@oar-sh/oar 0.9.1 → 0.9.3

package/server/features.mjs

@@ -2,25 +2,53 @@
 
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// Same resolution as server-runtime.mjs: an isolated server (tests, secondary
-// installs) points COPILOT_WEB_RELAY_CONFIG elsewhere and must not inherit the
-// checkout's live feature flags.
-const CONFIG_PATH = process.env.COPILOT_WEB_RELAY_CONFIG
-  ? path.resolve(String(process.env.COPILOT_WEB_RELAY_CONFIG))
-  : path.join(__dirname, 'config.json');
-
-const DEFAULT_FEATURES = Object.freeze({
-  SESSION_WORKER_ROUTING_ENABLED: false,
-  SESSION_WORKER_CONTINUATION_ROUTING_ENABLED: false,
-  SESSION_WORKER_FALLBACK_RESTART_ENABLED: false,
-  IMAGE_CONVERSATION_CONTINUITY_ENABLED: true,
-});
+
+// The single registry of relay feature flags. Server resolution, the settings
+// API payload, and the web UI's Features tab all render from these entries, so
+// a new in-development feature only needs a row here plus the code it gates.
+// `noop` marks a flag that is wired into resolution but not yet read by any
+// behavior — shown honestly in the UI so a rollout can be staged later.
+export const FEATURE_REGISTRY = Object.freeze([
+  Object.freeze({
+    name: 'SESSION_WORKER_ROUTING_ENABLED',
+    label: 'Session worker routing',
+    default: true,
+    noop: false,
+    description: 'Give each conversation its own dedicated worker process. The relay routes every message to the worker that owns that conversation, monitors its health, and recovers it if it crashes — a stuck or crashed turn in one conversation no longer stalls the others. When off, all conversations share the legacy polling pipeline.',
+  }),
+  Object.freeze({
+    name: 'SESSION_WORKER_CONTINUATION_ROUTING_ENABLED',
+    label: 'Continuation answer routing',
+    default: true,
+    noop: false,
+    description: 'Validate ownership strictly when you answer a clarification question: the relay checks the question’s conversation, continuation id, and owning worker before accepting the answer, so a stale or cross-wired reply is rejected instead of landing in the wrong session. Most useful together with session worker routing.',
+  }),
+  Object.freeze({
+    name: 'SESSION_WORKER_FALLBACK_RESTART_ENABLED',
+    label: 'Worker fallback restart (reserved)',
+    default: false,
+    noop: true,
+    description: 'Reserved rollout gate with no effect yet. It is intended to let the relay restart a turn on the fallback pipeline when a session worker cannot be revived. The toggle is shown so the rollout can be staged later without a release; enabling it today changes nothing.',
+  }),
+  Object.freeze({
+    name: 'IMAGE_CONVERSATION_CONTINUITY_ENABLED',
+    label: 'Generated-image continuity',
+    default: true,
+    noop: false,
+    description: 'Track the lineage of generated images so a follow-up like “edit this image” continues from the exact image you mean, not just the most recent one. The relay records which operation produced each image and threads edits back through the right source. When off, image follow-ups lose that source linkage.',
+  }),
+]);
+
+const DEFAULT_FEATURES = Object.freeze(Object.fromEntries(
+  FEATURE_REGISTRY.map((entry) => [entry.name, entry.default]),
+));
 
 const ENV_PREFIX = 'COPILOT_REMOTE_';
-const FEATURE_NAMES = Object.freeze(Object.keys(DEFAULT_FEATURES));
+const FEATURE_NAMES = Object.freeze(FEATURE_REGISTRY.map((entry) => entry.name));
+
+export function featureSettingKey(name) {
+  return `feature_${String(name || '').trim().toLowerCase()}`;
+}
 
 function parseBoolean(value) {
   if (typeof value === 'boolean') return value;
@@ -42,20 +70,6 @@ function normalizeKnownFeatureFlags(input) {
   return normalized;
 }
 
-function readFeaturesFromConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) {
-    return {};
-  }
-
-  try {
-    const parsed = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
-    const configured = parsed && typeof parsed === 'object' ? parsed.features : null;
-    return normalizeKnownFeatureFlags(configured);
-  } catch {
-    return {};
-  }
-}
-
 function readFeaturesFromEnv(env = process.env) {
   const entries = [];
   for (const key of FEATURE_NAMES) {
@@ -68,6 +82,17 @@ function readFeaturesFromEnv(env = process.env) {
   return Object.fromEntries(entries);
 }
 
