@oar-sh/oar 0.9.17 → 0.9.19

package/.github/extensions/web-relay/server-lifecycle/managed-server.mjs

@@ -1,3 +1,5 @@
+import { relayRuntimeNodeFlags, relayRuntimeNodeFlagsOrNone } from "../../../../server/relay-heap-guard.mjs";
+
 export function createManagedServerLifecycle({
   api,
   dbg,
@@ -16,6 +18,8 @@ export function createManagedServerLifecycle({
   relayPort = 3333,
   nodeBin,
   serverStartTimeoutMs,
+  // The heap limit and heap snapshot flags every relay runtime starts with.
+  nodeFlags = relayRuntimeNodeFlags,
 }) {
   let managedServerProc = null;
   let managedServerStdoutFd = null;
@@ -301,7 +305,15 @@ export function createManagedServerLifecycle({
         if (startupWorkspaceRoot) {
           serverEnv.COPILOT_WORKSPACE_ROOT = startupWorkspaceRoot;
         }
-        managedServerProc = spawn(nodeBin, serverArgs, {
+        // The runtime runs in this process (--supervised): its Node flags go here.
+        const { flags } = relayRuntimeNodeFlagsOrNone(nodeFlags, {
+          env: serverEnv,
+          execArgv: [],
+          serverDir,
+          fsImpl: fs,
+          logger: { log: (line) => dbg(line) },
+        });
+        managedServerProc = spawn(nodeBin, [...flags, ...serverArgs], {
           cwd: serverDir,
           env: serverEnv,
           stdio: ["ignore", managedServerStdoutFd, managedServerStderrFd],

package/.github/extensions/web-relay/skills/tool-activity.mjs

@@ -3,7 +3,7 @@ import {
   formatToolResultActivity as formatSharedToolResultActivity,
   formatVoteMemoryActivity,
 } from "../../../../shared/tool-activity.mjs";
-import { isRemoteRelayToolName } from "../../../../shared/remote-relay-tool-core.mjs";
+import { REMOTE_RELAY_TOOL_NAME, isRemoteRelayToolName } from "../../../../shared/remote-relay-tool-core.mjs";
 import { summarizeRemoteRelayCall } from "../../../../shared/remote-relay-contract.mjs";
 
 export function normalizeActivityText(value, maxToolDetailLength = 140) {
@@ -135,10 +135,11 @@ export function formatToolActivity(request, maxToolDetailLength = 140) {
   if (lower.includes("report_intent")) {
     return detail ? `● ${detail}` : "● Working…";
   }
-  // The OAR MCP server's tool reaches the CLI as `oar-remote_relay`: show the
-  // same line every other engine writes for it.
+  // The OAR MCP server's tool reaches the CLI as `oar-relay_tool` (up to
+  // 0.9.17 `oar-remote_relay`): show the same line every other engine writes
+  // for it.
   if (isRemoteRelayToolName(rawName)) {
-    return `Tool (remote_relay): ${summarizeRemoteRelayCall(toolArgsSnapshot(request))}`;
+    return `Tool (${REMOTE_RELAY_TOOL_NAME}): ${summarizeRemoteRelayCall(toolArgsSnapshot(request))}`;
   }
   return detail ? `Tool (${rawName}): ${detail}` : `Tool (${rawName})`;
 }

