@oar-sh/oar 0.9.0

package/shared/ask-user-bridge.mjs

@@ -0,0 +1,131 @@
+import {
+  DEFAULT_QUESTION_TIMEOUT_MS,
+  QUESTION_TIMEOUT_CONTINUATION_TEXT,
+} from './question-timeout.mjs';
+
+function sleepDefault(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function normalizeQuestions(input) {
+  const questions = Array.isArray(input?.questions) ? input.questions : [];
+  return questions
+    .map((entry) => ({
+      question: String(entry?.question || '').trim(),
+      // The SDK joins answers back by EXACT question text; a model question
+      // with stray whitespace must still match its answer key.
+      rawQuestion: String(entry?.question || ''),
+      header: String(entry?.header || '').trim(),
+      multiSelect: entry?.multiSelect === true,
+      options: (Array.isArray(entry?.options) ? entry.options : [])
+        .map((option) => ({
+          label: String(option?.label || '').trim(),
+          description: String(option?.description || '').trim(),
+        }))
+        .filter((option) => option.label),
+    }))
+    .filter((entry) => entry.question);
+}
+
+/**
+ * Bridge a provider worker's ask-user tool onto the relay question cards.
+ *
+ * `handleAskUserQuestion(input, { signal })` posts one relay question per
+ * question entry, waits for the answers, and returns the collected `answers`
+ * map (question text -> answer string). Provider workers identify themselves
+ * via `questionSource` / `questionRationale` (defaults preserve the Claude
+ * worker's original wire payload).
+ */
+export function createAskUserBridge({
+  api,
+  getActiveMessage,
+  sdkSessionId = '',
+  sleep = sleepDefault,
+  questionPollMs = 1500,
+  questionTimeoutMs = DEFAULT_QUESTION_TIMEOUT_MS,
+  questionSource = 'AskUserQuestion',
+  questionRationale = 'Claude requested clarification to continue this turn.',
+  dbg = () => {},
+} = {}) {
+  async function waitForRelayQuestionAnswer(questionId, { signal } = {}) {
+    const started = Date.now();
+    while (true) {
+      if (signal?.aborted) {
+        await api('POST', `/api/relay-question/${questionId}/timeout`, {}).catch(() => {});
+        return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true, aborted: true };
+      }
+      const { question } = await api('GET', `/api/relay-question/${questionId}`);
+      if (!question) throw new Error('Relay question missing');
+      if (question.status === 'answered') {
+        return { answer: String(question.answer || '').trim(), timedOut: false };
+      }
+      if (question.status === 'timed_out' || question.status === 'cancelled') {
+        return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
+      }
+      if (Date.now() - started >= questionTimeoutMs) {
+        await api('POST', `/api/relay-question/${questionId}/timeout`, {}).catch(() => {});
+        return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
+      }
+      await sleep(questionPollMs);
+    }
+  }
+
+  async function askSingleQuestion(entry, { signal } = {}) {
+    const activeMsg = typeof getActiveMessage === 'function' ? getActiveMessage() : null;
+    const choices = entry.options.map((option) => option.label);
+    const promptParts = [entry.question];
+    const optionDetails = entry.options
+      .filter((option) => option.description)
+      .map((option) => `- ${option.label}: ${option.description}`);
+    if (optionDetails.length) promptParts.push(optionDetails.join('\n'));
+    const questionPayload = {
+      queueId: activeMsg?.id,
+      messageId: activeMsg?.id,
+      conversationId: activeMsg?.conversationId,
+      mode: activeMsg?.relayMode || 'agent',
+      prompt: promptParts.join('\n\n'),
+      choices,
+      allowFreeform: true,
+      sdk_session_id: sdkSessionId || undefined,
+      timeout_ms: questionTimeoutMs,
+      context: {
+        source: questionSource,
+        rationale: questionRationale,
+        queueMessageId: activeMsg?.id || null,
+        conversationId: activeMsg?.conversationId || null,
+        relayMode: activeMsg?.relayMode || 'agent',
+        header: entry.header || undefined,
+        multiSelect: entry.multiSelect || undefined,
+      },
+    };
+    const created = await api('POST', '/api/relay-question', questionPayload);
+    const questionId = created?.question?.id;
+    if (!questionId) throw new Error('Relay question could not be created');
+    dbg('relay question created', questionId, 'prompt=', entry.question.slice(0, 80));
+    return waitForRelayQuestionAnswer(questionId, { signal });
+  }
+
+  async function handleAskUserQuestion(input, { signal } = {}) {
+    const questions = normalizeQuestions(input);
+    if (!questions.length) {
+      return { answers: {}, timedOut: false };
+    }
+    const answers = {};
+    let timedOut = false;
+    for (const entry of questions) {
+      const result = await askSingleQuestion(entry, { signal });
+      answers[entry.question] = result.answer;
+      if (entry.rawQuestion && entry.rawQuestion !== entry.question) {
+        answers[entry.rawQuestion] = result.answer;
+      }
+      if (result.timedOut) timedOut = true;
+      if (result.aborted) break;
+    }
+    return { answers, timedOut };
+  }
+
+  return {
+    handleAskUserQuestion,
+    waitForRelayQuestionAnswer,
+  };
+}

package/shared/auto-compact-window.mjs

@@ -0,0 +1,116 @@
+// The per-conversation auto-compact window: how many tokens of context the
+// Claude CLI is allowed to accumulate before it compacts the conversation.
