@oar-sh/oar 0.9.12 → 0.9.13

package/server/services/remote-relay-dispatcher.mjs

@@ -27,7 +27,9 @@ import {
 import { schemaFields } from '../../shared/question-schema.mjs';
 import { ANSWERED_ELSEWHERE_KIND } from '../../shared/steer-settle-markers.mjs';
 import { RELAY_EVENT_DEFAULT_TYPES } from '../../shared/relay-events.mjs';
+import { checkRequestedProviderModel, isAutoModelId, providerModelLabel, unknownProviderModelText } from './provider-model-selection.mjs';
 import { cleanTaskOutput, parseRunnerSummary, stallMinutes, stripSgr } from '../../shared/task-output-text.mjs';
+import { TASK_OUTPUT_NONE_MESSAGES } from '../public/app/task-console-render.mjs';
 import {
   RELAY_EVENT_REMOTE_PULL_PATH,
   RELAY_EVENT_REMOTE_SUBSCRIBE_PATH,
@@ -130,6 +132,8 @@ const FAILURE_TEXT_PATTERNS = Object.freeze([
   /^relay timeout after \d+ attempts/i,
 ]);
 const CLAUDE_LONG_CONTEXT_SUFFIX = /\[1m\]$/i;
+// How many of a provider's model ids an unknown-model refusal carries.
+const UNKNOWN_MODEL_LIST_MAX = 50;
 // POST /api/conversation/bootstrap refuses an effort its model does not take
 // with this code (400); POST /api/message sends the same 400 without a code,
 // but with the list below.
@@ -269,6 +273,45 @@ function matchOfferedModel(candidate, offered = []) {
   return offered.find((model) => model.toLowerCase().replace(CLAUDE_LONG_CONTEXT_SUFFIX, '') === wantedBase) || '';
 }
 
+/** The models /api/models lists for a provider label ("openai-byok"). */
+function catalogModelsLabelled(catalog, label) {
+  const providersByModel = isPlainObject(catalog?.models?.providersByModel) ? catalog.models.providersByModel : {};
+  return Object.entries(providersByModel)
+    .filter(([, providers]) => Array.isArray(providers) && providers.some((entry) => toText(entry).toLowerCase() === label))
+    .map(([model]) => model);
+}
+
+/** Copilot's catalogue: every model of /api/models no other provider claims alone. */
+function catalogGithubModels(catalog) {
+  const models = catalog?.models || {};
+  const providersByModel = isPlainObject(models.providersByModel) ? models.providersByModel : {};
+  const catalogModels = Array.isArray(models.models) ? models.models.map(toText).filter(Boolean) : [];
+  return catalogModels.filter((model) => {
+    const providers = catalogProvidersFor(providersByModel, model);
+    return providers.length === 0 || providers.includes(CATALOG_PROVIDER_LABELS.github);
+  });
+}
+
+/**
+ * The models a provider's New Chat list offers on the target, which its
+ * bootstrap and message routes accept, or null when the target has no list
+ * for it yet (discovery has not run or failed, the route did not answer):
+ * then a requested model cannot be checked here.
+ */
+function offeredModelList(catalog, provider) {
+  if (provider === 'github') {
+    const listed = catalogGithubModels(catalog);
+    return listed.length ? listed : null;
+  }
+  if (provider === 'openai') {
+    const listed = catalogModelsLabelled(catalog, CATALOG_PROVIDER_LABELS.openai);
+    return listed.length ? listed : null;
+  }
+  const settings = catalog?.settings?.[provider];
+  const listed = Array.isArray(settings?.models) ? settings.models.map(toText).filter(Boolean) : [];
+  return listed.length ? listed : null;
+}
+
 /** A reasoning effort as the relays write it, or '' when the value is not one. */
 function normalizeEffort(value) {
   const effort = toText(value).toLowerCase();
@@ -1016,19 +1059,9 @@ export function createRemoteRelayDispatcher({
 
   function listProviders(catalog) {
     const models = catalog.models || {};
-    const providersByModel = isPlainObject(models.providersByModel) ? models.providersByModel : {};
-    const catalogModels = Array.isArray(models.models) ? models.models.map(toText).filter(Boolean) : [];
-    const modelsLabelled = (label) => Object.entries(providersByModel)
-      .filter(([, providers]) => Array.isArray(providers) && providers.some((entry) => toText(entry).toLowerCase() === label))
-      .map(([model]) => model);
-
     return REMOTE_RELAY_PROVIDERS.map((provider) => {
       if (provider === 'github') {
-        // Copilot's catalogue is every model no other provider claims alone.
