@oar-sh/oar 0.9.1 → 0.9.3

package/server/public/app/composer-control-state.mjs

@@ -19,19 +19,51 @@ export function hasUploadingAttachments(attachments = []) {
   return countUploadingAttachments(attachments) > 0;
 }
 
+// Why a message sent right now queues instead of steering — worker-reported
+// hold reasons mapped to a human title. Stopping a turn lives on the message
+// bubbles, never here, so every state below is a Send/Steer/Queue shape.
+const STEERING_HOLD_TITLES = Object.freeze({
+  question: 'Will steer in after you answer the question',
+  compaction: 'Will steer in once the conversation finishes compacting',
+  adoption: 'Will steer in once the compaction recovery finishes',
+  delivery: 'Will steer in once the current delivery lands',
+});
+
 export function deriveComposerControlState({
   hasActiveTurn = false,
-  cancelRequested = false,
   hasDraft = false,
   sendInFlight = false,
   modelMetadataBlocked = false,
   attachmentsUploading = false,
+  // The conversation's session worker delivers a message typed during a live
+  // turn INTO that turn (mid-turn steering, advertised on its heartbeat
+  // snapshot) rather than queueing it behind — so the control says "Steer",
+  // not "Queue". Workers that do not advertise it keep the queue wording.
+  steeringSupported = false,
+  // The worker reports steering as momentarily held (open question card or
+  // plan approval, compaction, post-compaction adoption). A send stays allowed
+  // and reads "Queue": the relay holds the message and it steers in once the
+  // hold clears.
+  steeringHeld = false,
+  steeringHoldReason = null,
 } = {}) {
   const active = !!hasActiveTurn;
-  const stopping = !!cancelRequested;
   const draft = !!hasDraft;
   const metadataBlocked = !!modelMetadataBlocked;
   const uploading = !!attachmentsUploading;
+  const held = active && !!steeringSupported && !!steeringHeld;
+  // The label/title/action for a draft typed during a live turn: steer into it
+  // where the provider supports that (queued while steering is held), queue
+  // behind it otherwise.
+  const steerNow = !!steeringSupported && !held;
+  const midTurnAction = steerNow ? 'steer' : 'queue';
+  const midTurnLabel = steerNow ? 'Steer' : 'Queue';
+  const midTurnTitle = held
+    ? (STEERING_HOLD_TITLES[String(steeringHoldReason || '').trim()]
+      || 'Will steer in once steering resumes')
+    : (steeringSupported
+      ? 'Steer message into the running turn'
+      : 'Queue message behind current turn');
 
   if (metadataBlocked && !active) {
     return {
@@ -42,59 +74,45 @@ export function deriveComposerControlState({
     };
   }
 
-  // Uploads are eager, so the blocking window is short. Keeping the button
-  // labelled Send/Queue (rather than switching to Stop) avoids the control
-  // flipping meaning mid-upload while a turn is running.
+  // Uploads are eager, so the blocking window is short. The control keeps its
+  // Send/Steer/Queue meaning while it waits.
   if (uploading) {
-    const queueing = active && draft;
+    const midTurn = active && draft;
     return {
-      action: queueing ? 'queue' : 'send',
-      label: queueing ? 'Queue' : 'Send',
+      action: midTurn ? midTurnAction : 'send',
+      label: midTurn ? midTurnLabel : 'Send',
       title: 'Waiting for attachments to finish uploading',
       disabled: true,
     };
   }
 
   if (sendInFlight) {
-    if (active && draft) {
-      return {
-        action: 'queue',
-        label: 'Queue',
-        title: 'Queue message behind current turn',
-        disabled: true,
-      };
-    }
-    if (active) {
-      return {
-        action: 'stop',
-        label: stopping ? 'Stopping…' : 'Stop',
-        title: stopping ? 'Stopping the current turn' : 'Stop the current turn',
-        disabled: true,
-      };
-    }
     return {
-      action: 'send',
-      label: 'Send',
-      title: 'Send message',
+      action: active && draft ? midTurnAction : 'send',
+      label: active && draft ? midTurnLabel : 'Send',
+      title: active && draft ? midTurnTitle : 'Send message',
       disabled: true,
     };
   }
 
