@oar-sh/oar 0.9.12 → 0.9.14

package/server/routes/preview-routes.mjs

@@ -4,9 +4,46 @@
 // listener itself has no routes and no way to register anything. Creating or
 // closing a preview therefore always requires the relay token, even though the
 // resulting URL is public.
+//
+// Conversation scope. A preview's token is its only credential, so an agent's
+// preview tool must not see or close another conversation's. A request that
+// names a conversation — the `conversationId` query, else the
+// `X-Relay-Conversation-Id` header every worker and the OAR MCP server send —
+// is scoped to it: GET lists only its previews, DELETE refuses another
+// conversation's with a 403. Only a request with neither (the web UI's
+// Settings → Previews) gets the relay-wide view. Agent-side callers present the
+// same relay token as the owner, so this is a boundary for the tools, not
+// against a caller that deliberately leaves both out.
 
 import { validateStaticRoot } from '../services/preview-static-handler.mjs';
 
+/**
+ * The conversation ids a named scope covers: the id itself, and — when it
+ * names a conversation by its id or by its session id — that conversation's id
+ * and session id. They differ after a placeholder rekey, and a worker's or
+ * tool server's own identity is the session id. A lookup that fails narrows
+ * the scope to the named id rather than failing the request.
+ */
+export function createPreviewScopeResolver({
+  getConversation = () => null,
+  getConversationBySdkSessionId = () => null,
+} = {}) {
+  return function resolveConversationScope(id) {
+    const named = String(id || '').trim();
+    if (!named) return [];
+    const ids = new Set([named]);
+    let conversation = null;
+    try {
+      conversation = getConversation(named) || getConversationBySdkSessionId(named) || null;
+    } catch {}
+    for (const value of [conversation?.id, conversation?.sdk_session_id]) {
+      const text = String(value || '').trim();
+      if (text) ids.add(text);
+    }
+    return [...ids];
+  };
+}
+
 export function registerPreviewRoutes(app, deps) {
   const {
     auth,
@@ -20,6 +57,8 @@ export function registerPreviewRoutes(app, deps) {
     // publishes stay panel-only — the transcript records the conversation, not
     // panel actions).
     recordPreviewCard = () => {},
+    // (scope id) => the conversation ids it covers; createPreviewScopeResolver.
+    resolveConversationScope = (id) => (id ? [id] : []),
   } = deps;
 
   function laneUnavailable(res) {
@@ -36,13 +75,27 @@ export function registerPreviewRoutes(app, deps) {
     });
   }
 
-  // GET /api/previews — every live preview, or one conversation's when filtered.
-  // Unfiltered is what the settings "Live previews" list uses: nothing expires
-  // on its own, so there has to be one place that shows everything.
+  // The conversation ids a request is scoped to, or null for the owner's
+  // view. The query wins over the header: the header is the worker's own
+  // session, while a worker can be handed a row of another conversation (a
+  // placeholder rekey, or the shared fallback of the worker's pending lookup)
+  // and its tool names the conversation of the turn it is running.
+  function requestScope(req) {
+    const named = String(req.query?.conversationId || '').trim()
+      || String(req.headers?.['x-relay-conversation-id'] || '').trim();
+    if (!named) return null;
+    const ids = resolveConversationScope(named);
+    return Array.isArray(ids) && ids.length ? ids : [named];
+  }
+
+  // GET /api/previews — one conversation's live previews when scoped (see the
+  // top of the file), else every one. Unscoped is what the settings "Live
+  // previews" list uses: nothing expires on its own, so there has to be one
+  // place that shows everything.
   app.get('/api/previews', auth, (req, res) => {
-    const conversationId = String(req.query?.conversationId || '').trim();
-    const previews = conversationId
-      ? previewRegistry.listForConversation(conversationId)
+    const scope = requestScope(req);
+    const previews = scope
+      ? previewRegistry.list().filter((entry) => scope.includes(entry.conversationId))
       : previewRegistry.list();
     res.json({
       previews,
@@ -107,8 +160,21 @@ export function registerPreviewRoutes(app, deps) {
   });
 