-        const githubModels = catalogModels.filter((model) => {
-          const providers = catalogProvidersFor(providersByModel, model);
-          return providers.length === 0 || providers.includes(CATALOG_PROVIDER_LABELS.github);
-        });
+        const githubModels = catalogGithubModels(catalog);
         const defaultModel = toText(catalog.status.defaultModel) || toText(models.defaultModel) || toText(models.currentModel) || null;
         return {
           provider,
@@ -1060,7 +1093,7 @@ export function createRemoteRelayDispatcher({
         && (provider === 'claude' || provider === 'grok' || settings.configured === true);
       const defaultModel = toText(settings.model) || null;
       const listed = provider === 'openai'
-        ? modelsLabelled(CATALOG_PROVIDER_LABELS.openai)
+        ? catalogModelsLabelled(catalog, CATALOG_PROVIDER_LABELS.openai)
         : (Array.isArray(settings.models) ? settings.models : []);
       return {
         provider,
@@ -1299,9 +1332,12 @@ export function createRemoteRelayDispatcher({
     const health = isPlainObject(task.health) ? task.health : null;
     const quietAfter = Number(row.taskStallMinutes) || null;
     const minutes = live && health ? stallMinutes(health.lastOutputAt, now()) : null;
+    // The command line comes scrubbed: the relay cleans it when the worker posts it.
+    const command = toText(task.command);
     return {
       taskId,
       output: kind !== 'none',
+      ...(command ? { command: clipLine(command, 500) } : {}),
       ...(health ? {
         health: {
           ...(minutes !== null ? { minutesSinceOutput: minutes } : {}),
@@ -1595,7 +1631,7 @@ export function createRemoteRelayDispatcher({
     }
     const kind = toText(answer?.kind) || 'file';
     let note = null;
-    if (kind === 'none') note = toText(answer?.message) || 'Output is not available for this provider.';
+    if (kind === 'none') note = toText(answer?.message) || TASK_OUTPUT_NONE_MESSAGES.provider;
     else if (answer?.pending) note = 'The session\'s worker was asked for the output; call again in a few seconds.';
     else if (answer?.unavailable) note = 'The output file is not there any more (the provider cleaned it up).';
     else if (kind === 'snapshot') note = 'Only the end of this task\'s output is available (its provider keeps no file).';
@@ -1785,16 +1821,24 @@ export function createRemoteRelayDispatcher({
     }
     const runtime = isPlainObject(conversation?.runtimeSession) ? conversation.runtimeSession : {};
     const provider = toText(runtime.providerType).toLowerCase() || 'github';
+    // Checked before any approval card (runRelayAction) when the session
+    // could be read there; here otherwise.
+    const settled = args.model
+      ? (ctx.settledModel || await settleSendModel(ctx, conversation, args.model))
+      : null;
+    const requestedModel = settled?.model || '';
+    const modelNote = settled?.note || null;
     // Without a model the remote falls back to its catalogue's current one and
     // silently switches the session; keep the model the session already uses.
     // Grok pins its model at bootstrap and refuses any other, so it gets none.
-    const model = args.model
+    const model = requestedModel
       || (provider === 'grok' ? '' : (toText(conversation?.preferredModel) || toText(runtime.providerModel) || toText(runtime.model)));
     const mode = args.mode || ctx.caller.mode || toText(conversation?.preferredRelayMode) || '';
     // The remote runs a prompt that names no effort with its provider's
     // default, not with the one the session is set to: pass that one on, so
     // the session keeps its own. This session's effort is never mirrored here.
-    const requested = normalizeEffort(args.effort);
+    // A Copilot model named with its effort ("gpt-5.4-high") brings that effort.