   if (active && draft) {
     return {
-      action: 'queue',
-      label: 'Queue',
-      title: 'Queue message behind current turn',
+      action: midTurnAction,
+      label: midTurnLabel,
+      title: midTurnTitle,
       disabled: false,
     };
   }
 
   if (active) {
+    // Empty composer during a live turn: nothing to send, nothing to steer.
+    // The label stays "Send" (it only reads "Steer" with text present) and
+    // re-enables the moment the user types or the turn ends.
     return {
-      action: 'stop',
-      label: stopping ? 'Stopping…' : 'Stop',
-      title: stopping ? 'Stopping the current turn' : 'Stop the current turn',
-      disabled: stopping,
+      action: 'send',
+      label: 'Send',
+      title: 'Type a message to send',
+      disabled: true,
     };
   }
 

package/server/public/app/context-tier-options.mjs

@@ -1,11 +1,31 @@
 // Mirrors shared/model-id.mjs, which the browser cannot import (only
 // server/public is served).
 const CLAUDE_LONG_CONTEXT_LIMIT_TOKENS = 1000000;
-const UNKNOWN_WINDOW_LABEL = '—';
+export const UNKNOWN_WINDOW_LABEL = '—';
 
-function tokenLabel(tokens) {
+// Shared by the context chip and both model pickers so a window reads the same
+// everywhere: "400K", "1M", "1.05M" (the chip is 84px wide; "1050K" overflows).
+export function tokenLabel(tokens) {
   const limit = Number(tokens);
-  return Number.isFinite(limit) && limit > 0 ? `${Math.round(limit / 1000)}K` : UNKNOWN_WINDOW_LABEL;
+  if (!Number.isFinite(limit) || limit <= 0) return UNKNOWN_WINDOW_LABEL;
+  if (limit >= 1000000) {
+    return `${String((limit / 1000000).toFixed(2)).replace(/\.?0+$/, '')}M`;
+  }
+  return `${Math.round(limit / 1000)}K`;
+}
+
+// This chip is a context-TIER selector, so the default option must show the
+// default tier's own limit: the relay now caps defaultContextLimitTokens at
+// the runtime's real window (haiku 144K, gpt-5.4-mini 400K), while a model
+// with a long-context tier keeps a smaller default (gpt-5.6-terra: 400K
+// default, 1.05M long). Labelling the default with the full window would
+// render both of terra's tiers as "1.05M". The real window is only the
+// fallback for metadata that carries no derived default at all.
+function defaultWindowTokens(meta = {}) {
+  const derived = Number(meta.defaultContextLimitTokens);
+  if (Number.isFinite(derived) && derived > 0) return derived;
+  const real = Number(meta.contextWindowTokens);
+  return Number.isFinite(real) && real > 0 ? real : null;
 }
 
 function claudeTiersForModel(modelId, claudeTiers) {
@@ -33,7 +53,7 @@ export function buildContextTierOptions({
   claudeTiers = null,
 } = {}) {
   const meta = metadata && typeof metadata === 'object' ? metadata : {};
-  const defaultLabel = tokenLabel(meta.defaultContextLimitTokens);
+  const defaultLabel = tokenLabel(defaultWindowTokens(meta));
   const provider = String(providerType || '').trim().toLowerCase();
   const claudeTierList = provider === 'claude' ? claudeTiersForModel(modelId, claudeTiers) : null;
   if (claudeTierList) {

