@oar-sh/oar 0.9.15 → 0.9.16

package/CHANGELOG.md

@@ -3,6 +3,91 @@
 All notable changes to OAR are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [0.9.16] — 2026-10-24
+
+Highlights: agents can file the sessions they start into your session
+groups, change another session's model, mode or other settings, watch other
+sessions with fewer wake-ups (digests, quiet hours, exclusions), and
+schedule prompts that survive a relay restart. Agents can ask you a question
+without stopping their work, and the new Inbox lists every open question
+from this relay and its paired relays in one place. A new switch lets the
+agents of a conversation start sessions themselves.
+
+### Added
+
+- **Agents can put a new session into an existing session group.**
+  `remote_relay` create_session takes `group` (a group id, or its name in
+  any case) on this relay or a paired one, and `relay_info` lists the groups
+  there. An unknown group is refused with the groups listed, and nothing is
+  created. The approval card names the group, and the result carries it. A
+  relay too old for this is refused before anything is created. Renaming
+  and rearranging groups stays the owner's. An argument an action does not
+  take is no longer dropped without a word: create_session refuses it, and
+  the other actions list it in `ignored`.
+- **Agents can change another session's settings.** `remote_relay`
+  update_session sets a session's model, reasoning effort, relay mode,
+  auto-compact window, title, group, thinking or working folder for its next
+  turns, on this relay or a paired one, and answers the settings and what
+  changed. An unknown model is refused with the close matches; a group name
+  that does not exist makes a new group, and `none` takes the session out (a
+  group you made is never removed this way: it stays, shown empty in the
+  sidebar for you to rename or dissolve); a new folder
+  restarts the session's CLI there and is refused while it works. Only a
+  session the agent's own conversation started may be changed freely; any
+  other, yours or another agent's, needs your Allow once per conversation and
+  relay. A failed change still lists what it wrote. An open page shows the
+  change at once.
+- **"Agents in this conversation may start sessions."** A switch in the 🧠
+  settings of a session an agent started lets its agents start sessions
+  themselves, past the one-level rule; the limit of four at work and your
+  first Allow still apply. Only you can set it: agents and paired relays are
+  refused.
+- **Fewer wake-ups for watching agents.** A `remote_relay` subscription takes
+  `digest_minutes` (its events come as one message every N minutes),
+  `quiet_hours` (a daily window in a time zone, crossing midnight and the
+  clock changes included, whose events come as one message when it ends) and
+  `exclude` (sessions a subscription to all leaves out). Questions and errors
+  still come at once, held events survive a restart, and the hourly limit
+  stays on top. A turn the watcher prompted itself and whose finished reply it
+  waited for no longer wakes it a second time with turn_end.
+  `list_subscriptions` shows how many events each subscription holds and when
+  they are due, and the watching chip shows a small digest or quiet-hours hint.
+- **Scheduled prompts that survive a restart.** `remote_relay` schedule
+  queues a prompt at a time (`at`) or every N minutes (`every_minutes`, 5 to
+  10080), into the agent's own conversation or, with the user's approval in
+  ask and plan mode, another session on this relay. The relay keeps it in its
+  database, so a nightly review or a sweep no longer has to be set up again
+  after a deploy. A time missed while the relay was down fires once when it is
+  back, and a repeat waits while the one before is still queued. The message
+  says it is automated and approves nothing. `list_schedules` and `unschedule`
+  manage them, archiving a session ends its schedules, and a conversation
+  holds at most 20. The sidebar marks a scheduled session, and its header
+  lists the schedules with a Cancel button each.
+- **Questions that don't block, and the Inbox.** `remote_relay` ask puts a
+  question for you into the agent's session (up to eight options, a
+  recommendation, a folded detail, and urgency `now` for a push) and returns
+  at once, so the agent goes on with what does not depend on it. Your answer
+  or dismissal reaches it as a relay event, question_answered, without a
+  subscription, and does not count as your message for the agents' loop
+  guard. A lead can ask on behalf of another session, on this relay or a
+  paired one (kept where that session lives); `list_questions` and `withdraw`
+  manage them, and `read_session` lists them with their kind. The new
+  **Inbox** in the sidebar, with its count, lists every pending question
+  across this relay and the paired relays that answer, grouped by relay,
+  with a filter for your sessions or the agents', and what you answered in
+  the last day under a divider. An ask is answered there or in its session,
+  also one on a paired relay; a paired relay's cards open there, and the
+  pairing never carries an answer to a card. Agent text shows as plain text,
+  and on a phone the Inbox is one column with full-width buttons.
+
+### Fixed
+
+- **The agents' loop guard no longer counts the relay's own messages as the
+  user's.** A relay event, the usage-limit follow-up or the note after a
+  restart reset the count of prompts an agent may send to other agents
+  before the user is asked, so two agents that watched each other could go
+  on without the user. Only a message the user wrote resets it now.
+
 ## [0.9.15] — 2026-10-22
 
