@oar-sh/oar 0.9.1 → 0.9.3

package/server/services/oar-cli-helpers.mjs

@@ -19,7 +19,8 @@ export function buildDefaultConfig({ token = generateAuthToken(), port = 3333, l
     pollIntervalMs: 3000,
     processingTimeoutMs: 600000,
     conversationSessionMode: 'isolated',
-    updateCheck: true,
+    // No updateCheck key: automatic update checking is opt-in from the web
+    // UI (app_settings), never a config default — zero telemetry out of the box.
   };
 }
 
@@ -45,13 +46,16 @@ export function relayUrl({ config, lanAddress = null } = {}) {
  * so a `gh copilot` session is not tied to the unit's lifetime.
  */
 export function buildSystemdUnit({ nodeBin, packageRoot, configPath, dataDir, logDir }) {
+  // systemd units are Linux-only, so the path inside the unit is always
+  // posix-joined — host-platform path.join would write backslashes when this
+  // template is exercised on Windows (tests; the CLI never writes it there).
   return [
     '[Unit]',
     'Description=OAR — Open Agent Relay',
     'After=network-online.target',
     '',
     '[Service]',
-    `ExecStart=${nodeBin} ${path.join(packageRoot, 'server', 'server.js')}`,
+    `ExecStart=${nodeBin} ${path.posix.join(packageRoot, 'server', 'server.js')}`,
     `Environment=COPILOT_WEB_RELAY_CONFIG=${configPath}`,
     `Environment=COPILOT_WEB_RELAY_DATA_DIR=${dataDir}`,
     `Environment=COPILOT_WEB_RELAY_LOG_DIR=${logDir}`,

package/server/services/relay-prompt-sanitizer.mjs

@@ -4,6 +4,8 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+import { renderMediaEmbedInstructionBlock } from '../../shared/media-embed-instructions.mjs';
+
 const DEFAULT_RELAY_TOOL_GUIDANCE = [
   '# Relay Tool Guidance',
   'For any user-facing question or clarification, use the ask_user tool so the web relay can render question cards and buttons. Never ask questions in plain assistant text.',
@@ -125,13 +127,38 @@ function stripAttachmentPromptArtifacts(text) {
     .trim();
 }
 
+// The once-per-worker media-embed guidance rides ahead of the mode marker on
+// the Cursor/Grok prompt paths, so it is dropped before the prefix-anchored
+// marker patterns run. Machine-injected verbatim, never user-authored.
+const MEDIA_EMBED_BLOCK_PATTERN = new RegExp(
+  whitespaceFlexiblePattern(renderMediaEmbedInstructionBlock()),
+  'gi',
+);
+
+// A steered message's hidden note (shared/steer-note.mjs) leads the prompt the
+// runtime stored, right after any mode marker. Matched by its stable opening
+// words, because the browser copy of this module cannot import shared/.
+const STEER_NOTE_PATTERN = /^\s*\[Sent while you were still working on my previous message\.[^\]\n]*\]\s*/;
+
+// The Claude worker's slash-command guard (shared/slash-command-guard.mjs): a
+// zero-width space in front of a "/x" it delivers as text. trim() keeps it, so
+// it is matched on its own, and only where it guards a "/".
+const SLASH_COMMAND_GUARD_PATTERN = /^\u200B(?=\s*\/)/;
+
+function stripLeadingRelayNotes(text) {
+  const stripped = String(text || '').replace(STEER_NOTE_PATTERN, '').replace(SLASH_COMMAND_GUARD_PATTERN, '');
+  return stripped.trim() ? stripped.trim() : String(text || '').trim();
+}
+
 export function stripRelayPromptContext(text, relayMode = '', attachments = []) {
-  const value = stripAttachmentPromptArtifacts(text);
+  const value = stripAttachmentPromptArtifacts(text)
+    .replace(MEDIA_EMBED_BLOCK_PATTERN, '')
+    .trim();
   if (!value) return '';
   const patterns = buildPromptPrefixPatterns(relayMode);
   for (const pattern of patterns) {
     const stripped = value.replace(pattern, '').trim();
-    if (stripped && stripped !== value) return stripped;
+    if (stripped && stripped !== value) return stripLeadingRelayNotes(stripped);
   }
-  return value;
+  return stripLeadingRelayNotes(value);
 }

