@oar-sh/oar 0.9.1 → 0.9.3

package/server/routes/sessions-routes.mjs

@@ -1,4 +1,5 @@
 'use strict';
+import { liveResendsByOriginal } from '../services/steer-resend.mjs';
 import { killTmuxSession } from '../services/session-worker-launch-service.mjs';
 
 import fs from 'fs';
@@ -66,6 +67,11 @@ import {
   BACKGROUND_TASK_TIMEOUT_STEP_MINUTES,
   parseBackgroundTaskTimeoutUpdate,
 } from '../../shared/background-task-timeout.mjs';
+import {
+  PWA_APP_NAME_DEFAULT,
+  PWA_APP_NAME_MAX_LENGTH,
+  derivePwaShortName,
+} from '../../shared/pwa-app-name.mjs';
 
 export { mapUsageSnapshotRow };
 
@@ -942,13 +948,19 @@ export function normalizePreferredReasoningEffort(value) {
   return String(value || '').trim().toLowerCase();
 }
 
-const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
+// The web client caps what it saves at the same length (MAX_DRAFT_TEXT_LENGTH
+// in public/app/conversation-draft-sync.mjs); a test pins them together.
+export const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
 
 function normalizeConversationDraftText(value, { maxLength = MAX_CONVERSATION_DRAFT_LENGTH } = {}) {
   const text = String(value ?? '');
   if (!text.trim()) return '';
   if (text.length <= maxLength) return text;
-  return text.slice(0, maxLength);
+  // Never split a surrogate pair: SQLite would store the lone half as U+FFFD,
+  // and the client (which cuts the same way) would no longer match its draft.
+  const cut = text.slice(0, maxLength);
+  const last = cut.charCodeAt(cut.length - 1);
+  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
 }
 
 export function normalizeOptionalIsoTimestamp(value) {
@@ -1273,7 +1285,7 @@ export function buildSessionWorkerStatusPayload({
   return {
     enabled: featureFlags?.SESSION_WORKER_ROUTING_ENABLED === true,
     continuationRoutingEnabled: featureFlags?.SESSION_WORKER_CONTINUATION_ROUTING_ENABLED === true,
-    fallbackRestartEnabled: false,
+    fallbackRestartEnabled: featureFlags?.SESSION_WORKER_FALLBACK_RESTART_ENABLED === true,
     uiState: normalizeWorkerStatusText(snapshot?.health?.uiState, 'white'),
     degradedReason: normalizeWorkerStatusText(snapshot?.health?.degradedReason, null),
     health: snapshot?.health && typeof snapshot.health === 'object' ? snapshot.health : null,
@@ -1738,11 +1750,16 @@ export function buildConversationMessages({
       .map((row) => [String(row?.id || '').trim(), row])
       .filter(([id]) => !!id),
   );
+  // A stopped steer's marker says "Resent" from the data, so it holds across
+  // reloads and devices (the relay refuses a second Resend on the same basis).
+  const liveResends = liveResendsByOriginal(dbMessages, queueRows);
   const normalizedDbMessages = Array.isArray(dbMessages)
     ? dbMessages.map((message) => {
         const id = String(message?.id || '').trim();
+        // The queue's link is pruned with old rows; the message's own column
+        // keeps it, so a reload still anchors the reply under its prompt.
         const sourceMessageId = message?.role === 'assistant'
-          ? (responseMessageToSourceId.get(id) || undefined)
+          ? (responseMessageToSourceId.get(id) || String(message?.source_message_id || '').trim() || undefined)
           : undefined;
         // A user row's queue entry shares its id; assistant rows reach the same
         // entry through the response mapping. Both need it for the effort tag.
@@ -1770,6 +1787,15 @@ export function buildConversationMessages({
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
+          // 'continuation' badges a self-started turn; 'absorbed' marks a
+          // reply that continues through the next (steered) user message;
+          // 'folded'/'stopped' are a steer's settle markers. Without this the
+          // live-appended badge/merge/marker vanished on reload.
+          kind: message?.kind || undefined,
+          resendOfMessageId: message?.role === 'user' ? (message?.resend_of_message_id || undefined) : undefined,
+          resentAs: (message?.role === 'assistant' && message?.kind === 'stopped' && sourceMessageId)
+            ? (liveResends.get(sourceMessageId) || undefined)
+            : undefined,
         };
       })
     : [];
@@ -1971,6 +1997,11 @@ export function registerSessionsRoutes(app, deps) {
     refreshOpenAIProviderModels = async () => ({ ok: false, models: [], error: 'OpenAI model discovery is unavailable' }),
     getCopilotProviderSettings = () => ({ engine: 'extension', engines: ['extension', 'sdk'] }),
     setCopilotProviderSettings = () => ({ ok: false, error: 'Copilot settings are unavailable' }),
+    // Server-side Copilot model discovery (Phase 5A) — optional so route tests
+    // that don't exercise the catalog can omit it. When present it also gets
+    // the models_updated broadcaster, since only this module knows how to
+    // layer provider models onto the base catalog payload.
+    copilotModelDiscoveryService = null,
     getClaudeProviderSettings = () => ({ configured: false, enabled: false, model: 'claude-sonnet-5', models: [] }),
     setClaudeProviderSettings = () => ({ ok: false, error: 'Claude settings are unavailable' }),
     refreshClaudeProviderModels = async () => ({ ok: false, models: [], error: 'Claude model discovery is unavailable' }),
@@ -1981,6 +2012,10 @@ export function registerSessionsRoutes(app, deps) {
     // Owns the relay-wide single-flight CLI install/update, the descriptor
     // table and the binary bindings, on the same terms as claudeAuthService.
     cliInstallService = null,
+    updateCheckService = null,
+    updateInstallService = null,
+    buildUpdateStatePayload = null,
+    runningVersion = null,
     getCursorProviderSettings = () => ({ configured: false, enabled: false, model: 'composer-2.5', models: [] }),
     setCursorProviderSettings = () => ({ ok: false, error: 'Cursor settings are unavailable' }),
     refreshCursorProviderModels = async () => ({ ok: false, models: [], error: 'Cursor model discovery is unavailable' }),
@@ -2057,16 +2092,25 @@ export function registerSessionsRoutes(app, deps) {
     resolveCursorSessionRoot = null,
     getTurnCeilingMinutes = () => DEFAULT_TURN_CEILING_MINUTES,
     setTurnCeilingMinutes = () => ({ ok: false, error: 'Turn ceiling settings are unavailable' }),
+    getFeatureFlagsSettingsState = () => [],
+    setFeatureFlagSetting = () => ({ ok: false, error: 'Feature settings are unavailable' }),
+    getPwaAppName = () => '',
+    setPwaAppName = () => ({ ok: false, status: 500, error: 'App name settings are unavailable' }),
     getBackgroundTaskTimeoutMinutes = () => DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES,
     setBackgroundTaskTimeoutMinutes = () => ({ ok: false, error: 'Background task timeout settings are unavailable' }),
     markSharedViewerPresence,
     getSharedWatcherCount,
     statusEventService,
     windowsAutostartService,
+    windowsBootAutostartService,
     isSha256,
     uploadPathForSha,
   } = deps;
   const sdkSessionSyncService = createSdkSessionSyncService(db);
+  // Generic synchronous transaction runner for the session-sync route: binding
+  // validation, workspace learning and the binding writes must commit or roll
+  // back as one unit (audit #21).
+  const sessionSyncTransaction = db.transaction((work) => work());
 