+function readFeaturesFromSettings(readSetting) {
+  if (typeof readSetting !== 'function') return {};
+  const entries = [];
+  for (const key of FEATURE_NAMES) {
+    const parsed = parseBoolean(readSetting(featureSettingKey(key)));
+    if (parsed === null) continue;
+    entries.push([key, parsed]);
+  }
+  return Object.fromEntries(entries);
+}
+
 export function normalizeFeatureFlags(featureFlags = null) {
   return Object.freeze({
     ...DEFAULT_FEATURES,
@@ -75,21 +100,110 @@ export function normalizeFeatureFlags(featureFlags = null) {
   });
 }
 
-export function resolveFeatureFlags({
-  configFeatures = null,
-  env = process.env,
-} = {}) {
+/**
+ * The boot-time flag snapshot: registry defaults, overridden by rows in
+ * app_settings, overridden by COPILOT_REMOTE_* environment variables. Env stays
+ * on top so an isolated test server can pin a flag regardless of what its
+ * database says.
+ */
+export function resolveBootFeatureFlags({ readSetting, env = process.env } = {}) {
   return normalizeFeatureFlags({
-    ...normalizeKnownFeatureFlags(configFeatures),
+    ...readFeaturesFromSettings(readSetting),
     ...readFeaturesFromEnv(env),
   });
 }
 
-export const FEATURES = resolveFeatureFlags({
-  configFeatures: readFeaturesFromConfig(),
-});
+/**
+ * Per-flag rows for the settings API: what is active in this process, what is
+ * stored, whether the environment pins it, and what would be active after a
+ * restart. `restartRequired` is the only signal the UI needs to show the
+ * restart notice — flags are resolved once at boot and never reloaded.
+ */
+export function computeFeatureFlagState({ readSetting, env = process.env, activeFlags = null } = {}) {
+  const active = normalizeFeatureFlags(activeFlags);
+  const envFlags = readFeaturesFromEnv(env);
+  const storedFlags = readFeaturesFromSettings(readSetting);
+  return FEATURE_REGISTRY.map((entry) => {
+    const stored = Object.hasOwn(storedFlags, entry.name) ? storedFlags[entry.name] : null;
+    const envOverride = Object.hasOwn(envFlags, entry.name) ? envFlags[entry.name] : null;
+    const effectiveNext = envOverride ?? stored ?? entry.default;
+    return {
+      name: entry.name,
+      label: entry.label,
+      description: entry.description,
+      default: entry.default,
+      noop: entry.noop,
+      active: active[entry.name],
+      stored,
+      envOverride,
+      effectiveNext,
+      restartRequired: effectiveNext !== active[entry.name],
+    };
+  });
+}
+
+/**
+ * One-time boot migration away from a `features` key in config.json: known
+ * flags move into app_settings (without clobbering rows that already exist)
+ * and the key is stripped from the file.
+ *
+ * A read that fails is never followed by a write — config.json holds the auth
+ * token, so rewriting an unparseable-but-recoverable file would be far worse
+ * than running one boot on defaults (see writeCliBinariesToConfigFile in
+ * cli-install-service.mjs for the full rationale). The rewrite itself is
+ * tmp-file-then-rename in the config directory, mode 0600, for the same
+ * partial-write and token-exposure reasons.
+ */
+export function migrateLegacyConfigFeatures({
+  configPath,
+  readSetting,
+  writeSetting,
+  fsImpl = fs,
+  log = (message) => console.warn(message),
+} = {}) {
+  const target = String(configPath || '').trim();
+  if (!target || typeof readSetting !== 'function' || typeof writeSetting !== 'function') {
+    return { migrated: false };
+  }
+  if (!fsImpl.existsSync(target)) return { migrated: false };
+
+  let parsed = null;
+  try {
+    parsed = JSON.parse(fsImpl.readFileSync(target, 'utf8'));
+  } catch (error) {
+    log(`feature flags: refusing to migrate ${target}: it could not be parsed (${error?.message || error}); flags fall back to defaults + app settings + environment for this boot`);
+    return { migrated: false };
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || !('features' in parsed)) {
+    return { migrated: false };
+  }
+
+  const legacy = normalizeKnownFeatureFlags(parsed.features);
+  const adopted = [];
+  for (const [name, enabled] of Object.entries(legacy)) {
+    if (parseBoolean(readSetting(featureSettingKey(name))) !== null) continue;
+    writeSetting(featureSettingKey(name), enabled ? '1' : '0');
+    adopted.push(name);
+  }
+
+  delete parsed.features;
+  const tmpPath = path.join(
+    path.dirname(target),
+    `.${path.basename(target)}.${process.pid}.${Date.now()}.tmp`,
+  );
+  try {
+    fsImpl.writeFileSync(tmpPath, JSON.stringify(parsed, null, 2), { mode: 0o600 });
+    try { fsImpl.chmodSync(tmpPath, 0o600); } catch {}
+    fsImpl.renameSync(tmpPath, target);
+  } catch (error) {
+    try { fsImpl.unlinkSync(tmpPath); } catch {}
+    log(`feature flags: migrated values to app settings but could not strip the features key from ${target} (${error?.message || error})`);
+    return { migrated: true, adopted, stripped: false };
+  }
+  return { migrated: true, adopted, stripped: true };
+}
 