package/CHANGELOG.md

@@ -3,6 +3,240 @@
 All notable changes to OAR are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [0.9.19] — 2026-10-27
+
+Highlights: a relay that runs out of memory is restarted instead of staying
+down. Its runtime starts with a heap limit, set with `heapLimitMb` in
+`config.json`, and writes one heap snapshot when it nears that limit; a
+snapshot holds the relay's auth token and API keys, so never share one as it
+is. Agent sessions can use the providers a relay update added without a
+restart of their own, and Copilot refuses another provider's model id before
+it creates anything.
+
+### Fixed
+
+- **A relay that runs out of memory is restarted.** A relay runtime that ran
+  out of memory ended the relay for good. Its supervisor took the
+  out-of-memory abort for a clean stop and exited 0, which systemd does not
+  restart. The runtime is now relaunched like any crash. It starts with a heap
+  limit (60 % of RAM, 2048–8192 MB, set with `heapLimitMb` in `config.json`)
+  and writes one heap snapshot to `diagnostics` in the data directory when it
+  nears that limit. A heap snapshot holds the relay's auth token and API keys:
+  never share one as it is. The status log shows its memory every 10 minutes
+  and when the heap passes 80 % of the limit.
+- **`relay_tool` takes any provider id.** Agent sessions started before a
+  relay update refused the providers the update added (such as `deepseek` and
+  `claude-api`) in `relay_tool`'s `create_session` and `send`. The tool now
+  takes any provider id; the relay checks it against its current list and
+  names that list when it refuses one.
+- **Copilot refuses another provider's model id before creating anything.** A
+  Copilot session given another provider's model id (such as `claude-opus-5-5`
+  for Copilot's `claude-opus-5.5`) was created and then refused with
+  `CURSOR_MODEL_REQUIRES_NEW_CONVERSATION`. Copilot now refuses such an id
+  with `COPILOT_MODEL_UNAVAILABLE` and the close match before anything is
+  created, and a first prompt refused after `create_session` made the session
+  names that session.
+
+### Upgrade notes
+
+- **Agent sessions started before 0.9.19 keep their provider list:** their
+  workers keep running through the update, with the `relay_tool` they
+  started with. That list is the one 0.9.19 has, so nothing changes now; it
+  lacks the providers a later update adds until the session's worker
+  restarts, for example after **☠️ Kill session** in the `⋯` menu.
+
+## [0.9.18] — 2026-10-26
+
+Highlights: Claude chats can run on a Claude Console API key. Claude API is
+a provider beside your subscription, with an optional monthly spend cap and
+a card in Check Usage with the estimated spend. A Claude chat can switch
+between the subscription and the key and keep its Claude Code session, also
+when it is paused at the usage limit. The relay's agent tool is now called
+`relay_tool`. DeepSeek and Claude API chats start with all hooks off, and a
+subscription chat no longer runs on an API key that Claude Code's settings
+hand it.
+
+### Added
+
+- **Claude API: Claude chats on a Claude Console API key.** A provider
+  beside Claude (your subscription), billed to the Console organisation
+  the key belongs to.
+  - Settings → Providers → Claude API holds the key, the switch, the
+    default model and an optional monthly spend cap in US dollars. The key
+    is stored on the relay host and never shown again: the tab only says
+    that one is saved. Any `sk-ant-` Console key is taken; Claude login
+    and session tokens and Admin keys are refused when you save. A key
+    Anthropic itself refuses stays saved, and the tab's status line says
+    so until a save or Refresh models goes through. A cap the field cannot
+    take is named under the field.
+  - The relay lists the key's models from Anthropic when the key is saved,
+    when Claude API is switched on again, and on Refresh models. Until
+    then it offers the Claude tab's models.
+  - Commit attribution, the background command limit, the effort levels
+    and the compaction window stay on the Claude tab, shared by both; the
+    Claude API tab links there.
+  - New Chat offers Claude API, Select Models has a Claude API tab, and
+    its chats show a gold "Claude API" pill and "🔒 Session locked to
+    Claude API models."
+  - A turn that Claude API refuses or could not run ends with buttons:
+    Claude API settings (at the cap field when the monthly cap is
+    reached), Switch to subscription, Add funds, Console billing or
+    Console limits, as fits the reason.
+  - When the relay refuses to start a Claude API chat (the monthly cap, no