+//
+// This is a TOKEN COUNT, not a percentage — `Settings.autoCompactWindow` in the
+// bundled CLI is compared directly against the model's context window, and the
+// effective threshold is `min(setting, model max)`. Unset (null) means "Auto":
+// the CLI keeps its model-tuned default (e.g. 967k on a 1M-window model), which
+// is what `autoCompactThreshold` in the context-usage payload reports.
+//
+// Shared so the slider, the preferences write path and the worker all agree on
+// the same discrete stops; the browser mirrors these constants in
+// server/public/app/auto-compact-window-options.mjs (only server/public is
+// served) and a unit test asserts the two lists stay identical.
+
+/**
+ * The CLI silently refuses windows below 100k: it does not merely decline to
+ * compact, it drops the value and resolves back to the model default. Probed
+ * against the bundled CLI on 2026-08-20 (`claude-opus-5[1m]`):
+ *
+ *   setting 50_000  -> maxTokens 1_000_000, source 'auto'      (ignored)
+ *   setting 60_000  -> maxTokens 1_000_000, source 'auto'      (ignored)
+ *   setting 100_000 -> maxTokens   100_000, source 'settings'  (applied)
+ *
+ * The bundled CLI carries a matching 1e5 constant beside its auto-compact
+ * resolver. Offering a smaller stop would put a number on the slider that
+ * changes nothing, so the floor is enforced here instead.
+ */
+export const AUTO_COMPACT_WINDOW_MIN_TOKENS = 100_000;
+
+/** Index 0 is `null` = Auto (model default). Every other stop is a token count. */
+export const AUTO_COMPACT_WINDOW_STOPS = Object.freeze([
+  null,
+  100_000,
+  150_000,
+  200_000,
+  300_000,
+  500_000,
+  1_000_000,
+]);
+
+const NUMERIC_STOPS = AUTO_COMPACT_WINDOW_STOPS.filter((stop) => stop !== null);
+
+/**
+ * Normalize any stored/wire value onto a stop.
+ *
+ * Absent, blank, 'auto', <= 0 and junk all mean Auto (null) — there is no
+ * "disabled" state, so anything unusable falls back to the model default rather
+ * than pinning an arbitrary window.
+ */
+export function parseAutoCompactWindow(value) {
+  if (value === null || value === undefined) return null;
+  if (typeof value === 'string') {
+    const text = value.trim().toLowerCase();
+    if (!text || text === 'auto' || text === 'null') return null;
+  }
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return null;
+  // Snap to the nearest stop so a hand-edited row or an older client's value
+  // still lands on something the slider can represent.
+  let best = NUMERIC_STOPS[0];
+  let bestDistance = Math.abs(numeric - best);
+  for (const stop of NUMERIC_STOPS) {
+    const distance = Math.abs(numeric - stop);
+    if (distance < bestDistance) {
+      best = stop;
+      bestDistance = distance;
+    }
+  }
+  return best;
+}
+
+/** 'Auto' | '100k' | '1M' — the slider's own label, so it must stay short. */
+export function formatAutoCompactWindowLabel(value) {
+  const window = parseAutoCompactWindow(value);
+  if (window === null) return 'Auto';
+  if (window >= 1_000_000) {
+    const millions = window / 1_000_000;
+    return `${Number.isInteger(millions) ? millions : millions.toFixed(1)}M`;
+  }
+  return `${Math.round(window / 1000)}k`;
+}
+
+export function autoCompactWindowToIndex(value) {
+  const window = parseAutoCompactWindow(value);
+  const index = AUTO_COMPACT_WINDOW_STOPS.indexOf(window);
+  return index >= 0 ? index : 0;
+}
+
+/**
+ * What a queue delivery's `settings` should do to the worker's current window.