package/server/services/relay-question-context.mjs

@@ -0,0 +1,46 @@
+// The `context` block a relay question card carries: who asked, why, for which
+// queue row, and the few presentation hints the card renders from. Workers
+// send it on POST /api/relay-question; it is stored inside the question's
+// request envelope and served back to the client. Anything not listed here is
+// dropped, so a new hint the client reads must be added here too (the
+// multi-select flag was once silently stripped this way).
+
+/**
+ * @param {unknown} rawContext
+ * @param {{ normalizeRelayMode?: (mode: string) => string | null, defaultRelayMode?: string }} [options]
+ */
+export function sanitizeRelayQuestionContext(rawContext, {
+  normalizeRelayMode = (mode) => String(mode || '').trim().toLowerCase() || null,
+  defaultRelayMode = 'agent',
+} = {}) {
+  if (!rawContext || typeof rawContext !== 'object' || Array.isArray(rawContext)) return null;
+  const context = {};
+  if (typeof rawContext.source === 'string' && rawContext.source.trim()) {
+    context.source = rawContext.source.trim().slice(0, 64);
+  }
+  if (typeof rawContext.rationale === 'string' && rawContext.rationale.trim()) {
+    context.rationale = rawContext.rationale.trim().slice(0, 240);
+  }
+  if (typeof rawContext.queueMessageId === 'string' && rawContext.queueMessageId.trim()) {
+    context.queueMessageId = rawContext.queueMessageId.trim();
+  }
+  if (typeof rawContext.conversationId === 'string' && rawContext.conversationId.trim()) {
+    context.conversationId = rawContext.conversationId.trim();
+  }
+  if (typeof rawContext.relayMode === 'string' && rawContext.relayMode.trim()) {
+    context.relayMode = normalizeRelayMode(rawContext.relayMode) || defaultRelayMode;
+  }
+  // The card renders checkmarks instead of one-shot buttons when several
+  // answers are allowed (Claude's AskUserQuestion `multiSelect`, or the
+  // Copilot worker's wording heuristic). Only an explicit `true` is kept.
+  if (rawContext.multiSelect === true) context.multiSelect = true;
+  // Providers whose ask tool cannot always say so (Copilot) mark their choice
+  // cards with this: the card then offers a "Select several" switch, so the
+  // user can pick several answers even when the model did not flag it.
+  if (rawContext.allowMultiSelect === true) context.allowMultiSelect = true;
+  // Claude's short question label ("Workers", "Visibility").
+  if (typeof rawContext.header === 'string' && rawContext.header.trim()) {
+    context.header = rawContext.header.trim().slice(0, 120);
+  }
+  return Object.keys(context).length ? context : null;
+}

package/server/services/sdk-session-import-service.mjs

@@ -71,17 +71,69 @@ export function createSdkSessionImportService({
   parseSessionEventsToMessages,
   replaceRetrievableHistory,
   ensureRuntimeSessionBinding,
+  // Live evidence that the relay runs (or ran) a worker for this session in
+  // the current process — queue rows alone miss a worker between turns.
+  hasRelayExecutionSignal = () => false,
   logger = console,
 } = {}) {
   if (!db || !stmts || typeof createClient !== 'function') throw new Error('SDK session importer requires database, statements, and a client factory');
-  let runtime = null;
+  let runtimeCreation = null;
   let activeRun = null;
+  let closing = false;
   const countConversationMessages = db.prepare(`
     SELECT COUNT(*) AS count
     FROM messages
     WHERE conversation_id = ?
   `);
 