   /**
    * Drops draft references to the given blobs and reclaims any that no longer
@@ -2089,9 +2133,11 @@ export function registerSessionsRoutes(app, deps) {
     }
   }
 
-  const SDK_DELETE_WAIT_TIMEOUT_MS = 12_000;
-  const SDK_DELETE_POLL_MS = 200;
   const SDK_DELETE_STALE_PROCESSING_MS = 60_000;
+  const CLI_SESSION_DELETE_TIMEOUT_MS = 10_000;
+  const LIVE_WORKER_STATUSES = new Set(['starting', 'ready', 'processing']);
+  // A session id that is safe to join into a path under the session-state root.
+  const SESSION_FOLDER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
   const markConversationDeleted = db.prepare(`UPDATE conversations SET status = 'deleted', updated_at = ? WHERE id = ?`);
   const getActiveQueueForMessage = db.prepare(`
     SELECT id
@@ -2120,6 +2166,20 @@ export function registerSessionsRoutes(app, deps) {
     WHERE conversation_id = ?
       AND status IN ('pending', 'processing', 'parked')
   `);
+  const countProcessingConversationQueueRows = db.prepare(`
+    SELECT COUNT(*) AS count
+    FROM queue
+    WHERE conversation_id = ?
+      AND status = 'processing'
+  `);
+  const findOtherLiveConversationForSdkSession = db.prepare(`
+    SELECT id
+    FROM conversations
+    WHERE sdk_session_id = ?
+      AND id != ?
+      AND status != 'deleted'
+    LIMIT 1
+  `);
   const getConversationUsageSnapshotAggregate = db.prepare(`
     SELECT
       COUNT(*) AS snapshot_count,
@@ -2183,10 +2243,6 @@ export function registerSessionsRoutes(app, deps) {
   const sessionLaunchMutex = createKeyedMutex();
   const relaunchCoalescer = createRelaunchCoalescer({ windowMs: RELAUNCH_COALESCE_WINDOW_MS });
 
-  function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-
   // Layer every enabled provider's models onto the base Copilot catalog.
   function buildModelCatalogWithProviders(modelState, openAISettings = getOpenAIProviderSettings()) {
     return buildModelCatalogWithGrokProvider(
@@ -2201,6 +2257,12 @@ export function registerSessionsRoutes(app, deps) {
     );
   }
 
+  // A discovery that lands outside any route (the deferred boot refresh) still
+  // has to reach connected pickers the way a snapshot POST does.
+  copilotModelDiscoveryService?.setOnCatalogUpdated?.(() => {
+    io.emit('models_updated', buildModelCatalogWithProviders(getModelCatalogState()));
+  });
+
   function extractClientIp(req) {
     const forwardedForHeader = String(req.headers?.['x-forwarded-for'] || '').trim();
     if (forwardedForHeader) {
@@ -2263,16 +2325,121 @@ export function registerSessionsRoutes(app, deps) {
     return true;
   }
 
