@oar-sh/oar 0.9.1 → 0.9.3

package/server/claude-worker/claude-session-worker.mjs

@@ -9,15 +9,16 @@ import { fileURLToPath } from 'url';
 import {
   loadTokenFromConfig,
   resolveRelayServerUrl,
-} from '../../.github/extensions/web-relay/runtime/config-loader.mjs';
-import { createApiClient } from '../../.github/extensions/web-relay/runtime/api-client.mjs';
-import { createWorkerWebSocketLink } from '../../.github/extensions/web-relay/runtime/worker-websocket-link.mjs';
-import { createHeartbeatController } from '../../.github/extensions/web-relay/polling/heartbeat.mjs';
+} from '../../shared/worker-runtime/config-loader.mjs';
+import { createApiClient } from '../../shared/worker-runtime/api-client.mjs';
+import { createWorkerWebSocketLink } from '../../shared/worker-runtime/worker-websocket-link.mjs';
+import { createHeartbeatController } from '../../shared/worker-runtime/heartbeat.mjs';
 import { createControlPoller } from '../../shared/control-poller.mjs';
 import { resolveDeliveredAutoCompactWindow } from '../../shared/auto-compact-window.mjs';
 import { resolveDeliveredThinking } from '../../shared/claude-thinking.mjs';
 import { installWorkerCrashGuard } from '../../shared/worker-crash-guard.mjs';
 import { createClaudeSessionRunner } from './claude-session-process.mjs';
+import { createRunnerLinkBridge, failSettlingRowsOnShutdown } from './claude-worker-link-wiring.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const HEARTBEAT_MS = 10_000;
@@ -82,6 +83,9 @@ async function main() {
     onAbortSubagent: (subagentRunId) => turnRunner.stopBackgroundTaskByToolUseId(subagentRunId),
     dbg,
   });
+  const linkBridge = createRunnerLinkBridge();
+  // Late-bound: the heartbeat controller is built after the runner.
+  let heartbeat = null;
   const turnRunner = createClaudeSessionRunner({
     api,
     sdkSessionId,
@@ -102,18 +106,37 @@ async function main() {
     getBackgroundTaskTimeoutMs: () => backgroundTaskTimeoutMs,
     getAutoCompactWindow: () => autoCompactWindow,
     getThinking: () => thinking,
+    // A readiness flip is a hold starting or ending (question card,
+    // compaction, a turn-opening delivery): the steering snapshot changed
+    // with it, so it goes out now rather than on the next 10 s heartbeat.
+    onDeliveryReadinessChange: (ready) => {
+      linkBridge.onDeliveryReadinessChange(ready);
+      heartbeat?.requestPulse();
+    },
+    canHandBackHeldDelivery: () => linkBridge.canHandBackHeldDelivery(),
     dbg,
   });
 
   let heartbeatTimer = null;
-  const heartbeat = createHeartbeatController({
+  heartbeat = createHeartbeatController({
     api,
     pollMs: HEARTBEAT_MS,
     getSessionReady: () => true,
     getHeartbeatTimer: () => heartbeatTimer,
     setHeartbeatTimer: (timer) => { heartbeatTimer = timer; },
     getActiveQueueMessageId: () => turnRunner.getActiveQueueMessageId(),
-    getActiveQueueMessageIds: () => turnRunner.getActiveQueueMessageIds(),
+    // The runner reports { id, attemptId } entries; the heartbeat's claim
+    // payload is id-only (its String() coercion would mangle an object), while
+    // the crash guard below takes the entries whole so its requeues stay
+    // fenced to this attempt.
+    getActiveQueueMessageIds: () => turnRunner.getActiveQueueMessageIds().map((entry) => entry.id),
+    // Composer steering snapshot. Holds reach the relay within a pulse window
+    // (onDeliveryReadinessChange above) and a relay that just came up gets it
+    // on its first hello; the periodic beat only backstops the rest.
+    getSteeringState: () => turnRunner.steeringState(),
+    // Consumed rows the runner could not fail itself; the relay fails them.
+    getSettleFailed: () => turnRunner.getSettleFailed(),
+    onSettleFailedHandled: (ids) => turnRunner.acknowledgeSettleFailed(ids),
   });
 