package/server/public/app/conversation-draft-sync.mjs

@@ -0,0 +1,187 @@
+// Per-conversation record of the server draft this client's composer last
+// agreed with. The composer text is local state that changes on every
+// keystroke; this record changes only when the server acknowledges a save or
+// the composer adopts a remote draft. Its updatedAt is the base version every
+// draft save is checked against, so it must never be touched by a local edit.
+
+import { serializeDraftAttachments } from './composer-attachment-cache.mjs';
+import { normalizeDraftTimestampMs } from './conversation-draft-timestamp-utils.mjs';
+
+// Sent with every draft save. It is what lets the server conflict-check an
+// explicit null base: clients from before this protocol also send null (JSON
+// keeps it), and for them null has to keep meaning "unconditional".
+export const DRAFT_SYNC_PROTOCOL_VERSION = 2;
+
+// Must equal the server's MAX_CONVERSATION_DRAFT_LENGTH (a test pins it). The
+// server truncates longer drafts, so the client saves and compares only this
+// prefix; otherwise a long composer never matches its acknowledged draft and
+// is re-saved on every refresh. The composer itself (and the message) is not
+// limited — only what survives as a draft.
+export const MAX_DRAFT_TEXT_LENGTH = 20_000;
+
+// Cuts at a code-point boundary, exactly like the server: a cut through a
+// surrogate pair would store a lone surrogate, which SQLite hands back as
+// U+FFFD — a different text at the same version.
+export function draftTextForSync(text) {
+  const value = String(text || '');
+  if (value.length <= MAX_DRAFT_TEXT_LENGTH) return value;
+  const cut = value.slice(0, MAX_DRAFT_TEXT_LENGTH);
+  const last = cut.charCodeAt(cut.length - 1);
+  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+
+const syncedDraftsByConversation = new Map();
+
+function conversationKey(conversationId) {
+  return String(conversationId || '').trim();
+}
+
+/** Order-sensitive fingerprint of a draft attachment list; null when absent. */
+export function draftAttachmentsKey(attachments) {
+  if (attachments === undefined || attachments === null) return null;
+  return serializeDraftAttachments(Array.isArray(attachments) ? attachments : [], { max: Number.MAX_SAFE_INTEGER })
+    .map((row) => row.sha256)
+    .join(',');
+}
+
+export function getSyncedDraft(conversationId) {
+  return syncedDraftsByConversation.get(conversationKey(conversationId)) || null;
+}
+
+export function recordSyncedDraft(conversationId, {
+  text = '',
+  attachments = undefined,
+  updatedAt = null,
+} = {}) {
+  const id = conversationKey(conversationId);
+  if (!id) return null;
+  const previous = syncedDraftsByConversation.get(id) || null;
+  const incomingKey = draftAttachmentsKey(attachments);
+  const record = {
+    text: String(text || ''),
+    attachmentsKey: incomingKey === null ? (previous?.attachmentsKey ?? null) : incomingKey,
+    updatedAt: updatedAt || null,
+  };
+  syncedDraftsByConversation.set(id, record);
+  return record;
+}
+
+export function forgetSyncedDraft(conversationId) {
+  syncedDraftsByConversation.delete(conversationKey(conversationId));
+}
+
+/**
+ * A save is a no-op when the server already holds exactly this text (and,
+ * for saves that carry attachments, exactly these attachments) — but only
+ * while no newer server version is known. If one is (a remote draft deferred
+ * while the user typed), the save must still go out so its version check
+ * surfaces that draft instead of silently keeping a stale base.
+ */
+export function isDraftSaveNoop({ synced = null, text = '', attachmentsKey = null, knownUpdatedAt = null } = {}) {
+  if (!synced) return false;
+  if (normalizeDraftTimestampMs(knownUpdatedAt) > normalizeDraftTimestampMs(synced.updatedAt)) return false;
+  if (String(text || '') !== synced.text) return false;
+  if (attachmentsKey === null) return true;
+  return synced.attachmentsKey !== null && attachmentsKey === synced.attachmentsKey;
+}
+
+/**
+ * Decides a 409 draft conflict.
+ * - converged: the server already holds what we wanted to save.
