@oar-sh/oar 0.9.1 → 0.9.3

package/server/services/windows-boot-autostart-service.mjs

@@ -0,0 +1,487 @@
+import fs from 'fs';
+import path from 'path';
+import { execFile, spawn } from 'child_process';
+
+import { resolveOarRoot } from './oar-state-migration-service.mjs';
+import {
+  LEGACY_WINDOWS_AUTOSTART_FILENAME,
+  WINDOWS_AUTOSTART_FILENAME,
+  escapeBatchValue,
+  resolveWindowsStartupDirectory,
+} from './windows-autostart-service.mjs';
+
+/**
+ * "At system startup" autostart: a boot-trigger Scheduled Task running the
+ * relay as the current user via S4U ("run whether user is logged on or not",
+ * no stored password), headless, reachable before anyone signs in.
+ *
+ * The task's settings are a verbatim port of the hand-made task this design
+ * was proven on (docs/plans/2026-09-02-windows-boot-autostart.md): boot
+ * trigger +30s, no execution time limit, restart 5x/1min, StartWhenAvailable,
+ * IgnoreNew. The task executes a generated launcher .cmd rather than node
+ * directly, so a config-path change only regenerates a file — it never needs
+ * the task re-registered (which would mean another elevation).
+ *
+ * Elevation is THE constraint here: registering or deleting a boot-trigger
+ * task needs administrator rights and the relay runs unelevated. enable() and
+ * disable() therefore spawn `Start-Process -Verb RunAs` around a generated
+ * sweep script; the UAC prompt renders on the PC's physical desktop only, so
+ * both report `pendingElevation` and the caller polls getState() until the
+ * task appears/disappears (or shows `manualCommand` after a decline/timeout).
+ * The elevated script does nothing but the schtasks calls — every file write
+ * and cleanup stays in this unelevated process.
+ */
+
+export const BOOT_TASK_NAME = 'oar-relay';
+// The hand-made pre-rebrand task. Recognized so the UI can offer migration,
+// and deleted inside the same elevated sweep that registers the new name —
+// one UAC covers the whole transition.
+export const LEGACY_BOOT_TASK_NAME = 'copilot-remote-relay';
+export const BOOT_LAUNCHER_FILENAME = 'oar-web-relay-launcher.cmd';
+export const BOOT_TASK_XML_FILENAME = 'oar-relay-task.xml';
+export const BOOT_ELEVATION_SCRIPT_FILENAME = 'oar-relay-elevate.ps1';
+const ELEVATION_TIMEOUT_MS = 120_000;
+
+function normalizeText(value) {
+  return String(value == null ? '' : value).trim();
+}
+
+function escapeXml(value) {
+  return String(value == null ? '' : value)
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&apos;');
+}
+
+/**
+ * The launcher the task executes. Same shape as the sign-in .cmd minus the
+ * `title` line: a boot task runs in session 0 where no console is ever shown.
+ */
+export function buildBootLauncherScript({
+  packageRoot,
+  nodePath = process.execPath,
+  configPath = '',
+  // Where the relay process lives, NOT where its code lives: on Windows a
+  // process pins its cwd, and self-update must be able to replace the package
+  // directory. Callers pass the OAR state root; the package-root default only
+  // serves builders that predate self-update.
+  workingDirectory = '',
+  pathImpl = path,
+} = {}) {
+  if (!normalizeText(packageRoot)) {
+    throw new Error('Windows boot autostart requires the package root.');
+  }
+  if (!normalizeText(nodePath)) {
+    throw new Error('Windows boot autostart requires the Node.js executable path.');
+  }
+  const resolvedPackageRoot = pathImpl.resolve(String(packageRoot));
+  const serverPath = pathImpl.join(resolvedPackageRoot, 'server', 'server.js');
+  const lines = [
+    '@echo off',
+    'rem Generated by OAR settings (system-startup autostart). Regenerated on',