   const wsLink = createWorkerWebSocketLink({
@@ -121,6 +144,18 @@ async function main() {
     token,
     dbg,
     getSessionReady: () => true,
+    // Mid-turn steering: while a turn is running and the runner can absorb
+    // another message into it, the link keeps signalling readiness, so a
+    // message sent while Claude is thinking is pushed into the live turn
+    // instead of waiting for the result (docs/plans/2026-09-19-claude-mid-
+    // turn-steering.md).
+    getSteeringReady: () => turnRunner.canAcceptSteering(),
+    // A hold (open question card, compaction, adoption) suppresses readiness
+    // even between deliveries — a delivery drawn into it is only handed back.
+    getDeliveryHeld: () => turnRunner.isDeliveryHeld(),
+    // A relay that just (re)started knows nothing of this worker until it
+    // heartbeats; the composer's steering snapshot rides that beat.
+    onServerHello: () => heartbeat.requestPulse(),
     getSessionId: () => sdkSessionId,
     getPid: () => process.pid,
     onDeliver: async (pending, reason) => {
@@ -154,20 +189,30 @@ async function main() {
       dbg('unknown worker control ignored', type || '(none)');
     },
   });
+  linkBridge.attach(wsLink);
 
-  const shutdown = (signal) => {
+  let shuttingDown = false;
+  const shutdown = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
     dbg(`shutting down (${signal})`);
     try { wsLink.stop(); } catch {}
     try { heartbeat.stopHeartbeat(); } catch {}
     try { controlPoller.stop(); } catch {}
+    // Consumed steers still settling must fail, not be left for dead-worker
+    // recovery to requeue and run twice (same 2 s cap as the crash guard).
+    try {
+      const failed = await failSettlingRowsOnShutdown({ api, runner: turnRunner, timeoutMs: 2_000 });
+      if (failed) dbg(`failed ${failed} settling row(s) before exit`);
+    } catch {}
     // Hard-close the persistent CLI process; a worker teardown cannot save
     // its background tasks, and the orphan-notification replay on the next
     // resume reports whatever they left behind.
     try { turnRunner.shutdown({ graceful: false }); } catch {}
     process.exit(0);
   };
-  process.on('SIGTERM', () => shutdown('SIGTERM'));
-  process.on('SIGINT', () => shutdown('SIGINT'));
+  process.on('SIGTERM', () => { void shutdown('SIGTERM'); });
+  process.on('SIGINT', () => { void shutdown('SIGINT'); });
   installWorkerCrashGuard({
     api,
     workerName: 'claude-session-worker',

package/server/claude-worker/claude-turn-publisher.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { countPlanLikeLines } from '../../shared/plan-lines.mjs';
 import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
+import { buildSteerSettleFailure, steerSettleFailureText } from '../../shared/steer-settle-failure.mjs';
 
 const PLAN_BOARD_ACTIONS = [
   { id: 'autopilot', label: 'Implement in autopilot', mode: 'autopilot' },
@@ -8,6 +9,26 @@ const PLAN_BOARD_ACTIONS = [
   { id: 'exit_only', label: 'Stop here', mode: 'agent' },
 ];
 
+/**
+ * The attempt-fencing echo for a row's write bodies. Every publish that names
+ * a `messageId` also names the attempt it belongs to, so the relay can refuse
+ * writes from a superseded attempt (a requeued row re-delivered elsewhere).
+ * Omitted entirely when the row carries no attempt id (a pre-fencing relay).
+ */
+export function attemptFields(message) {
+  return message?.attemptId ? { attemptId: message.attemptId } : {};
+}
+
+/** A 409 whose detail names `stale_attempt`: this attempt was superseded. */
+export function isStaleAttemptError(error) {
+  if (Number(error?.status) !== 409) return false;
+  const detail = typeof error?.detail === 'string' ? error.detail : JSON.stringify(error?.detail || '');
+  return detail.includes('stale_attempt');
+}
+
+export { buildSteerSettleFailure, steerSettleFailureText };
+export const STEER_SETTLE_FAILED_TEXT = steerSettleFailureText('folded');
+
 export function buildClaudePlanReadyBoardPayload({ message, planText = '' } = {}) {
   const summary = String(planText || '').trim();
   if (!summary) return null;
@@ -38,6 +59,11 @@ export function buildClaudePlanReadyBoardPayload({ message, planText = '' } = {}
  * (delivered or background-continuation) through one publisher.
  */
 export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRuns = null } = {}) {
+  function drainWorkflowRuns({ terminal = false } = {}) {
+    if (terminal || typeof takeWorkflowRuns !== 'function') return null;
+    return takeWorkflowRuns();
+  }
+
   async function postActivity(message, text, subagentRunId = null, metadata = null) {
     if (!text) return;
     await api('POST', '/api/activity', {
@@ -47,6 +73,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
       text,
       ...(subagentRunId ? { subagentRunId } : {}),
       ...(metadata && typeof metadata === 'object' ? { metadata } : {}),
+      ...attemptFields(message),
     }).catch(() => {});
   }
 