-  async function waitForSdkDeleteCompletion(sdkSessionId, timeoutMs = SDK_DELETE_WAIT_TIMEOUT_MS) {
-    const sid = String(sdkSessionId || '').trim();
-    if (!sid) return { completed: false };
-    const startedAt = Date.now();
-    while ((Date.now() - startedAt) < timeoutMs) {
-      const row = stmts.getSdkDeleteRequestBySessionId.get(sid);
-      if (!row) return { completed: true };
-      await sleep(SDK_DELETE_POLL_MS);
-    }
-    return { completed: false };
+  /**
+   * Whether a conversation is still working, which blocks deleting it: a turn
+   * is running (including one waiting on a question card or an approval) or
+   * background tasks are live. Both only count while the session's worker is
+   * alive: a dead worker runs nothing, and the processing rows or task set it
+   * left behind would otherwise make the conversation undeletable. A session
+   * the registry has never seen may still be running a turn, so its
+   * processing rows count.
+   *
+   * A worker's pid decides whether it is alive; its status only when it has
+   * none. A turn that fails marks a worker that is still running 'error',
+   * and it stays so until its next turn, background tasks and all.
+   */
+  function describeConversationActivity(conversationId, workerSessionId) {
+    const worker = sessionWorkerRegistry?.getWorker?.(workerSessionId) || null;
+    const workerAlive = !!worker && (worker.pid
+      ? isPidAlive(worker.pid)
+      : LIVE_WORKER_STATUSES.has(String(worker.status || '').trim().toLowerCase()));
+    const processingCount = Number(countProcessingConversationQueueRows.get(conversationId)?.count || 0);
+    const taskKeys = [...new Set([conversationId, workerSessionId])];
+    const liveTasks = workerAlive ? taskKeys.flatMap((key) => backgroundTaskStore?.get?.(key) || []) : [];
+    return {
+      turnRunning: processingCount > 0 && (workerAlive || !worker),
+      backgroundTaskCount: liveTasks.length,
+      // Tasks the panel shows no Stop button for (Copilot detached shells).
+      unstoppableTaskCount: liveTasks.filter((task) => task?.stoppable === false).length,
+    };
+  }
+
+  function withDeadline(promise, timeoutMs, label) {
+    let timer = null;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs} ms`)), timeoutMs);
+        timer.unref?.();
+      }),
+    ]).finally(() => clearTimeout(timer));
+  }
+
+  /**
+   * The Claude CLI's footprint for one session: its transcript
+   * (`<projectDir>/<nativeSessionId>.jsonl`) and the per-session folder beside
+   * it. Nothing else in the project folder is touched — it holds every other
+   * session of that workspace and the project memory.
+   */
+  function deleteClaudeCliSession({ conversation, runtimeSession }) {
+    const nativeSessionId = String(runtimeSession?.claude_native_session_id || '').trim();
+    if (!nativeSessionId || typeof resolveClaudeSessionRoot !== 'function') return { deleted: null };
+    const anchors = resolveClaudeSessionRoot({
+      claudeNativeSessionId: nativeSessionId,
+      workspaceRootPath: String(
+        conversation?.runtime_workspace_root_path || conversation?.configured_workspace_root_path || '',
+      ).trim(),
+    });
+    if (!anchors?.projectDirPath) return { deleted: null };
+    const projectDir = path.resolve(anchors.projectDirPath);
+    const targets = [anchors.transcriptPath, anchors.sessionRootExists ? anchors.sessionRootPath : '']
+      .filter(Boolean)
+      .map((target) => path.resolve(target))
+      .filter((target) => path.dirname(target) === projectDir
+        && [nativeSessionId, `${nativeSessionId}.jsonl`].includes(path.basename(target)));
+    for (const target of targets) fs.rmSync(target, { recursive: true, force: true });
+    return { deleted: targets.length > 0 };
+  }
+
+  /**
+   * The Copilot session, through the runtime's own deleteSession(). When that
+   * fails the request goes on the SDK delete queue, which a CLI-side consumer
+   * (the extension engine) still works off.
+   */
+  async function deleteCopilotCliSession({ sdkSessionId, conversationId }) {
+    const stateRoot = String(resolveSessionStateRoot?.() || '').trim();
+    const sessionDir = stateRoot && SESSION_FOLDER_ID_PATTERN.test(sdkSessionId) ? path.join(stateRoot, sdkSessionId) : '';
+    // A conversation deleted before its first turn has no session on disk yet
+    // (the runtime would answer "Session file not found").
+    if (sessionDir && !fs.existsSync(sessionDir)) return { deleted: null };
+    if (typeof sdkSessionImportService?.deleteSession !== 'function') return { deleted: null };
+    try {
+      await withDeadline(
+        sdkSessionImportService.deleteSession(sdkSessionId),
+        CLI_SESSION_DELETE_TIMEOUT_MS,
+        'Copilot deleteSession()',
+      );
+      return { deleted: true };
+    } catch (error) {
+      const reason = String(error?.message || error);
+      if (/Session file not found/i.test(reason)) {
+        // The runtime keeps no session for it, only this session's own
+        // folder (a run that never wrote its session file): nothing to retry.
+        if (sessionDir) fs.rmSync(sessionDir, { recursive: true, force: true });
+        return { deleted: sessionDir ? true : null };
+      }
+      console.warn(`[delete] Copilot session ${shortId(sdkSessionId)} was not deleted: ${reason}`);
+      enqueueSdkDeleteRequest(sdkSessionId, conversationId);
+      return { deleted: false, queued: true };
+    }
+  }
+
+  /** The conversation's CLI-side session, per provider; null where the relay keeps none. */
+  async function deleteCliSession({ conversation, conversationId, sdkSessionId, runtimeSession }) {
+    const provider = String(runtimeSession?.provider_type || '').trim().toLowerCase();
+    try {
+      if (provider === 'claude') return deleteClaudeCliSession({ conversation, runtimeSession });
+      if (!sdkSessionId) return { deleted: null };
+      if (!provider || provider === 'github' || provider === 'openai') {
+        return await deleteCopilotCliSession({ sdkSessionId, conversationId });
+      }
+      return { deleted: null };
+    } catch (error) {
+      // The conversation is already tombstoned: a file the OS will not let go
+      // of must not leave it half deleted.
+      console.warn(`[delete] CLI session of ${shortId(conversationId)} was not deleted: ${error?.message || error}`);
+      return { deleted: false };
+    }
   }
 