+    'rem every settings change - do not edit by hand.',
+  ];
+  if (normalizeText(configPath)) {
+    lines.push(`set "COPILOT_WEB_RELAY_CONFIG=${escapeBatchValue(pathImpl.resolve(configPath))}"`);
+  }
+  const cwdTarget = normalizeText(workingDirectory)
+    ? pathImpl.resolve(String(workingDirectory))
+    : resolvedPackageRoot;
+  lines.push(
+    `cd /d "${escapeBatchValue(cwdTarget)}"`,
+    `"${escapeBatchValue(pathImpl.resolve(nodePath))}" "${escapeBatchValue(serverPath)}"`,
+    '',
+  );
+  return lines.join('\r\n');
+}
+
+/**
+ * Task Scheduler XML, settings ported verbatim from the proven manual task.
+ * The S4U principal is registered by SID, not account name: a by-name
+ * principal breaks if the user is renamed, a SID does not.
+ */
+export function buildBootTaskXml({
+  sid,
+  launcherPath,
+  packageRoot,
+  // See buildBootLauncherScript: the task's cwd must survive a self-update
+  // replacing the package directory, so callers pass the OAR state root.
+  workingDirectory = '',
+  description = 'Starts the OAR web relay at system startup (S4U, no logon required). Managed by OAR settings.',
+} = {}) {
+  if (!/^S-1-[\d-]+$/.test(normalizeText(sid))) {
+    throw new Error(`Windows boot autostart requires the current user's SID (got: ${JSON.stringify(sid)}).`);
+  }
+  if (!normalizeText(launcherPath)) {
+    throw new Error('Windows boot autostart requires the launcher path.');
+  }
+  if (!normalizeText(packageRoot)) {
+    throw new Error('Windows boot autostart requires the package root.');
+  }
+  return [
+    '<?xml version="1.0" encoding="UTF-16"?>',
+    '<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
+    '  <RegistrationInfo>',
+    `    <Description>${escapeXml(description)}</Description>`,
+    `    <URI>\\${BOOT_TASK_NAME}</URI>`,
+    '  </RegistrationInfo>',
+    '  <Principals>',
+    '    <Principal id="Author">',
+    `      <UserId>${escapeXml(normalizeText(sid))}</UserId>`,
+    '      <LogonType>S4U</LogonType>',
+    '    </Principal>',
+    '  </Principals>',
+    '  <Settings>',
+    '    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>',
+    '    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>',
+    '    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>',
+    '    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>',
+    '    <RestartOnFailure>',
+    '      <Count>5</Count>',
+    '      <Interval>PT1M</Interval>',
+    '    </RestartOnFailure>',
+    '    <StartWhenAvailable>true</StartWhenAvailable>',
+    '    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>',
+    '  </Settings>',
+    '  <Triggers>',
+    '    <BootTrigger>',
+    '      <Delay>PT30S</Delay>',
+    '    </BootTrigger>',
+    '  </Triggers>',
+    '  <Actions Context="Author">',
+    '    <Exec>',
+    '      <Command>C:\\Windows\\System32\\cmd.exe</Command>',
+    `      <Arguments>/d /c "${escapeXml(launcherPath)}"</Arguments>`,
+    `      <WorkingDirectory>${escapeXml(normalizeText(workingDirectory) || packageRoot)}</WorkingDirectory>`,
+    '    </Exec>',
+    '  </Actions>',
+    '</Task>',
+    '',
+  ].join('\r\n');
+}
+
+/**
+ * schtasks rejects a UTF-8 file whose XML header declares UTF-16 (and the
+ * header must declare UTF-16 for /create /xml) — so the bytes on disk are
+ * UTF-16LE with a BOM, matching what `schtasks /query /xml` itself exports.
+ */
+export function encodeTaskXml(xml) {
+  return Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(String(xml), 'utf16le')]);
+}
+
+/** Minimal field scrape of a task's exported XML; no XML parser dependency. */
+export function parseTaskXml(xmlText) {
+  const text = String(xmlText == null ? '' : xmlText);