+    const requested = normalizeEffort(args.effort) || normalizeEffort(settled?.effort);
     const own = requested ? '' : normalizeEffort(conversation?.preferredReasoningEffort);
     const origin = await buildOrigin(ctx);
     const { sent, choice } = await postPromptWithEffort(ctx, { session, text: args.text, origin, model, mode }, {
@@ -1802,11 +1846,91 @@ export function createRemoteRelayDispatcher({
       source: requested ? EFFORT_SOURCES.requested : (own ? EFFORT_SOURCES.remote : ''),
       note: null,
     });
-    return deliverAndWait('send', ctx, { session, sent, waitSeconds: args.wait_seconds, extra: effortResult(choice) });
+    return deliverAndWait('send', ctx, {
+      session,
+      sent,
+      waitSeconds: args.wait_seconds,
+      extra: { ...(modelNote ? { modelNote } : {}), ...effortResult(choice) },
+    });
+  }
+
+  /**
+   * A model the agent named, checked against the list New Chat offers for
+   * `provider` on the target (offeredModelList). Throws a DispatchFailure
+   * (unknownModel) for one it does not offer, before anything is created or
+   * sent. Returns `{ model, note }`: the id to use (the provider's casing, a
+   * Claude alias resolved) and what the agent should know about it, the
+   * model left unchecked for want of a list included.
+   */
+  function settleRequestedModel(ctx, catalog, provider, requested, { creating, extraModels = [] }) {
+    const entry = catalog ? listProviders(catalog).find((candidate) => candidate.provider === provider) : null;
+    const offered = catalog ? offeredModelList(catalog, provider) : null;
+    const check = checkRequestedProviderModel({
+      requestedModel: requested,
+      provider,
+      // What the message route accepts besides (send): the provider's whole
+      // discovered list and the session's own model. Never a list by itself.
+      models: offered ? [...offered, ...extraModels.map(toText).filter(Boolean)] : null,
+      defaultModel: entry?.defaultModel || '',
+      effortsFor: (base) => catalogEffortsFor(catalog?.models, provider, base),
+    });
+    const where = `on relay "${ctx.relay.name}"`;
+    const label = providerModelLabel(provider);
+    if (check.status === 'unknown') {
+      throw new DispatchFailure(400, REMOTE_RELAY_ERROR_CODES.unknownModel,
+        `${unknownProviderModelText({ model: requested, provider, suggestions: check.suggestions, models: check.models, where })} ${creating ? 'No session was created.' : 'Nothing was sent.'}`,
+        {
+          provider,
+          model: requested,
+          suggestions: check.suggestions,
+          models: check.models.slice(0, UNKNOWN_MODEL_LIST_MAX),
+          note: 'Pass one of these ids (relay_info lists them per provider), or leave model out.',
+        });
+    }
+    if (check.status === 'unchecked') {
+      return {
+        model: requested,
+        note: `Model '${requested}' could not be checked: ${label} ${where} has no model list yet (its model discovery has not run or failed), so ${creating ? 'the session was created' : 'the prompt was sent'} with it as asked.`,
+      };
+    }
+    const tierNote = check.tierDropped ? ` ${label} ${where} lists no "[1m]" id for it, so it runs with the standard context.` : '';
+    if (check.status === 'alias') {
+      return { model: check.model, note: `'${requested}' was taken as ${check.model}, the newest ${label} model of that name ${where}.${tierNote}` };
+    }
+    // A Copilot model with its effort: the bootstrap and the message route
+    // know the listed id, so the effort goes on apart.
+    if (check.base) return { model: check.base, effort: check.effort, note: `'${requested}' was taken as ${check.base} with effort ${check.effort}.` };
+    if (check.tierDropped) return { model: check.model, note: `'${requested}' was taken as ${check.model}.${tierNote}` };
+    // The same id in the provider's casing needs no word; another one does.
+    if (check.model.toLowerCase() !== requested.toLowerCase()) {
+      return { model: check.model, note: `'${requested}' is listed as ${check.model} ${where}; that is the model used.` };
+    }
+    return { model: check.model, note: null };
+  }
+
+  /** settleRequestedModel for a send to `conversation` (its detail payload); an unread catalogue leaves it unchecked. */
+  async function settleSendModel(ctx, conversation, requested) {
+    const runtime = isPlainObject(conversation?.runtimeSession) ? conversation.runtimeSession : {};
+    const provider = toText(runtime.providerType).toLowerCase() || 'github';
+    let catalog = null;
+    try {
+      catalog = await loadCatalog(ctx);
+    } catch {
+      // No catalogue: the model goes unchecked, and the note says so.