+ *
+ * Old relays omit `autoCompactWindow` entirely; that must keep whatever the
+ * worker already had rather than silently resetting the pin. An explicit
+ * `null` (or anything unusable) is the user choosing Auto and must clear it —
+ * so the key's *presence*, not its truthiness, decides. A truthiness check
+ * here would collapse both cases and break "return to Auto".
+ *
+ * Not snapped: the worker forwards the value to the CLI as-is, and the write
+ * path already snapped it.
+ *
+ * @param {number|null} current the worker's last known window
+ * @param {object|null|undefined} settings the delivery's settings bag
+ * @returns {number|null}
+ */
+export function resolveDeliveredAutoCompactWindow(current, settings) {
+  if (!settings || typeof settings !== 'object') return current ?? null;
+  if (!Object.prototype.hasOwnProperty.call(settings, 'autoCompactWindow')) return current ?? null;
+  const delivered = Number(settings.autoCompactWindow);
+  return Number.isFinite(delivered) && delivered > 0 ? Math.round(delivered) : null;
+}
+
+export function autoCompactWindowFromIndex(index) {
+  const i = Math.round(Number(index));
+  if (!Number.isFinite(i) || i < 0 || i >= AUTO_COMPACT_WINDOW_STOPS.length) return null;
+  return AUTO_COMPACT_WINDOW_STOPS[i];
+}

package/shared/background-task-timeout.mjs

@@ -0,0 +1,52 @@
+// Ceiling on how long background tasks alone may keep a conversation's
+// persistent Claude CLI process alive, shared so the settings slider and the
+// worker enforcing it agree on bounds and formatting.
+//
+// 0 means no limit — the default: a process holding live tasks stays up until
+// the tasks finish, the user stops them from the composer panel, or the
+// worker/relay goes down. Mirrors shared/turn-ceiling.mjs.
+
+export const BACKGROUND_TASK_TIMEOUT_MIN_MINUTES = 0;
+export const BACKGROUND_TASK_TIMEOUT_MAX_MINUTES = 600;
+export const BACKGROUND_TASK_TIMEOUT_STEP_MINUTES = 5;
+export const DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES = 0;
+
+/** 0 disables the timeout entirely (unlimited). */
+export function normalizeBackgroundTaskTimeoutMinutes(value, fallback = DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES) {
+  // Number('') and Number(null) are both 0, which would silently read as
+  // "no limit". Absent input is absent, not a request to disable the timeout.
+  if (value === null || value === undefined) return fallback;
+  if (typeof value === 'string' && value.trim() === '') return fallback;
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return fallback;
+  const rounded = Math.round(numeric);
+  if (rounded <= BACKGROUND_TASK_TIMEOUT_MIN_MINUTES) return 0;
+  return Math.min(BACKGROUND_TASK_TIMEOUT_MAX_MINUTES, rounded);
+}
+
+export function backgroundTaskTimeoutMinutesToMs(minutes) {
+  return normalizeBackgroundTaskTimeoutMinutes(minutes) * 60_000;
+}
+
+/** An unset setting means "never configured", which is the default — not 0. */
+export function readBackgroundTaskTimeoutSetting(storedValue) {
+  const text = storedValue === null || storedValue === undefined ? '' : String(storedValue).trim();
+  if (!text) return DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES;
+  return normalizeBackgroundTaskTimeoutMinutes(text);
+}
+
+export function parseBackgroundTaskTimeoutUpdate(value) {
+  const minutes = normalizeBackgroundTaskTimeoutMinutes(value, null);
+  if (minutes === null) return { ok: false, error: 'timeoutMinutes must be a number' };
+  return { ok: true, minutes };
+}
+
+export function formatBackgroundTaskTimeoutLabel(minutes) {
+  const normalized = normalizeBackgroundTaskTimeoutMinutes(minutes);
+  if (normalized === 0) return 'No limit';
+  if (normalized < 60) return `${normalized} min`;
+  const hours = Math.floor(normalized / 60);
+  const remainder = normalized % 60;
+  const hourLabel = `${hours} h`;
+  return remainder ? `${hourLabel} ${remainder} min` : hourLabel;
+}

package/shared/claude-thinking.mjs

@@ -0,0 +1,101 @@
+// Per-conversation thinking control for the Claude worker: whether the CLI's
+// extended thinking runs, and whether its text is visible in the transcript.
