn. Otherwise nothing happens.
 
-Interrupted turns: when a restart cuts a turn short, the agent CLI resumes the conversation by writing two lines into your history, "Continue from where you left off." and the reply "No response requested.". Neither came from the user or from you, and the user never saw them. Never mention or apologise for them, and never reply "No response requested." yourself: finish the interrupted work if it still matters, then act on the current message.
+Interrupted turns: when a restart cuts a turn short, the agent CLI resumes the conversation by writing two lines into your history, "Continue from where you left off." and the reply "No response requested.". Neither came from the user or from you, and the user never saw them. Never mention or apologise for them, and never reply "No response requested." yourself: finish the interrupted work if it still matters, then act on the current message. A /stop leaves the same two lines, but then your next message starts with a note that the person stopped that turn: the stopped request is cancelled, so never resume, redo or re-offer it unless they ask.
 
 ## Guidelines
 - Keep responses concise — many users are on mobile.

package/core/turn-journal.js

@@ -25,6 +25,9 @@
 //     (6) on SIGTERM, whose sender kills soon after; whatever is still
 //     running stays journaled.
 //   - /stop offers each dropped queued message back with a "Run it" button.
+//   - /stop marks the conversation "stopped" (kept across a restart): its next
+//     turn is told the stopped request is cancelled, not cut off (see
+//     markStopped).
 // Scheduled runs (wake-ups, crons, watches) are not journaled: jobs.json keeps
 // their own retry, so they are never resumed twice.
 
@@ -78,7 +81,7 @@ function remove(file) { try { fs.unlinkSync(file); } catch (_) {} }
 
 // Persist the record, or drop the file when nothing is left in it.
 function store(file, record) {
-  if (!record.turn && !(record.queued || []).length) return remove(file);
+  if (!record.turn && !(record.queued || []).length && !record.stopped) return remove(file);
   write(file, record);
 }
 
@@ -164,6 +167,8 @@ function begin(runContext, opts = {}) {
     },
     queued: (existing.queued || []).filter((q) => q.runId !== runContext.runId),
   };
+  // A stop this turn has not taken yet stays for the turn that does.
+  if (existing.stopped) record.stopped = existing.stopped;
   try { write(file, record); } catch (error) { console.warn(`[turn-journal] could not journal ${runContext.laneKey}: ${error.message}`); return false; }
   active.set(runContext.laneKey, file);
   ensureHeartbeat();
@@ -205,6 +210,52 @@ function dropQueued(laneKey, runIds) {
   store(file, record);
 }
 
+// ── /stop: a cancel, not a cut ─────────────────────────────────────────
+// /stop kills the provider mid-turn. On the next message Claude Code resumes
+// the session and writes the cut turn into the history the same way a
+// restart's cut reads ("[Request interrupted by user for tool use]", then
+// "Continue from where you left off." / "No response requested."), and the
+// system prompt says to finish work a restart cut off. So a stopped request
+// came back on the next message (home pi, 9 Oct: "/stop" on "ok play big
+// bang", then "Big Bang didn't start … just say if you still want it"). The
+// stop is kept in the conversation's file until its next turn takes it.
+function markStopped(laneKey, opts = {}) {
+  if (!journalOn() || !laneKey) return false;
+  const file = fileFor(laneKey);
+  const record = read(file) || { v: 1, conversation: null, turn: null, queued: [] };
+  if (!record.conversation && opts.runContext?.origin) record.conversation = conversationOf(opts.runContext);
+  record.stopped = {
+    at: Number.isFinite(opts.now) ? opts.now : Date.now(),
+    runId: opts.runContext?.runId || null,
+  };
+  try { write(file, record); } catch (_) { return false; }
+  return true;
+}
+
+// The conversation's stop, once: the turn that takes it carries the note.
+function takeStopped(laneKey) {
+  if (!journalOn() || !laneKey) return null;
+  const file = fileFor(laneKey);
+  const record = read(file);
+  if (!record?.stopped) return null;
+  const stopped = record.stopped;
+  delete record.stopped;
+  try { store(file, record); } catch (_) {}
+  return stopped;
+}
+
+// /new, /end or a project change: the stopped turn's history is gone.
+function clearStopped(laneKey) {
+  takeStopped(laneKey);
+}
+
+// What the turn after a /stop reads before the person's message.
+function stoppedNote(stopped) {
+  const at = Number(stopped?.at);
+  const when = Number.isFinite(at) && at > 0 ? `At ${hhmm(at)} the person` : "The person";
+  return `[${when} stopped your previous turn with /stop, so that request is cancelled. Your history may still show it unfinished, followed by "Continue from where you left off." from the agent CLI (not from them). Don't resume it, redo it or offer to do it again unless they ask; just answer the message below.]`;
+}
+
 function list() {
   if (!journalOn()) return [];
   let names = [];
@@ -337,7 +388,8 @@ async function resumeInterrupted(adapters, overrides = {}) {
     if (!turn) {
       const queued = record.queued || [];
       record.queued = [];
-      remove(file);
+      // A stop not yet taken stays (the restored messages' turn takes it).
+      store(file, record);
       runQueued({ ...record, queued }, adapter, deps);
       out.restored += queued.length;
       continue;
@@ -502,6 +554,7 @@ module.exports = {
   conversationOf, chatScope, findAdapter, defaultDeps,
   resumeInterrupted, handleResumeAction, RESUME_PROMPT,
   rememberDropped, droppedKeyboard, handleRunDropped,
+  markStopped, takeStopped, clearStopped, stoppedNote,
   drain, exitAfterDrain, isDraining, markShuttingDown,
   resumeEnabled, maxAgeMs, drainTimeoutMs, sigtermDrainTimeoutMs, MAX_ATTEMPTS, HEARTBEAT_MS,
   _resetForTests,