+    }
+    const settings = catalog?.settings?.[provider];
+    return settleRequestedModel(ctx, catalog, provider, requested, {
+      creating: false,
+      extraModels: [
+        ...(Array.isArray(settings?.availableModels) ? settings.availableModels : []),
+        runtime.providerModel,
+        runtime.model,
+      ],
+    });
   }
 
   async function createSession(ctx, args) {
-    const catalog = await loadCatalog(ctx);
+    const catalog = ctx.catalog || await loadCatalog(ctx);
     const providers = buildProviders(catalog);
     const configured = providers.filter((entry) => entry.configured).map((entry) => entry.provider);
     const provider = createProvider(ctx.caller, args);
@@ -1821,6 +1945,16 @@ export function createRemoteRelayDispatcher({
     let model = args.model || '';
     let modelSource = model ? 'requested' : '';
     let note = null;
+    let variantEffort = '';
+    if (model) {
+      // Refused here when the provider does not offer it: a session created
+      // with an id its provider never runs stays empty, and every send to it
+      // fails.
+      const settled = settleRequestedModel(ctx, catalog, provider, model, { creating: true });
+      model = settled.model;
+      note = settled.note;
+      variantEffort = normalizeEffort(settled.effort);
+    }
     // A cloud session without a requested model gets the Claude Cloud tab's
     // default, as New Chat does: the bootstrap picks it, nothing is mirrored.
     if (!model && cloud) {
@@ -1842,7 +1976,7 @@ export function createRemoteRelayDispatcher({
 
     // The effort mirrors the caller like the model does: this session's when
     // the remote lists it for the model (or lists nothing), else the remote's.
-    let choice = { effort: normalizeEffort(args.effort), source: EFFORT_SOURCES.requested, note: null };
+    let choice = { effort: normalizeEffort(args.effort) || variantEffort, source: EFFORT_SOURCES.requested, note: null };
     if (!choice.effort && cloud) {
       // A cloud session takes no effort: none is mirrored, none is reported.
       choice = { effort: '', source: '', note: null };
@@ -1898,6 +2032,11 @@ export function createRemoteRelayDispatcher({
         `Relay "${ctx.relay.name}" did not return the new session's id.`);
     }
     const boundModel = toText(bootstrap?.selectedModel) || model;
+    // A relay that swapped the asked model for another (one that predates
+    // these checks does for Copilot) is named, never passed over in silence.
+    if (modelSource === 'requested' && model && !isAutoModelId(model) && boundModel.toLowerCase() !== model.toLowerCase()) {
+      note = [note, `Relay "${ctx.relay.name}" started the session on ${boundModel}, not on ${model} as asked.`].filter(Boolean).join(' ');
+    }
     let sent;
     try {
       const posted = await postPromptWithEffort(ctx, { session, text: args.text, origin, model: boundModel, mode }, choice);
@@ -2679,10 +2818,39 @@ export function createRemoteRelayDispatcher({
         { relay: relay.name, retryAfterSeconds }));
     }
 
+    // The target's catalogue, loaded before anyone is asked for approval when
+    // the agent names a model: a card for a model that does not exist there
+    // would be a question about nothing. createSession reuses it.
+    let catalog = null;
+    let settledModel = null;
     if (action === 'create_session') {
       const problem = createSessionProblem(caller, args);
       if (problem) return finish(failure(400, REMOTE_RELAY_ERROR_CODES.invalidInput, problem, { relay: relay.name }));
     }
+    if ((action === 'create_session' || action === 'send') && args.model) {
+      const early = { relay, caller, hops, conversationId, signal };
+      try {
+        if (action === 'create_session') {
+          catalog = await loadCatalog(early);
+          const provider = createProvider(caller, args);
+          // A provider not set up there answers as such (createSession), not
+          // with a model it has no list for.