@@ -69,6 +96,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...attemptFields(message),
       }).catch(() => {});
       return;
     }
@@ -81,6 +109,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
         text: payload.text,
         done: payload.done === true,
         ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+        ...attemptFields(message),
       }).catch(() => {});
       return;
     }
@@ -96,6 +125,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
         parentSubagentId: payload.parentSubagentId || undefined,
         displayName: payload.displayName || undefined,
         status: payload.status,
+        ...attemptFields(message),
       }).catch(() => {});
       return;
     }
@@ -155,31 +185,90 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
       mode: message.relayMode || 'agent',
       text: String(text || ''),
       done: true,
+      ...attemptFields(message),
     }).catch(() => {});
   }
 
-  async function publishResponse(message, { text, model, terminalError = null, modelOrigin }) {
+  /**
+   * Returns the outcome: 'published' (the relay took it), 'stale' (another
+   * attempt owns the row), 'failed' (not taken and NOT requeued), or
+   * 'requeued'. A `kind` marks a row whose prompt the CLI already consumed —
+   * 'absorbed' (the reply continues through the next, steered message),
+   * 'folded' (answered by the turn it was steered into) or 'stopped' (steered
+   * into a turn the user stopped) — and such a row is never
+   * requeued, since re-delivery would run the prompt a second time; the
+   * caller owns retrying it. `requeueOnFailure: false` opts any other publish
+   * into the same contract.
+   */
+  async function publishResponse(message, {
+    text,
+    model,
+    terminalError = null,
+    modelOrigin,
+    absorbed = false,
+    kind = null,
+    requeueOnFailure = true,
+    // Ids of steered queue rows pushed into the turn this response finishes
+    // and still unsettled: the relay marks them consumed in the same
+    // transaction, so no recovery path ever re-runs them (at-most-once even
+    // if this worker dies before settling them).
+    consumedSteerIds = null,
+    // A caller retrying one publish drains the settled workflow digests ONCE
+    // and passes them to every attempt, so a failed attempt cannot lose them.
+    workflowRuns: presetWorkflowRuns,
+  }) {
+    const responseKind = kind || (absorbed ? 'absorbed' : null);
     // Final digests of workflows that settled since the last response ride the
     // next successful response publish — the summarizing turn is the natural
     // transcript anchor for the "Finished background task" card. Terminal
     // failures skip the drain so the digests stay buffered for a later turn;
     // if this POST fails (→ requeue) or the process dies before any response
     // publishes, the drained digests are lost — acceptable v1.
-    const workflowRuns = (!terminalError && typeof takeWorkflowRuns === 'function')
-      ? takeWorkflowRuns()
-      : null;
-    await api('POST', '/api/response', {
-      messageId: message.id,
-      conversationId: message.conversationId,
-      text: String(text || ''),
-      model: model || null,
-      modelOrigin: modelOrigin
-        || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
-      ...(Array.isArray(workflowRuns) && workflowRuns.length ? { workflowRuns } : {}),
-      ...(terminalError ? { terminalError } : {}),
-    }).catch(async () => {
-      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
-    });
+    const workflowRuns = presetWorkflowRuns !== undefined
+      ? presetWorkflowRuns
+      : drainWorkflowRuns({ terminal: Boolean(terminalError) });
+    // Entries are { id, attemptId } (the relay fences each mark on its
+    // attempt) or bare ids.
+    const consumed = (Array.isArray(consumedSteerIds) ? consumedSteerIds : [])
+      .map((entry) => (entry && typeof entry === 'object'
+        ? { id: String(entry.id || '').trim(), attemptId: entry.attemptId || null }
+        : { id: String(entry || '').trim(), attemptId: null }))
+      .filter((entry) => entry.id);
+    try {
+      await api('POST', '/api/response', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        text: String(text || ''),
+        model: model || null,
+        modelOrigin: modelOrigin
+          || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
+        ...(Array.isArray(workflowRuns) && workflowRuns.length ? { workflowRuns } : {}),
+        ...(terminalError ? { terminalError } : {}),
+        // The relay stamps the assistant message's kind from these: 'absorbed'
+        // renders as merged into the next (steered) user message, 'folded' as
+        // a compact marker on its own message, 'stopped' as a steer the
+        // user's Stop cut off unanswered.
+        ...(responseKind === 'absorbed' ? { absorbed: true } : {}),
+        ...(responseKind && responseKind !== 'absorbed' ? { kind: responseKind } : {}),
+        ...(consumed.length ? { consumedSteerIds: consumed } : {}),
+        ...attemptFields(message),
+      });
+      return 'published';
+    } catch (error) {
+      // A stale_attempt 409 means the row already moved on to another attempt
+      // (requeued and re-delivered); the requeue would 409 the same way, and
+      // the newer attempt owes the row its answer — drop this one.
+      if (isStaleAttemptError(error)) {
+        dbg('response refused as stale_attempt; dropping', message.id);
+        return 'stale';
+      }
+      if (responseKind || !requeueOnFailure) {
+        dbg('response publish failed; not requeuing a consumed prompt', message.id, error?.message || String(error));
+        return 'failed';
+      }
+      await api('POST', '/api/requeue', { messageId: message.id, ...attemptFields(message) }).catch(() => {});
+      return 'requeued';
+    }
   }
 