-export function getSessionWorkerFeatureFlags(featureFlags = FEATURES) {
+export function getSessionWorkerFeatureFlags(featureFlags) {
   const normalized = normalizeFeatureFlags(featureFlags);
   return {
     enabled: normalized.SESSION_WORKER_ROUTING_ENABLED === true,
@@ -98,7 +212,7 @@ export function getSessionWorkerFeatureFlags(featureFlags = FEATURES) {
   };
 }
 
-export function isFeatureEnabled(featureName, featureFlags = FEATURES) {
+export function isFeatureEnabled(featureName, featureFlags) {
   const name = String(featureName || '').trim();
   if (!name) return false;
   const normalized = normalizeFeatureFlags(featureFlags);

package/server/grok-worker/grok-session-worker.mjs

@@ -8,10 +8,10 @@ import { fileURLToPath } from 'url';
 import {
   loadTokenFromConfig,
   resolveRelayServerUrl,
-} from '../../.github/extensions/web-relay/runtime/config-loader.mjs';
-import { createApiClient } from '../../.github/extensions/web-relay/runtime/api-client.mjs';
-import { createWorkerWebSocketLink } from '../../.github/extensions/web-relay/runtime/worker-websocket-link.mjs';
-import { createHeartbeatController } from '../../.github/extensions/web-relay/polling/heartbeat.mjs';
+} from '../../shared/worker-runtime/config-loader.mjs';
+import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
+import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
+import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { installWorkerCrashGuard } from '../../shared/worker-crash-guard.mjs';
 import { createGrokTurnRunner } from './grok-turn-runner.mjs';
@@ -131,7 +131,7 @@ async function main() {
   installWorkerCrashGuard({
     api,
     workerName: 'grok-session-worker',
-    getActiveQueueMessageIds: () => [turnRunner.getActiveQueueMessageId()],
+    getActiveQueueMessageIds: () => [turnRunner.getActiveQueueAttempt()],
   });
 
   dbg(`starting session=${sdkSessionId.slice(0, 8)} server=${serverUrl} cwd=${cwd} model=${defaultModel || 'default'}`);

package/server/grok-worker/grok-turn-runner.mjs

@@ -6,6 +6,7 @@ import {
 import { buildGrokContextUsage, resolveGrokContextWindow } from './grok-context-usage.mjs';
 import { extractGrokUsageFromPromptResult, normalizeGrokTurnUsage } from '../services/plan-usage-grok.mjs';
 import { createPreviewInstructionsProvider } from '../../shared/preview-instructions.mjs';
+import { renderMediaEmbedInstructionBlock } from '../../shared/media-embed-instructions.mjs';
 import { countPlanLikeLines } from '../../shared/plan-lines.mjs';
 import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
 