   function finalizeDeletedConversationsForSdkSession(sdkSessionId) {
@@ -2407,7 +2574,7 @@ export function registerSessionsRoutes(app, deps) {
       (stmts.getSharedMessages || stmts.getMessages).all(resolvedConversationId),
     );
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -2739,16 +2906,36 @@ export function registerSessionsRoutes(app, deps) {
     }
 
     try {
-      const workspaceRootSync = learnWorkspaceRootFromSessionSync({
-        learnConversationWorkspaceRoot,
-        sdkSessionId,
-        conversationId,
-        workspaceRootPath,
-      });
-      const sync = sdkSessionSyncService.syncSession({
-        sdk_session_id: sdkSessionId,
-        conversation_id: conversationId,
+      // Conflicts veto the request BEFORE workspace learning may create or
+      // mutate rows, and the whole set commits atomically — a 409 leaves every
+      // table exactly as the request found it (audit #21). The placeholder
+      // queue-owner rekey inside syncSession lands in this same transaction,
+      // so a dequeue can never read a half-migrated owner id (audit #22).
+      const { workspaceRootSync, sync } = sessionSyncTransaction(() => {
+        sdkSessionSyncService.validateBinding({
+          sdk_session_id: sdkSessionId,
+          conversation_id: conversationId,
+        });
+        const learned = learnWorkspaceRootFromSessionSync({
+          learnConversationWorkspaceRoot,
+          sdkSessionId,
+          conversationId,
+          workspaceRootPath,
+        });
+        return {
+          workspaceRootSync: learned,
+          sync: sdkSessionSyncService.syncSession({
+            sdk_session_id: sdkSessionId,
+            conversation_id: conversationId,
+          }),
+        };
       });
+      // In-memory half of the placeholder rekey, immediately after the DB half
+      // committed: markWorkerSessionSeen below would otherwise mint a second
+      // registry entry under the real id and strand the placeholder entry.
+      if (sync?.placeholderSdkSessionId) {
+        sessionWorkerRegistry?.rekeyWorker?.(sync.placeholderSdkSessionId, sync.sdkSessionId);
+      }
       const rebind = relayRestartOrchestrator?.applySessionSync?.({
         sdkSessionId,
         conversationId,
@@ -3070,17 +3257,27 @@ export function registerSessionsRoutes(app, deps) {
       const result = await sdkSessionImportService.refreshConversation(existingConversation);
       if (result.status === 'failed') throw new Error(result.error || 'Failed to refresh conversation history');
       if (result.status !== 'completed') {
-        const error = new Error(
-          result.reason === 'tombstoned'
-            ? 'Conversation not found'
-            : 'Conversation history refresh is already in progress',
-        );
-        error.statusCode = result.reason === 'tombstoned' ? 404 : 409;
+        // Each skip gets its precise cause; the old blanket "already in
+        // progress" told users a relay-owned conversation was merely busy and
+        // to try again (audit #19).
+        const skip = result.category === 'relay-owned'
+          ? { statusCode: 409, code: 'relay-owned', message: 'Conversation history is owned by the relay and cannot be re-imported' }
+          : result.category === 'bound-elsewhere'
+            ? { statusCode: 409, code: 'bound-elsewhere', message: 'SDK session is bound to another conversation' }
+            : result.reason === 'tombstoned'
+              ? { statusCode: 404, code: 'not-found', message: 'Conversation not found' }
+              : result.reason === 'importer-closing'
+                ? { statusCode: 503, code: 'shutting-down', message: 'Relay is shutting down' }
+                : { statusCode: 409, code: 'refresh-in-progress', message: 'Conversation history refresh is already in progress' };
+        const error = new Error(skip.message);
+        error.statusCode = skip.statusCode;
+        error.code = skip.code;
         throw error;
       }
     } catch (error) {
       return res.status(error?.statusCode || 500).json({
         error: error?.message || 'Failed to refresh conversation history',
+        ...(error?.code ? { code: error.code } : {}),
       });
     }
 