+  const grab = (tag) => {
+    const match = text.match(new RegExp(`<${tag}>([^<]*)</${tag}>`));
+    return match ? match[1].trim() : null;
+  };
+  return {
+    command: grab('Command'),
+    argumentsLine: grab('Arguments'),
+    workingDirectory: grab('WorkingDirectory'),
+    logonType: grab('LogonType'),
+    userId: grab('UserId'),
+  };
+}
+
+/**
+ * Ours or someone else's? A task counts as ours when its action runs our
+ * launcher path; anything else under our name is `foreign` and the UI offers
+ * an explicit "Replace", never a silent overwrite.
+ */
+export function classifyTaskXml(xmlText, { launcherPath } = {}) {
+  const parsed = parseTaskXml(xmlText);
+  const needle = normalizeText(launcherPath).toLowerCase();
+  if (needle && String(parsed.argumentsLine || '').toLowerCase().includes(needle)) {
+    return 'ready';
+  }
+  return 'foreign';
+}
+
+/**
+ * The elevated sweep. Everything the admin token is actually needed for —
+ * and nothing else — in one script, so one UAC covers the whole transition
+ * out of any mixed state (legacy-named task, hand-made task, fresh install).
+ */
+export function buildElevationScript({ action, xmlPath } = {}) {
+  if (action === 'enable') {
+    if (!normalizeText(xmlPath)) {
+      throw new Error('The enable sweep needs the task XML path.');
+    }
+    return [
+      `schtasks /delete /tn "${LEGACY_BOOT_TASK_NAME}" /f 2>$null`,
+      `schtasks /delete /tn "${BOOT_TASK_NAME}" /f 2>$null`,
+      `schtasks /create /tn "${BOOT_TASK_NAME}" /xml "${xmlPath}"`,
+      'exit $LASTEXITCODE',
+      '',
+    ].join('\r\n');
+  }
+  if (action === 'disable') {
+    return [
+      `schtasks /delete /tn "${BOOT_TASK_NAME}" /f 2>$null`,
+      `schtasks /delete /tn "${LEGACY_BOOT_TASK_NAME}" /f 2>$null`,
+      'exit 0',
+      '',
+    ].join('\r\n');
+  }
+  throw new Error(`Unknown elevation action: ${JSON.stringify(action)}`);
+}
+
+/** `whoami /user /fo csv` → the current user's SID. */
+export function parseSidFromWhoami(stdout) {
+  const match = String(stdout || '').match(/"(S-1-[\d-]+)"/);
+  return match ? match[1] : null;
+}
+
+function defaultExecFileImpl(file, args) {
+  return new Promise((resolve) => {
+    execFile(file, args, { windowsHide: true }, (error, stdout, stderr) => {
+      resolve({
+        code: error ? (typeof error.code === 'number' ? error.code : 1) : 0,
+        stdout: String(stdout || ''),
+        stderr: String(stderr || ''),
+      });
+    });
+  });
+}
+
+export function createWindowsBootAutostartService({
+  platform = process.platform,
+  env = process.env,
+  packageRoot,
+  nodePath = process.execPath,
+  configPath = '',
+  fsImpl = fs,
+  pathImpl = path,
+  execFileImpl = defaultExecFileImpl,
+  spawnImpl = spawn,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+  now = () => Date.now(),
+  logger = console,
+} = {}) {
+  const supported = platform === 'win32';
+  // One elevation in flight at a time; getState() reports it and the
+  // completion callback resolves it.
+  let pending = null; // { action, startedAt, timer, child }
+  let lastError = null;
+
+  const oarRoot = () => resolveOarRoot(env, platform);
+  const launcherPath = () => pathImpl.join(oarRoot(), BOOT_LAUNCHER_FILENAME);
+  const xmlPath = () => pathImpl.join(oarRoot(), BOOT_TASK_XML_FILENAME);
+  const elevationScriptPath = () => pathImpl.join(oarRoot(), BOOT_ELEVATION_SCRIPT_FILENAME);
+
+  function log(message) {
+    try { logger?.log?.(`[boot-autostart] ${message}`); } catch {}
+  }
+
+  async function queryTaskXml(taskName) {
+    const result = await execFileImpl('schtasks', ['/query', '/tn', taskName, '/xml']);