   // DELETE /api/previews/:token — the link stops resolving immediately. The dev
-  // server behind it is untouched; it is a separate background task.
+  // server behind it is untouched; it is a separate background task. A scoped
+  // request may close only its own conversation's previews.
   app.delete('/api/previews/:token', auth, (req, res) => {
+    const scope = requestScope(req);
+    if (scope) {
+      const token = String(req.params?.token || '').trim();
+      // list() also holds the stored previews a restart could not check yet.
+      const target = previewRegistry.list().find((entry) => entry.token === token);
+      if (target && !scope.includes(target.conversationId)) {
+        return res.status(403).json({
+          error: 'This preview belongs to another conversation; a conversation can close only its own previews. '
+            + 'The owner can close it in Settings → Previews.',
+        });
+      }
+    }
     const closed = previewRegistry.close(req.params?.token);
     if (!closed.ok) return res.status(closed.status || 404).json({ error: closed.error });
     res.json({ ok: true, preview: closed.preview });

package/server/routes/relay-board-routes.mjs

@@ -1,6 +1,7 @@
 'use strict';
 
 import { persistConversationPreferences } from '../services/conversation-preferences-service.mjs';
+import { fallbackReasoningEffort } from '../services/conversation-model-fallback.mjs';
 
 function normalizeId(value) {
   const text = String(value || '').trim();
@@ -93,12 +94,28 @@ export function registerRelayBoardRoutes(app, deps) {
     uuidv4,
     normalizeRelayMode,
     resolveRequestedModel,
+    resolveRequestedReasoningEffort,
     DEFAULT_RELAY_MODE,
     DEFAULT_MODEL,
     formatRelayBoardRow,
     pushDispatchService,
   } = deps;
 
+  /**
+   * The effort the follow-up runs with when the model id carries none: the
+   * conversation's own, clamped to the levels the model has. A model the
+   * catalog cannot check (another provider's) takes it as it is.
+   */
+  function conversationEffortFor(conversationId, model) {
+    const preferred = String(stmts.getConvAnyStatus?.get?.(conversationId)?.preferred_reasoning_effort || '').trim().toLowerCase();
+    if (!preferred) return null;
+    if (typeof resolveRequestedReasoningEffort !== 'function') return preferred;
+    const check = resolveRequestedReasoningEffort(model, preferred);
+    if (check?.ok) return String(check.effort || '').trim() || null;
+    const supported = Array.isArray(check?.supported) ? check.supported : [];
+    return supported.length ? (fallbackReasoningEffort([preferred], supported) || null) : preferred;
+  }
+
   /**
    * The session goes on in the mode that was chosen on the board: after
    * "Implement in autopilot" the composer says Autopilot, and the next message
@@ -250,9 +267,9 @@ export function registerRelayBoardRoutes(app, deps) {
         const resolvedVariantModel = modelResolution?.ok
           ? String(modelResolution.modelVariantId || latestModel || resolvedBaseModel).trim()
           : String(latestModel || resolvedBaseModel).trim();
-        const resolvedReasoningEffort = modelResolution?.ok
+        const resolvedReasoningEffort = (modelResolution?.ok
           ? String(modelResolution.reasoningEffort || '').trim() || null
-          : null;
+          : null) || conversationEffortFor(convId, resolvedBaseModel);
         queuedMessageId = uuidv4();
         stmts.insertMsg.run(
           queuedMessageId,

package/server/routes/relay-restart-routes.mjs

@@ -0,0 +1,73 @@
+'use strict';
+
+// The queued relay restart beyond queueing and cancelling it (those two are
+// POST /api/relay/shutdown and /api/relay/shutdown/cancel in
+// messages-routes.mjs): what a restart would wait for and leave running, the
+// "keep waiting" answer to the max-wait question, and the max-wait setting
+// (services/relay-restart-queue.mjs). Token only, like the restart itself.
+
+import {
+  DEFAULT_RELAY_RESTART_MAX_WAIT_MINUTES,
+  RELAY_RESTART_MAX_WAIT_CHOICES,
+  parseRelayRestartMaxWaitUpdate,
+} from '../services/relay-restart-queue.mjs';
+
+function requestedByOf(req) {
+  return String(req.body?.requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
+}
+
+export function registerRelayRestartRoutes(app, {
+  auth,
+  getState = null,
+  collectRestartPicture = null,
+  keepWaiting = null,
+  getMaxWaitMinutes = () => DEFAULT_RELAY_RESTART_MAX_WAIT_MINUTES,
+  setMaxWaitMinutes = null,
+  maxWaitOverrideMs = null,
+} = {}) {
+  // The queued request's state, and with `?action=` the picture for a
+  // restart or shutdown asked now (the confirmation reads it first).
+  app.get('/api/relay/shutdown', auth, (req, res) => {
+    if (typeof getState !== 'function') {
+      return res.status(501).json({ error: 'Relay shutdown orchestration is unavailable' });
+    }
+    const state = getState();
+    const action = String(req.query?.action || 'restart').trim().toLowerCase() === 'shutdown' ? 'shutdown' : 'restart';
+    let preview = null;
+    if (typeof collectRestartPicture === 'function') {
+      try { preview = { action, ...collectRestartPicture({ action }) }; } catch {}
+    }
+    return res.json({ ok: true, ...state, preview });
+  });
+
+  app.post('/api/relay/shutdown/keep-waiting', auth, (req, res) => {
+    if (typeof keepWaiting !== 'function') {
+      return res.status(501).json({ error: 'Relay shutdown orchestration is unavailable' });
+    }
+    return res.json({ ok: true, ...keepWaiting({ requestedBy: requestedByOf(req) }) });
+  });
+
+  const settingPayload = (maxWaitMinutes) => ({
+    ok: true,
+    maxWaitMinutes,
+    choices: [...RELAY_RESTART_MAX_WAIT_CHOICES],
+    defaultMinutes: DEFAULT_RELAY_RESTART_MAX_WAIT_MINUTES,
+    // A test relay's environment override wins over the stored value.
+    overrideMs: maxWaitOverrideMs,
+  });
+
+  app.get('/api/settings/relay-restart-max-wait', auth, (_req, res) => {
+    res.json(settingPayload(getMaxWaitMinutes()));
+  });
+
+  app.post('/api/settings/relay-restart-max-wait', auth, (req, res) => {
+    const parsed = parseRelayRestartMaxWaitUpdate(req.body?.maxWaitMinutes);
+    if (!parsed.ok) return res.status(400).json({ ok: false, error: parsed.error });
+    if (typeof setMaxWaitMinutes !== 'function') {
+      return res.status(503).json({ ok: false, error: 'Relay restart settings are unavailable' });
+    }
+    const result = setMaxWaitMinutes(parsed.minutes);
+    if (!result?.ok) return res.status(500).json({ ok: false, error: result?.error || 'Saving failed' });
+    return res.json(settingPayload(result.maxWaitMinutes));
+  });
+}