+//
+// THE RELAY'S DEFAULTS ARE ON + SUMMARIZED. copilot-remote deliberately takes
+// a position here rather than deferring to the CLI: a relay you read on a
+// phone is a place where seeing the model's reasoning is the point.
+//
+// There is deliberately no "host default" state on either axis:
+//   - The worker sets no `settingSources`, so it loads no filesystem settings
+//     — "host" only ever meant the CLI's built-in default, which is itself ON
+//     for supported models. It was near-synonymous with On even before this.
+//   - A host-default state has to be stored as SQL NULL, which is
+//     indistinguishable from "never set". Once NULL resolves to the relay
+//     default, picking "host default" would silently do nothing.
+// So both axes are two-state, and NULL in the DB means "never set → relay
+// default".
+//
+// Probed against the bundled CLI 2.1.226 / SDK 0.3.226 on 2026-08-26
+// (docs/plans/claude-thinking-control.md → Probe results):
+//
+// - `enabled` — `Settings.alwaysThinkingEnabled`, honored at SPAWN in both
+//   directions, but mid-session only ENABLING works: a mid-session `false` is
+//   accepted and silently ignored, so turning thinking off takes effect at the
+//   next CLI spawn.
+// - `display` — 'summarized' (a readable summary of the reasoning; the raw
+//   chain of thought is never exposed by the API on any setting) or 'omitted'
+//   (the block still arrives, with empty text). Applies live both ways via
+//   `setMaxThinkingTokens(budget, display)`. NOTE: display is visibility only
+//   — the model thinks, and bills, identically either way, so 'omitted' is not
+//   a cost control. `Thinking: Off` is.
+//
+// Shared so the browser control, the preferences write path and the worker
+// agree; the browser mirror lives in
+// server/public/app/claude-thinking-options.mjs (only server/public is served)
+// and a unit test asserts the two stay identical.
+
+/** Thinking runs unless the conversation explicitly turns it off. */
+export const DEFAULT_THINKING_ENABLED = true;
+
+/** Thoughts are visible unless the conversation explicitly hides them. */
+export const DEFAULT_THINKING_DISPLAY = 'summarized';
+
+export const THINKING_DISPLAY_MODES = Object.freeze(['summarized', 'omitted']);
+
+/**
+ * Normalize any stored/wire value onto the on/off state.
+ *
+ * Anything unusable — absent, NULL, junk, an older client's value — resolves
+ * to the relay default (on) rather than silently disabling thinking.
+ */
+export function parseThinkingEnabled(value) {
+  if (value === false || value === 0) return false;
+  if (typeof value === 'string') {
+    const text = value.trim().toLowerCase();
+    if (text === 'false' || text === '0' || text === 'off') return false;
+    if (text === 'true' || text === '1' || text === 'on') return true;
+    return DEFAULT_THINKING_ENABLED;
+  }
+  if (value === true || value === 1) return true;
+  return DEFAULT_THINKING_ENABLED;
+}
+
+/** 'summarized' | 'omitted'; anything unusable is the default, never hidden by accident. */
+export function parseThinkingDisplay(value) {
+  const text = String(value ?? '').trim().toLowerCase();
+  return text === 'omitted' ? 'omitted' : DEFAULT_THINKING_DISPLAY;
+}
+
+/** Short label for the control ("On · visible", "Off · hidden"). */
+export function formatThinkingLabel({ enabled = DEFAULT_THINKING_ENABLED, display = DEFAULT_THINKING_DISPLAY } = {}) {
+  const enabledLabel = parseThinkingEnabled(enabled) ? 'On' : 'Off';
+  const displayLabel = parseThinkingDisplay(display) === 'omitted' ? 'hidden' : 'visible';
+  return `${enabledLabel} · ${displayLabel}`;
+}
+
+/**
+ * What a queue delivery's `settings` should do to the worker's current
+ * thinking state — the twin of `resolveDeliveredAutoCompactWindow`: an absent
+ * key (an older relay that does not send these yet) keeps the last known
+ * value, while a present key replaces it. Presence, not truthiness, decides —
+ * a truthiness check would read an explicit `false` as "not mentioned" and
+ * make turning thinking off impossible.