@@ -3122,7 +3319,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(conversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(conversationId);
@@ -3524,7 +3721,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(resolvedConversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -3795,15 +3992,30 @@ export function registerSessionsRoutes(app, deps) {
     if (!existing || String(existing.status || '').trim() === 'deleted') {
       return res.status(404).json({ error: 'Conversation not found' });
     }
-    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt ?? req.body?.base_draft_updated_at;
-    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined;
+    // A null base means "I have seen no draft" and conflicts with any versioned
+    // draft — but only from clients that declare the versioned protocol. Older
+    // tabs also send an explicit null (after every keystroke), and a 409 there
+    // would revert their typing, so for them null stays unconditional.
+    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt !== undefined
+      ? req.body.baseDraftUpdatedAt
+      : req.body?.base_draft_updated_at;
+    const speaksVersionedDraftProtocol = Number(req.body?.draftSyncVersion) >= 2;
+    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined
+      && (baseDraftUpdatedAtValue !== null || speaksVersionedDraftProtocol);
     const normalizedBaseDraftUpdatedAt = normalizeOptionalIsoTimestamp(baseDraftUpdatedAtValue);
     const suppliedBaseTimestamp = String(baseDraftUpdatedAtValue ?? '').trim();
     if (comparesDraftVersion && suppliedBaseTimestamp && !normalizedBaseDraftUpdatedAt) {
       return res.status(400).json({ error: 'Invalid baseDraftUpdatedAt timestamp' });
     }
     const existingDraftUpdatedAt = normalizeOptionalIsoTimestamp(existing.draft_updated_at);
-    if (hasConversationDraftVersionConflict({
+    // A pagehide copy taken while this client's own send was in flight carries
+    // the pre-send base; the send transaction has since moved the version. That
+    // move (recorded with the sender's client id) is the only mismatch it may
+    // pass — a newer draft from anyone else still conflicts.
+    const acceptsOwnSendVersion = req.body?.acceptOwnSend === true
+      && !!senderClientId
+      && String(existing.draft_updated_by_client_id || '') === senderClientId;
+    if (!acceptsOwnSendVersion && hasConversationDraftVersionConflict({
       existingDraftUpdatedAt,
       baseDraftUpdatedAt: normalizedBaseDraftUpdatedAt,
       compareEnabled: comparesDraftVersion,
@@ -3815,6 +4027,7 @@ export function registerSessionsRoutes(app, deps) {
         conflict: true,
         conversationId,
         draftText: String(existing.draft_text || ''),
+        draftAttachments: parseDraftAttachmentsColumn(existing.draft_attachments),
         draftUpdatedAt: existingDraftUpdatedAt,
         draftUpdatedByClientId: existing.draft_updated_by_client_id || null,
       });
@@ -4216,42 +4429,131 @@ export function registerSessionsRoutes(app, deps) {
     }
 
     try {
-      const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
-      if (!sdkSessionId) {
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-        cleanupGeneratedImagesForConversation({
-          conversationId: id,
-          sdkSessionId: null,
-          messageRows: stmts.getMessages?.all?.(id) || [],
-          parseAttachments,
-          hydrateAttachment,
-          resolveSessionStateRoot,
-        });
-        const orphanedUploads = collectOrphanedUploadsFromConversation(id);
-        hardDeleteConversationRows(id);
-        deleteOrphanedUploads(orphanedUploads);
-        io.emit('conversation_deleted', { conversationId: id });
-        return res.json({ ok: true });
-      }
-
-      markConversationDeleted.run(new Date().toISOString(), id);
-      stmts.markDeletedSdkSession.run(sdkSessionId, new Date().toISOString());
-      if (sdkSessionId !== id) {
-        // Also tombstone the conversation id itself for legacy/synthetic sdk id fallback paths.
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-      }
-      enqueueSdkDeleteRequest(sdkSessionId, id);
-      const awaited = await waitForSdkDeleteCompletion(sdkSessionId);
-      if (awaited.completed) return res.json({ ok: true });
-
-      io.emit('conversation_delete_pending', { conversationId: id });
-      return res.json({ ok: true, pending: true });
+      // Session workers are keyed by the SDK session id, which is the
+      // conversation id until a session is bound. Serialized with launches and
+      // relaunches of that session, and with a second delete of it.
+      const workerSessionId = String(existing.sdk_session_id || '').trim() || id;
+      const outcome = await sessionLaunchMutex.runExclusive(
+        workerSessionId,
+        () => deleteConversationNow(id),
+      );
+      return res.status(outcome.statusCode).json(outcome.body);
     } catch (error) {
       console.warn(`[archive] Delete failed for ${id}: ${error?.message || error}`);
       return res.status(500).json({ error: 'Failed to delete conversation' });
     }
   });
 