+    return result.code === 0 ? result.stdout : null;
+  }
+
+  function startupCmdPaths() {
+    const dir = resolveWindowsStartupDirectory(env, pathImpl);
+    return [
+      pathImpl.join(dir, WINDOWS_AUTOSTART_FILENAME),
+      pathImpl.join(dir, LEGACY_WINDOWS_AUTOSTART_FILENAME),
+    ];
+  }
+
+  function removeStartupCmds() {
+    let removed = 0;
+    for (const target of startupCmdPaths()) {
+      try {
+        if (fsImpl.existsSync(target)) {
+          fsImpl.unlinkSync(target);
+          removed += 1;
+        }
+      } catch (error) {
+        log(`could not remove ${target}: ${error?.message || error}`);
+      }
+    }
+    return removed;
+  }
+
+  function manualCommandFor(action) {
+    return action === 'disable'
+      ? `schtasks /delete /tn "${BOOT_TASK_NAME}" /f`
+      : `schtasks /create /tn "${BOOT_TASK_NAME}" /xml "${xmlPath()}" /f`;
+  }
+
+  function spawnsDisabled() {
+    // The e2e harness's kill switch. schtasks is not a provider CLI, but the
+    // point is identical: an isolated relay must not read (let alone mutate)
+    // host machine state.
+    return Boolean(normalizeText(env?.COPILOT_WEB_RELAY_DISABLE_CLI_SPAWN));
+  }
+
+  async function getState() {
+    if (!supported) {
+      return { supported: false, platform };
+    }
+    if (spawnsDisabled()) {
+      return {
+        supported: true,
+        platform,
+        taskStatus: 'unknown',
+        taskName: BOOT_TASK_NAME,
+        legacyTaskPresent: false,
+        launcherPath: null,
+        pendingElevation: null,
+        lastError: null,
+        manualCommand: manualCommandFor('enable'),
+      };
+    }
+    const ownXml = await queryTaskXml(BOOT_TASK_NAME);
+    const legacyXml = await queryTaskXml(LEGACY_BOOT_TASK_NAME);
+    const taskStatus = ownXml === null
+      ? (legacyXml !== null ? 'legacy' : 'missing')
+      : classifyTaskXml(ownXml, { launcherPath: launcherPath() });
+    return {
+      supported: true,
+      platform,
+      taskStatus,
+      taskName: BOOT_TASK_NAME,
+      legacyTaskPresent: legacyXml !== null,
+      launcherPath: fsImpl.existsSync(launcherPath()) ? launcherPath() : null,
+      pendingElevation: pending ? pending.action : null,
+      lastError,
+      manualCommand: manualCommandFor(pending?.action || 'enable'),
+    };
+  }
+
+  function writeFileAtomic(targetPath, contents) {
+    fsImpl.mkdirSync(pathImpl.dirname(targetPath), { recursive: true });
+    const temporaryPath = `${targetPath}.tmp`;
+    fsImpl.writeFileSync(temporaryPath, contents);
+    fsImpl.renameSync(temporaryPath, targetPath);
+  }
+
+  function settlePending(outcome) {
+    if (!pending) return;
+    if (pending.timer) clearTimeoutImpl(pending.timer);
+    pending = null;
+    lastError = outcome || null;
+  }
+
+  /**
+   * The elevated child is powershell running Start-Process -Verb RunAs -Wait:
+   * the outer process lives exactly as long as the UAC prompt plus the sweep
+   * script, so its exit is the "elevation finished (or was declined)" signal.
+   */
+  function spawnElevated(action, onSettled) {
+    const child = spawnImpl('powershell.exe', [
+      '-NoProfile',
+      '-NonInteractive',
+      '-Command',
+      [
+        '$p = Start-Process -FilePath powershell.exe -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList',
+        `'-NoProfile','-ExecutionPolicy','Bypass','-File','${elevationScriptPath()}'`,
+        '; exit $p.ExitCode',
+      ].join(' '),
+    ], {
+      stdio: ['ignore', 'ignore', 'pipe'],
+      windowsHide: true,
+    });
+    let stderr = '';
+    child.stderr?.on?.('data', (chunk) => { stderr = `${stderr}${chunk}`.slice(-2000); });