+ * - adopt: the local text is unchanged since the last sync, so the remote
+ *   draft simply wins.
+ * - keep-local: both sides edited; the local (newest) keystroke wins and the
+ *   remote text becomes the one offered for restore.
+ */
+export function resolveDraftConflict({
+  localText = '',
+  localAttachmentsKey = null,
+  baseText = null,
+  baseAttachmentsKey = null,
+  serverText = '',
+  serverAttachmentsKey = null,
+} = {}) {
+  const local = String(localText || '');
+  const attachmentsMatch = (other) => localAttachmentsKey === null || localAttachmentsKey === other;
+  if (local === String(serverText || '') && attachmentsMatch(serverAttachmentsKey)) return 'converged';
+  if (baseText !== null && local === baseText && attachmentsMatch(baseAttachmentsKey)) return 'adopt';
+  return 'keep-local';
+}
+
+/**
+ * Whether an incoming remote draft may replace the composer of the
+ * conversation on screen. Only an unmodified composer (text and attachments
+ * still equal to the last synced draft) adopts it, focused or not. A modified
+ * one never does — not even for an equal or newer version: its edit is unsaved
+ * (a failed flush leaves exactly this state), and the caller re-saves it so the
+ * version check decides. An upload still in flight counts as a modification.
+ * With nothing synced yet there is no saved edit to protect.
+ * Attachment keys are null when unknown and then do not take part.
+ */
+export function shouldApplyIncomingDraftToComposer({
+  inputText = '',
+  incomingText = '',
+  syncedText = null,
+  inputAttachmentsKey = null,
+  incomingAttachmentsKey = null,
+  syncedAttachmentsKey = null,
+  attachmentsUploading = false,
+} = {}) {
+  if (attachmentsUploading) return false;
+  const current = draftTextForSync(inputText);
+  const sameAttachments = (other) => inputAttachmentsKey === null || other === null || inputAttachmentsKey === other;
+  if (current === String(incomingText || '') && sameAttachments(incomingAttachmentsKey)) return true;
+  if (syncedText === null) return true;
+  return current === syncedText && sameAttachments(syncedAttachmentsKey);
+}
+
+/**
+ * PATCH body for the pagehide Background Sync copy of a draft flush, or null
+ * when the composer holds nothing unsaved. Compared against the synced draft,
+ * not the local text (which every keystroke updates).
+ */
+export function draftFlushRequestBody({
+  inputText = '',
+  synced = null,
+  fallbackText = '',
+  fallbackUpdatedAt = null,
+  clientId = null,
+  afterPendingSend = false,
+} = {}) {
+  const draftText = draftTextForSync(inputText);
+  const serverText = synced ? synced.text : draftTextForSync(fallbackText);
+  if (draftText === serverText) return null;
+  if (afterPendingSend) {
+    // An emptied composer after a send is what the send leaves anyway.
+    if (!draftText.trim()) return null;
+    // The send will move the server's version past this base. acceptOwnSend
+    // lets the replay through only while that move is this client's own (the
+    // send transaction records the sender); anyone else's newer draft still
+    // wins with a 409.
+    return {
+      draftText,
+      clientId,
+      draftSyncVersion: DRAFT_SYNC_PROTOCOL_VERSION,
+      baseDraftUpdatedAt: (synced ? synced.updatedAt : fallbackUpdatedAt) || null,
+      acceptOwnSend: true,
+    };
+  }
+  return {
+    draftText,
+    clientId,
+    draftSyncVersion: DRAFT_SYNC_PROTOCOL_VERSION,
+    baseDraftUpdatedAt: (synced ? synced.updatedAt : fallbackUpdatedAt) || null,
+  };
+}
+
+// A queued draft flush replayed later than this (Firefox/Safari replay the
+// outbox only on the next page load, possibly hours on) would write text
+// nobody is looking at over whatever the draft became meanwhile. sw.js
+// mirrors this value; a test pins them together.
+export const DRAFT_FLUSH_MAX_AGE_MS = 5 * 60 * 1000;
+
+export function isStaleDraftFlushEntry(entry, now = Date.now()) {
+  if (String(entry?.kind || '') !== 'draft-flush') return false;
+  const createdAt = Number(entry?.createdAt || 0);
+  return !Number.isFinite(createdAt) || createdAt <= 0 || now - createdAt > DRAFT_FLUSH_MAX_AGE_MS;
+}