package/server/routes/sessions-routes.mjs

@@ -24,7 +24,13 @@ import {
 } from '../../shared/claude-background-command-limit.mjs';
 import { CLAUDE_ATTRIBUTION_MODES, DEFAULT_CLAUDE_ATTRIBUTION_MODE, claudeAttributionModelLabel, claudeAttributionTrailer, normalizeClaudeAttributionMode, resolveClaudeAttributionMode } from '../../shared/claude-attribution.mjs';
 import { parseThinkingDisplay, parseThinkingEnabled } from '../../shared/claude-thinking.mjs';
-import { isProviderModelAvailable, resolveProviderModelSelection } from '../services/provider-model-selection.mjs';
+import {
+  checkRequestedProviderModel,
+  isAutoModelId,
+  isProviderModelAvailable,
+  resolveProviderModelSelection,
+  unknownProviderModelText,
+} from '../services/provider-model-selection.mjs';
 import {
   DEFAULT_CLAUDE_REASONING_EFFORTS,
   resolveProviderReasoningEffort,
@@ -117,6 +123,7 @@ import {
   PWA_APP_NAME_MAX_LENGTH,
   derivePwaShortName,
 } from '../../shared/pwa-app-name.mjs';
+import { parseRestartResumeUpdate } from '../services/restart-resume-service.mjs';
 
 export { mapUsageSnapshotRow };
 