+ *
+ * @param {{enabled: boolean, display: string}|null} current
+ * @param {object|null|undefined} settings the delivery's settings bag
+ * @returns {{enabled: boolean, display: string}}
+ */
+export function resolveDeliveredThinking(current, settings) {
+  const base = {
+    enabled: parseThinkingEnabled(current?.enabled),
+    display: parseThinkingDisplay(current?.display),
+  };
+  if (!settings || typeof settings !== 'object') return base;
+  if (Object.prototype.hasOwnProperty.call(settings, 'thinkingEnabled')) {
+    base.enabled = parseThinkingEnabled(settings.thinkingEnabled);
+  }
+  if (Object.prototype.hasOwnProperty.call(settings, 'thinkingDisplay')) {
+    base.display = parseThinkingDisplay(settings.thinkingDisplay);
+  }
+  return base;
+}

package/shared/context-window-fallbacks.mjs

@@ -0,0 +1,148 @@
+// Static context-window fallbacks shared by the Copilot snapshot service, the
+// Cursor worker and the Copilot SDK worker's BYOK provider config, so the
+// tables cannot drift. Used only when the provider does not advertise a window
+// itself (Copilot events without limits, Cursor models without a `context`
+// parameter, an OpenAI-compatible endpoint the Copilot runtime does not
+// recognise).
+
+import { canonicalizeModelId } from './model-id.mjs';
+
+// Context window of a model id carrying the `[1m]` capability suffix, whatever
+// the base model's default window is.
+export const LONG_CONTEXT_TOKENS = 1000000;
+
+export const MODEL_FALLBACK_LIMITS = Object.freeze({
+  // Anthropic Claude Sonnet
+  'claude-sonnet-5': 200000,
+  'claude-sonnet-4.6': 200000,
+  'claude-sonnet-4.5': 200000,
+  // Anthropic Claude Haiku
+  'claude-haiku-4.5': 200000,
+  // Anthropic Claude Fable
+  'claude-fable-5': 200000,
+  // Anthropic Claude Opus
+  'claude-opus-5': 200000,
+  'claude-opus-4.8': 200000,
+  'claude-opus-4.7': 200000,
+  'claude-opus-4.6': 200000,
+  'claude-opus-4.6-fast': 200000,
+  'claude-opus-4.5': 200000,
+  // OpenAI GPT-5 series
+  'gpt-5.6-terra': 272000,
+  'gpt-5.6-luna': 272000,
+  'gpt-5.6-sol': 272000,
+  'gpt-5.5': 256000,
+  'gpt-5.4': 256000,
+  'gpt-5.3-codex': 256000,
+  'gpt-5.2-codex': 256000,
+  'gpt-5.2': 256000,
+  'gpt-5.4-mini': 256000,
+  'gpt-5-mini': 256000,
+  // Google Gemini
+  'gemini-3.1-pro-preview': 1000000,
+  'gemini-3.5-flash': 1000000,
+  // Cursor-served models without a `context` parameter in `models.list()`.
+  // Conservative published defaults; a provider-advertised window always wins.
+  'grok-4.5': 256000,
+  'composer-2.5': 200000,
+  // xAI models the Grok CLI serves when ACP discovery reports no window
+  // (public xAI docs values); also reachable through the Cursor catalog.
+  'grok-4': 256000,
+  'grok-code-fast-1': 256000,
+});
+
+/**
+ * Resolve a fallback context window for a model id.
+ *
+ * Model ids may carry a bracketed capability suffix (see `isSafeClaudeModelId`),
+ * e.g. `claude-opus-5[1m]`. Those are a different context window than the base
+ * model, so they are resolved first — falling through to the base entry would
+ * report a 1M session as 200k.