 Highlights: `oar setup` asks how the relay starts on Windows, at sign-in or

package/README.md

@@ -45,29 +45,29 @@ flowchart LR
 <table>
 <tr>
 <td width="42%" rowspan="4" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.15" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.16" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
 <br><sub>On a phone: the same conversations, installable as an app.</sub>
 </td>
 <td width="58%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.15" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.16" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
 <br><sub>Agents working in parallel, each with live token counts and its own Stop.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.15" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.16" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
 <br><sub>When the agent needs a decision, it asks, and waits for your answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.15" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
+<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.16" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
 <br><sub>Read the reasoning, not just the answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.15" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
+<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.16" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
 <br><sub>Agents that watch agents: woken by events, approving nothing.</sub>
 </td>
 </tr>
@@ -116,11 +116,11 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 <table>
 <tr>
 <td width="62%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.15" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.16" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
 <br><sub>Send a message while the agent works, and it steers the running turn.</sub>
 </td>
 <td width="38%" valign="top">
-<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.15" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
+<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.16" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
 <br><sub>What each plan has left, in one place.</sub>
 </td>
 </tr>
@@ -137,7 +137,7 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 - **Share** a conversation as a read-only link, hide single messages and the host's paths from it, and see when it was opened ([Sharing](docs/web-ui.md#sharing)).
 - **On your phone**: install OAR as an app and get push notifications ([Notifications and the app](docs/web-ui.md#notifications-and-the-app)).
 
-The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.15](CHANGELOG.md#0915--2026-10-22) as the latest.
+The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.16](CHANGELOG.md#0916--2026-10-24) as the latest.
 
 ## Remote access
 
@@ -188,7 +188,7 @@ flowchart LR
 
 You stay in charge: per paired relay you decide whether agents may only read, also prompt, or do everything, and in the `ask` and `plan` modes every write asks you first. A subscription only notifies; it approves nothing.
 
-<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.15"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.15"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.15" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
+<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.16"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.16"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.16" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
 
 How pairing, permissions and limits work is in [Agents working together](docs/agents-together.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",