+          if (listProviders(catalog).find((entry) => entry.provider === provider)?.configured) {
+            settleRequestedModel(early, catalog, provider, args.model, { creating: true });
+          }
+        } else {
+          const conversation = await call(early, 'GET', sessionPath(args.session), { query: { limit: 1 } });
+          settledModel = await settleSendModel(early, conversation, args.model);
+        }
+      } catch (error) {
+        if (error instanceof DispatchFailure) {
+          return finish(failure(error.status, error.code, error.message, { relay: relay.name, ...error.extra }));
+        }
+        // The target did not answer: the call itself reports that.
+        catalog = null;
+        settledModel = null;
+      }
+    }
 
     const localCreate = local && action === 'create_session';
     let holdsLocalCreate = false;
@@ -2756,7 +2924,7 @@ export function createRemoteRelayDispatcher({
         }
       }
 
-      const ctx = { relay, caller, hops, conversationId, signal, onPromptQueued: releaseLocalCreate };
+      const ctx = { relay, caller, hops, conversationId, signal, onPromptQueued: releaseLocalCreate, ...(catalog ? { catalog } : {}), ...(settledModel ? { settledModel } : {}) };
       const body = await ACTIONS[action](ctx, args);
       if (prompting) agentPrompts(conversationId).count += 1;
       const { summary, ...rest } = body;

package/server/services/restart-resume-service.mjs

@@ -0,0 +1,303 @@
+'use strict';
+
+/**
+ * "After a relay restart, tell interrupted sessions to carry on" (opt-in,
+ * per relay, off by default).
+ *
+ * Session workers outlive the relay's runtime, and a turn whose worker lived
+ * through the restart simply goes on. A turn whose worker did not (it died
+ * with the relay, or came back without the turn) is dealt with by the
+ * recovery paths, and most of them requeue it: the row runs again by itself,
+ * and nothing more is needed. A few cannot run again, because the prompt
+ * already reached the agent and a second delivery would run it twice:
+ *
+ *  - a background continuation (a turn the agent opened itself), torn down;
+ *  - a steer the CLI had already taken (`consumed_at`), failed;
+ *  - a turn that had started (activity, a stream) when its live worker no
+ *    longer claimed it, failed instead of replayed (`turn-replay-blocked`).
+ *
+ * The agent never hears that its turn stopped. With the setting on, such a
+ * session gets ONE note of the relay's in the conversation once its rows are
+ * settled: the relay restarted, the turn was interrupted, check what you
+ * were doing and carry on. The user's message is never sent again.
+ *
+ * Which turns count: the rows that were `processing` when this runtime
+ * started (`captureBoot`), followed through the recovery paths
+ * (`noteOutcome`). A row its worker claims after the start (a heartbeat
+ * that lists it: the worker lived through the restart and has the turn) is
+ * the restart's no more: whatever ends it later is not put down to it.
+ * A conversation gets a note when one of its rows was cut off and none was
+ * requeued (that one runs again: a note would double the work), claimed by
+ * a worker that lived through the restart, or failed for another reason.
+ * Nothing for idle sessions, nothing when
+ * the setting is off when the note would be sent, nothing for an archived or
+ * deleted conversation, nothing while a usage-limit follow-up is held (it
+ * carries the turn on itself), at most one note per conversation and
+ * runtime. The note is an ordinary pending row, queued behind whatever the
+ * user has queued already, so it never jumps ahead of a user message; its
+ * delivery starts the session's worker as for any message.
+ */
+
+import { randomUUID } from 'node:crypto';
+
+export const RESTART_RESUME_SETTING_KEY = 'restart_resume_notes';
+export const RESTART_RESUME_KIND = 'relay-restart-resume';
+export const RESTART_RESUME_LEAD = 'Automatic message from OAR, not from the user:';
+
+// How long after the start a cut-off turn is still put down to the restart.