+  /** DELETE /api/conversation/:id under its session's lock; see the route. */
+  async function deleteConversationNow(id) {
+    const existing = stmts.getConvAnyStatus.get(id);
+    if (!existing) return { statusCode: 200, body: { ok: true, alreadyDeleted: true } };
+    const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
+    const workerSessionId = sdkSessionId || id;
+
+    const activity = describeConversationActivity(id, workerSessionId);
+    if (activity.turnRunning) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'turn-running',
+          message: 'This conversation is still working on a reply. Stop it, then delete it.',
+        },
+      };
+    }
+    if (activity.backgroundTaskCount > 0) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'background-tasks',
+          // Kill session stops the session's worker, and the delete counts no
+          // tasks for a conversation whose worker is gone.
+          message: activity.unstoppableTaskCount > 0
+            ? 'Background tasks are still running in this conversation, and some have no Stop button. Use Kill session in its ⋯ menu, then delete it.'
+            : 'Background tasks are still running in this conversation. Stop them in the task panel, then delete it.',
+        },
+      };
+    }
+
+    // A worker and CLI session that another live conversation still uses
+    // stay; only this conversation's own data goes.
+    const sharedWithConversationId = sdkSessionId
+      ? String(findOtherLiveConversationForSdkSession.get(sdkSessionId, id)?.id || '').trim() || null
+      : null;
+    // A Copilot session the relay only imported, and never ran, belongs to
+    // whoever started it in the CLI. Deleting the conversation hides and
+    // tombstones it, and nothing more: the relay started no process for it
+    // (the process scan would find that user's own `copilot --resume`), and
+    // its CLI session stays. Asked before the stop, which removes the registry
+    // entry that shows the relay has run it.
+    const importedOnly = !!sdkSessionId && sdkSessionImportService?.isImportedOnly?.(sdkSessionId) === true;
+
+    // An idle worker is stopped before anything is deleted: the route used to
+    // leave it running (and holding its workspace) until the relay restarted.
+    // Nothing is touched when it will not die.
+    let workerStopped = false;
+    if (!sharedWithConversationId && !importedOnly) {
+      const stopped = await stopIdleWorkspaceRootSession({
+        sdkSessionId: workerSessionId,
+        worker: sessionWorkerRegistry?.getWorker?.(workerSessionId) || null,
+        sessionWorkerSupervisor,
+        sessionWorkerRegistry,
+        sessionWorkerProcessInspector,
+        stopOverrides: sessionWorkerStopOverrides,
+      });
+      if (!stopped.ok) {
+        return {
+          statusCode: 409,
+          body: {
+            ok: false,
+            error: 'worker-stop-failed',
+            message: "Couldn't stop this conversation's session, so nothing was deleted. Try again in a moment.",
+            remainingPids: stopped.remainingPids || [],
+          },
+        };
+      }
+      workerStopped = (stopped.stoppedPids || []).length > 0;
+      // Re-armed after the stop, which can outlast the kill block's grace
+      // window: nothing may respawn a worker for the rows deleted below.
+      sessionWorkerSupervisor?.markKilled?.(workerSessionId);
+      for (const key of new Set([id, workerSessionId])) backgroundTaskStore?.replace?.(key, []);
+    }
+
+    const deletedAt = new Date().toISOString();
+    markConversationDeleted.run(deletedAt, id);
+    // Tombstones keep the SDK session importer from bringing it back.
+    stmts.markDeletedSdkSession.run(sdkSessionId || id, deletedAt);
+    if (sdkSessionId && sdkSessionId !== id) stmts.markDeletedSdkSession.run(id, deletedAt);
+
+    const cliSession = sharedWithConversationId || importedOnly
+      ? { deleted: null }
+      : await deleteCliSession({
+        conversation: existing,
+        conversationId: id,
+        sdkSessionId,
+        runtimeSession: stmts.getRuntimeSessionByConversation?.get?.(id) || null,
+      });
+
+    cleanupGeneratedImagesForConversation({
+      conversationId: id,
+      sdkSessionId,
+      messageRows: stmts.getMessages?.all?.(id) || [],
+      parseAttachments,
+      hydrateAttachment,
+      resolveSessionStateRoot,
+    });
+    const orphanedUploads = collectOrphanedUploadsFromConversation(id);
+    hardDeleteConversationRows(id);
+    deleteOrphanedUploads(orphanedUploads);
+    if (sdkSessionId && !cliSession.queued) stmts.deleteSdkDeleteRequest?.run?.(sdkSessionId);
+    io.emit('conversation_deleted', { conversationId: id });
+    return { statusCode: 200, body: { ok: true, workerStopped, cliSessionDeleted: cliSession.deleted } };
+  }
+
   // POST /api/conversation/:id/archive — archive conversation
   app.post('/api/conversation/:id/archive', auth, async (req, res) => {
     const id = String(req.params.id || '').trim();
@@ -4789,6 +5091,8 @@ export function registerSessionsRoutes(app, deps) {
       platform: process.platform,
       features: featureFlags || {},
       sessionWorker: sessionWorkerStatus,
+      version: runningVersion || null,
+      update: typeof buildUpdateStatePayload === 'function' ? buildUpdateStatePayload() : null,
     });
   });
 
@@ -4925,6 +5229,10 @@ export function registerSessionsRoutes(app, deps) {
     // which models exist, only which process runs them. Running workers are
     // deliberately left alone — the new engine applies to the next spawn.
     io.emit('copilot_settings_updated', settingsPayload);
+    // Fire-and-forget: an engine flip to SDK is exactly when the extension
+    // stops publishing snapshots, so re-run the server-side discovery in the
+    // background (it dedupes/skips on its own; a failure keeps the catalog).
+    void copilotModelDiscoveryService?.refresh?.('settings-change');
     return res.json({ ok: true, ...settingsPayload });
   });
 