package/server/claude-worker/claude-remote-relay-tool.mjs

@@ -13,7 +13,9 @@ import {
   REMOTE_RELAY_MODES,
   REMOTE_RELAY_PROVIDERS,
   REMOTE_RELAY_SESSION_SCOPES,
+  REMOTE_RELAY_THINKING_DISPLAYS,
 } from '../../shared/remote-relay-contract.mjs';
+import { RELAY_ASK_URGENCIES } from '../../shared/relay-asks.mjs';
 import {
   REMOTE_RELAY_CALL_FAILED,
   REMOTE_RELAY_TOOL_DESCRIPTION,
@@ -67,7 +69,21 @@ export const REMOTE_RELAY_TOOL_ZOD_SHAPE = {
   mode: choice('mode', REMOTE_RELAY_MODES),
   effort: text('effort'),
   title: text('title'),
+  // The one exception to the parity with the JSON schema: Claude may send
+  // null for update_session's group (out of the group), as "none" does on
+  // the providers whose strict schemas take a string only.
+  group: z.string().nullable().optional().describe(FIELDS.group.description),
+  auto_compact_window: number('auto_compact_window'),
+  thinking_enabled: z.boolean().optional().describe(FIELDS.thinking_enabled.description),
+  thinking_display: choice('thinking_display', REMOTE_RELAY_THINKING_DISPLAYS),
   question_id: text('question_id'),
+  // ask: the contract's validator refuses a question or detail that is too
+  // long, or more than eight options, with a message the model can act on.
+  question: text('question'),
+  options: z.array(z.string()).optional().describe(FIELDS.options.description),
+  recommendation: text('recommendation'),
+  detail: text('detail'),
+  urgency: choice('urgency', RELAY_ASK_URGENCIES),
   answer: text('answer'),
   choices: z.array(z.string()).optional().describe(FIELDS.choices.description),
   if_busy: choice('if_busy', REMOTE_RELAY_IF_BUSY),
@@ -78,18 +94,37 @@ export const REMOTE_RELAY_TOOL_ZOD_SHAPE = {
   match: text('match'),
   stalled_minutes: number('stalled_minutes'),
   heartbeat_minutes: number('heartbeat_minutes'),
+  digest_minutes: number('digest_minutes'),
+  // Loose and every field optional: the contract's validator checks the
+  // times and the zone and says what is wrong; an empty one is no option.
+  quiet_hours: z.looseObject({
+    from: z.string().optional().describe(FIELDS.quiet_hours.properties.from.description),
+    to: z.string().optional().describe(FIELDS.quiet_hours.properties.to.description),
+    tz: z.string().optional().describe(FIELDS.quiet_hours.properties.tz.description),
+  }).optional().describe(FIELDS.quiet_hours.description),
+  // A list, or the comma-separated text the contract takes as well.
+  exclude: z.union([z.array(z.string()), z.string()]).optional().describe(FIELDS.exclude.description),
   subscription_id: text('subscription_id'),
   watcher: text('watcher'),
   from: text('from'),
+  at: text('at'),
+  every_minutes: number('every_minutes'),
+  schedule_id: text('schedule_id'),
   task_id: text('task_id'),
   lines: number('lines'),
 };
 
+// What the tool registers: the shape as a loose object. A raw shape becomes a
+// strict-stripping object in the SDK's MCP layer, which would drop a key the
+// schema lacks before the contract's validator could refuse it (create_session)
+// or name it in `ignored` (the other actions). The loose object lets it through.
+export const REMOTE_RELAY_TOOL_ZOD_SCHEMA = z.looseObject(REMOTE_RELAY_TOOL_ZOD_SHAPE);
+
 export function createRemoteRelayToolDefinition({ api, getConversationId = () => '', dbg = () => {} } = {}) {
   return {
     name: REMOTE_RELAY_TOOL_NAME,
     description: REMOTE_RELAY_TOOL_DESCRIPTION,
-    inputSchema: REMOTE_RELAY_TOOL_ZOD_SHAPE,
+    inputSchema: REMOTE_RELAY_TOOL_ZOD_SCHEMA,
     // `extra.signal` is the MCP request's: the SDK aborts it when the CLI
     // cancels the call (a Stop interrupting the turn) or the process's MCP
     // transport closes, and the pending relay request goes with it.

