@oar-sh/oar 0.9.12 → 0.9.14

package/server/server-runtime.mjs

@@ -42,7 +42,7 @@ import { registerRelayBoardRoutes } from './routes/relay-board-routes.mjs';
 import { registerCacheRoutes } from './routes/cache-routes.mjs';
 import { registerGitRoutes } from './routes/git-routes.mjs';
 import { registerClaudeCloudRoutes } from './routes/claude-cloud-routes.mjs';
-import { registerPreviewRoutes } from './routes/preview-routes.mjs';
+import { createPreviewScopeResolver, registerPreviewRoutes } from './routes/preview-routes.mjs';
 import { registerRemoteRelayRoutes } from './routes/remote-relay-routes.mjs';
 import { registerRelayEventRoutes } from './routes/relay-event-routes.mjs';
 import { createRemoteRelayRepository } from './repositories/remote-relay-repository.mjs';
@@ -75,6 +75,13 @@ import { createHostSuspendService } from './services/host-suspend-service.mjs';
 import { USAGE_LIMIT_ACCOUNT_SOCKET_EVENT, createUsageLimitPauseService } from './services/usage-limit-pause-service.mjs';
 import { createSessionActivityTracker, resolveBootReportingWindowMs } from './services/session-activity-tracker.mjs';
 import { createBackgroundTaskStore } from './services/background-task-store.mjs';
+import { createSqliteBackgroundTaskPersistence } from './services/background-task-persistence.mjs';
+import {
+  RESTART_RESUME_SETTING_KEY,
+  createRestartResumeService,
+  parseRestartResumeUpdate,
+  readRestartResumeSetting,
+} from './services/restart-resume-service.mjs';
 import { createBackgroundWorkView } from './services/background-work-view.mjs';
 import { createRelayEventService } from './services/relay-event-service.mjs';
 import { createRelayEventLinkService } from './services/relay-event-link-service.mjs';
@@ -90,6 +97,7 @@ import { runHostSuspendToRam } from './services/host-suspend-command.mjs';
 import { createActiveDeviceTracker } from './services/push-active-device-service.mjs';
 import { registerPushRoutes } from './routes/push-routes.mjs';
 import { registerAboutRoutes } from './routes/about-routes.mjs';
+import { registerRelayRestartRoutes } from './routes/relay-restart-routes.mjs';
 import { createAboutService, resolveBuildCommit } from './services/about-service.mjs';
 import { createImageOperationService } from './services/image-operation-service.mjs';
 import {
@@ -116,7 +124,9 @@ import { createClaudeSessionRootResolver } from './services/claude-session-root-
 import { createCursorSessionRootResolver } from './services/cursor-session-root-service.mjs';
 import { createGitChangesService } from './services/git-changes-service.mjs';
 import { createRelaySingletonGuard } from './services/relay-singleton-guard.mjs';
-import { resolveDataDir } from './services/data-dir-resolution.mjs';
+import { adoptEarlierDatabase, lostPackageDatabaseWarning, packageDatabaseEvidence } from './services/earlier-database-service.mjs';
+import { ensureDataDirs, resolveDataDir, resolveUploadDir, resolveUploadReadDirs, uploadPathInDirs } from './services/data-dir-resolution.mjs';
+import { mergeStrayMigratedUploads } from './services/oar-state-migration-service.mjs';
 import { createRelayRestartOrchestrator } from './services/relay-restart-orchestrator-service.mjs';
 import { createRelayBridgeOwnerService } from './services/relay-bridge-owner-service.mjs';
 import { createRelayCliLauncherService } from './services/relay-cli-launcher-service.mjs';
@@ -165,7 +175,7 @@ import {
   migrateLegacyConfigFeatures,
   resolveBootFeatureFlags,
 } from './features.mjs';
-import { RELAY_RESTART_EXIT_CODE } from './relay-exit-codes.mjs';
+import { RELAY_RESTART_EXIT_CODE, RELAY_STOP_EXIT_CODE } from './relay-exit-codes.mjs';
 import { DEFAULT_QUESTION_TIMEOUT_MS, questionExpiresAt } from '../shared/question-timeout.mjs';
 import {
   parseTurnCeilingUpdate,
@@ -183,8 +193,17 @@ import {
   parseSharePathPrivacyUpdate,
   readSharePathPrivacySetting,
 } from '../shared/share-path-privacy.mjs';
-import { isRelayShutdownQueued, queuedShutdownCanProceed, relayShutdownGateReply } from './services/relay-shutdown-gate.mjs';
+import { isRelayShutdownQueued, relayShutdownGateReply } from './services/relay-shutdown-gate.mjs';
+import {
+  createRelayRestartQueue,
+  parseRelayRestartMaxWaitUpdate,
+  readRelayRestartMaxWaitSetting,
+  resolveRelayRestartMaxWaitOverrideMs,
+  RELAY_RESTART_MAX_WAIT_SETTING_KEY,
+} from './services/relay-restart-queue.mjs';
+import { createRestartPictureCollector } from './services/relay-restart-picture.mjs';
 import { createStaleRecoveryClockGuard } from './services/stale-recovery-clock-guard.mjs';
+import { createStaleTurnRecovery } from './services/stale-turn-recovery.mjs';
 import {
   STALE_SUBAGENT_RUN_BOOT_DELAY_MS,
   STALE_SUBAGENT_RUN_SWEEP_INTERVAL_MS,
@@ -232,7 +251,7 @@ import {
 import { createModelVariantCatalogService } from './services/model-variant-catalog-service.mjs';
 import { applyPwaManifestTheme, normalizePwaTheme } from './services/pwa-manifest-theme.mjs';
 import { mapSubagentRunHeader } from './services/subagent-timeline-service.mjs';
-import { describeExecError, describeSpawnEnvironment, windowsSystemToolPath } from '../shared/windows-system-tools.mjs';
+import { describeExecError, describeSpawnEnvironment, normalizeTempEnv, windowsSystemToolPath } from '../shared/windows-system-tools.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = path.resolve(__dirname, '..');
@@ -263,9 +282,8 @@ const APP_CONFIG_PLACEHOLDER = /window\.__COPILOT_APP_CONFIG = \{ basePath: '[^'
 const PWA_VERSION_PLACEHOLDER = /const __PWA_VERSION = '[^']*';/;
 // The console goes to a terminal, a tmux pane or nowhere: keep a copy to read
 // after a restart or an incident.
-const relayConsoleLog = installRelayConsoleLog({
-  logPath: resolveRelayConsoleLogPath({ env: process.env, serverDir: __dirname }),
-});
+const relayConsoleLogPath = resolveRelayConsoleLogPath({ env: process.env, serverDir: __dirname });
+const relayConsoleLog = installRelayConsoleLog({ logPath: relayConsoleLogPath });
 const ttyConsoleRuntime = await maybeStartTtyConsole({
   serverDir: __dirname,
   logsDir: path.join(__dirname, 'logs'),
@@ -273,6 +291,8 @@ const ttyConsoleRuntime = await maybeStartTtyConsole({
 });
 // The terminal console takes the console's methods over when it starts.
 relayConsoleLog?.rewrap();
+// TEMP and TMP for this relay and everything it starts (normalizeTempEnv).
+for (const change of normalizeTempEnv()) console.log(`[startup] ${change} (quotes taken off, or the folder is not there)`);
 