+    const timer = setTimeoutImpl(() => {
+      try { child.kill('SIGTERM'); } catch {}
+      settlePending(`${action} timed out waiting for the admin confirmation on the PC.`);
+      onSettled?.(false);
+    }, ELEVATION_TIMEOUT_MS);
+    timer?.unref?.();
+    pending = { action, startedAt: now(), timer, child };
+    child.on('error', (error) => {
+      settlePending(`${action} could not request elevation: ${error?.message || error}`);
+      onSettled?.(false);
+    });
+    child.on('close', (code) => {
+      if (!pending) return; // timeout already settled it
+      if (code === 0) {
+        settlePending(null);
+        onSettled?.(true);
+      } else {
+        // 1 from Start-Process usually means the UAC prompt was declined.
+        const detail = normalizeText(stderr).split('\n')[0] || `exit code ${code}`;
+        settlePending(`${action} was not confirmed (${detail}). Run the command below from an elevated shell instead.`);
+        onSettled?.(false);
+      }
+    });
+  }
+
+  async function requestEnable() {
+    if (!supported) {
+      throw new Error('Windows boot autostart is only available on Windows.');
+    }
+    if (spawnsDisabled()) {
+      throw new Error('Windows boot autostart is disabled on this relay (CLI spawns are off).');
+    }
+    if (pending) {
+      return { ...(await getState()), accepted: false };
+    }
+    lastError = null;
+    writeFileAtomic(launcherPath(), buildBootLauncherScript({ packageRoot, nodePath, configPath, workingDirectory: oarRoot(), pathImpl }));
+    const who = await execFileImpl('whoami', ['/user', '/fo', 'csv']);
+    const sid = parseSidFromWhoami(who.stdout);
+    if (!sid) {
+      lastError = 'Could not determine the current user SID (whoami /user failed).';
+      return { ...(await getState()), accepted: false };
+    }
+    writeFileAtomic(xmlPath(), encodeTaskXml(buildBootTaskXml({
+      sid,
+      launcherPath: launcherPath(),
+      packageRoot: pathImpl.resolve(String(packageRoot)),
+      workingDirectory: oarRoot(),
+    })));
+    writeFileAtomic(elevationScriptPath(), buildElevationScript({ action: 'enable', xmlPath: xmlPath() }));
+    spawnElevated('enable', (ok) => {
+      if (ok) {
+        // Mutual exclusion: boot mode owns startup now, so the sign-in
+        // entries (either name) must not race it at the next logon.
+        const removed = removeStartupCmds();
+        log(`enabled; removed ${removed} sign-in autostart entr${removed === 1 ? 'y' : 'ies'}`);
+      } else {
+        log(`enable did not complete: ${lastError}`);
+      }
+    });
+    return { ...(await getState()), accepted: true };
+  }
+
+  async function requestDisable() {
+    if (!supported) {
+      throw new Error('Windows boot autostart is only available on Windows.');
+    }
+    if (spawnsDisabled()) {
+      throw new Error('Windows boot autostart is disabled on this relay (CLI spawns are off).');
+    }
+    if (pending) {
+      return { ...(await getState()), accepted: false };
+    }
+    lastError = null;
+    writeFileAtomic(elevationScriptPath(), buildElevationScript({ action: 'disable' }));
+    spawnElevated('disable', (ok) => {
+      if (ok) {
+        try {
+          if (fsImpl.existsSync(launcherPath())) fsImpl.unlinkSync(launcherPath());
+        } catch (error) {
+          log(`could not remove launcher: ${error?.message || error}`);
+        }
+        log('disabled');
+      } else {
+        log(`disable did not complete: ${lastError}`);
+      }
+    });
+    return { ...(await getState()), accepted: true };
+  }
+
+  return {
+    getState,
+    requestEnable,
+    requestDisable,
+  };
+}