@@ -5264,6 +5572,72 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // --- OAR self-update ----------------------------------------------------
+  // Checking is opt-in (zero telemetry by default). All routes are no-ops
+  // with clear errors when OAR_NO_UPDATE_CHECK killed the check service.
+  const updateStatePayload = () => (typeof buildUpdateStatePayload === 'function' ? buildUpdateStatePayload() : null);
+
+  app.get('/api/update/state', auth, (_req, res) => {
+    res.json({ ok: true, update: updateStatePayload() });
+  });
+
+  app.post('/api/update/auto-check', auth, (req, res) => {
+    if (!updateCheckService) {
+      return res.status(503).json({ error: 'Update checks are disabled on this relay (OAR_NO_UPDATE_CHECK)' });
+    }
+    const enabled = req.body?.enabled;
+    if (typeof enabled !== 'boolean') {
+      return res.status(400).json({ error: 'enabled must be a boolean' });
+    }
+    updateCheckService.setAutoCheck(enabled);
+    return res.json({ ok: true, update: updateStatePayload() });
+  });
+
+  app.post('/api/update/check', auth, async (_req, res) => {
+    if (!updateCheckService) {
+      return res.status(503).json({ error: 'Update checks are disabled on this relay (OAR_NO_UPDATE_CHECK)' });
+    }
+    await updateCheckService.checkNow();
+    return res.json({ ok: true, update: updateStatePayload() });
+  });
+
+  app.post('/api/update/dismiss', auth, (req, res) => {
+    if (req.body?.outcome === true) {
+      const cleared = updateInstallService?.clearOutcome?.();
+      return cleared?.ok
+        ? res.json({ ok: true, update: updateStatePayload() })
+        : res.status(500).json({ error: 'Update state is unavailable' });
+    }
+    if (!updateCheckService) {
+      return res.status(503).json({ error: 'Update checks are disabled on this relay (OAR_NO_UPDATE_CHECK)' });
+    }
+    const result = updateCheckService.dismissVersion(req.body?.version);
+    if (!result.ok) return res.status(400).json({ error: result.error });
+    return res.json({ ok: true, update: updateStatePayload() });
+  });
+
+  app.post('/api/update/cancel', auth, (_req, res) => {
+    if (!updateInstallService?.cancel) {
+      return res.status(503).json({ error: 'Updates are unavailable on this relay' });
+    }
+    updateInstallService.cancel();
+    return res.json({ ok: true, update: updateStatePayload() });
+  });
+
+  app.post('/api/update/apply', auth, async (req, res) => {
+    if (!updateInstallService) {
+      return res.status(503).json({ error: 'Updates are unavailable on this relay' });
+    }
+    const result = await updateInstallService.startUpdate({ version: req.body?.version });
+    if (!result.ok) {
+      return res.status(Number(result.statusCode) || 400).json({
+        error: result.error || 'Failed to start the update',
+        update: updateStatePayload(),
+      });
+    }
+    return res.json({ ok: true, targetVersion: result.targetVersion, update: updateStatePayload() });
+  });
+
   // --- Grok account (CLI device-code OAuth) -------------------------------
   // Same shape as the Claude block above, one state shorter: `grok login
   // --device-auth` prints a URL carrying the device code, then polls x.ai and
@@ -5615,12 +5989,89 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
-  app.get('/api/settings/windows-autostart', auth, (_req, res) => {
+  const pwaAppNamePayload = (appName) => ({
+    appName,
+    defaultName: PWA_APP_NAME_DEFAULT,
+    shortName: derivePwaShortName(appName || PWA_APP_NAME_DEFAULT),
+    maxLength: PWA_APP_NAME_MAX_LENGTH,
+  });
+
+  app.get('/api/settings/pwa-app-name', auth, (_req, res) => {
+    res.json(pwaAppNamePayload(getPwaAppName()));
+  });
+
+  app.post('/api/settings/pwa-app-name', auth, (req, res) => {
+    const result = setPwaAppName(req.body?.appName);
+    if (!result.ok) {
+      return res.status(result.status || 400).json({ error: result.error });
+    }
+    return res.json(pwaAppNamePayload(result.appName));
+  });
+
+  const featureFlagsSettingsPayload = () => {
+    const flags = getFeatureFlagsSettingsState();
+    return {
+      flags,
+      restartRequired: flags.some((flag) => flag.restartRequired === true),
+    };
+  };
+
+  app.get('/api/settings/features', auth, (_req, res) => {
+    res.json(featureFlagsSettingsPayload());
+  });
+
+  app.post('/api/settings/features', auth, (req, res) => {
+    const name = String(req.body?.name || '').trim();
+    const enabled = req.body?.enabled;
+    if (!name) return res.status(400).json({ error: 'name is required' });
+    if (typeof enabled !== 'boolean') return res.status(400).json({ error: 'enabled must be a boolean' });
+    const result = setFeatureFlagSetting(name, enabled);
+    if (!result.ok) {
+      const status = result.error === 'Unknown feature flag' ? 400 : 500;
+      return res.status(status).json({ error: result.error });
+    }
+    return res.json(featureFlagsSettingsPayload());
+  });
+
+  /**
+   * Merge the two Windows autostart services into one mode-shaped state.
+   * A ready boot task wins the mode call even when a Startup .cmd also
+   * exists (that mixed state is real on upgraded hosts): the boot task is
+   * what owns the running relay there, and the leftover .cmd is reported so
+   * the UI can offer cleanup instead of hiding the race.
+   */
+  async function windowsAutostartMergedState() {
+    const signin = windowsAutostartService.getState();
+    const boot = windowsBootAutostartService
+      ? await windowsBootAutostartService.getState()
+      : { supported: false };
+    const bootReady = boot.supported && boot.taskStatus === 'ready';
+    const mode = bootReady ? 'boot' : (signin.enabled ? 'signin' : 'off');
+    return {
+      supported: signin.supported,
+      platform: signin.platform,
+      mode,
+      // Back-compat for pre-mode clients: their toggle keeps meaning
+      // "starts automatically somehow".
+      enabled: mode !== 'off',
+      boot: boot.supported ? {
+        taskStatus: boot.taskStatus,
+        taskName: boot.taskName,
+        legacyTaskPresent: boot.legacyTaskPresent,
+        pendingElevation: boot.pendingElevation,
+        lastError: boot.lastError,
+        manualCommand: boot.manualCommand,
+      } : null,
+      signinEnabled: signin.enabled,
+    };
+  }
+
+  app.get('/api/settings/windows-autostart', auth, async (_req, res) => {
     if (!windowsAutostartService) {
       return res.status(500).json({ error: 'Windows autostart settings are unavailable' });
     }
     try {
-      return res.json(windowsAutostartService.getState());
+      return res.json(await windowsAutostartMergedState());
     } catch {
       return res.status(500).json({
         error: 'Unable to read Windows autostart. Check access to your user Startup folder.',
@@ -5628,19 +6079,49 @@ export function registerSessionsRoutes(app, deps) {
     }
   });
 