 // ─── Config ────────────────────────────────────────────────────────────────────
 const CONFIG_PATH    = process.env.COPILOT_WEB_RELAY_CONFIG
@@ -280,26 +300,32 @@ const CONFIG_PATH    = process.env.COPILOT_WEB_RELAY_CONFIG
   : path.join(__dirname, 'config.json');
 // env var > config.json `dataDir` > <server>/data — see data-dir-resolution.mjs
 // for why the config can carry it (a dev checkout pointing at a release
-// install's data, and autostart launchers that only pin the config path).
+// install's data).
 const DATA_DIR = resolveDataDir({ env: process.env, configPath: CONFIG_PATH, serverDir: __dirname });
 const DB_PATH        = path.join(DATA_DIR, 'copilot.db');
 const RELAY_LOCK_PATH = path.join(DATA_DIR, 'relay-server.lock');
-const UPLOAD_DIR     = process.env.COPILOT_WEB_RELAY_DATA_DIR
-  ? path.join(DATA_DIR, 'uploads')
-  : path.join(__dirname, 'uploads');
+// Uploads follow the data dir whenever the env var or config.json chose it.
+const UPLOAD_DIR     = resolveUploadDir({ dataDir: DATA_DIR, env: process.env, serverDir: __dirname });
+// Uploads earlier versions left in <server>/uploads or <state root>/uploads
+// are read in place; nothing there is written, moved or deleted.
+const UPLOAD_READ_DIRS = resolveUploadReadDirs({ uploadDir: UPLOAD_DIR, dataDir: DATA_DIR, serverDir: __dirname });
 const INITIAL_WORKSPACE_ROOT = resolveStartupWorkspaceRoot(__dirname);
 const WORKSPACE_ROOT_LOCKED = true;
 const SESSION_COOKIE = 'copilot_session';
 const AUTH_COOKIE = 'copilot_auth';
 
-if (!fs.existsSync(DATA_DIR)) {
-  fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 });
-}
+ensureDataDirs({ dataDir: DATA_DIR, uploadDir: UPLOAD_DIR });
 if (process.platform !== 'win32') {
   fs.chmodSync(DATA_DIR, 0o700);
 }
-if (!fs.existsSync(UPLOAD_DIR)) {
-  fs.mkdirSync(UPLOAD_DIR, { recursive: true });
+// Earlier migrations put a checkout's uploads in <state root>/uploads, which
+// nothing read: merge them in (never overwriting, never deleting the source).
+mergeStrayMigratedUploads({ dataDir: DATA_DIR, uploadDir: UPLOAD_DIR, logger: console });
+for (const dir of UPLOAD_READ_DIRS.slice(1)) {
+  try {
+    const count = fs.readdirSync(dir).filter((name) => isSha256(name)).length;
+    if (count) console.log(`[uploads] New uploads go to ${UPLOAD_DIR}; ${count} earlier upload${count === 1 ? '' : 's'} in ${dir} are read from there.`);
+  } catch {}
 }
 
 async function refreshOpenAIProviderModels() {
@@ -1081,18 +1107,20 @@ function setCursorProviderSettings(update = {}) {
 const CURSOR_MODEL_DISCOVERY_TIMEOUT_MS = 20_000;
 
 // Reasoning tiers for one discovered Cursor model, in composer vocabulary.
-// Cursor exposes effort as a per-model parameter named 'effort' or 'reasoning'
-// whose value list varies by model; 'extra-high' is Cursor's spelling of the
-// composer's 'xhigh'. Values with no composer equivalent (e.g. 'minimal') are
-// dropped rather than remapped onto a tier the model does not actually have.
+// Cursor exposes effort as a per-model parameter named 'effort', 'reasoning'
+// or 'reasoning_effort' whose value list varies by model; 'extra-high' is
+// Cursor's spelling of the composer's 'xhigh'. Values with no composer
+// equivalent (e.g. 'minimal') are dropped rather than remapped onto a tier the
+// model does not actually have.
 // Mirrors resolveCursorReasoningParams exactly, including its parameter
-// precedence: it consults 'effort' first and only falls back to 'reasoning',
-// so scanning both would advertise an off switch the worker never sends.
+// precedence: it consults 'effort' first, then 'reasoning', then
+// 'reasoning_effort', so scanning several would advertise an off switch the
+// worker never sends.
 function cursorEntrySupportsReasoningOff(entry) {
   const parameters = Array.isArray(entry?.parameters) ? entry.parameters : [];
   const byId = new Map(parameters.map((param) => [String(param?.id || '').trim().toLowerCase(), param]));
   if (byId.has('thinking')) return true;
-  const effortParam = byId.get('effort') || byId.get('reasoning');
+  const effortParam = byId.get('effort') || byId.get('reasoning') || byId.get('reasoning_effort');
   const values = Array.isArray(effortParam?.values) ? effortParam.values : [];
   return values.some((value) => (
     String((value && typeof value === 'object' ? value.value : value) || '').trim().toLowerCase() === 'none'
@@ -1105,7 +1133,7 @@ function cursorEntryEffortLevels(entry) {
   // listing both parameters must not have its tiers read from one and its off
   // switch from the other.
   const byId = new Map(parameters.map((param) => [String(param?.id || '').trim().toLowerCase(), param]));
-  const effortParam = byId.get('effort') || byId.get('reasoning');
+  const effortParam = byId.get('effort') || byId.get('reasoning') || byId.get('reasoning_effort');
   if (!effortParam) return [];
   const levels = [];
   for (const value of (Array.isArray(effortParam.values) ? effortParam.values : [])) {
@@ -1808,18 +1836,43 @@ function isProcessAlive(pid) {
   }
 }
 