+ */
+export function resolveFallbackContextLimitTokens(modelId) {
+  const model = String(modelId || '').trim().toLowerCase();
+  if (!model) return null;
+  if (MODEL_FALLBACK_LIMITS[model]) return MODEL_FALLBACK_LIMITS[model];
+  const suffixMatch = model.match(/\[([^\]]+)\]\s*$/);
+  if (!suffixMatch) return null;
+  if (suffixMatch[1].trim() === '1m') return LONG_CONTEXT_TOKENS;
+  return MODEL_FALLBACK_LIMITS[model.slice(0, suffixMatch.index).trim()] || null;
+}
+
+/**
+ * Max OUTPUT tokens per model family, matched by longest prefix.
+ *
+ * Separate from the windows above because the two are not interchangeable: the
+ * window is how much a request may total, this is how much of it the completion
+ * may claim. Only the OpenAI-compatible families a BYOK endpoint can serve are
+ * listed — an unlisted family resolves to no ceilings at all, which is the
+ * point (see `resolveModelTokenCeilings`).
+ */
+const MODEL_OUTPUT_TOKEN_LIMITS = Object.freeze([
+  Object.freeze({ prefix: 'gpt-4o', maxOutputTokens: 16_384 }),
+  Object.freeze({ prefix: 'gpt-4.1', maxOutputTokens: 32_768 }),
+  Object.freeze({ prefix: 'gpt-5', maxOutputTokens: 128_000 }),
+  Object.freeze({ prefix: 'codex-', maxOutputTokens: 128_000 }),
+  Object.freeze({ prefix: 'o3', maxOutputTokens: 100_000 }),
+  Object.freeze({ prefix: 'o4-', maxOutputTokens: 100_000 }),
+]);
+
+/**
+ * Family-level context windows, matched by longest prefix, for ids
+ * `MODEL_FALLBACK_LIMITS` does not name individually.
+ *
+ * Deliberately NOT merged into that table: it is consulted by the Copilot
+ * snapshot service and the Cursor worker as an exact-id lookup for models those
+ * providers actually serve, and widening it to whole families would start
+ * answering questions those callers currently (correctly) answer with "no
+ * fallback". This table is only read through `resolveModelTokenCeilings`, whose
+ * one consumer is the BYOK provider config, and the exact-id table always wins.
+ */
+const MODEL_FAMILY_CONTEXT_WINDOWS = Object.freeze([
+  Object.freeze({ prefix: 'gpt-4o', contextWindow: 128_000 }),
+  Object.freeze({ prefix: 'gpt-4.1', contextWindow: 1_047_576 }),
+  // The gpt-5 family spans 256k (gpt-5.2/5.4/5.5 and the minis) and 272k (the
+  // 5.6 series); the exact-id table separates them. An id this module has never
+  // heard of gets the SMALLER of the two, because a window guessed too large is
+  // the harmful direction: it converts what would have been early compaction
+  // into a hard API rejection with the whole history intact.
+  Object.freeze({ prefix: 'gpt-5', contextWindow: 256_000 }),
+  Object.freeze({ prefix: 'codex-', contextWindow: 256_000 }),
+  Object.freeze({ prefix: 'o3', contextWindow: 200_000 }),
+  Object.freeze({ prefix: 'o4-', contextWindow: 200_000 }),
+]);
+
+function longestPrefixEntry(table, model) {
+  let best = null;
+  for (const entry of table) {
+    if (!model.startsWith(entry.prefix)) continue;
+    if (!best || entry.prefix.length > best.prefix.length) best = entry;
+  }
+  return best;
+}
+
+/**
+ * Resolve `{ contextWindow, maxPromptTokens, maxOutputTokens }` for a model id,
+ * or `{}` when this module cannot answer confidently.
+ *
+ * The prompt ceiling is DERIVED (`window − output`) rather than tabulated, so
+ * the two numbers can never contradict each other: a consumer compares the
+ * whole outbound prompt against `maxPromptTokens` before deciding to compact,
+ * and the completion still has to fit alongside it inside the same window.
+ *
+ * Returning `{}` for an unknown model is the deliberate answer, not a gap. A
+ * guessed ceiling that is too HIGH turns early compaction into hard API errors,
+ * whereas the consumer's own default is merely conservative.