+    key, switched off), New Chat stays open with the reason, Claude API
+    settings, and Start on subscription, which starts the same chat on
+    the Claude provider; on a phone the dialog scrolls to it.
+- **Switch a Claude chat between your subscription and the Claude API
+  key.** `POST /api/conversation/:id/billing` moves a chat between
+  `claude` (the subscription) and `claude-api` (the saved key). It keeps
+  its Claude Code session.
+  - In the browser, a Claude chat has a `Subscription | API key` toggle
+    under the lock note while Claude API is on with a saved key. It says
+    what a pending switch waits for, and why a side cannot be chosen; at
+    the monthly cap it says the chat stays on the subscription, and so
+    does the usage-limit banner.
+  - The switch applies from the next turn: a running turn finishes on the
+    billing it started on. Messages already queued run on the new one.
+  - The relay restarts the chat's Claude Code between turns. It waits
+    while a turn, a question, a compaction or a background task is still
+    running.
+  - The transcript notes each switch. The first turn on the key has no
+    prompt cache and costs more.
+  - The switch is refused, with the reason, when the key is missing or
+    Claude API is off, when the monthly cap is reached, or when the
+    chat's model is not on the target's model list.
+- **Switch this chat to API key at the usage limit.** When a subscription
+  chat is paused at the Claude usage limit, the banner offers the switch
+  if the chat may move to the key. The paused turn then carries on on
+  the key at once. Nothing switches by itself.
+- **Agents can switch a Claude session's billing.** `relay_tool` `send`
+  takes `provider` (`claude` or `claude-api`) for a Claude session. The
+  other billing switches the session together with the message:
+  - in one call, so a refused switch sends nothing and a refused message
+    switches nothing;
+  - the approval card says "Switches billing to API key";
+  - a relay from before this version refuses it and sends nothing.
+- **A Claude API card in Check Usage.** It shows what this relay's turns
+  on the Claude API key are estimated to have cost today and this month,
+  per model, with the tokens, and the monthly cap as a bar when one is set.
+  - The figures are Claude Code's own estimate from its price table, so
+    sub-agents, compaction and web search are in them. The Console's
+    billing page (linked) has the real figures and the balance.
+  - Days and the month follow the relay's time zone, and the cap starts
+    over at local midnight on the 1st.
+  - Tokens Claude Code has no price for show as "no price known" or
+    "estimate incomplete", never as $0.
+  - Turns paid from a Max or Team plan's subscriber API credit are counted
+    too; OAR cannot see that credit.
+  - The card stays while a key is saved, also with Claude API switched
+    off, so the month's spend stays in view (DeepSeek's card goes with the
+    provider).
+- **A monthly cap for Claude API.** Once this month's estimate reaches the
+  cap set in Settings → Providers → Claude API:
+  - a new turn on the key does not run: the chat gets a note with the code
+    `relay.claude-api-cap-reached`. A turn Claude Code starts by itself,
+    when a background task reports back, gets the note and that chat's
+    background tasks are stopped as soon as the relay hears of the turn,
+    since each report would start another such turn; the turn itself is
+    stopped when the worker takes the stop. Its first request may already
+    be billed, and a short turn can end before the stop arrives. The note
+    also mentions tasks no stop reaches, since they can keep starting such
+    turns and keep a switch to the subscription waiting. The note comes
+    once per chat until the cap clears, a Claude API setting is saved, or a
+    turn of that chat runs on the key again. The same stop applies when
+    Claude API has no key or is switched off;
+  - a switch to the key is refused;
+  - an agent's send to a session on the key and a new Claude API chat (New
+    Chat or an agent's `create_session`) get 409 `CLAUDE_API_CAP_REACHED`,
+    and nothing is queued or created.
+
+  A turn that is already running finishes. A turn's cost is booked when it
+  ends, so running turns can take the month past the cap. The cap counts
+  only the priced part of the estimate. If the spend cannot be read, the cap counts as
+  reached. Console spend limits still apply on top.
+
+### Changed
+
+- **A send does not switch a Claude chat's billing.** A message that