package/server/public/app/conversation-list-filter.mjs

@@ -0,0 +1,86 @@
+// Title filtering for the conversation sidebar. Kept DOM-free so it can be unit
+// tested; journal-view.js touches window/document at module scope and cannot be
+// imported from node:test.
+
+// NFC first so a decomposed "é" (e + U+0301, as some IMEs and pasted text
+// produce) matches a precomposed one. Case folding is toLocaleLowerCase only, so
+// multi-char folds are a known limit: "ß" does not match "SS".
+function foldForMatch(text) {
+  return String(text ?? '').normalize('NFC').toLocaleLowerCase();
+}
+
+export function normalizeConversationFilter(text) {
+  return foldForMatch(text).trim();
+}
+
+export function conversationMatchesFilter(conversation, normalizedFilter) {
+  if (!normalizedFilter) return true;
+  return foldForMatch(conversation?.title).includes(normalizedFilter);
+}
+
+export function filterConversations(conversations, filterText) {
+  const list = Array.isArray(conversations) ? conversations : [];
+  const normalized = normalizeConversationFilter(filterText);
+  if (!normalized) return list;
+  return list.filter((conversation) => conversationMatchesFilter(conversation, normalized));
+}
+
+export function describeFilterMatchCount(count, { loadedOnly = false } = {}) {
+  const n = Math.max(0, Number(count) || 0);
+  const noun = loadedOnly ? 'loaded conversation' : 'conversation';
+  if (n === 0) return `No ${noun}s match`;
+  return n === 1 ? `1 ${noun} matches` : `${n} ${noun}s match`;
+}
+
+function cursorKey(state) {
+  try {
+    return JSON.stringify(state?.nextCursor ?? null);
+  } catch {
+    return '';
+  }
+}
+
+// While a filter is active the sidebar has to search conversations that only
+// exist on unloaded pages, so pull every remaining page through the loader.
+// shouldContinue() is checked before each page so clearing the filter (or
+// switching it) aborts the drain. loadMore() resolving falsy is ambiguous:
+// - the loader is busy (a boundary-check load/prefetch is in flight): wait it
+//   out without spending idle retries, so the drain does not give up while the
+//   list is still loading. busyRetries caps a genuinely stuck fetch.
+// - a reset bumped the loader version mid-fetch, or the fetch failed: retry,
+//   but stop after maxIdleRetries consecutive no-progress attempts so a failing
+//   endpoint is not hammered forever.
+// An advanced cursor counts as progress even when the page was empty.
+export async function drainRemainingPages(loader, shouldContinue = () => true, {
+  retryDelayMs = 200,
+  maxIdleRetries = 10,
+  maxBusyRetries = 300,
+  delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+} = {}) {
+  if (!loader || typeof loader.loadMore !== 'function' || typeof loader.getState !== 'function') {
+    return false;
+  }
+  let loadedAnything = false;
+  let idleRetries = 0;
+  let busyRetries = 0;
+  while (loader.getState().hasMore && shouldContinue()) {
+    const cursorBefore = cursorKey(loader.getState());
+    const loaded = await loader.loadMore();
+    const state = loader.getState();
+    if (loaded) loadedAnything = true;
+    if (loaded || cursorKey(state) !== cursorBefore) {
+      idleRetries = 0;
+      busyRetries = 0;
+      continue;
+    }
+    if (state.isLoading || state.isPrefetching) {
+      busyRetries += 1;
+      if (busyRetries > maxBusyRetries) break;
+    } else {
+      idleRetries += 1;
+      if (idleRetries > maxIdleRetries) break;
+    }
+    await delay(retryDelayMs);
+  }
+  return loadedAnything;
+}

package/server/public/app/conversation-preferences.mjs

@@ -69,6 +69,49 @@ export function resolveConversationComposerSelection({
   };
 }
 