package/server/claude-worker/claude-session-process.mjs

@@ -53,7 +53,7 @@ import {
   STEER_STOPPED_TEXT,
 } from '../../shared/steer-settle-markers.mjs';
 import { stripSteerNote, withSteerNoteContent } from '../../shared/steer-note.mjs';
-import { isRelayEventDelivery } from '../../shared/relay-events.mjs';
+import { isRelayAutomatedDelivery } from '../../shared/relay-events.mjs';
 import {
   stripSlashCommandGuard,
   stripSlashCommandGuardContent,
@@ -4209,9 +4209,9 @@ export function createClaudeSessionRunner({
         // noted steer no longer starts with "/" and is pushed as noted. The
         // replay signatures strip the guard too, so expectedText stays the
         // user's own text here as well.
-        // Nor into an event message the relay wrote: the note speaks as the
-        // user, the event must not (shared/relay-events.mjs).
-        const pushedContent = withSlashCommandGuardContent(steered && procRef.activeCtx?.kind !== 'continuation' && !isRelayEventDelivery(message)
+        // Nor into a message the relay wrote (an event, a scheduled prompt):
+        // the note speaks as the user, that message must not (shared/relay-events.mjs).
+        const pushedContent = withSlashCommandGuardContent(steered && procRef.activeCtx?.kind !== 'continuation' && !isRelayAutomatedDelivery(message)
           ? withSteerNoteContent(content)
           : content);
         procRef.pendingDelivered.push({ ctx, expectedText: contentText(content), pushedAt: Date.now(), steered });

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -112,7 +112,7 @@ import { STEER_FOLDED_TEXT, STEER_STOPPED_TEXT, STEER_TURN_FAILED_TEXT } from '.
 import { buildSteerSettleFailure } from '../../shared/steer-settle-failure.mjs';
 import { shouldEmitStreamUpdate } from '../../shared/stream-emit-gating.mjs';
 import { withSteerNote } from '../../shared/steer-note.mjs';
-import { isRelayEventDelivery } from '../../shared/relay-events.mjs';
+import { isRelayAutomatedDelivery } from '../../shared/relay-events.mjs';
 import { isTransientRelayError } from '../../shared/worker-runtime/relay-errors.mjs';
 import {
   createTurnLiveness,
@@ -4456,7 +4456,7 @@ export function createCopilotSdkSessionRunner({
     // Not in a continuation: there the running work is the runtime's own
     // follow-up, not a request of the user's to keep going with.
     // Nor in an event message the relay wrote: the note speaks as the user.
-    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' || isRelayEventDelivery(message) ? body : withSteerNote(body));
+    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' || isRelayAutomatedDelivery(message) ? body : withSteerNote(body));
     // Re-checked AFTER the awaits and before anything is sent or registered.
     // Nothing has been sent yet, so handing the row back to the normal path is
     // free.

package/server/db-schema.mjs

@@ -24,6 +24,11 @@ import { migrateConversationGroupPosition } from './migrations/0015-conversation
 import { migrateShareAccessLog } from './migrations/0016-share-access-log.mjs';
 import { migrateConversationHistoryIndexes } from './migrations/0017-conversation-history-indexes.mjs';
 import { migrateBackgroundTaskRows } from './migrations/0018-background-task-rows.mjs';
+import { migrateRelayEventSubscriptionOptions } from './migrations/0019-relay-event-subscription-options.mjs';
+import { migrateConversationMayCreateSessions } from './migrations/0020-conversation-may-create-sessions.mjs';
+import { migrateConversationGroupAgentMarks } from './migrations/0021-conversation-group-agent-marks.mjs';
+import { migrateRelaySchedules } from './migrations/0022-relay-schedules.mjs';
+import { migrateRelayAsks } from './migrations/0023-relay-asks.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -855,6 +860,53 @@ try {
   console.warn(`[background-tasks] migration 0018 failed; retrying on next boot: ${error?.message || error}`);
 }
 