+  // Ownership ledger (audit #19). The importer creates a runtime binding for
+  // every conversation it imports, so "a binding exists" cannot double as "the
+  // relay executes this conversation" — that reading froze every imported
+  // session after its first import. The ledger's origin column records who the
+  // binding belongs to; relay evidence flips it durably below.
+  const getImportOwnership = db.prepare(`
+    SELECT status, origin
+    FROM sdk_session_imports
+    WHERE sdk_session_id = ?
+  `);
+  // Any queue row referencing the session — including done/failed ones that
+  // have not been pruned yet — proves the relay queued a turn for it.
+  const getQueueEvidence = db.prepare(`
+    SELECT 1 AS present
+    FROM queue
+    WHERE conversation_id = ? OR owner_sdk_session_id = ?
+    LIMIT 1
+  `);
+  // Durable one-way flip: once the relay owns a session, pruned queue rows or
+  // a restart must not hand it back to the importer.
+  const markImportRelayOwned = db.prepare(`
+    UPDATE sdk_session_imports
+    SET origin = 'relay', updated_at = ?
+    WHERE sdk_session_id = ? AND (origin IS NULL OR origin != 'relay')
+  `);
+  const markImportOriginImported = db.prepare(`
+    UPDATE sdk_session_imports
+    SET origin = 'imported'
+    WHERE sdk_session_id = ? AND (origin IS NULL OR origin = 'imported')
+  `);
+
+  function relayOwnsSession(sdkSessionId) {
+    const ledger = getImportOwnership.get(sdkSessionId) || null;
+    if (ledger?.origin === 'relay') return true;
+    const executed = !!getQueueEvidence.get(sdkSessionId, sdkSessionId)
+      || hasRelayExecutionSignal(sdkSessionId) === true;
+    if (executed) {
+      markImportRelayOwned.run(new Date().toISOString(), sdkSessionId);
+      return true;
+    }
+    // origin = 'imported' is only ever written by a completed import, so it is
+    // the one proof the binding belongs to the importer (and it survives a
+    // later failed refresh attempt). Anything else — no ledger row, no origin —
+    // means the relay created the binding (conversation bootstrap,
+    // session-sync) and owns the history.
+    return ledger?.origin !== 'imported';
+  }
+
   const upsertConversation = db.prepare(`
     INSERT INTO conversations (id, title, sdk_session_id, configured_workspace_root_path, runtime_workspace_root_path, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -94,8 +146,21 @@ export function createSdkSessionImportService({
   `);
 
   async function getRuntime() {
-    if (!runtime) runtime = await createClient();
-    return runtime;
+    // Refusing after dispose() is what stops a mid-shutdown import from
+    // resurrecting a fresh SDK client the server would never tear down.
+    if (closing) throw new Error('SDK session importer is shutting down');
+    // Callers share the start in flight: parallel deletes, or a delete during
+    // the startup import, each started a runtime of their own, and only the
+    // last one was ever disposed. A start that fails is dropped, so the next
+    // call tries again.
+    if (!runtimeCreation) {
+      const creation = Promise.resolve().then(() => createClient());
+      runtimeCreation = creation;
+      creation.catch(() => {
+        if (runtimeCreation === creation) runtimeCreation = null;
+      });
+    }
+    return runtimeCreation;
   }
 