@@ -43,6 +44,17 @@ export function buildGrokPlanReadyBoardPayload({
   };
 }
 
+// Delivered rows carry an attemptId the worker echoes on every write so the
+// server can fence out a superseded attempt (HTTP 409 stale_attempt) instead
+// of letting two attempts interleave writes on the same row. The real api
+// client reports the rejection body as a string; tolerate a parsed object too.
+function isStaleAttemptRejection(error) {
+  if (error?.status !== 409) return false;
+  const detail = error?.detail;
+  const text = typeof detail === 'string' ? detail : String(detail?.error || '');
+  return text.includes('stale_attempt');
+}
+
 function buildGrokTerminalError(classified, message) {
   return {
     kind: 'grok-turn-failed',
@@ -110,6 +122,7 @@ export function createGrokTurnRunner({
   // prefix like the mode nudge — once per worker, since the Grok session keeps
   // the history it was told in.
   let previewInstructionsSent = false;
+  let mediaInstructionsSent = false;
   // The user's max-turn-duration ceiling (0 = no limit), piggybacked on queue
   // deliveries; null means no delivery has told us yet and the ACP defaults
   // apply.
@@ -119,6 +132,13 @@ export function createGrokTurnRunner({
     return waitingForTurn ? String(activeMessage?.id || '') : '';
   }
 
+  // Crash-guard shape: the attempt id, when known, fences the dying worker's
+  // requeue so it cannot yank back a row a successor attempt now owns.
+  function getActiveQueueAttempt() {
+    if (!waitingForTurn || !activeMessage?.id) return null;
+    return { id: String(activeMessage.id), attemptId: activeMessage.attemptId || null };
+  }
+
   function isTurnActive() {
     return waitingForTurn;
   }
@@ -176,6 +196,7 @@ export function createGrokTurnRunner({
       mode: message.relayMode || 'agent',
       text,
       ...(subagentRunId ? { subagentRunId } : {}),
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
     }).catch(() => {});
   }
 
@@ -195,6 +216,7 @@ export function createGrokTurnRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -207,6 +229,7 @@ export function createGrokTurnRunner({
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -222,6 +245,7 @@ export function createGrokTurnRunner({
         parentSubagentId: payload.parentSubagentId || undefined,
         displayName: payload.displayName || undefined,
         status: payload.status,
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
       }).catch(() => {});
       return;
     }
@@ -289,6 +313,7 @@ export function createGrokTurnRunner({
       mode: message.relayMode || 'agent',
       text: String(text || ''),
       done: true,
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
     }).catch(() => {});
   }
 
@@ -301,8 +326,18 @@ export function createGrokTurnRunner({
       modelOrigin: modelOrigin
         || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
       ...(terminalError ? { terminalError } : {}),
-    }).catch(async () => {
-      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+      ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+    }).catch(async (error) => {
+      // A stale_attempt rejection means the server already handed this row to
+      // a newer attempt; requeueing would yank it back, so drop instead.
+      if (isStaleAttemptRejection(error)) {
+        dbg('response rejected as stale_attempt; dropping superseded turn', message.id);
+        return;
+      }
+      await api('POST', '/api/requeue', {
+        messageId: message.id,
+        ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+      }).catch(() => {});
     });
   }
 
@@ -339,7 +374,8 @@ export function createGrokTurnRunner({
       : await Promise.resolve()
         .then(() => getPreviewInstructions?.())
         .catch(() => '');
-    const promptText = [previewBlock, modeNudge, userText].filter(Boolean).join('\n\n');
+    const mediaBlock = mediaInstructionsSent ? '' : renderMediaEmbedInstructionBlock();
+    const promptText = [previewBlock, mediaBlock, modeNudge, userText].filter(Boolean).join('\n\n');
     const pendingNudgedRelayMode = String(message.relayMode || 'agent').trim().toLowerCase();
 
     let turn = null;
@@ -378,6 +414,7 @@ export function createGrokTurnRunner({
           }
           lastNudgedRelayMode = pendingNudgedRelayMode;
           if (previewBlock) previewInstructionsSent = true;
+          if (mediaBlock) mediaInstructionsSent = true;
           break;
         } catch (error) {
           // A stale agent whose previous prompt never settled reports busy;
@@ -433,7 +470,10 @@ export function createGrokTurnRunner({
         await publishFinalStream(message, fallbackText);
         await publishResponse(message, { text: fallbackText, model: responseModel });
       } else {
-        await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+        await api('POST', '/api/requeue', {
+          messageId: message.id,
+          ...(message.attemptId ? { attemptId: message.attemptId } : {}),
+        }).catch(() => {});
       }
       return true;
     }
@@ -513,6 +553,7 @@ export function createGrokTurnRunner({
   return {
     handlePendingPayload,
     getActiveQueueMessageId,
+    getActiveQueueAttempt,
     isTurnActive,
     dispose,
     setTurnCeilingMs(value) {