-  app.post('/api/settings/windows-autostart', auth, (req, res) => {
-    if (typeof req.body?.enabled !== 'boolean') {
-      return res.status(400).json({ error: 'enabled must be a boolean' });
+  app.post('/api/settings/windows-autostart', auth, async (req, res) => {
+    const rawMode = req.body?.mode;
+    const hasBoolean = typeof req.body?.enabled === 'boolean';
+    // Pre-mode clients send {enabled}; it maps onto the sign-in mode exactly
+    // as before this endpoint learned about boot mode.
+    const mode = rawMode !== undefined
+      ? String(rawMode)
+      : (hasBoolean ? (req.body.enabled ? 'signin' : 'off') : null);
+    if (!['off', 'signin', 'boot'].includes(mode)) {
+      return res.status(400).json({ error: "mode must be 'off', 'signin' or 'boot' (or enabled a boolean)" });
     }
     if (!windowsAutostartService) {
       return res.status(500).json({ error: 'Windows autostart settings are unavailable' });
     }
     try {
-      const currentState = windowsAutostartService.getState();
-      if (!currentState.supported) {
+      if (!windowsAutostartService.getState().supported) {
         return res.status(400).json({ error: 'Windows autostart is only available on Windows' });
       }
-      return res.json(windowsAutostartService.setEnabled(req.body.enabled));
+      if (mode === 'boot') {
+        if (!windowsBootAutostartService) {
+          return res.status(500).json({ error: 'Windows boot autostart is unavailable' });
+        }
+        // The sweep's completion also removes the Startup .cmd entries; the
+        // sign-in service is not touched here so a declined UAC leaves the
+        // previous mode fully intact.
+        const result = await windowsBootAutostartService.requestEnable();
+        return res.json({ ...(await windowsAutostartMergedState()), accepted: result.accepted });
+      }
+      // Leaving boot mode needs its own elevated sweep before the sign-in
+      // half applies; a declined UAC must not leave both modes armed.
+      const boot = windowsBootAutostartService ? await windowsBootAutostartService.getState() : null;
+      let accepted = true;
+      if (boot?.supported && (boot.taskStatus === 'ready' || boot.taskStatus === 'foreign' || boot.legacyTaskPresent)) {
+        if (boot.taskStatus === 'foreign' && mode === 'signin') {
+          // Someone else's task under our name: never delete it as a side
+          // effect of picking sign-in mode.
+          windowsAutostartService.setEnabled(true);
+          return res.json({ ...(await windowsAutostartMergedState()), accepted: true });
+        }
+        accepted = (await windowsBootAutostartService.requestDisable()).accepted;
+      }
+      windowsAutostartService.setEnabled(mode === 'signin');
+      return res.json({ ...(await windowsAutostartMergedState()), accepted });
     } catch {
       return res.status(500).json({
         error: 'Unable to update Windows autostart. Check access to your user Startup folder.',
@@ -5899,8 +6380,14 @@ export function registerSessionsRoutes(app, deps) {
         grokSettings?.enabled === true
           ? refreshGrokProviderModels()
           : Promise.resolve({ ok: true, skipped: true, models: [], error: null }),
+        // Copilot SDK discovery self-gates on an installed CLI (skipped:true
+        // when there is none), so unlike the providers above it has no
+        // enablement flag to check here.
+        typeof copilotModelDiscoveryService?.refresh === 'function'
+          ? copilotModelDiscoveryService.refresh('manual-refresh')
+          : Promise.resolve({ ok: true, skipped: true, models: [], error: null }),
       ];
-      const [cliRefresh, openAIRefresh, claudeRefresh, cursorRefresh, grokRefresh] = await Promise.allSettled(refreshTasks);
+      const [cliRefresh, openAIRefresh, claudeRefresh, cursorRefresh, grokRefresh, copilotDiscoveryRefresh] = await Promise.allSettled(refreshTasks);
       if (cliRefresh.status === 'rejected') throw cliRefresh.reason;
       const openAIModelDiscovery = openAIRefresh.status === 'fulfilled'
         ? openAIRefresh.value
@@ -5930,6 +6417,9 @@ export function registerSessionsRoutes(app, deps) {
             models: Array.isArray(grokSettings?.models) ? grokSettings.models : [],
             error: grokRefresh.reason?.message || 'Grok model discovery failed',
           };
+      const copilotModelDiscovery = copilotDiscoveryRefresh.status === 'fulfilled'
+        ? copilotDiscoveryRefresh.value
+        : { ok: false, models: [], error: copilotDiscoveryRefresh.reason?.message || 'Copilot model discovery failed' };
       io.emit('models_updated', buildModelCatalogWithProviders(
         getModelCatalogState(),
       ));
@@ -5940,6 +6430,7 @@ export function registerSessionsRoutes(app, deps) {
         claudeModelDiscovery,
         cursorModelDiscovery,
         grokModelDiscovery,
+        copilotModelDiscovery,
       });
     } catch (error) {
       return res.status(500).json({
@@ -5982,6 +6473,9 @@ export function registerSessionsRoutes(app, deps) {
       reasoningEfforts: modelState.reasoningEfforts || [],
       contextLimitsByModel: modelState.contextLimitsByModel || {},
       modelMetadataByModel: modelState.modelMetadataByModel || {},
+      // Enabled models the last authoritative snapshot no longer listed: they
+      // stay in models[] (a selection must not vanish) but pickers grey them.
+      unavailableModels: Array.isArray(modelState.unavailableModels) ? modelState.unavailableModels : [],
       claudeContextTiersByModel: modelState.claudeContextTiersByModel || {},
       providersByModel: modelState.providersByModel || {},
       stale: modelState.stale,