   function isTombstoned(sdkSessionId) {
@@ -136,6 +201,16 @@ export function createSdkSessionImportService({
     const workspaceRoot = text(metadata.workspaceRootPath || metadata.workspace_root_path || metadata.cwd) || null;
     const title = sessionTitle(session, messages);
     db.transaction(() => {
+      // The relay may have queued a turn while this import was reading SDK
+      // events; overwriting now would replace relay history with the raw
+      // transcript. Re-checked inside the transaction so the decision and the
+      // write are one unit. (The durable origin flip happens in the caller —
+      // an UPDATE here would roll back with the throw.)
+      if (getQueueEvidence.get(sdkSessionId, sdkSessionId) || hasRelayExecutionSignal(sdkSessionId) === true) {
+        const error = new Error('Relay queued a turn during import');
+        error.code = 'relay-owned';
+        throw error;
+      }
       upsertConversation.run(sdkSessionId, title, sdkSessionId, workspaceRoot, workspaceRoot, createdAt, updatedAt);
       ensureRuntimeSessionBinding(sdkSessionId, null, updatedAt, sdkSessionId);
       replaceRetrievableHistory(sdkSessionId, messages);
@@ -147,12 +222,15 @@ export function createSdkSessionImportService({
         now,
         sdkSessionId,
       );
+      // The binding above belongs to the import, not to relay execution.
+      markImportOriginImported.run(sdkSessionId);
     })();
   }
 
   async function importSession(session, { force = false } = {}) {
     const sdkSessionId = sessionIdOf(session);
     if (!sdkSessionId) return { status: 'skipped', category: 'unchanged', reason: 'missing-session-id' };
+    if (closing) return { sdkSessionId, status: 'skipped', category: 'unchanged', reason: 'importer-closing' };
     if (isTombstoned(sdkSessionId)) return { sdkSessionId, status: 'skipped', category: 'tombstoned', reason: 'tombstoned' };
     // Sessions the relay created to execute an existing conversation's turns
     // are vehicles, not conversations: their history already lives in the
@@ -165,15 +243,16 @@ export function createSdkSessionImportService({
     // The SDK-engine workers (Copilot SDK, Claude, Cursor, Grok) run a
     // conversation's turns in a CLI session that shares the conversation's OWN
     // id — the exact equality the guard above reads as "external". A runtime
-    // binding for that conversation means the relay executes it and already
-    // owns its history: importing would overwrite relay messages with the raw
-    // runtime transcript, instruction preambles included (burn-in incident
-    // 2026-08-31: "[Relay mode: autopilot] …" surfaced as user bubbles and
-    // conversation titles after a restart). This also protects an imported
-    // conversation the user later CONTINUED in the relay — from that moment
-    // the relay's history is authoritative, not the CLI transcript.
+    // binding for that conversation used to be read as relay ownership
+    // outright, but the importer itself creates a binding on every completed
+    // import — that reading made the first import the last (audit #19). The
+    // binding still matters (importing over relay history reproduces the
+    // burn-in incident 2026-08-31: "[Relay mode: autopilot] …" surfaced as
+    // user bubbles and titles after a restart), so ownership now comes from
+    // the ledger: only a binding the importer did NOT account for, or actual
+    // relay activity (a queued turn, a live worker), blocks the import.
     const runtimeSession = stmts.getRuntimeSessionByConversation?.get?.(sdkSessionId) || null;
-    if (runtimeSession) {
+    if (runtimeSession && relayOwnsSession(sdkSessionId)) {
       return { sdkSessionId, status: 'skipped', category: 'relay-owned', reason: 'relay-execution-session' };
     }
     // Same protection when a live conversation already claims this session id
@@ -202,11 +281,20 @@ export function createSdkSessionImportService({
       persistCompletedImport({ sdkSessionId, session, messages });
       return { sdkSessionId, status: 'completed', category: claimed.category, messageCount: messages.length };
     } catch (error) {
-      stmts.failSdkSessionImport.run(new Date().toISOString(), boundedError(error), sdkSessionId);
+      const now = new Date().toISOString();
+      if (error?.code === 'relay-owned') {
+        // The relay claimed the session mid-import. Flip ownership durably and
+        // release the claim so the ledger row is not stuck in 'processing'.
+        markImportRelayOwned.run(now, sdkSessionId);
+        stmts.failSdkSessionImport.run(now, boundedError(error), sdkSessionId);
+        return { sdkSessionId, status: 'skipped', category: 'relay-owned', reason: 'relay-claimed-during-import' };
+      }
+      stmts.failSdkSessionImport.run(now, boundedError(error), sdkSessionId);
       return { sdkSessionId, status: 'failed', category: 'failed', error: boundedError(error) };
     } finally {
-      try { await resumed?.stop?.(); } catch {}
-      try { await resumed?.dispose?.(); } catch {}
+      // SDK 1.0.13's CopilotSession cleanup API; the previous optional
+      // stop()/dispose() calls matched nothing and leaked every resume.
+      try { await resumed?.disconnect?.(); } catch {}
     }
   }
 