+// Options of relay event subscriptions (digest, quiet hours, exclude) and the
+// watcher's own prompts: columns on 0011's table and one table. The event
+// service checks for them and refuses the options without them, so a failure
+// is logged and retried next boot like 0018.
+try {
+  migrateRelayEventSubscriptionOptions(db);
+} catch (error) {
+  console.warn(`[relay-events] migration 0019 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// The owner's "agents in this conversation may start sessions": one column.
+// Without it nobody can turn the switch on (the preferences route refuses
+// it) and the one-level rule holds for every session, so a failure is logged
+// and retried next boot like 0019.
+try {
+  migrateConversationMayCreateSessions(db);
+} catch (error) {
+  console.warn(`[remote-relays] migration 0020 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// What an agent's update_session may do to a group: two columns. Without
+// them an owner's group an agent emptied is kept until the next boot repair
+// only, so a failure is logged and retried next boot like 0020.
+try {
+  migrateConversationGroupAgentMarks(db);
+} catch (error) {
+  console.warn(`[session-groups] migration 0021 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// Relay schedules: one new table. The schedule service checks for it and
+// refuses the schedule actions without it, so a failure is logged and
+// retried next boot like 0021.
+try {
+  migrateRelaySchedules(db);
+} catch (error) {
+  console.warn(`[relay-schedules] migration 0022 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// Questions that don't block (remote_relay ask): one new table. The ask
+// service checks for it and refuses the ask actions without it, so a failure
+// is logged and retried next boot like 0022.
+try {
+  migrateRelayAsks(db);
+} catch (error) {
+  console.warn(`[relay-asks] migration 0023 failed; retrying on next boot: ${error?.message || error}`);
+}
+
 const runtimeSessionColumns = db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((c) => c.name);
 if (runtimeSessionColumns.length) {
   if (!runtimeSessionColumns.includes('strategy')) {

package/server/migrations/0019-relay-event-subscription-options.mjs

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * Migration: options of relay event subscriptions.
+ *
+ * Columns on `relay_event_subscriptions` (all NULL = off, as before):
+ *
+ * - `digest_minutes`: the subscription's non-urgent events are held and
+ *   delivered as one row every N minutes; `digest_last_at` is when its last
+ *   such row went out (the next one is due N minutes after it).
+ * - `quiet_hours_json`: `{ from, to, tz }`; non-urgent events in the window
+ *   are held until it ends.
+ * - `exclude_json`: session ids an "all" subscription leaves out.
+ *
+ * `relay_event_own_prompts`: the prompts a watcher sent through send or
+ * create_session (`message_id` is the prompt's), and when it received the
+ * finished reply (`received_at`): the turn_end of such a turn is not
+ * delivered to it again. Rows go after a day.
+ *
+ * Held events are ordinary undelivered `relay_events` rows: they and the
+ * timers rebuilt from them survive a restart without anything more here.
+ *
+ * Additive and idempotent. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0019-relay-event-subscription-options.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+export const RELAY_EVENT_OPTION_COLUMNS = Object.freeze([
+  ['digest_minutes', 'INTEGER'],
+  ['digest_last_at', 'TEXT'],
+  ['quiet_hours_json', 'TEXT'],
+  ['exclude_json', 'TEXT'],
+]);
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+export function migrateRelayEventSubscriptionOptions(db) {
+  if (!tableExists(db, 'relay_event_subscriptions')) {
+    throw new Error('relay_event_subscriptions is missing (migration 0011 has not run)');
+  }
+  const present = new Set(db.prepare(`PRAGMA table_info(relay_event_subscriptions)`).all().map((column) => column.name));
+  let columnsAdded = 0;
+  for (const [name, type] of RELAY_EVENT_OPTION_COLUMNS) {
+    if (present.has(name)) continue;
+    db.exec(`ALTER TABLE relay_event_subscriptions ADD COLUMN ${name} ${type}`);
+    columnsAdded += 1;
+  }
+  let tablesAdded = 0;
+  if (!tableExists(db, 'relay_event_own_prompts')) {
+    db.exec(`
+      CREATE TABLE relay_event_own_prompts (
+        message_id              TEXT PRIMARY KEY,
+        watcher_conversation_id TEXT NOT NULL,
+        relay_id                TEXT NOT NULL DEFAULT 'self',
+        session_id              TEXT NOT NULL,
+        created_at              TEXT NOT NULL,
+        received_at             TEXT
+      )
+    `);
+    tablesAdded += 1;
+  }
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_relay_event_own_prompts_created
+    ON relay_event_own_prompts(created_at)
+  `);
+  return { applied: columnsAdded > 0 || tablesAdded > 0, columnsAdded, tablesAdded };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateRelayEventSubscriptionOptions(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0019 on ${dbPath}`);
+    console.log(result.applied
+      ? `  relay event subscription options: columns added ${result.columnsAdded}, tables added ${result.tablesAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0019 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}