+// The guard's own stale-lock rules (lockHolderMayRun; an EPERM is alive).
 const relaySingletonGuard = createRelaySingletonGuard({
   lockPath: RELAY_LOCK_PATH,
   pid: process.pid,
   token: config.authToken,
-  isProcessAlive,
   logger: console,
 });
 try {
   relaySingletonGuard.acquire();
 } catch (error) {
+  // A held lock is not a crash: the supervisors do not retry 78.
   console.error(`[server] ${error?.message || String(error)}`);
-  process.exit(1);
+  process.exit(error?.code === 'ERELAYLOCKED' ? RELAY_STOP_EXIT_CODE : 1);
+}
+// Before the database opens, under the lock (adoptEarlierDatabase); the
+// result also feeds lostPackageDatabaseWarning.
+let earlierDatabase;
+{
+  try {
+    earlierDatabase = adoptEarlierDatabase({
+      dataDir: DATA_DIR,
+      uploadDir: UPLOAD_DIR,
+      serverDir: __dirname,
+      configPath: CONFIG_PATH,
+      packageRoot: REPO_ROOT,
+      Database,
+      authToken: config.authToken,
+      logger: console,
+    });
+  } catch (error) {
+    earlierDatabase = { status: 'refused', error: `[data] Not starting: the database this relay ran on until now could not be looked at (${error?.message || error}).` };
+  }
+  if (earlierDatabase.status === 'refused') {
+    console.error(earlierDatabase.error);
+    try { relaySingletonGuard.release(); } catch {}
+    process.exit(RELAY_STOP_EXIT_CODE);
+  }
 }
 
 const MAX_REQUEUE_RETRIES = Number.isFinite(Number(config.maxRequeueRetries))
@@ -1877,7 +1930,7 @@ const runtimeTimers = {
   questionExpiry: null,
   pendingWorkerPrime: null,
   sharedViewerPrune: null,
-  shutdownDrain: null,
+  restoredTaskSettle: null,
 };
 
 function normalizeRemotePath(value) {
@@ -2112,7 +2165,7 @@ function setSharePathPrivacyMode(value) {
 // checkout, data and upload dirs, the workspace roots it knows, and the OS
 // user name. The share routes add the conversation's own roots.
 function sharePathKnownRoots() {
-  const roots = [REPO_ROOT, DATA_DIR, UPLOAD_DIR, currentWorkspaceRootPath(), INITIAL_WORKSPACE_ROOT];
+  const roots = [REPO_ROOT, DATA_DIR, ...UPLOAD_READ_DIRS, currentWorkspaceRootPath(), INITIAL_WORKSPACE_ROOT];
   const userNames = [];
   try { roots.push(os.homedir()); } catch {}
   try { userNames.push(os.userInfo().username); } catch {}
@@ -2202,6 +2255,21 @@ function setTaskStallMinutes(value) {
   return { ok: true, minutes: parsed.minutes };
 }
 
+// "After a relay restart, tell interrupted sessions to carry on" (off by default).
+function getRestartResumeEnabled() {
+  return readRestartResumeSetting(readAppSettingValue(RESTART_RESUME_SETTING_KEY));
+}
+
+function setRestartResumeEnabled(value) {
+  if (typeof stmts?.upsertAppSetting?.run !== 'function') {
+    return { ok: false, error: 'Restart settings are unavailable' };
+  }
+  const parsed = parseRestartResumeUpdate(value);
+  if (!parsed.ok) return parsed;
+  stmts.upsertAppSetting.run(RESTART_RESUME_SETTING_KEY, parsed.enabled ? '1' : '0', new Date().toISOString());
+  return { ok: true, enabled: parsed.enabled };
+}
+
 function resolveDefaultSessionWorkspaceRootState() {
   return resolveDefaultSessionWorkspaceRootStateFromService({
     storedPath: readAppSettingValue(DEFAULT_SESSION_WORKSPACE_ROOT_KEY),
@@ -2648,6 +2716,7 @@ const configuredConversationSessionMode =
 updateModelCatalog({ models: [DEFAULT_MODEL], currentModel: DEFAULT_MODEL, defaultModel: DEFAULT_MODEL, source: 'bootstrap' });
 
 // ─── SQLite Setup ─────────────────────────────────────────────────────────────
+const databaseCreatedAtStart = !fs.existsSync(DB_PATH);
 const db = new Database(DB_PATH);
 if (process.platform !== 'win32') {
   fs.chmodSync(DB_PATH, 0o600);
@@ -3011,6 +3080,7 @@ function buildSessionWorkerLaunchEnvForSession(targetSessionId) {
       enabled: true,
       model: cursorModel,
       apiKey: cursorSettings.apiKey,
+      dataDir: DATA_DIR,
     });
   }
   if (providerType === 'grok') {
@@ -3451,140 +3521,98 @@ function attachTtyConsoleRuntimeTitle(runtime) {
 }
 attachTtyConsoleRuntimeTitle(ttyConsoleRuntime);
 