+const DEFAULT_WINDOW_MS = 30 * 60_000;
+
+/** The stored value as on or off; off unless it was switched on. */
+export function readRestartResumeSetting(raw) {
+  return ['1', 'true', 'on'].includes(String(raw ?? '').trim().toLowerCase());
+}
+
+export function parseRestartResumeUpdate(value) {
+  if (typeof value !== 'boolean') return { ok: false, error: 'enabled must be true or false' };
+  return { ok: true, enabled: value };
+}
+
+function defaultFormatTime(ms) {
+  const at = new Date(Number(ms));
+  if (!Number.isFinite(at.getTime())) return 'just now';
+  return `${at.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+}
+
+/** The note's text. */
+export function buildRestartResumeNoteText({ restartedAt, formatTime = defaultFormatTime } = {}) {
+  return `${RESTART_RESUME_LEAD} the relay restarted at ${formatTime(restartedAt)}, and the turn you were working on was interrupted before it finished. `
+    + 'Check where you were (the files you changed, the commands and background tasks you started) and carry on from there. '
+    + 'Do not repeat steps that already completed; if the work was already done, say so briefly.';
+}
+
+const OUTCOMES = new Set(['cut', 'requeued', 'failed', 'claimed']);
+
+function text(value) {
+  return String(value ?? '').trim();
+}
+
+export function createRestartResumeService({
+  db,
+  stmts,
+  isEnabled = () => false,
+  emit = () => {},
+  wake = () => {},
+  now = () => Date.now(),
+  bootAt = now(),
+  windowMs = DEFAULT_WINDOW_MS,
+  formatTime = defaultFormatTime,
+  logger = console,
+} = {}) {
+  if (!db || !stmts) throw new Error('createRestartResumeService requires db and stmts');
+  const listProcessing = db.prepare(`
+    SELECT id, conversation_id, model, model_variant_id, reasoning_effort, context_tier, relay_mode,
+           owner_sdk_session_id, runtime_session_id
+    FROM queue WHERE status = 'processing'
+  `);
+  const statusOf = db.prepare(`SELECT status FROM queue WHERE id = ?`);
+  let heldPause = null;
+  try {
+    // A held usage-limit follow-up (usage-limit-pause-service.mjs).
+    heldPause = db.prepare(`
+      SELECT 1 FROM queue
+      WHERE conversation_id = ? AND status = 'pending' AND usage_limit_pause IS NOT NULL
+      LIMIT 1
+    `);
+  } catch {}
+
+  // queue id → conversation id, for the rows processing at the start.
+  const watched = new Map();
+  // conversation id → { rows: Map(queue id → { row, outcome }) }
+  const conversations = new Map();
+  // Conversations that had their note in this runtime.
+  const noted = new Set();
+
+  function log(line) {
+    try { logger?.log?.(`[restart-resume] ${line}`); } catch {}
+  }
+
+  function expired() {
+    return now() - bootAt > windowMs;
+  }
+
+  /** The rows processing when this runtime started; returns how many. */
+  function captureBoot() {
+    let rows = [];
+    try { rows = listProcessing.all(); } catch {}
+    for (const row of rows) {
+      const conversationId = text(row.conversation_id);
+      const id = text(row.id);
+      if (!conversationId || !id) continue;
+      watched.set(id, conversationId);
+      let entry = conversations.get(conversationId);
+      if (!entry) conversations.set(conversationId, entry = { rows: new Map() });
+      entry.rows.set(id, { row, outcome: null });
+    }
+    if (rows.length) log(`${rows.length} turn(s) were running when the relay started; following them`);
+    return rows.length;
+  }
+
+  /**
+   * What a recovery path did with a row: `cut` (it cannot run again),
+   * `requeued` (it runs again by itself) or `failed` (ended for another
+   * reason); or `claimed`: its worker, alive after the restart, holds it.
+   * Only the rows of the start count, and only their first outcome.
+   */
+  function noteOutcome(row, outcome) {
+    const id = text(row?.id ?? row);
+    const conversationId = watched.get(id);
+    if (!conversationId || !OUTCOMES.has(outcome)) return false;
+    watched.delete(id);
+    const entry = conversations.get(conversationId)?.rows.get(id);
+    if (entry && !entry.outcome) entry.outcome = outcome;
+    settle(conversationId);
+    return true;
+  }
+
+  // Decides a conversation once none of its rows of the start is processing.
+  function settle(conversationId) {
+    const entry = conversations.get(conversationId);
+    if (!entry) return;
+    for (const [id, item] of entry.rows) {
+      if (item.outcome) continue;
+      let status = '';
+      try { status = text(statusOf.get(id)?.status).toLowerCase(); } catch {}
+      if (status === 'processing') return;
+      // Back in the queue by a path that did not say so: it runs again.