package/shared/ask-user-bridge.mjs

@@ -17,6 +17,12 @@ function normalizeQuestions(input) {
       rawQuestion: String(entry?.question || ''),
       header: String(entry?.header || '').trim(),
       multiSelect: entry?.multiSelect === true,
+      // Structured-elicitation parity: a schema object rides through to the
+      // create payload untouched (the server normalizes and validates it).
+      requestedSchema: entry?.requestedSchema && typeof entry.requestedSchema === 'object'
+        && !Array.isArray(entry.requestedSchema)
+        ? entry.requestedSchema
+        : null,
       options: (Array.isArray(entry?.options) ? entry.options : [])
         .map((option) => ({
           label: String(option?.label || '').trim(),
@@ -47,8 +53,12 @@ export function createAskUserBridge({
   questionRationale = 'Claude requested clarification to continue this turn.',
   dbg = () => {},
 } = {}) {
-  async function waitForRelayQuestionAnswer(questionId, { signal } = {}) {
+  // `timeoutMs` overrides the bridge-wide default for one wait (a structured
+  // elicitation may carry its own deadline). Additive: existing callers pass
+  // only `signal` and behave exactly as before.
+  async function waitForRelayQuestionAnswer(questionId, { signal, timeoutMs } = {}) {
     const started = Date.now();
+    const deadlineMs = timeoutMs ?? questionTimeoutMs;
     while (true) {
       if (signal?.aborted) {
         await api('POST', `/api/relay-question/${questionId}/timeout`, {}).catch(() => {});
@@ -57,12 +67,22 @@ export function createAskUserBridge({
       const { question } = await api('GET', `/api/relay-question/${questionId}`);
       if (!question) throw new Error('Relay question missing');
       if (question.status === 'answered') {
-        return { answer: String(question.answer || '').trim(), timedOut: false };
+        return {
+          answer: String(question.answer || '').trim(),
+          // The validated structured submission, when the card carried a
+          // `requestedSchema` and the relay stored one. Null otherwise — flat
+          // consumers read `answer` and never see a shape change.
+          structuredAnswer: question.structuredAnswer && typeof question.structuredAnswer === 'object'
+            && !Array.isArray(question.structuredAnswer)
+            ? question.structuredAnswer
+            : null,
+          timedOut: false,
+        };
       }
       if (question.status === 'timed_out' || question.status === 'cancelled') {
         return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
       }
-      if (Date.now() - started >= questionTimeoutMs) {
+      if (Date.now() - started >= deadlineMs) {
         await api('POST', `/api/relay-question/${questionId}/timeout`, {}).catch(() => {});
         return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
       }
@@ -86,7 +106,13 @@ export function createAskUserBridge({
       prompt: promptParts.join('\n\n'),
       choices,
       allowFreeform: true,
+      // Top-level, as the create route reads it (elicitation parity; absent
+      // for the flat question shape every existing caller sends).
+      ...(entry.requestedSchema ? { requestedSchema: entry.requestedSchema } : {}),
       sdk_session_id: sdkSessionId || undefined,
+      // Fences the card to the delivering attempt: the server refuses creation
+      // once the row has been requeued to a newer attempt.
+      attemptId: activeMsg?.attemptId || undefined,
       timeout_ms: questionTimeoutMs,
       context: {
         source: questionSource,
@@ -108,20 +134,26 @@ export function createAskUserBridge({
   async function handleAskUserQuestion(input, { signal } = {}) {
     const questions = normalizeQuestions(input);
     if (!questions.length) {
-      return { answers: {}, timedOut: false };
+      return { answers: {}, structuredAnswers: {}, timedOut: false };
     }
     const answers = {};
+    // Validated structured submissions, keyed like `answers`, present only for
+    // questions that carried a `requestedSchema`. Flat consumers keep reading
+    // `answers` unchanged.
+    const structuredAnswers = {};
     let timedOut = false;
     for (const entry of questions) {
       const result = await askSingleQuestion(entry, { signal });
       answers[entry.question] = result.answer;
+      if (result.structuredAnswer) structuredAnswers[entry.question] = result.structuredAnswer;
       if (entry.rawQuestion && entry.rawQuestion !== entry.question) {
         answers[entry.rawQuestion] = result.answer;
+        if (result.structuredAnswer) structuredAnswers[entry.rawQuestion] = result.structuredAnswer;
       }
       if (result.timedOut) timedOut = true;
       if (result.aborted) break;
     }
-    return { answers, timedOut };
+    return { answers, structuredAnswers, timedOut };
   }
 
   return {

package/shared/background-task-timeout.mjs

@@ -2,14 +2,22 @@
 // persistent Claude CLI process alive, shared so the settings slider and the
 // worker enforcing it agree on bounds and formatting.
 //
-// 0 means no limit — the default: a process holding live tasks stays up until
-// the tasks finish, the user stops them from the composer panel, or the
-// worker/relay goes down. Mirrors shared/turn-ceiling.mjs.
+// The default is 4 hours: long enough for real long-running work to finish,
+// short enough that a forgotten shell or agent does not keep its runtime
+// alive indefinitely. 0 (chosen explicitly) means no limit: a process holding
+// live tasks stays up until the tasks finish, the user stops them from the
+// composer panel, or the worker/relay goes down. Mirrors
+// shared/turn-ceiling.mjs.
+//
+// The browser mirrors the default in
+// server/public/app/background-task-timeout-options.mjs (only server/public is
+// served), and the slider's static markup in server/public/index.html starts
+// at it; unit tests pin both to this module.
 