-let pendingRelayShutdownRequest = null;
-function normalizeRestartRequestFlag(value) {
-  if (value === true || value === 1) return true;
-  if (value === false || value === 0 || value == null) return false;
-  const normalized = String(value).trim().toLowerCase();
-  return normalized === 'true' || normalized === '1' || normalized === 'yes' || normalized === 'on';
-}
-
-function getRelayShutdownState() {
-  const pending = pendingRelayShutdownRequest;
-  if (!pending) {
-    return {
-      status: runtimeShutdownStarted ? 'shutting_down' : 'idle',
-      action: runtimeShutdownStarted ? 'shutdown' : null,
-      restart: false,
-      reason: null,
-      requestedBy: null,
-      requestedAt: null,
-    };
+// ─── Queued relay restart / shutdown ─────────────────────────────────────────
+// A request waits until no turn is processing and holds new turns meanwhile
+// (services/relay-shutdown-gate.mjs); past the maximum wait it asks instead
+// of acting (services/relay-restart-queue.mjs). Every client shows a banner
+// with what it waits for, from `relay_shutdown_state` (sent on each change
+// and on connect).
+const relayRestartMaxWaitOverrideMs = resolveRelayRestartMaxWaitOverrideMs(process.env);
+if (relayRestartMaxWaitOverrideMs !== null) {
+  console.log(`${runtimeLogPrefix()}Relay restart max wait pinned to ${relayRestartMaxWaitOverrideMs} ms (OAR_RELAY_RESTART_MAX_WAIT_MS)`);
+}
+function getRelayRestartMaxWaitMinutes() {
+  return readRelayRestartMaxWaitSetting(readAppSettingValue(RELAY_RESTART_MAX_WAIT_SETTING_KEY));
+}
+function setRelayRestartMaxWaitMinutes(value) {
+  if (!stmts.upsertAppSetting) return { ok: false, error: 'Relay restart settings are unavailable' };
+  const parsed = parseRelayRestartMaxWaitUpdate(value);
+  if (!parsed.ok) return parsed;
+  stmts.upsertAppSetting.run(RELAY_RESTART_MAX_WAIT_SETTING_KEY, String(parsed.minutes), new Date().toISOString());
+  // A queued request measures its current period against the new value.
+  relayRestartQueue.refresh();
+  return { ok: true, maxWaitMinutes: parsed.minutes };
+}
+let restartPictureCollector = null;
+// What a restart would wait for, hold and leave running (the confirmation
+// asks before anything is queued). Built on first use: the background-work
+// view is set up further down.
+function collectRestartPicture({ action = 'restart' } = {}) {
+  if (!restartPictureCollector) {
+    restartPictureCollector = createRestartPictureCollector({
+      db,
+      backgroundWorkView,
+      listHeldTasks: () => backgroundTaskStore.listRestored().map(({ key, task }) => ({
+        conversationId: resolveConversationRecord({ conversationId: key, sdkSessionId: key })?.id || key,
+        description: task?.description || task?.taskType || '',
+      })),
+      providerOf: (conversationId) => stmts.getRuntimeSessionByConversation?.get?.(conversationId)?.provider_type,
+      titleOf: (conversationId) => hostActivityTitle(conversationId),
+    });
   }
-  return {
-    status: runtimeShutdownStarted ? 'shutting_down' : 'queued',
-    action: pending.action || 'shutdown',
-    restart: pending.action === 'restart',
-    reason: pending.reason || null,
-    requestedBy: pending.requestedBy || null,
-    requestedAt: pending.requestedAt || null,
-  };
+  return restartPictureCollector({ action });
 }
+const relayRestartQueue = createRelayRestartQueue({
+  getCounts: () => queueCounts(),
+  collectPicture: collectRestartPicture,
+  startShutdown: ({ action, reason, requestedBy, requestedAt }) => {
+    const exitCode = action === 'restart' ? RELAY_RESTART_EXIT_CODE : 0;
+    // The next start tells the conversations that asked for relay_restarted
+    // how this one ended (services/relay-event-service.mjs).
+    try { relayEventService?.noteRelayExit({ action, reason, requestedBy, requestedAt }); } catch {}
+    sessionWorkerWebSocketService.emitDraining(`api-${action}:${reason}`);
+    void shutdownRuntime(`api-${action}:${reason}`, { exitCode });
+  },
+  getMaxWaitMs: () => (relayRestartMaxWaitOverrideMs !== null
+    ? relayRestartMaxWaitOverrideMs
+    : getRelayRestartMaxWaitMinutes() * 60_000),
+  isShuttingDown: () => runtimeShutdownStarted,
+  onStateChange: (state) => {
+    try { io.emit('relay_shutdown_state', state); } catch {}
+  },
+  onMaxWaitReached: (state) => {
+    const sessions = Array.isArray(state.waitingFor) ? state.waitingFor.length : 0;
+    const minutes = Math.max(1, Math.round(Number(state.maxWaitMs || 0) / 60_000));
+    void pushDispatchService.notifyRelayRestart({
+      body: `The queued relay ${state.action} has waited ${minutes} min for ${sessions} session${sessions === 1 ? '' : 's'}. Restart now, keep waiting or cancel it.`,
+    });
+  },
+  logger: console,
+  logPrefix: () => runtimeLogPrefix(),
+});
 
-// Every client shows a banner while a shutdown/restart is queued, so the
-// state goes out on each transition (request, cancel, drain) and on connect.
 function relayShutdownStatePayload() {
-  return { ...getRelayShutdownState(), queue: queueCounts() };
-}
-function emitRelayShutdownState() {
-  try { io.emit('relay_shutdown_state', relayShutdownStatePayload()); } catch {}
+  return relayRestartQueue.getState();
 }
 
 function cancelRelayShutdown({ requestedBy = 'localhost-api' } = {}) {
-  if (runtimeShutdownStarted) {
-    return { cancelled: false, status: 'shutting_down', ...relayShutdownStatePayload() };
-  }
-  if (!pendingRelayShutdownRequest) {
-    return { cancelled: false, ...relayShutdownStatePayload() };
-  }
-  const dropped = pendingRelayShutdownRequest;
-  pendingRelayShutdownRequest = null;
-  if (runtimeTimers.shutdownDrain) {
-    try { clearInterval(runtimeTimers.shutdownDrain); } catch {}
-    runtimeTimers.shutdownDrain = null;
-  }
-  console.log(
-    `${runtimeLogPrefix()}Relay ${dropped.action || 'shutdown'} request cancelled by `
-    + `${String(requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api'}`,
-  );
-  emitRelayShutdownState();
-  return { cancelled: true, dropped, ...relayShutdownStatePayload() };
+  const result = relayRestartQueue.cancel({ requestedBy });
+  if (result?.cancelled) relayEventService?.noteRestartCancelled();
+  return result;
 }
 