package/server/migrations/0020-conversation-may-create-sessions.mjs

@@ -0,0 +1,67 @@
+'use strict';
+
+/**
+ * Migration: the owner's "agents in this conversation may start sessions".
+ *
+ * `may_create_sessions` is 1 when the owner allowed the agents of a session
+ * that an agent started to start sessions on this relay themselves (the
+ * remote_relay tool's one-level rule is lifted for it); NULL or 0 otherwise.
+ * Only the owner sets it, in the conversation's settings or through the
+ * preferences route; no agent can.
+ *
+ * Additive and idempotent. Safe to run on every boot. Rolling back needs no
+ * data change: older code ignores the column and keeps the one-level rule.
+ *
+ * Usage: node server/migrations/0020-conversation-may-create-sessions.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+export function migrateConversationMayCreateSessions(db) {
+  if (!tableExists(db, 'conversations')) {
+    throw new Error('conversations is missing (the base schema has not run)');
+  }
+  const present = new Set(db.prepare(`PRAGMA table_info(conversations)`).all().map((column) => column.name));
+  if (present.has('may_create_sessions')) return { applied: false, columnsAdded: 0 };
+  db.exec(`ALTER TABLE conversations ADD COLUMN may_create_sessions INTEGER`);
+  return { applied: true, columnsAdded: 1 };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateConversationMayCreateSessions(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0020 on ${dbPath}`);
+    console.log(result.applied
+      ? `  may create sessions: columns added ${result.columnsAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0020 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}

package/server/migrations/0021-conversation-group-agent-marks.mjs

@@ -0,0 +1,77 @@
+'use strict';
+
+/**
+ * Migration: what an agent's update_session may do to a session group.
+ *
+ * - `conversation_groups.agent_made` is 1 for a group update_session made
+ *   (a name the relay did not have). Only such a group goes once an agent
+ *   takes its last member out.
+ * - `conversation_groups.kept_empty_at` is set when an agent took the last
+ *   member out of a group the owner made: the group stays (empty), the boot
+ *   repair and the sweep leave it alone, and agents can still name it. The
+ *   mark goes as soon as a member joins again.
+ *
+ * Additive and idempotent. Safe to run on every boot. Rolling back needs no
+ * data change: older code ignores both columns (its boot repair removes an
+ * empty group, as it always did).
+ *
+ * Usage: node server/migrations/0021-conversation-group-agent-marks.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+export function migrateConversationGroupAgentMarks(db) {
+  if (!tableExists(db, 'conversation_groups')) {
+    throw new Error('conversation_groups is missing (migration 0014 has not run)');
+  }
+  const present = new Set(db.prepare(`PRAGMA table_info(conversation_groups)`).all().map((column) => column.name));
+  let columnsAdded = 0;
+  if (!present.has('agent_made')) {
+    db.exec(`ALTER TABLE conversation_groups ADD COLUMN agent_made INTEGER`);
+    columnsAdded += 1;
+  }
+  if (!present.has('kept_empty_at')) {
+    db.exec(`ALTER TABLE conversation_groups ADD COLUMN kept_empty_at TEXT`);
+    columnsAdded += 1;
+  }
+  return { applied: columnsAdded > 0, columnsAdded };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateConversationGroupAgentMarks(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0021 on ${dbPath}`);
+    console.log(result.applied
+      ? `  group agent marks: columns added ${result.columnsAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0021 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}