+  names the other billing gets 409 `CLAUDE_BILLING_SWITCH_REQUIRED`
+  (before, a Claude API chat ignored `provider: "claude"`). A message
+  from a page that still showed the other billing gets 409
+  `CLAUDE_BILLING_CHANGED`. Its text goes into the chat's draft, so the
+  page, and a send replayed from the offline outbox, lose nothing. The
+  outbox keeps the text only, not attachments.
+
+- **No hooks or status line run in DeepSeek chats.** In 0.9.17, Claude Code
+  in a DeepSeek chat ran the hooks and the `statusLine` command of
+  DeepSeek's settings folder, of the chat folder's `.claude/settings.json`
+  and `settings.local.json`, and of plugins, as the relay's user with the
+  DeepSeek key in their environment; a folder's `SessionStart` hook ran
+  before the relay had pinned the endpoint and key. Now those chats start
+  with all hooks off, and so do Claude API chats. The setting is on Claude
+  Code's command line, so it is in force from the start, and a folder's
+  settings can't turn it back on (`scripts/claude-cli-hooks-proof.mjs`
+  shows it on the bundled Claude Code). Hooks in managed settings still
+  run. Chats on your Claude login keep their hooks and status line. The
+  agent's own commands can still read the key; the relay redacts it in
+  what it shows.
+- **The relay's agent tool is now called `relay_tool`.** It was
+  `remote_relay`, and it is listed under the new name on every provider
+  (Claude's `mcp__relay__relay_tool`), with the same actions and fields; the
+  docs and the agents' instructions use it too. OAR's own MCP server, which
+  Grok and the Copilot extension engine use, still runs a call to
+  `remote_relay` but no longer lists it. Tool lines written under the old
+  name still show as this tool.
+  - If your own instructions, permission rules or hooks name `remote_relay`
+    or `mcp__relay__remote_relay`, change them to `relay_tool` or
+    `mcp__relay__relay_tool`: outside OAR's MCP server the old name is
+    refused.
+- **A subscription chat never runs on an API key.** Claude Code takes an
+  API key over your Claude login when one of its settings hands it one:
+  - `env.ANTHROPIC_API_KEY` in `~/.claude/settings.json` or the chat
+    folder's `.claude/settings*.json`;
+  - an `apiKeyHelper`;
+  - a Console login.
+
+  Until now such a chat ran on that key and billed the key's owner. Now
+  the turn stops at Claude Code's start, with a note naming the source
+  and the setting to remove. At most one model request, sent a moment
+  after that start, can go out first.
+
+- **The docs cover Claude API.** The providers guide has a Claude API
+  section: the key, the models, the shared `~/.claude`, the billing switch
+  and when it applies, what fails closed, the monthly cap and the
+  subscriber API credit. The web UI, configuration, security,
+  agents-together and troubleshooting pages, the README, the server
+  README and DEVELOPING.md (the worker and its live check) cover it too,
+  and the feature tracker has a Claude API page. Troubleshooting has two
+  known gaps:
+  - a key that is not tied to a workspace gets HTTP 400 from Anthropic;
+    for now, create the key inside a workspace (naming the workspace in
+    OAR is planned);
+  - a model Claude Code has no price for (currently Claude Haiku 5.5)
+    shows "no price known" on the Claude API card, and its tokens are left
+    out of the estimate.
+- **Corrections to the 0.9.17 notes:**
+  - DeepSeek's budget bar changes colour at 50 % and 75 % of the budget
+    and turns red at 90 %; the notes said amber near it and red over it.
+  - The composer's context chip shows DeepSeek's 1M window (1,048,576
+    tokens) as `1.05M`.
+  - The `preview` tool's hint to bind a dev server to 127.0.0.1 reaches
+    only sessions that have the tool (Claude, Claude API, DeepSeek, Cursor,
+    and Grok and Copilot's Extension engine through OAR's MCP server), not
+    every provider. Copilot's SDK engine, and those two when the relay runs
+    with `OAR_MCP_SERVER=0`, are taught the preview API without it.
+
+### Upgrade notes
+
+- **Downgrading to 0.9.17:** first switch Claude chats on the Claude API
+  key back to Subscription. 0.9.17 does not know Claude API, so a chat
+  left on the key runs as a Copilot chat there. That now includes a chat
+  that started on the subscription and was switched to the key. 0.9.17
+  ignores the new database columns and tables. The two triggers on the
+  queue table keep stamping its new column there, which does no harm.
+- **Downgrading to 0.9.17 turns hooks back on in DeepSeek chats:** they
+  run the hooks and status line of their settings folders again.
+
 ## [0.9.17] — 2026-10-25
 