-function requestRelayShutdown({ reason = 'manual-request', requestedBy = 'localhost-api', restart = false } = {}) {
-  const safeReason = String(reason || 'manual-request').trim().slice(0, 140) || 'manual-request';
-  const safeRequestedBy = String(requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
-  const restartRequested = normalizeRestartRequestFlag(restart);
-  const requestedAction = restartRequested ? 'restart' : 'shutdown';
-  if (runtimeShutdownStarted) {
-    return {
-      accepted: false,
-      status: 'shutting_down',
-      action: requestedAction,
-      restart: restartRequested,
-      reason: safeReason,
-    };
-  }
-
-  // Shutdown is deferred until no turn is processing; it never interrupts an
-  // active turn. From here on no pending row is handed out (the dequeue paths
-  // read relayShutdownQueued): a turn started meanwhile would postpone the
-  // restart again. Pending and parked rows wait in the database and run
-  // after the restart.
-  if (!pendingRelayShutdownRequest) {
-    pendingRelayShutdownRequest = {
-      action: requestedAction,
-      reason: safeReason,
-      requestedBy: safeRequestedBy,
-      requestedAt: new Date().toISOString(),
-    };
-  } else if (restartRequested && pendingRelayShutdownRequest.action !== 'restart') {
-    pendingRelayShutdownRequest = {
-      ...pendingRelayShutdownRequest,
-      action: 'restart',
-      reason: safeReason,
-      requestedBy: safeRequestedBy,
-      requestedAt: new Date().toISOString(),
-    };
-  }
-
-  const tryShutdownWhenIdle = () => {
-    if (runtimeShutdownStarted) return;
-    const counts = queueCounts();
-    if (!queuedShutdownCanProceed(counts)) return;
-    const requestInfo = pendingRelayShutdownRequest;
-    pendingRelayShutdownRequest = null;
-    if (runtimeTimers.shutdownDrain) {
-      try { clearInterval(runtimeTimers.shutdownDrain); } catch {}
-      runtimeTimers.shutdownDrain = null;
-    }
-    const action = requestInfo?.action === 'restart' ? 'restart' : 'shutdown';
-    const exitCode = action === 'restart' ? RELAY_RESTART_EXIT_CODE : 0;
-    console.log(
-      `${runtimeLogPrefix()}Relay ${action} request accepted by ${requestInfo?.requestedBy || 'unknown'}`
-      + `; no turn is processing (${counts.pendingCount} pending, ${counts.parkedCount} parked wait), exiting now (reason=${requestInfo?.reason || 'manual-request'})`,
-    );
-    sessionWorkerWebSocketService.emitDraining(`api-${action}:${requestInfo?.reason || 'manual-request'}`);
-    void shutdownRuntime(`api-${action}:${requestInfo?.reason || 'manual-request'}`, { exitCode });
-    emitRelayShutdownState();
-  };
+function keepWaitingForRelayShutdown({ requestedBy = 'localhost-api' } = {}) {
+  return relayRestartQueue.keepWaiting({ requestedBy });
+}
 
-  if (!runtimeTimers.shutdownDrain) {
-    runtimeTimers.shutdownDrain = setInterval(tryShutdownWhenIdle, 1000);
-  }
-  tryShutdownWhenIdle();
-  if (pendingRelayShutdownRequest) emitRelayShutdownState();
-  const counts = queueCounts();
-  return {
-    accepted: true,
-    status: 'queued',
-    action: pendingRelayShutdownRequest?.action || requestedAction,
-    restart: (pendingRelayShutdownRequest?.action || requestedAction) === 'restart',
-    requestedAt: pendingRelayShutdownRequest?.requestedAt || new Date().toISOString(),
-    reason: pendingRelayShutdownRequest?.reason || safeReason,
-    requestedBy: pendingRelayShutdownRequest?.requestedBy || safeRequestedBy,
-    queue: counts,
-  };
+function requestRelayShutdown(options = {}) {
+  // The loop guard of relay_restarted: a conversation whose turn answers the
+  // last restart is not woken by this one. Noted first, since an immediate
+  // request exits from inside the call.
+  if (!runtimeShutdownStarted) relayEventService?.noteRestartRequested();
+  const result = relayRestartQueue.request(options);
+  if (!relayRestartQueue.isQueued() && !runtimeShutdownStarted) relayEventService?.noteRestartCancelled();
+  return result;
 }
 
 function toNullableInt(value) {
@@ -4227,7 +4255,9 @@ function isSha256(value) {
 }
 
 function uploadPathForSha(sha256) {
-  return path.join(UPLOAD_DIR, sha256);
+  let expectedSize = null;
+  try { expectedSize = stmts.getUploadFile.get(String(sha256 || '').trim().toLowerCase())?.size_bytes ?? null; } catch {}
+  return uploadPathInDirs(UPLOAD_READ_DIRS, sha256, { expectedSize });
 }
 
 function uploadContentUrlForSha(sha256) {
@@ -4908,7 +4938,10 @@ function persistUploadBuffer(buffer, options = {}) {
   if (!Buffer.isBuffer(buffer) || !buffer.length) throw new Error('Empty upload');
   if (buffer.length > MAX_UPLOAD_BYTES) throw new Error('Uploaded file too large');
   const sha256 = crypto.createHash('sha256').update(buffer).digest('hex');
-  const filePath = uploadPathForSha(sha256);
+  // Always kept in the upload dir: the folders of earlier versions can go
+  // (a package update, a clean checkout), so a new reference never relies on
+  // them. An existing file is never overwritten.
+  const filePath = path.join(UPLOAD_DIR, sha256);
   if (!fs.existsSync(filePath)) {
     const tmpPath = path.join(UPLOAD_DIR, `${sha256}.${process.pid}.${Date.now()}.tmp`);
     fs.writeFileSync(tmpPath, buffer);
@@ -4946,13 +4979,14 @@ function buildStoredAttachment({ sha256, name, type, size }) {
   if (!isSha256(normalizedSha)) return null;
   const normalizedName = String(name || '').trim().slice(0, 255) || `upload-${normalizedSha.slice(0, 12)}`;
   const normalizedType = String(type || '').trim().toLowerCase().slice(0, 127) || 'application/octet-stream';
+  const filePath = uploadPathForSha(normalizedSha);
   return {
     name: normalizedName,
     type: normalizedType,
     size: Number(size || 0),
     sha256: normalizedSha,
-    path: uploadPathForSha(normalizedSha),
-    reference: `@${uploadPathForSha(normalizedSha)}`,
+    path: filePath,
+    reference: `@${filePath}`,
     contentUrl: uploadContentUrlForSha(normalizedSha),
   };
 }
@@ -5025,7 +5059,9 @@ function deleteOrphanedUploads(hashes) {
     const refs = Number(stmts.countUploadRefsBySha.get(sha256)?.cnt || 0);
     if (refs > 0) continue;
     stmts.deleteUploadFile.run(sha256);
-    const filePath = uploadPathForSha(sha256);
+    // Only the upload dir is swept; the folders of earlier versions are
+    // read-only to the relay.
+    const filePath = path.join(UPLOAD_DIR, sha256);
     if (fs.existsSync(filePath)) {
       try { fs.unlinkSync(filePath); } catch {}
     }
@@ -5248,10 +5284,14 @@ function previewCardsForResponse(responseMessageId) {
     .slice(0, 5);
 }
 