+      item.outcome = status === 'pending' || status === 'parked' ? 'requeued' : 'settled';
+      watched.delete(id);
+    }
+    conversations.delete(conversationId);
+    const outcomes = [...entry.rows.values()].map((item) => item.outcome);
+    if (!outcomes.includes('cut')) return;
+    if (outcomes.includes('requeued')) {
+      log(`conv=${conversationId.slice(0, 8)} no note: the interrupted turn runs again by itself`);
+      return;
+    }
+    if (outcomes.includes('claimed')) {
+      log(`conv=${conversationId.slice(0, 8)} no note: its worker lived through the restart and has its turn`);
+      return;
+    }
+    if (outcomes.includes('failed')) {
+      log(`conv=${conversationId.slice(0, 8)} no note: the turn failed, the failure says what to do`);
+      return;
+    }
+    const cut = [...entry.rows.values()].find((item) => item.outcome === 'cut')?.row || null;
+    sendNote(conversationId, cut);
+  }
+
+  function skip(conversationId, why) {
+    log(`conv=${conversationId.slice(0, 8)} no note: ${why}`);
+    return null;
+  }
+
+  function sendNote(conversationId, cutRow) {
+    if (noted.has(conversationId)) return skip(conversationId, 'it had one after this restart');
+    let enabled = false;
+    try { enabled = isEnabled() === true; } catch {}
+    if (!enabled) return skip(conversationId, 'the setting is off');
+    const conversation = stmts.getConvAnyStatus?.get?.(conversationId) || null;
+    if (!conversation || text(conversation.status) === 'deleted') return skip(conversationId, 'the conversation is gone');
+    if (Number(conversation.archived) === 1) return skip(conversationId, 'the conversation is archived');
+    try {
+      if (heldPause?.get(conversationId)) return skip(conversationId, 'a usage-limit follow-up carries the turn on');
+    } catch {}
+    noted.add(conversationId);
+
+    const at = new Date(now()).toISOString();
+    const messageId = randomUUID();
+    const noteText = buildRestartResumeNoteText({ restartedAt: bootAt, formatTime });
+    const runtimeSession = stmts.getRuntimeSessionByConversation?.get?.(conversationId) || null;
+    const latestModel = stmts.getLatestConversationModel?.get?.(conversationId)?.model || null;
+    // The model and mode the interrupted turn ran with.
+    const model = text(cutRow?.model) || text(latestModel) || text(runtimeSession?.provider_model) || text(runtimeSession?.model) || null;
+    const modelVariant = text(cutRow?.model_variant_id) || model;
+    const relayMode = text(cutRow?.relay_mode) || 'agent';
+    const owner = text(cutRow?.owner_sdk_session_id) || text(runtimeSession?.sdk_session_id) || null;
+    const write = db.transaction(() => {
+      stmts.insertMsg.run(
+        messageId,
+        conversationId,
+        'user',
+        noteText,
+        modelVariant || null,
+        relayMode,
+        null,
+        at,
+        modelVariant || null,
+        null,
+        text(modelVariant).toLowerCase() === 'auto' ? 'auto' : 'manual',
+      );
+      stmts.setMessageKind?.run?.(RESTART_RESUME_KIND, messageId);
+      stmts.updateConvTime?.run?.(at, conversationId);
+      const queueArgs = [
+        messageId,
+        conversationId,
+        text(cutRow?.runtime_session_id) || runtimeSession?.id || null,
+        0,
+        model,
+        modelVariant || null,
+        text(cutRow?.reasoning_effort) || null,
+        text(cutRow?.context_tier) || null,
+        relayMode,
+        noteText,
+        null,
+        at,
+        owner,
+        owner ? at : null,
+        null,
+        null,
+      ];
+      if (stmts.queueHasImageOperationId || stmts.insertQ?.source?.includes?.('image_operation_id')) queueArgs.push(null);
+      stmts.insertQ.run(...queueArgs);
+    });
+    try {
+      write();
+    } catch (error) {
+      noted.delete(conversationId);