 export const BACKGROUND_TASK_TIMEOUT_MIN_MINUTES = 0;
 export const BACKGROUND_TASK_TIMEOUT_MAX_MINUTES = 600;
 export const BACKGROUND_TASK_TIMEOUT_STEP_MINUTES = 5;
-export const DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES = 0;
+export const DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES = 240;
 
 /** 0 disables the timeout entirely (unlimited). */
 export function normalizeBackgroundTaskTimeoutMinutes(value, fallback = DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES) {

package/shared/claude-model-catalog.mjs

@@ -0,0 +1,49 @@
+// How the relay's Claude model list survives Anthropic rotating its lineup.
+//
+// `supportedModels()` reports only what the CLI currently advertises, so a
+// straight replace silently drops a model you are using the moment a successor
+// appears (Fable 5 -> Fable 5.1, 2026-09-05). Previous ids keep working through
+// `--model` until they are actually retired server-side, so the catalog keeps
+// them and lets the user decide when to stop using one.
+
+export const MAX_CLAUDE_CATALOG_MODELS = 32;
+
+/**
+ * Freshly discovered models first (they are the current lineup), then models a
+ * previous discovery found and this one no longer advertises. The default model
+ * always leads so the composer's selection can never fall out of its own list.
+ */
+export function mergeDiscoveredClaudeModels({
+  defaultModel = '',
+  discovered = [],
+  previouslyKnown = [],
+  max = MAX_CLAUDE_CATALOG_MODELS,
+} = {}) {
+  const merged = [];
+  const seen = new Set();
+  const add = (value) => {
+    const id = String(value || '').trim();
+    if (!id) return;
+    // Ids are conventionally lowercase; dedupe case-insensitively but keep the
+    // first spelling seen so discovery's casing wins over a stored variant.
+    const key = id.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    merged.push(id);
+  };
+
+  add(defaultModel);
+  for (const id of Array.isArray(discovered) ? discovered : []) add(id);
+  for (const id of Array.isArray(previouslyKnown) ? previouslyKnown : []) add(id);
+
+  const limit = Number.isInteger(max) && max > 0 ? max : MAX_CLAUDE_CATALOG_MODELS;
+  // Retained ids trail the current lineup, so the cap sheds the stalest first.
+  return merged.slice(0, limit);
+}
+
+/** Discovered effort ladders win; retained models keep the ladder they had. */
+export function mergeClaudeModelEfforts(previousEfforts = {}, discoveredEfforts = {}) {
+  const previous = previousEfforts && typeof previousEfforts === 'object' ? previousEfforts : {};
+  const discoveredMap = discoveredEfforts && typeof discoveredEfforts === 'object' ? discoveredEfforts : {};
+  return { ...previous, ...discoveredMap };
+}

package/shared/context-window-fallbacks.mjs

@@ -20,6 +20,7 @@ export const MODEL_FALLBACK_LIMITS = Object.freeze({
   'claude-haiku-4.5': 200000,
   // Anthropic Claude Fable
   'claude-fable-5': 200000,
+  'claude-fable-5.1': 200000,
   // Anthropic Claude Opus
   'claude-opus-5': 200000,
   'claude-opus-4.8': 200000,

package/shared/control-poller.mjs

@@ -63,7 +63,10 @@ export function createControlPoller({
 
     dbg('abort_turn control received', control.id);
     try {
-      await onAbortTurn();
+      // The control names the row the user stopped. A runner that owns several
+      // rows at once (a turn plus the messages steered into it) needs it to
+      // tell the stopped row from the ones it must settle itself.
+      await onAbortTurn(control);
       await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
         ok: true,
         note: abortAckNote,