-// Live background-task sets, as the session workers publish them. Memory
-// only: after a runtime start the heartbeat's digest brings each set back
-// (services/background-task-store.mjs).
-const backgroundTaskStore = createBackgroundTaskStore();
+// Live background-task sets, as the session workers publish them. The sets
+// are memory only: after a runtime start the heartbeat's digest brings each
+// set back. The console rows (the output file of a running shell, the ended
+// rows of the last hour) are stored (migration 0018) and restored here; a
+// running one is held until its worker reports (services/background-task-store.mjs).
+const backgroundTaskStore = createBackgroundTaskStore({
+  persistence: createSqliteBackgroundTaskPersistence(db, { logger: console }),
+});
 // The output a worker posts for a task with no output file (the console's
 // fallback); memory only, an hour.
 const taskOutputSnapshots = createTaskOutputSnapshots();
@@ -5366,6 +5406,29 @@ const usageLimitPauseService = createUsageLimitPauseService({
   logger: console,
 });
 
+// Turns a restart cut off for good (their worker went with the relay, and a
+// second delivery would run the prompt twice): with the setting on, their
+// session gets one note to carry on. The rows processing right now are the
+// ones the runtime before left; the recovery paths below report what became
+// of each (services/restart-resume-service.mjs).
+const restartResumeService = createRestartResumeService({
+  db,
+  stmts,
+  isEnabled: getRestartResumeEnabled,
+  emit: (event, payload) => io.emit(event, payload),
+  // The note is an ordinary pending message: the primer starts a stopped
+  // worker, the socket service hands it to a running one.
+  wake: () => {
+    void primePendingSessionWorkers('restart-resume');
+    sessionWorkerWebSocketService?.emitQueueChanged?.('restart-resume');
+  },
+  logger: console,
+});
+restartResumeService.captureBoot();
+function noteRestartTurnOutcome(row, outcome) {
+  try { restartResumeService.noteOutcome(row, outcome); } catch {}
+}
+
 // ─── Relay events ─────────────────────────────────────────────────────────────
 // What each session is doing (state, tasks, quiet time) and the subscriptions
 // through which a watching session is woken with the events of the sessions
@@ -5531,56 +5594,21 @@ function failConsumedRowTerminally(row, reason) {
   });
 }
 
-function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso = null } = {}) {
-  const params = { inactiveBefore: cutoffIso, ceilingBefore: ceilingBeforeIso || null };
-  // Stale background-continuation turns are torn down, never requeued —
-  // replaying one would deliver the CLI's own continuation as a user prompt.
-  const staleContinuations = stmts.listStaleProcessingContinuations?.all?.(params) || [];
-  for (const row of staleContinuations) {
-    stmts.dropStaleContinuation?.run?.(row.id);
-    io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
-    // A teardown is a turn ending with no reply; it must be visible in the
-    // console log (the only trace of a silent one was `ignored=already_failed`
-    // hours later, when the worker's reply arrived for the dead row).
-    const lastSeen = row.owner_last_claimed_at || row.processing_at || row.timestamp || null;
-    const reason = lastSeen && lastSeen < cutoffIso ? `inactive since ${lastSeen}` : `ceiling (started ${row.processing_at || row.timestamp})`;
-    console.warn(`${runtimeLogPrefix()}STALE CONTINUATION ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} dropped: ${reason}`);
-  }
-  const listedRows = stmts.listRecoverableProcessing.all(params);
-  for (const row of listedRows.filter((entry) => entry?.consumed_at)) failConsumedRowTerminally(row, 'stale-recovery');
-  const allRows = listedRows.filter((entry) => !entry?.consumed_at);
-  if (!allRows.length) return [];
-  // Enforce the retry budget before requeueing: failing these rows first
-  // flips them out of 'processing' so the recovery UPDATE below skips them.
-  const overBudget = allRows.filter((row) => Number(row?.retry_count || 0) + 1 >= MAX_REQUEUE_RETRIES);
-  for (const row of overBudget) failRecoveredRowTerminally(row, 'stale-recovery');
-  const rows = allRows.filter((row) => Number(row?.retry_count || 0) + 1 < MAX_REQUEUE_RETRIES);
-  if (!rows.length) return [];
-
-  const tx = db.transaction(() => {
-    stmts.recoverProcessingBefore.run({ ...params, requeueAt: requeueAtIso });
-    const settleRecoveredAbortControls = db.prepare(`
-      UPDATE relay_control_requests
-      SET status = 'failed',
-          error = ?,
-          updated_at = ?,
-          completed_at = ?
-      WHERE queue_message_id = ?
-        AND type IN ('abort_turn', 'abort_subagent')
-        AND status IN ('pending', 'processing')
-    `);
-    const now = new Date().toISOString();
-    for (const row of rows) {
-      settleRecoveredAbortControls.run('queue-recovered', now, now, row.id);
-    }
-  });
-  tx();
-
-  for (const row of rows) {
-    io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'pending' });
-  }
-  io.emit('queue_updated', { recovered: rows.length });
-  return rows;
+// The stale-turn sweep itself lives in services/stale-turn-recovery.mjs so it
+// can be tested against a real database; io is created further down, hence
+// the late-bound emit.
+const staleTurnRecovery = createStaleTurnRecovery({
+  db,
+  stmts,
+  emit: (event, payload) => io.emit(event, payload),
+  maxRequeueRetries: MAX_REQUEUE_RETRIES,
+  failRecoveredRowTerminally,
+  failConsumedRowTerminally,
+  noteRestartTurnOutcome,
+  warn: (line) => console.warn(`${runtimeLogPrefix()}${line}`),
+});
+function recoverProcessingOlderThan(cutoffIso, requeueAtIso, options) {
+  return staleTurnRecovery.recoverProcessingOlderThan(cutoffIso, requeueAtIso, options);
 }
 