+      try { logger?.warn?.(`[restart-resume] conv=${conversationId.slice(0, 8)} note not queued: ${error?.message || error}`); } catch {}
+      return null;
+    }
+    try {
+      emit('user_message', {
+        conversationId,
+        messageId,
+        senderClientId: null,
+        message: {
+          role: 'user',
+          text: noteText,
+          model: modelVariant || null,
+          mode: relayMode,
+          attachments: [],
+          timestamp: at,
+          kind: RESTART_RESUME_KIND,
+        },
+      });
+    } catch {}
+    try { emit('message_status', { messageId, conversationId, status: 'pending' }); } catch {}
+    try { wake({ conversationId, ownerSessionId: owner, messageId }); } catch {}
+    log(`conv=${conversationId.slice(0, 8)} note queued: its turn was cut off by the restart`);
+    return messageId;
+  }
+
+  /** Decides the conversations whose rows settled on their own; ends the watch after the window. */
+  function tick() {
+    if (!conversations.size) return;
+    if (expired()) {
+      watched.clear();
+      conversations.clear();
+      return;
+    }
+    for (const conversationId of [...conversations.keys()]) settle(conversationId);
+  }
+
+  return {
+    captureBoot,
+    noteOutcome,
+    tick,
+    /** What is still followed, for tests and diagnostics. */
+    pending() {
+      return [...conversations.keys()];
+    },
+  };
+}

package/server/services/session-worker-process-service.mjs

@@ -296,6 +296,8 @@ export function createSessionWorkerProcessInspector({
   platform = process.platform,
   execFileSyncImpl = execFileSync,
   execFileImpl = execFile,
+  // Where Windows keeps PowerShell (the bare name when it is not there).
+  systemToolPath = windowsSystemToolPath,
   now = () => Date.now(),
   snapshotCacheMs = SNAPSHOT_CACHE_MS,
   slowReadMs = SLOW_READ_MS,
@@ -320,7 +322,7 @@ export function createSessionWorkerProcessInspector({
 
   function getWindowsProcessSnapshot() {
     if (platform !== 'win32') return [];
-    const output = execFileSyncImpl(windowsSystemToolPath('powershell.exe'), ['-NoProfile', '-Command', WINDOWS_PROCESS_SNAPSHOT_SCRIPT], {
+    const output = execFileSyncImpl(systemToolPath('powershell.exe'), ['-NoProfile', '-Command', WINDOWS_PROCESS_SNAPSHOT_SCRIPT], {
       // stderr is kept (not shown): a failed read reports it.
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,
@@ -376,7 +378,7 @@ export function createSessionWorkerProcessInspector({
     if (platform !== 'win32') return Promise.resolve([]);
     return new Promise((resolve, reject) => {
       execFileImpl(
-        windowsSystemToolPath('powershell.exe'),
+        systemToolPath('powershell.exe'),
         ['-NoProfile', '-Command', WINDOWS_PROCESS_SNAPSHOT_SCRIPT],
         { windowsHide: true, timeout: WINDOWS_PROCESS_SNAPSHOT_TIMEOUT_MS, maxBuffer: WINDOWS_PROCESS_SNAPSHOT_MAX_BUFFER },
         (error, stdout, stderr) => {
@@ -545,7 +547,7 @@ export function createSessionWorkerProcessInspector({
   function stopWindowsPids(pids) {
     const ids = uniquePids(pids);
     if (!ids.length) return [];
-    execFileSyncImpl(windowsSystemToolPath('powershell.exe'), ['-NoProfile', '-Command', buildStopWindowsPidsScript(ids)], {
+    execFileSyncImpl(systemToolPath('powershell.exe'), ['-NoProfile', '-Command', buildStopWindowsPidsScript(ids)], {
       stdio: ['ignore', 'ignore', 'ignore'],
     });
     return ids;
@@ -557,7 +559,7 @@ export function createSessionWorkerProcessInspector({
     if (!ids.length) return Promise.resolve([]);
     return new Promise((resolve, reject) => {
       execFileImpl(
-        windowsSystemToolPath('powershell.exe'),
+        systemToolPath('powershell.exe'),
         ['-NoProfile', '-Command', buildStopWindowsPidsScript(ids)],
         { windowsHide: true, timeout: WINDOWS_STOP_TIMEOUT_MS, maxBuffer: WINDOWS_PROCESS_SNAPSHOT_MAX_BUFFER },
         (error) => {