@@ -229,6 +317,9 @@ export function createSdkSessionImportService({
         const sessions = await normalizeEvents(await client.client.listSessions());
         summary.listed = sessions.length;
         for (const session of sessions) {
+          // A shutdown mid-sweep must stop cleanly between sessions instead of
+          // racing dispose() for the runtime.
+          if (closing) break;
           const result = await importSession(session);
           summary[result.category] = Number(summary[result.category] || 0) + 1;
         }
@@ -248,6 +339,34 @@ export function createSdkSessionImportService({
     return activeRun;
   }
 
+  /**
+   * Remove a Copilot session from the runtime's own store, for a conversation
+   * deleted in the relay. Goes through the SDK rather than the session-state
+   * folder so the runtime's bookkeeping stays consistent. Throws when the
+   * runtime cannot do it; the caller decides what that means.
+   */
+  async function deleteSession(sdkSessionId) {
+    const sid = text(sdkSessionId);
+    if (!sid) throw new Error('Missing session id');
+    const client = await getRuntime();
+    if (typeof client?.client?.deleteSession !== 'function') {
+      throw new Error('deleteSession() is unavailable in this Copilot runtime');
+    }
+    await client.client.deleteSession(sid);
+  }
+
+  /**
+   * Whether the relay only imported this session and never ran it: the ledger
+   * says the importer brought it in, and no queued turn or relay worker says
+   * the relay has run it since. Continuing an imported conversation does not
+   * touch the ledger, so that evidence is checked here too, and it flips the
+   * ledger to 'relay' for good, as it does on import.
+   */
+  function isImportedOnly(sdkSessionId) {
+    const sid = text(sdkSessionId);
+    return !!sid && !relayOwnsSession(sid);
+  }
+
   async function refreshConversation(conversation) {
     const sdkSessionId = text(conversation?.sdk_session_id || conversation?.sdkSessionId || conversation?.id);
     if (!sdkSessionId || isTombstoned(sdkSessionId)) {
@@ -262,9 +381,18 @@ export function createSdkSessionImportService({
     runStartupImport,
     importSession,
     refreshConversation,
+    deleteSession,
+    isImportedOnly,
     async dispose() {
-      const current = runtime;
-      runtime = null;
+      // Flag first: getRuntime() must refuse before the client goes away, or a
+      // concurrent import finds no runtime and starts a replacement while the
+      // server is exiting.
+      closing = true;
+      try { await activeRun; } catch {}
+      // A start still in flight is waited for, so its runtime is disposed too.
+      const creation = runtimeCreation;
+      runtimeCreation = null;
+      const current = await creation?.catch(() => null);
       await current?.dispose?.();
     },
   };

package/server/services/sdk-session-sync-service.mjs

@@ -65,14 +65,29 @@ export function createSdkSessionSyncService(db) {
     WHERE id = ?
   `);
 
+  // Rekeying a placeholder must carry every live queue row with it: a
+  // processing/parked row left under the placeholder id would be orphaned the
+  // moment the real session id takes over (audit #22). attempt_id is
+  // deliberately untouched — owner migration must not invalidate the Phase 1
+  // attempt fence on an in-flight row.
   const migrateQueueOwnerSessionId = db.prepare(`
     UPDATE queue
     SET owner_sdk_session_id = ?
-    WHERE status = 'pending'
+    WHERE status IN ('pending', 'processing', 'parked')
       AND owner_sdk_session_id = ?
       AND conversation_id = ?
   `);
 