 // One `/api/usage` needs the same token for the quota read and the billing
@@ -5915,7 +5943,7 @@ const readContextFromSessionEvents = contextSnapshotService.readContextFromSessi
 // Claude-provider sessions live under the Agent SDK's project layout rather than
 // ~/.copilot/session-state, so their browsable session folder resolves separately.
 const claudeSessionRootResolver = createClaudeSessionRootResolver({ fs, path });
-const cursorSessionRootResolver = createCursorSessionRootResolver({ fs, path, serverDir: __dirname });
+const cursorSessionRootResolver = createCursorSessionRootResolver({ fs, path, serverDir: __dirname, dataDir: DATA_DIR });
 
 // ─── Express + Socket.io Setup ────────────────────────────────────────────────
 const app        = express();
@@ -6442,14 +6470,17 @@ function recoverDeadWorkerProcessingRows(sessionId, reason) {
       // No user prompt to replay: a dead worker's continuation is torn down.
       stmts.dropStaleContinuation?.run?.(row.id);
       io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
+      noteRestartTurnOutcome(row, 'cut');
       continue;
     }
     if (row.consumed_at) {
       failConsumedRowTerminally(row, `worker-died-${reason}`);
+      noteRestartTurnOutcome(row, 'cut');
       continue;
     }
     if (Number(row.retry_count || 0) + 1 >= MAX_REQUEUE_RETRIES) {
       failRecoveredRowTerminally(row, `worker-died-${reason}`);
+      noteRestartTurnOutcome(row, 'failed');
       continue;
     }
     // The dead worker's subagent runs can never be terminated by the replay
@@ -6457,6 +6488,7 @@ function recoverDeadWorkerProcessingRows(sessionId, reason) {
     closeStrandedSubagentRuns(stmts.listRunningSubagentRunsByQueueMessage?.all?.(row.id) || [], row.id);
     stmts.recoverProcessingRowKeepOwner?.run?.(requeueAt, row.id);
     io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'pending' });
+    noteRestartTurnOutcome(row, 'requeued');
     recovered += 1;
   }
   if (recovered > 0) {
@@ -6569,7 +6601,7 @@ function sessionHasBackgroundWork(sid) {
 const detachedWorkerWatch = createDetachedWorkerWatch({
   isEnabled: () => featureFlags?.SESSION_WORKER_ROUTING_ENABLED === true
     && !runtimeShutdownStarted
-    && !pendingRelayShutdownRequest,
+    && !relayRestartQueue.isQueued(),
   listWaitingSessionIds: () => (stmts.listPendingWorkerOwnerSessionIds?.all?.(25) || [])
     .map((row) => row?.sdk_session_id),
   hasWorkerSocket: (sid) => sessionWorkerWebSocketService.hasWorkerSocket(sid) === true,
@@ -6766,10 +6798,10 @@ const runtimeState = {
   get relayPaused() { return relayPaused; },
   set relayPaused(value) { relayPaused = value; },
   get ttyConsoleActive() { return Boolean(ttyConsoleRuntime?.tty); },
-  get relayShutdown() { return getRelayShutdownState(); },
+  get relayShutdown() { return relayRestartQueue.getState(); },
   // A shutdown or restart waits for the processing turns: no pending row
-  // goes out meanwhile (see requestRelayShutdown).
-  get relayShutdownQueued() { return !!pendingRelayShutdownRequest && !runtimeShutdownStarted; },
+  // goes out meanwhile (services/relay-restart-queue.mjs).
+  get relayShutdownQueued() { return relayRestartQueue.isQueued(); },
   get hostSuspend() { return hostSuspendService.getState(); },
   get usageLimit() {
     return { account: usageLimitPauseService.getAccountState(), pauses: usageLimitPauseService.listPauses() };
@@ -6788,6 +6820,34 @@ const windowsBootAutostartService = createWindowsBootAutostartService({
   packageRoot: REPO_ROOT,
   configPath: CONFIG_PATH,
 });
+// Autostart entries written before they pinned the data and log folders start
+// the relay on a database inside the package directory, or before TEMP and
+// the data drive are there. Brought up to date once this relay holds the
+// lock and its port; edited ones stay.
+function refreshWindowsAutostartEntries() {
+  // Entries that ran the relay on the database inside the package.
+  const unpinnedLaunchers = [];
+  const onEarlierForm = ({ path: launcher, pinnedData }) => { if (!pinnedData) unpinnedLaunchers.push(launcher); };
+  for (const [name, refresh] of [
+    ['sign-in entry', () => windowsAutostartService.refreshInstalledEntry({ onEarlierForm })],
+    ['boot launcher', () => windowsBootAutostartService.refreshInstalledLauncher({ onEarlierForm })],
+  ]) {
+    try {
+      if (refresh()) console.log(`[autostart] brought the ${name} up to date: it pins the data and log folders and waits for TEMP and the data drive`);
+    } catch (error) {
+      console.warn(`[autostart] could not bring the ${name} up to date: ${error?.message || error}`);
+    }
+  }
+  const warning = lostPackageDatabaseWarning({
+    unpinnedLaunchers,
+    earlierDatabase,
+    databaseCreated: databaseCreatedAtStart,
+    evidence: unpinnedLaunchers.length > 0 && packageDatabaseEvidence({ serverDir: __dirname, ownDirs: [DATA_DIR, path.dirname(relayConsoleLogPath)] }),
+    serverDir: __dirname,
+    dbPath: DB_PATH,
+  });
+  if (warning) console.error(warning);
+}
 