   /**
@@ -214,7 +303,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
    * plan-mode fallback board, response row. Mirrors the pre-session-process
    * turn runner's tail exactly.
    */
-  async function publishCompletedTurn({ message, state, responseModel, planBoardPosted }) {
+  async function publishCompletedTurn({ message, state, responseModel, planBoardPosted, consumedSteerIds = null }) {
     const result = state.result;
     const finalText = String(
       state.resultTexts.join('\n\n') || result?.text || state.lastStreamedText || '',
@@ -236,10 +325,10 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
     // fails the message with a misleading "Relay timeout".
     const publishedText = finalText || EMPTY_TURN_COMPLETION_NOTE;
     await publishFinalStream(message, publishedText);
-    await publishResponse(message, { text: publishedText, model: responseModel });
+    await publishResponse(message, { text: publishedText, model: responseModel, consumedSteerIds });
   }
 
-  async function publishErrorResult({ message, state, responseModel }) {
+  async function publishErrorResult({ message, state, responseModel, consumedSteerIds = null }) {
     const result = state.result;
     const errorText = result.text
       || `Claude turn failed (${result.subtype || 'unknown error'}).`;
@@ -255,6 +344,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
         failedAt: new Date().toISOString(),
         queueMessageId: String(message.id || '') || null,
       },
+      consumedSteerIds,
     });
   }
 
@@ -278,6 +368,7 @@ export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRun
 
   return {
     postActivity,
+    drainWorkflowRuns,
     dispatchAction,
     publishContextUsage,
     publishPlanUsage,

package/server/claude-worker/claude-worker-link-wiring.mjs

@@ -0,0 +1,9 @@
+// The Claude worker's glue between its session runner and the relay socket
+// link. The implementation moved to shared/worker-runtime/runner-link-wiring.mjs
+// when the Copilot SDK worker adopted the same delivery gate; this module is
+// the import path the Claude worker and its tests still use.
+
+export {
+  createRunnerLinkBridge,
+  failSettlingRowsOnShutdown,
+} from '../../shared/worker-runtime/runner-link-wiring.mjs';