+// Every effort rung any provider speaks, lowest first. 'ultracode' sits on top
+// but is a Claude mode rather than "more thinking", so it is never a clamp
+// target and a remembered ultracode does not degrade to xhigh (it falls
+// through to the next candidate — the existing "drops cleanly" rule).
+export const REASONING_EFFORT_LADDER = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultracode'];
+
+function normalizeEffortList(efforts = []) {
+  return (Array.isArray(efforts) ? efforts : [])
+    .map((effort) => String(effort || '').trim().toLowerCase())
+    .filter(Boolean);
+}
+
+/**
+ * Clamp rule, per candidate in priority order:
+ *   1. the candidate itself when the model supports it;
+ *   2. else the highest supported rung BELOW it, ignoring 'none'
+ *      (gpt-5.6-terra@max → gpt-5.4-mini lands on xhigh);
+ *   3. else the lowest supported rung ABOVE it, ignoring 'none'
+ *      (a remembered 'minimal' on a model whose floor is 'low' → low);
+ *   4. else the next candidate.
+ * With no candidate usable: the lowest non-'none' rung the model offers, or
+ * 'none' when that is all there is. Effort names off the ladder (image
+ * quality values, unknown providers) only ever match exactly.
+ */
+export function nearestSupportedReasoningEffort(candidates = [], supportedEfforts = []) {
+  const options = normalizeEffortList(supportedEfforts);
+  if (!options.length) return '';
+  const rungOf = (effort) => REASONING_EFFORT_LADDER.indexOf(effort);
+  const ranked = options
+    .filter((option) => option !== 'none' && rungOf(option) >= 0)
+    .sort((left, right) => rungOf(left) - rungOf(right));
+  for (const candidate of normalizeEffortList(candidates)) {
+    if (options.includes(candidate)) return candidate;
+    const rung = rungOf(candidate);
+    if (rung < 0 || candidate === 'ultracode') continue;
+    const below = ranked.filter((option) => rungOf(option) < rung);
+    if (below.length) return below[below.length - 1];
+    const above = ranked.find((option) => rungOf(option) > rung && option !== 'ultracode');
+    if (above) return above;
+  }
+  return options.find((option) => option !== 'none') || options[0];
+}
+
 // Priority: an explicit request (conversation preference, or the effort being
 // carried across a user model change) beats what the previous conversation left
 // in the DOM. Reversing those two is what let a New Chat "high" become "low".
@@ -78,14 +121,8 @@ export function resolveComposerReasoningEffort({
   currentEffort = '',
   supportedEfforts = [],
 } = {}) {
-  const options = (Array.isArray(supportedEfforts) ? supportedEfforts : [])
-    .map((effort) => String(effort || '').trim().toLowerCase())
-    .filter(Boolean);
-  if (!options.length) return '';
-  const candidates = [preferredEffort, storedEffort, currentEffort]
-    .map((effort) => String(effort || '').trim().toLowerCase())
-    .filter(Boolean);
-  const match = candidates.find((candidate) => options.includes(candidate));
-  if (match) return match;
-  return options.find((option) => option !== 'none') || options[0];
+  return nearestSupportedReasoningEffort(
+    [preferredEffort, storedEffort, currentEffort],
+    supportedEfforts,
+  );
 }

package/server/public/app/conversation-provider-indicator.mjs

@@ -35,6 +35,14 @@ export function conversationProviderIndicatorLabel(conversation = null) {
   return '';
 }
 
+// A question card names the runtime that asks, the way the list pill names it.
+// Unresolved reads plain "Question": every card used to say "Copilot question",
+// Claude's and Cursor's included.
+export function questionCardHeadLabel(conversation = null) {
+  const provider = conversationProviderIndicatorLabel(conversation);
+  return provider ? `${provider} question` : 'Question';
+}
+
 const SESSION_LOCK_LABELS = {
   github: 'GitHub Copilot',
   openai: 'OpenAI',