 const gitChangesService = createGitChangesService();
 // GET /api/git/remote: where a folder lives on GitHub (New Chat, Claude Cloud).
@@ -7017,6 +7077,9 @@ const sharedRouteDeps = {
   pokeTaskHealth: () => taskHealthPoller.poke(),
   getTaskStallMinutes,
   setTaskStallMinutes,
+  getRestartResumeEnabled,
+  setRestartResumeEnabled,
+  noteRestartTurnOutcome,
   // A closure, not the registry itself: this deps object is built before the
   // preview lane is constructed further down the file.
   listConversationPreviews: (conversationId) => previewRegistry.listForConversation(conversationId),
@@ -7049,6 +7112,7 @@ const sharedRouteDeps = {
   fs,
   path,
   uploadsDir: UPLOAD_DIR,
+  uploadReadDirs: UPLOAD_READ_DIRS,
   fetchUsageSummary,
   fetchCopilotBillingUsage,
   fetchGrokBillingUsage: createGrokBillingUsageFetcher(),
@@ -7146,6 +7210,16 @@ registerRelayEventRoutes(app, {
   relayEventService,
   remoteRelayInbound,
 });
+registerRelayRestartRoutes(app, {
+  auth,
+  // Read only: a GET neither fires the restart nor asks the question.
+  getState: () => relayRestartQueue.getState(),
+  collectRestartPicture,
+  keepWaiting: keepWaitingForRelayShutdown,
+  getMaxWaitMinutes: getRelayRestartMaxWaitMinutes,
+  setMaxWaitMinutes: setRelayRestartMaxWaitMinutes,
+  maxWaitOverrideMs: relayRestartMaxWaitOverrideMs,
+});
 registerAboutRoutes(app, {
   auth,
   aboutService: createAboutService({
@@ -7236,6 +7310,8 @@ function recoverStaleMessages() {
   const ceilingBeforeIso = ceilingMs > 0 ? new Date(Date.now() - ceilingMs).toISOString() : null;
   const requeueAt = addMsIso(cliOnline ? 30_000 : 2_000);
   const recoveredRows = recoverProcessingOlderThan(cutoff, requeueAt, { ceilingBeforeIso });
+  // Turns of the start that ended on their own decide their session's note.
+  try { restartResumeService.tick(); } catch {}
   if (recoveredRows.length > 0) {
     const ceilingNote = ceilingBeforeIso ? `, ceiling ${Math.round(ceilingMs / 60_000)}min` : '';
     console.log(
@@ -7561,6 +7637,27 @@ const taskOutputRooms = createTaskOutputRooms({
 // the live tasks with an output file.
 const taskHealthPoller = createTaskHealthPoller({ store: backgroundTaskStore, io });
 taskHealthPoller.start();
+// Console tasks held since the restart whose worker has not reported within
+// twice the boot window (at least 15 s: a test relay has none): that worker
+// did not survive the restart. They are marked ended (their output stays
+// readable for the hour), never running.
+runtimeTimers.restoredTaskSettle = setTimeout(() => {
+  runtimeTimers.restoredTaskSettle = null;
+  const keys = backgroundTaskStore.endUnconfirmed();
+  if (!keys.length) return;
+  console.log(`${runtimeLogPrefix()}BG-TASKS ${keys.length} session(s) did not report after the restart; their console tasks are marked ended`);
+  for (const key of keys) {
+    try {
+      io.emit('background_tasks', {
+        conversationId: key,
+        tasks: backgroundTaskStore.withHealth(backgroundTaskStore.get(key), key),
+        endedTasks: backgroundTaskStore.ended(key),
+      });
+    } catch {}
+  }
+  taskHealthPoller.poke();
+}, Math.max(15_000, 2 * resolveBootReportingWindowMs(process.env)));
+runtimeTimers.restoredTaskSettle?.unref?.();
 // The handshake presents the token as `auth.token` or the cookie; a query
 // `token` is not read (see services/relay-auth.mjs).
 io.use(relayAuth.socketMiddleware);
@@ -7723,12 +7820,21 @@ registerPreviewRoutes(app, {
       new Date().toISOString(),
     );
   },
+  // A scope named by a conversation's id or its session id covers both.
+  resolveConversationScope: createPreviewScopeResolver({
+    getConversation: (id) => {
+      const conv = stmts.getConvAnyStatus.get(id) || null;
+      return conv && String(conv.status || '').trim().toLowerCase() !== 'deleted' ? conv : null;
+    },
+    getConversationBySdkSessionId: (id) => stmts.getConvBySdkSessionId?.get?.(id) || null,
+  }),
 });
 
 function clearRuntimeTimers() {
   for (const timer of Object.values(runtimeTimers)) {
     if (!timer) continue;
     try { clearInterval(timer); } catch {}
+    try { clearTimeout(timer); } catch {}
   }
   subagentRecordRetention?.stop();
   try { taskHealthPoller.stop(); } catch {}
@@ -7739,7 +7845,8 @@ function clearRuntimeTimers() {
   runtimeTimers.questionExpiry = null;
   runtimeTimers.pendingWorkerPrime = null;
   runtimeTimers.sharedViewerPrune = null;
-  runtimeTimers.shutdownDrain = null;
+  runtimeTimers.restoredTaskSettle = null;
+  try { relayRestartQueue.dispose(); } catch {}
 }
 
 let runtimeShutdownPromise = null;
@@ -7780,6 +7887,9 @@ function shutdownRuntime(reason = 'unknown', { exitCode = 0 } = {}) {
     console.warn(`${runtimeLogPrefix()}Grok auth service shutdown failed: ${error?.message || error}`);
   }
   sessionWorkerWebSocketService.stop();
+  // A queued request wrote its own end already; this covers the rest
+  // (signals, the owner gone).
+  try { relayEventService.noteRelayExit({ action: runtimeShutdownExitCode === RELAY_RESTART_EXIT_CODE ? 'restart' : 'shutdown', reason }); } catch {}
   try { relayEventService.stop(); } catch {}
   try { relayEventLinkService.stop(); } catch {}
   tmuxInspectorSocketService.stop();
@@ -7910,12 +8020,19 @@ httpServer.on('error', (error) => {
   process.exit(1);
 });
 httpServer.listen(config.port, listenHost, () => {
+  // Conversations that asked for relay_restarted hear that the relay is back:
+  // once it listens, so a start that fails to bind does not take the record
+  // of how the run before ended.
+  try { relayEventService.noteRelayStarted(); } catch (error) {
+    console.warn(`${runtimeLogPrefix()}relay_restarted not recorded: ${error?.message || error}`);
+  }
   const readyBanner = buildRelayReadyBannerData();
   console.log('');
   for (const line of (readyBanner.lines || [])) {
     console.log(line);
   }
   console.log('\nCLI status: waiting for first heartbeat...\n');
+  refreshWindowsAutostartEntries();
 
   // Start SSH tunnel after server is listening
   sshTunnelManager.start();