package/server/copilot-sdk-runtime.mjs

@@ -91,7 +91,11 @@ export function buildInstalledCopilotClientOptions({
       path: cliPath,
     },
     mode: 'empty',
-    baseDirectory,
+    // Runtime 1.0.83 made 'empty' mode refuse to construct without an explicit
+    // per-session persistence location. ~/.copilot is exactly what the runtime
+    // defaulted to before (baseDirectory sets COPILOT_HOME), so the import
+    // sweep keeps seeing the CLI's real session state.
+    baseDirectory: String(baseDirectory || '').trim() || path.join(os.homedir(), '.copilot'),
     useLoggedInUser: true,
     logLevel,
     workingDirectory: cwd,
@@ -119,8 +123,13 @@ export async function createInstalledCopilotClient({
     approveAll: sdk.approveAll,
     paths,
     async dispose() {
-      await client.stop?.();
-      await client.dispose?.();
+      // stop() can reject (e.g. the CLI already died); dispose() must still
+      // run or the transport resources leak with it.
+      try {
+        await client.stop?.();
+      } finally {
+        await client.dispose?.();
+      }
     },
   };
 }

package/server/copilot-worker/copilot-ask-user-tool.mjs

@@ -0,0 +1,89 @@
+// The relay's own `ask_user` tool for Copilot SDK sessions.
+//
+// The runtime's built-in `ask_user` offers the model only `question` and
+// `choices` (captured from the request body, runtime 1.0.88), so a model has
+// no way to say "the user may pick several of these" — and the relay could
+// only guess from the wording. The SDK lets a host register a tool that
+// overrides a built-in one of the same name (`overridesBuiltInTool`), so the
+// worker registers this superset instead: the same name and fields every
+// model already knows, plus `multi_select`. Verified with the fake-provider
+// probe (2026-09-25): the model sees exactly one `ask_user` with this schema,
+// the handler receives the call, and the built-in path is never used.
+//
+// Pure: schema, argument parsing and the result wording. The session process
+// wires the handler to the relay question bridge.
+
+import { normalizeUserInputChoices } from './copilot-question-bridge.mjs';
+
+export const RELAY_ASK_USER_TOOL_NAME = 'ask_user';
+
+export const RELAY_ASK_USER_TOOL_DESCRIPTION = [
+  'Ask the user a question and wait for their response.',
+  'Use this tool when you need to ask the user questions during execution. This allows you to:',
+  '1. Gather user preferences or requirements',
+  '2. Clarify ambiguous instructions',
+  '3. Get decisions on implementation choices as you work',
+  '4. Offer choices to the user about what direction to take',
+  'The question is shown to the user as a card with a button per choice.',
+  'Set multi_select to true when the user may pick several of the choices (the choices are not',
+  'mutually exclusive); the answer then lists every pick, separated by ", ". Leave it false or',
+  'omit it when exactly one choice applies.',
+].join('\n');
+
+export const RELAY_ASK_USER_TOOL_PARAMETERS = Object.freeze({
+  type: 'object',
+  properties: {
+    question: {
+      type: 'string',
+      description: 'The question to ask the user. Ensure only one question is asked at a time - do not bundle multiple questions together.',
+    },
+    choices: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Optional list of choices for a multiple choice question. Prefer providing choices when possible.',
+    },
+    multi_select: {
+      type: 'boolean',
+      description: 'true when the user may pick several of the choices; false or omitted when exactly one applies.',
+    },
+  },
+  required: ['question'],
+});
+
+/** The call's arguments, tolerating the camelCase spelling some models emit. */
+export function parseAskUserToolArguments(args) {
+  const source = args && typeof args === 'object' && !Array.isArray(args) ? args : {};
+  return {
+    question: String(source.question || '').trim(),
+    choices: normalizeUserInputChoices(source.choices),
+    multiSelect: source.multi_select === true || source.multiSelect === true,
+  };
+}
+
+/**
+ * The tool result the model reads, worded like the built-in's ("User
+ * selected: b" for a choice, "User responded: …" for anything else) so a
+ * model's habits carry over. A timed-out card returns the bridge's
+ * continuation text as it is.
+ */
+export function formatAskUserToolResult({ answer, wasFreeform = true, timedOut = false } = {}) {
+  const text = String(answer ?? '').trim();
+  if (timedOut) return text;
+  if (!text) return 'User responded with an empty answer.';
+  // `wasFreeform` comes from the question bridge (`deriveWasFreeform`), the
+  // single owner of "was this one of the offered choices".
+  return wasFreeform === false ? `User selected: ${text}` : `User responded: ${text}`;
+}
+
+/**
+ * Whether a session create/resume failure is the runtime refusing the
+ * override (an older runtime without `overridesBuiltInTool`, or one that
+ * rejects replacing this built-in). Anything else is a real failure.
+ */
+export function isToolOverrideRejection(error) {
+  const message = String(error?.message || error || '');
+  if (/overridesBuiltInTool/i.test(message)) return true;
+  // The tool named together with an override/clash complaint — a message that
+  // merely mentions ask_user (a replayed call in history, say) is not one.
+  return /\bask_user\b/i.test(message) && /(built-?in|clash|conflict|overrid|duplicate)/i.test(message);
+}