 Highlights: DeepSeek is a provider of its own. Paste a DeepSeek API key and

package/README.md

@@ -27,7 +27,7 @@ flowchart LR
   end
   subgraph host["Your computer"]
     relay["OAR relay<br/>chats, queue, history, files"]
-    agents["Copilot · OpenAI · Claude<br/>Cursor · Grok · DeepSeek"]
+    agents["Copilot · OpenAI · Claude · Claude API<br/>Cursor · Grok · DeepSeek"]
   end
   cloud["☁️ Claude Cloud<br/>sandbox at Anthropic"]
   phone <--> relay
@@ -36,7 +36,7 @@ flowchart LR
   relay <--> cloud
 ```
 
-- **Seven runtimes, one chat**: you pick the agent per conversation, and all of them share the same chat, queue, history, file browser, and question cards ([Runtimes](#runtimes)).
+- **Eight runtimes, one chat**: you pick the agent per conversation, and all of them share the same chat, queue, history, file browser, and question cards ([Runtimes](#runtimes)).
 - **Yours**: the relay runs on your hardware, answers only on this machine until you change that, and collects no telemetry ([Security notes](#security-notes)).
 - **Under active development**: expect occasional rough edges, and some provider SDK features that are missing or incomplete.
 
@@ -45,29 +45,29 @@ flowchart LR
 <table>
 <tr>
 <td width="42%" rowspan="4" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.17" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.19" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
 <br><sub>On a phone: the same conversations, installable as an app.</sub>
 </td>
 <td width="58%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.17" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.19" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
 <br><sub>Agents working in parallel, each with live token counts and its own Stop.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.17" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.19" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
 <br><sub>When the agent needs a decision, it asks, and waits for your answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.17" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
+<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.19" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
 <br><sub>Read the reasoning, not just the answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.17" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
+<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.19" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
 <br><sub>Agents that watch agents: woken by events, approving nothing.</sub>
 </td>
 </tr>
@@ -102,6 +102,7 @@ The runtime (the *provider* in the UI) is chosen in **New Chat** and stays fixed
 | [**OpenAI (BYOK)**](docs/providers.md#openai-byok-and-openai-image) | Copilot's agent against OpenAI or a compatible endpoint | Your own API key |
 | [**OpenAI Image**](docs/providers.md#openai-byok-and-openai-image) | A chat whose replies are images | The same key |
 | [**Claude**](docs/providers.md#claude-agent-sdk) | Claude Code on your machine | A Claude login, made from **⚙️ Settings** |
+| [**Claude API**](docs/providers.md#claude-api) | Claude Code on your machine, billed to a Claude Console API key; a Claude chat can switch between the two | A Claude Console API key |
 | [**Claude Cloud**](docs/providers.md#claude-cloud) (experimental) | Claude Code in a sandbox at Anthropic, on a GitHub repository | A claude.ai account with GitHub connected |
 | [**Cursor**](docs/providers.md#cursor-agent-sdk) | Cursor's agent | A Cursor API key |
 | [**Grok**](docs/providers.md#grok-cli-acp) | xAI's Grok CLI | A Grok sign-in, made from **⚙️ Settings** |
@@ -117,11 +118,11 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 <table>
 <tr>
 <td width="62%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.17" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.19" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
 <br><sub>Send a message while the agent works, and it steers the running turn.</sub>
 </td>
 <td width="38%" valign="top">
-<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.17" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
+<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.19" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
 <br><sub>What each plan has left, in one place.</sub>
 </td>
 </tr>
@@ -133,12 +134,12 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 - **Background work**: a task panel lists the commands and sub-agents that outlive a reply, each with its own **Stop** and its full record; a command's console shows its output live, says when it has gone quiet and counts a test run's passes and failures; the panel and its consoles come back after a relay restart, and a queued restart shows what it waits for and asks after a maximum wait ([Background tasks](docs/web-ui.md#background-tasks), [After a relay restart](docs/web-ui.md#after-a-relay-restart)).
 - **Choose how the agent works**: `ask`, `plan`, `agent` or `autopilot`, plus model and reasoning effort, per message ([Relay modes](docs/web-ui.md#relay-modes)).
 - **Files and git**: browse the workspace, preview files, review git changes in a diff viewer, and publish a dev server as a preview link ([Files, git, and previews](docs/web-ui.md#files-git-and-previews), [preview servers](docs/preview-servers.md)).
-- **Usage and context**: plan limits and credits of every provider, and what fills the model's context window ([Usage and context](docs/web-ui.md#usage-and-context)).
+- **Usage and context**: plan limits and credits of every provider, the estimated spend of DeepSeek and Claude API keys, and what fills the model's context window ([Usage and context](docs/web-ui.md#usage-and-context)).
 - **Your conversations everywhere**: the history lives on the relay, drafts follow you from device to device, and conversations can be searched, archived, grouped and pinned ([The conversation list](docs/web-ui.md#the-conversation-list), [drafts](docs/web-ui.md#drafts-across-devices), [session groups](docs/web-ui.md#session-groups), [pins](docs/web-ui.md#pinned-messages)).
 - **Share** a conversation as a read-only link, hide single messages and the host's paths from it, and see when it was opened ([Sharing](docs/web-ui.md#sharing)).
 - **On your phone**: install OAR as an app and get push notifications ([Notifications and the app](docs/web-ui.md#notifications-and-the-app)).
 
-The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.17](CHANGELOG.md#0917--2026-10-25) as the latest.
+The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.19](CHANGELOG.md#0919--2026-10-27) as the latest.
 
 ## Remote access
 
@@ -189,7 +190,7 @@ flowchart LR
 
 You stay in charge: per paired relay you decide whether agents may only read, also prompt, or do everything, and in the `ask` and `plan` modes every write asks you first. A subscription only notifies; it approves nothing.
 
-<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.17"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.17"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.17" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
+<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.19"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.19"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.19" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
 
 How pairing, permissions and limits work is in [Agents working together](docs/agents-together.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",