package/server/migrations/0004-steer-settle-markers.mjs

@@ -0,0 +1,119 @@
+'use strict';
+
+/**
+ * Migration: give steering settle stubs a durable shape the transcript can
+ * render on reload.
+ *
+ * 1. `messages.source_message_id` — the user message an assistant row answers.
+ *    The link used to live only in `queue.response_message_id`, and the queue
+ *    keeps just the newest 200 finished rows, so older assistant rows lost
+ *    their anchor and fell back to response-time ordering: an absorbed
+ *    (handed-off) reply then sorted below the steered message it hands off to,
+ *    and the merge never applied. Backfilled from whatever queue rows remain.
+ * 2. `messages.resend_of_message_id` — on a user message sent with Resend,
+ *    the stopped steer it re-sends. Durable, so "Resent" survives reloads and
+ *    other devices, and the relay can refuse a second Resend of one original.
+ * 3. Fold stubs saved as kind='absorbed' become kind='folded'. 'absorbed'
+ *    tells the client the reply continues through the NEXT user message, so
+ *    the next ordinary message after a fold was styled as steered.
+ *
+ * Idempotent: the column is added once, the backfill only fills NULLs, and the
+ * kind rewrite matches nothing once applied. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0004-steer-settle-markers.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+import { STEER_FOLDED_TEXT } from '../../shared/steer-settle-markers.mjs';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function columnNames(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((column) => String(column.name)));
+}
+
+export function migrateSteerSettleMarkers(db) {
+  if (!tableExists(db, 'messages')) {
+    return { applied: false, reason: 'messages table not found', sourceLinksBackfilled: 0, foldStubsRekinded: 0 };
+  }
+  let columns = columnNames(db, 'messages');
+  let columnAdded = false;
+  if (!columns.has('source_message_id')) {
+    db.exec(`ALTER TABLE messages ADD COLUMN source_message_id TEXT`);
+    columnAdded = true;
+  }
+  if (!columns.has('resend_of_message_id')) {
+    db.exec(`ALTER TABLE messages ADD COLUMN resend_of_message_id TEXT`);
+    columnAdded = true;
+  }
+  if (columnAdded) columns = columnNames(db, 'messages');
+  let sourceLinksBackfilled = 0;
+  let foldStubsRekinded = 0;
+  db.transaction(() => {
+    // Walk the (small, pruned) queue rather than correlating every message
+    // against it.
+    if (tableExists(db, 'queue') && columnNames(db, 'queue').has('response_message_id')) {
+      const link = db.prepare(`
+        UPDATE messages SET source_message_id = ?
+        WHERE id = ? AND role = 'assistant' AND source_message_id IS NULL
+      `);
+      const rows = db.prepare(`
+        SELECT id, response_message_id FROM queue
+        WHERE response_message_id IS NOT NULL AND response_message_id != ''
+      `).all();
+      for (const row of rows) {
+        sourceLinksBackfilled += link.run(String(row.id), String(row.response_message_id)).changes;
+      }
+    }
+    if (columns.has('kind')) {
+      foldStubsRekinded = db.prepare(`
+        UPDATE messages SET kind = 'folded'
+        WHERE role = 'assistant' AND kind = 'absorbed' AND TRIM(text) = ?
+      `).run(STEER_FOLDED_TEXT).changes;
+    }
+  })();
+  return {
+    applied: columnAdded || sourceLinksBackfilled > 0 || foldStubsRekinded > 0,
+    columnAdded,
+    sourceLinksBackfilled,
+    foldStubsRekinded,
+  };
+}
+
+export function migrate(dbPath) {
+  const db = new Database(dbPath);
+  try {
+    return migrateSteerSettleMarkers(db);
+  } finally {
+    db.close();
+  }
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0004 on ${dbPath}`);
+    console.log(result.applied
+      ? `  column added: ${result.columnAdded}; source links backfilled: ${result.sourceLinksBackfilled}; fold stubs re-kinded: ${result.foldStubsRekinded}`
+      : `  skipped: ${result.reason || 'nothing to change'}`);
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0004 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}