package/server/copilot-worker/copilot-attachments.mjs

@@ -9,7 +9,24 @@ function isImageAttachment(att) {
   return String(att?.type || '').toLowerCase().startsWith('image/');
 }
 
-function imageFromDataUrl(att) {
+/** Strict base64: the alphabet, optional padding, block length a multiple of 4. */
+const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+
+/**
+ * Decode-and-validate an inline data URL (audit #33).
+ *
+ * Disk-backed images have always enforced the decoded 5 MiB ceiling; data URLs
+ * used to skip it entirely, so a ~9 MiB decoded image (the server's ENCODED
+ * ceiling is larger) could ride straight past a limit this module claims to
+ * enforce. The ceiling is now applied to the DECODED byte count, uniformly with
+ * the disk path, and the base64 itself is validated first — `Buffer.from` is
+ * lenient and would silently decode garbage into a corrupt blob.
+ *
+ * Returns `{ data, mimeType }` for an embeddable image, `{ tooLarge: true }`
+ * for a valid image over the ceiling (so the caller can degrade explicitly),
+ * and `null` for anything invalid.
+ */
+function imageFromDataUrl(att, maxBytes) {
   const dataUrl = String(att?.dataUrl || '').trim();
   if (!dataUrl.startsWith('data:')) return null;
   const match = dataUrl.match(/^data:([^;,]+);base64,(.+)$/i);
@@ -17,6 +34,8 @@ function imageFromDataUrl(att) {
   const mimeType = String(match[1] || '').trim().toLowerCase();
   const data = String(match[2] || '').trim();
   if (!mimeType.startsWith('image/') || !data) return null;
+  if (data.length % 4 !== 0 || !BASE64_RE.test(data)) return null;
+  if (Buffer.from(data, 'base64').length > maxBytes) return { tooLarge: true };
   return { data, mimeType };
 }
 
@@ -59,6 +78,7 @@ export function buildCopilotMessageOptions(message, {
 
     if (isImageAttachment(att)) {
       let blob = null;
+      let tooLarge = false;
       if (filePath && fsImpl.existsSync(filePath)) {
         try {
           const bytes = fsImpl.readFileSync(filePath);
@@ -72,13 +92,26 @@ export function buildCopilotMessageOptions(message, {
           blob = null;
         }
       }
-      if (!blob) blob = imageFromDataUrl(att);
+      if (!blob) {
+        // The decoded ceiling applies to data URLs exactly as to disk reads —
+        // this is also the path an OVERSIZED disk image with a dataUrl twin
+        // used to sneak through.
+        const decoded = imageFromDataUrl(att, maxInlineImageBytes);
+        if (decoded?.tooLarge) tooLarge = true;
+        else blob = decoded;
+      }
       if (blob) {
         attachments.push({ type: 'blob', data: blob.data, mimeType: blob.mimeType, displayName: name });
         noteLines.push(`Attached image "${name}" (${mime}) is embedded in this message.`);
       } else if (filePath) {
         attachments.push({ type: 'file', path: filePath, displayName: name });
         noteLines.push(`Attached image "${name}" (${mime}): ${filePath}`);
+      } else if (tooLarge) {
+        // A valid image with nowhere to degrade to: too big to embed, no path
+        // for a file reference. Dropping it SILENTLY would leave the model
+        // answering about an image it never saw, so the omission is stated in
+        // the same note channel every other attachment uses.
+        noteLines.push(`Attached image "${name}" (${mime}) was too large to embed and has no file path, so it was omitted.`);
       }
       continue;
     }