@@ -2139,6 +2146,8 @@ export function registerSessionsRoutes(app, deps) {
     setBackgroundTaskTimeoutMinutes = () => ({ ok: false, error: 'Background task timeout settings are unavailable' }),
     getTaskStallMinutes = () => DEFAULT_TASK_STALL_MINUTES,
     setTaskStallMinutes = () => ({ ok: false, error: 'Task stall settings are unavailable' }),
+    getRestartResumeEnabled = () => false,
+    setRestartResumeEnabled = () => ({ ok: false, error: 'Restart settings are unavailable' }),
     markSharedViewerPresence,
     getSharedWatcherCount,
     statusEventService,
@@ -4023,8 +4032,10 @@ export function registerSessionsRoutes(app, deps) {
   // then nothing is shared.
   function collectSharePreviewTokens(conversationId) {
     const tokens = new Set();
-    // Every preview of the relay, not only this conversation's: the preview
-    // tool's list covers them all, and a reply may quote any of its tokens.
+    // Every preview of the relay, not only this conversation's: a reply may
+    // quote any token its agent got hold of — one the user pasted from
+    // Settings → Previews, or a relay-wide list fetched by hand with the relay
+    // token (the preview tool's own list is scoped to its conversation).
     try {
       for (const knownToken of listKnownPreviewTokens?.() || []) tokens.add(String(knownToken));
     } catch {
@@ -5792,6 +5803,55 @@ export function registerSessionsRoutes(app, deps) {
         supportedModels: providerModelSelection.availableModels || [],
       });
     }
+    // Copilot falls back to the catalogue's current model for an id it does
+    // not list, which New Chat (it only offers listed ids) never meets. An
+    // agent naming a mistyped id ("gpt-5-4") would get a session on another
+    // model than it asked for, or one its next send cannot reach: refused.
+    // A listed id is bound in the list's casing, and one with its effort
+    // ("gpt-5.4-high") as the listed id plus that effort: the catalogue
+    // lookup below knows exact base ids only and would fall back too.
+    let copilotBoundModel = '';
+    let copilotVariantEffort = '';
+    if (
+      remoteRequest.remote
+      && !useClaudeCloudProvider && !useOpenAIProvider && !useClaudeProvider && !useCursorProvider && !useGrokProvider
+    ) {
+      const mergedModels = Array.isArray(modelState?.models) ? modelState.models : [];
+      const providersByModel = modelState?.providersByModel && typeof modelState.providersByModel === 'object'
+        ? modelState.providersByModel
+        : {};
+      // Copilot's own: listed for it, or for no provider in particular.
+      const copilotModels = mergedModels.filter((modelId) => {
+        const providers = providersByModel[String(modelId || '').trim().toLowerCase()];
+        return !Array.isArray(providers) || providers.length === 0
+          || providers.some((provider) => String(provider || '').trim().toLowerCase() === 'github-copilot');
+      });
+      const reasoningByModel = modelState?.reasoningByModel && typeof modelState.reasoningByModel === 'object'
+        ? modelState.reasoningByModel
+        : {};
+      const copilotCheck = checkRequestedProviderModel({
+        requestedModel: requestedBootstrapModel,
+        provider: 'github',
+        models: copilotModels,
+        effortsFor: (base) => reasoningByModel[base] || reasoningByModel[String(base).toLowerCase()] || null,
+      });
+      // Another provider's model is answered by the checks below ("requires
+      // the Claude provider"), not as an unknown one.
+      const otherProviders = mergedModels.some((modelId) => String(modelId || '').trim().toLowerCase() === requestedBootstrapModel.toLowerCase());
+      if (copilotCheck.status === 'known' && copilotCheck.model && !isAutoModelId(copilotCheck.model)) {
+        copilotBoundModel = copilotCheck.base || copilotCheck.model;
+        copilotVariantEffort = copilotCheck.effort || '';
+      }
+      if (copilotCheck.status === 'unknown' && !otherProviders) {
+        return res.status(400).json({
+          ok: false,
+          error: unknownProviderModelText({ model: copilotCheck.model, provider: 'github', suggestions: copilotCheck.suggestions, models: copilotCheck.models }),
+          code: 'COPILOT_MODEL_UNAVAILABLE',
+          supportedModels: copilotCheck.models,
+          ...(copilotCheck.suggestions.length ? { suggestedModels: copilotCheck.suggestions } : {}),
+        });
+      }
+    }
     if (useOpenAIProvider && openAISettings?.configured !== true) {
       return res.status(400).json({
         ok: false,
@@ -5842,7 +5902,7 @@ export function registerSessionsRoutes(app, deps) {
       bootstrapWorkspaceRootPath = validatedRoot.realPath;
     }
 
-    const selectedModel = providerModelSelection ? providerModelSelection.model : catalogSelectedModel;
+    const selectedModel = providerModelSelection ? providerModelSelection.model : (copilotBoundModel || catalogSelectedModel);
     if (requestedProviderType === 'openai-image' && !isOpenAIImageModelId(selectedModel)) {
       return res.status(400).json({
         ok: false,
@@ -5914,7 +5974,7 @@ export function registerSessionsRoutes(app, deps) {
     // first send would apply, so the composer can restore it from the server
     // instead of guessing from localStorage.
     const bootstrapReasoning = resolveProviderReasoningEffort({
-      requestedEffort: req.body?.reasoningEffort,
+      requestedEffort: req.body?.reasoningEffort || copilotVariantEffort,
       strict: bootstrapProviderType === 'openai',
       supportedEfforts: supportedReasoningEffortsForProviderModel({
         providerType: bootstrapProviderType,
@@ -7145,6 +7205,20 @@ export function registerSessionsRoutes(app, deps) {
     return res.json(taskStallMinutesPayload(result.minutes));
   });
 
+  // "After a relay restart, tell interrupted sessions to carry on"
+  // (restart_resume_notes, off by default; services/restart-resume-service.mjs).
+  app.get('/api/settings/restart-resume', auth, (_req, res) => {
+    res.json({ enabled: getRestartResumeEnabled() === true, default: false });
+  });
+
+  app.post('/api/settings/restart-resume', auth, (req, res) => {
+    const parsed = parseRestartResumeUpdate(req.body?.enabled);
+    if (!parsed.ok) return res.status(400).json({ error: parsed.error });
+    const result = setRestartResumeEnabled(parsed.enabled);
+    if (!result.ok) return res.status(500).json({ error: result.error });
+    return res.json({ enabled: result.enabled, default: false });
+  });
+
   const pwaAppNamePayload = (appName) => ({
     appName,
     defaultName: PWA_APP_NAME_DEFAULT,