+ */
+export function resolveModelTokenCeilings(modelId) {
+  const model = canonicalizeModelId(modelId);
+  if (!model) return {};
+  const maxOutputTokens = longestPrefixEntry(MODEL_OUTPUT_TOKEN_LIMITS, model)?.maxOutputTokens ?? null;
+  const contextWindow = resolveFallbackContextLimitTokens(model)
+    ?? longestPrefixEntry(MODEL_FAMILY_CONTEXT_WINDOWS, model)?.contextWindow
+    ?? null;
+  if (!contextWindow || !maxOutputTokens) return {};
+  const maxPromptTokens = contextWindow - maxOutputTokens;
+  if (!(maxPromptTokens > 0)) return {};
+  return { contextWindow, maxPromptTokens, maxOutputTokens };
+}

package/shared/control-poller.mjs

@@ -0,0 +1,115 @@
+function sleepDefault(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Poll the relay's control API while a turn is in flight, mirroring the
+ * Copilot extension's `checkActiveAbortControl` semantics:
+ * - `abort_turn`   → invoke `onAbortTurn()` and acknowledge the control.
+ * - `abort_subagent` → try `onAbortSubagent(subagentRunId)` when the worker
+ *   provides one (the Claude worker can stop a BACKGROUNDED subagent via
+ *   `query.stopTask` using the task↔tool_use_id map); otherwise — or when the
+ *   handler reports the run unknown — answer "not supported". The full-turn
+ *   Stop always works.
+ *
+ * Provider workers customize the acknowledgement note via `abortAckNote`.
+ */
+export function createControlPoller({
+  api,
+  sdkSessionId,
+  pollMs = 1200,
+  sleep = sleepDefault,
+  abortAckNote = 'query aborted',
+  onAbortSubagent = null,
+  dbg = () => {},
+} = {}) {
+  let active = null;
+
+  async function checkOnce({ queueMessageId, onAbortTurn }) {
+    const ownerSessionId = String(sdkSessionId || '').trim();
+    if (!ownerSessionId) return false;
+    const pending = await api(
+      'GET',
+      `/api/control/active?sdkSessionId=${encodeURIComponent(ownerSessionId)}&queueMessageId=${encodeURIComponent(String(queueMessageId || ''))}`,
+    ).catch(() => null);
+    const control = pending?.control || null;
+    const controlType = String(control?.type || '').trim();
+    if (!control || !controlType) return false;
+
+    if (controlType === 'abort_subagent') {
+      const subagentRunId = String(control.subagentRunId || control.subagent_run_id || '').trim();
+      if (typeof onAbortSubagent === 'function' && subagentRunId) {
+        try {
+          const stopped = await onAbortSubagent(subagentRunId);
+          if (stopped) {
+            await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
+              ok: true,
+              note: 'subagent task stopped',
+            }).catch(() => {});
+            return false;
+          }
+        } catch (error) {
+          dbg('abort_subagent handler failed', error?.message || String(error));
+        }
+      }
+      await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
+        ok: false,
+        error: 'Targeted subagent cancellation is not supported by this runtime.',
+      }).catch(() => {});
+      return false;
+    }
+
+    if (controlType !== 'abort_turn') return false;
+
+    dbg('abort_turn control received', control.id);
+    try {
+      await onAbortTurn();
+      await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
+        ok: true,
+        note: abortAckNote,
+      }).catch(() => {});
+      return true;
+    } catch (error) {
+      await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
+        ok: false,
+        error: String(error?.message || error || 'abort failed'),
+      }).catch(() => {});
+      return false;
+    }
+  }
+
+  function start({ queueMessageId, onAbortTurn }) {
+    stop();
+    const state = { stopped: false };
+    active = state;
+    (async () => {
+      while (!state.stopped) {
+        await sleep(pollMs);
+        if (state.stopped) return;
+        try {
+          const aborted = await checkOnce({ queueMessageId, onAbortTurn });
+          if (aborted) return;
+        } catch (error) {
+          dbg('control poll failed', error?.message || String(error));
+        }
+      }
+    })();
+    return state;
+  }
+
+  function stop(handle) {
+    // Handle-scoped stop: a caller finishing an old turn must only stop that
+    // turn's poller. Without the scoping, a late finalize for a previous
+    // context would kill the poller of the turn currently running — leaving
+    // its Stop button dead. A bare stop() still stops whatever is active.
+    if (handle) {
+      handle.stopped = true;
+      if (active === handle) active = null;
+      return;
+    }
+    if (active) active.stopped = true;
+    active = null;
+  }
+
+  return { start, stop, checkOnce };
+}