+  // Once a session syncs, the relay drives it: its ledger row (if it was ever
+  // imported) flips to relay ownership so the startup import sweep can never
+  // again overwrite relay history with the raw CLI transcript. One-way by
+  // design; rows that never existed are a no-op.
+  const markImportRelayOwned = db.prepare(`
+    UPDATE sdk_session_imports
+    SET origin = 'relay', updated_at = ?
+    WHERE sdk_session_id = ? AND (origin IS NULL OR origin != 'relay')
+  `);
+
   const insertRuntimeSession = db.prepare(runtimeSessionsSupportProviders
     ? `
       INSERT INTO runtime_sessions (
@@ -85,24 +100,27 @@ export function createSdkSessionSyncService(db) {
       ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?)
     `);
 
-  const syncSessionTx = db.transaction((sdkSessionIdRaw, conversationIdRaw) => {
-    const sdkSessionId = normalizeId(sdkSessionIdRaw);
-    const conversationId = normalizeId(conversationIdRaw);
-    const nowIso = new Date().toISOString();
-
+  // Every conflict check, no writes. syncSessionTx runs it immediately before
+  // mutating; the session-sync route additionally runs it (via validateBinding,
+  // with requireConversation off — workspace learning may legitimately create
+  // the conversation afterwards) BEFORE workspace learning is allowed to touch
+  // any table, so a doomed request is vetoed while everything is pristine
+  // (audit #21).
+  function assertNoBindingConflicts(sdkSessionId, conversationId, { requireConversation = true } = {}) {
     if (!sdkSessionId || !conversationId) {
       throw makeError('Missing sdk_session_id or conversation_id', 400);
     }
 
-    const conversation = getConversation.get(conversationId);
-    if (!conversation || String(conversation.status || '').trim() === 'deleted') {
+    const conversation = getConversation.get(conversationId) || null;
+    const conversationMissing = !conversation || String(conversation.status || '').trim() === 'deleted';
+    if (conversationMissing && requireConversation) {
       throw makeError('Conversation not found', 404);
     }
 
-    const existingConversationSdkSessionId = normalizeId(conversation.sdk_session_id);
-    const placeholderConversationBinding = existingConversationSdkSessionId
+    const existingConversationSdkSessionId = conversationMissing ? '' : normalizeId(conversation.sdk_session_id);
+    const placeholderConversationBinding = !!(existingConversationSdkSessionId
       && existingConversationSdkSessionId === conversationId
-      && existingConversationSdkSessionId !== sdkSessionId;
+      && existingConversationSdkSessionId !== sdkSessionId);
     if (existingConversationSdkSessionId && existingConversationSdkSessionId !== sdkSessionId && !placeholderConversationBinding) {
       throw makeError(
         `Conversation ${conversationId} is already bound to SDK session ${existingConversationSdkSessionId}`,
@@ -146,14 +164,6 @@ export function createSdkSessionSyncService(db) {
       );
     }
 