package/server/copilot-worker/copilot-continuation-signals.mjs

@@ -54,6 +54,51 @@ export const SHELL_SETTLED_NOTIFICATION_KINDS = Object.freeze([
 /** Tools that address an already-running shell by id. */
 export const SHELL_HANDLE_TOOLS = Object.freeze(['read_bash', 'write_bash', 'stop_bash']);
 
+/**
+ * `system.notification` kinds that mean "a background agent this session
+ * started is done" — `agent_idle` for a multi-turn agent that finished its
+ * prompt and now waits for messages, `agent_completed` for a single-shot one.
+ * Both make the runtime re-invoke the model (`read_agent` + a reply under the
+ * spawning interaction), so both herald a continuation exactly like the shell
+ * kinds do (live-probed on runtime 1.0.88, 2026-09-25).
+ */
+export const AGENT_SETTLED_NOTIFICATION_KINDS = Object.freeze([
+  'agent_completed',
+  'agent_idle',
+]);
+
+/**
+ * The background agent a `system.notification` reports as settled, or null.
+ * `{ agentId, agentType, displayName, description, status }` — `status` is
+ * 'completed' | 'failed' for `agent_completed`, 'idle' for `agent_idle`.
+ */
+export function settledAgentFromNotification(event) {
+  if (String(event?.type || '') !== 'system.notification') return null;
+  const data = eventData(event);
+  const kind = data.kind && typeof data.kind === 'object' ? data.kind : {};
+  const type = String(kind.type || '');
+  if (!AGENT_SETTLED_NOTIFICATION_KINDS.includes(type)) return null;
+  const agentId = String(kind.agentId || '').trim();
+  if (!agentId) return null;
+  return {
+    agentId,
+    agentType: String(kind.agentType || '').trim(),
+    displayName: String(kind.displayName || '').trim(),
+    description: String(kind.description || '').trim(),
+    status: type === 'agent_idle' ? 'idle' : (String(kind.status || '').trim() || 'completed'),
+  };
+}
+
+/** A one-line transcript note for a settled background agent, posted into its continuation. */
+export function describeSettledAgent(agent) {
+  if (!agent?.agentId) return '';
+  const name = agent.displayName || agent.description || agent.agentType || 'agent';
+  const verb = agent.status === 'failed' ? 'failed' : 'finished';
+  return agent.description && agent.description !== name
+    ? `Background agent ${name} ${verb}: ${agent.description}`
+    : `Background agent ${name} ${verb}`;
+}
+
 // `<command started in detached background with shellId: 1>`
 const SHELL_OPENED_RE = /detached\s+(?:background|command)[^<>]*?shellId:\s*([^\s>,]+)/i;
 // `<detached command with shellId: 1 completed with exit code 0>`
@@ -118,7 +163,17 @@ export const CONTINUATION_OPENING_EVENT_TYPES = Object.freeze([
 
 const OPENING_TYPES = new Set(CONTINUATION_OPENING_EVENT_TYPES);
 
+/**
+ * Only ROOT-agent events open a turn. A background subagent keeps emitting
+ * `agentId`-tagged `tool.execution_start` / `assistant.message` / its own
+ * `user.message` after the turn that spawned it has settled (live-probed on
+ * runtime 1.0.88: the subagent's whole life happens under the main loop's
+ * idle), and none of that is the main agent starting work. The root agent's
+ * follow-up when the subagent finishes (`read_agent` + a reply) carries no
+ * `agentId` and opens the continuation as before.
+ */
 export function isContinuationOpeningEvent(event) {
+  if (String(event?.agentId || '').trim()) return false;
   return OPENING_TYPES.has(String(event?.type || ''));
 }