-    updateConversationSdkSession.run(sdkSessionId, nowIso, conversationId);
-    if (placeholderConversationBinding) {
-      migrateQueueOwnerSessionId.run(sdkSessionId, conversationId, conversationId);
-    }
-
-    let runtimeSessionId = null;
-    let createdRuntimeSession = false;
-
     if (runtimeSessionByConversation) {
       const currentSdkSessionId = normalizeId(runtimeSessionByConversation.sdk_session_id);
       if (currentSdkSessionId && currentSdkSessionId !== sdkSessionId && currentSdkSessionId !== conversationId) {
@@ -162,18 +172,47 @@ export function createSdkSessionSyncService(db) {
           409,
         );
       }
+    }
+
+    return {
+      placeholderConversationBinding,
+      runtimeSessionByConversation,
+      runtimeSessionBySdkSessionId,
+    };
+  }
+
+  // ORDERING CONTRACT (audit #22): the queue dequeue path reads
+  // owner_sdk_session_id to route pending work, so the placeholder→real rekey
+  // below must be visible before the next dequeue considers this
+  // conversation's rows. Both run on the same better-sqlite3 connection and
+  // this whole rekey is one synchronous transaction, so a dequeue can never
+  // observe a half-rekeyed state; callers must keep the in-memory registry
+  // rekey immediately after this transaction commits (see the session-sync
+  // route) rather than deferring it past other queue work.
+  const syncSessionTx = db.transaction((sdkSessionIdRaw, conversationIdRaw) => {
+    const sdkSessionId = normalizeId(sdkSessionIdRaw);
+    const conversationId = normalizeId(conversationIdRaw);
+    const nowIso = new Date().toISOString();
+
+    const {
+      placeholderConversationBinding,
+      runtimeSessionByConversation,
+      runtimeSessionBySdkSessionId,
+    } = assertNoBindingConflicts(sdkSessionId, conversationId, { requireConversation: true });
+
+    updateConversationSdkSession.run(sdkSessionId, nowIso, conversationId);
+    let migratedQueueRows = 0;
+    if (placeholderConversationBinding) {
+      migratedQueueRows = Number(migrateQueueOwnerSessionId.run(sdkSessionId, conversationId, conversationId).changes || 0);
+    }
+
+    let runtimeSessionId = null;
+    let createdRuntimeSession = false;
 
+    if (runtimeSessionByConversation) {
       updateRuntimeSessionSdkSession.run(conversationId, sdkSessionId, nowIso, runtimeSessionByConversation.id);
       runtimeSessionId = runtimeSessionByConversation.id;
     } else if (runtimeSessionBySdkSessionId) {
-      const currentConversationId = normalizeId(runtimeSessionBySdkSessionId.conversation_id);
-      if (currentConversationId && currentConversationId !== conversationId) {
-        throw makeError(
-          `SDK session ${sdkSessionId} is already bound to conversation ${currentConversationId}`,
-          409,
-        );
-      }
-
       updateRuntimeSessionSdkSession.run(conversationId, sdkSessionId, nowIso, runtimeSessionBySdkSessionId.id);
       runtimeSessionId = runtimeSessionBySdkSessionId.id;
     } else {
@@ -191,11 +230,23 @@ export function createSdkSessionSyncService(db) {
       );
     }
 
+    markImportRelayOwned.run(nowIso, sdkSessionId);
+    if (conversationId !== sdkSessionId) {
+      // A conversation originally imported under its own session id keeps a
+      // ledger row under that id; rebinding to a new CLI session means the
+      // relay owns that history now too.
+      markImportRelayOwned.run(nowIso, conversationId);
+    }
+
     return {
       conversationId,
       sdkSessionId,
       runtimeSessionId,
       createdRuntimeSession,
+      migratedQueueRows,
+      // Non-null when this sync rekeyed a placeholder binding: the caller must
+      // rekey any in-memory worker-registry entry from this id to sdkSessionId.
+      placeholderSdkSessionId: placeholderConversationBinding ? conversationId : null,
     };
   });
 
@@ -203,5 +254,11 @@ export function createSdkSessionSyncService(db) {
     syncSession({ sdk_session_id, conversation_id }) {
       return syncSessionTx(sdk_session_id, conversation_id);
     },
+    // Read-only conflict probe for the session-sync route's validate-first
+    // ordering. Missing conversations pass — workspace learning creates them.
+    validateBinding({ sdk_session_id, conversation_id }) {
+      assertNoBindingConflicts(normalizeId(sdk_session_id), normalizeId(conversation_id), { requireConversation: false });
+      return true;
+    },
   };
 }