@oar-sh/oar 0.9.19 → 0.9.21

package/server/public/sw.js

@@ -191,6 +191,14 @@ async function handleNotificationClick(event) {
       if (ok) return;
     }
   }
+  // A card on a paired relay: it carries no question id, only the
+  // link of its session there, and is answered there ("Open there").
+  const url = String(data.url || '');
+  if (!data.questionId && /^https?:\/\//i.test(url)) {
+    event.notification.close();
+    await self.clients.openWindow(url);
+    return;
+  }
   event.notification.close();
   await focusOrOpenConversation(String(data.conversationId || ''));
 }

package/server/relay-heap-guard.mjs

@@ -141,7 +141,9 @@ export function configuredHeapLimit({ configPath, fsImpl = fs } = {}) {
   return Number.isInteger(mb) && mb >= MIN_HEAP_LIMIT_MB ? { mb } : { invalid: value };
 }
 
-function freeBytes(dir, fsImpl) {
+// Free bytes on the disk of `dir`, or null when unknown. Also used by the
+// database backup's space check (db-backup-service.mjs), with diskBytes.
+export function freeBytes(dir, fsImpl) {
   try {
     if (typeof fsImpl.statfsSync !== 'function') return null;
     const stats = fsImpl.statfsSync(dir);
@@ -151,6 +153,17 @@ function freeBytes(dir, fsImpl) {
   }
 }
 
+// The size of the disk of `dir`, or null when unknown.
+export function diskBytes(dir, fsImpl) {
+  try {
+    if (typeof fsImpl.statfsSync !== 'function') return null;
+    const stats = fsImpl.statfsSync(dir);
+    return Number(stats.blocks) * Number(stats.bsize);
+  } catch {
+    return null;
+  }
+}
+
 /** A path for the log: `~` for the home folder, so a log line names no user. */
 export function displayPath(target, homeDir = os.homedir()) {
   const resolved = path.resolve(String(target || ''));

package/server/relay-self-restart.mjs

@@ -1,7 +1,8 @@
-import { spawn } from 'child_process';
+import { spawn, spawnSync } from 'child_process';
 import path from 'path';
 import { RELAY_RESTART_EXIT_CODE, RELAY_STOP_EXIT_CODE } from './relay-exit-codes.mjs';
 import { relayRuntimeNodeFlags, relayRuntimeNodeFlagsOrNone } from './relay-heap-guard.mjs';
+import { detectRelayHosting } from './services/relay-restart-picture.mjs';
 
 // Role selection travels on argv, never in the environment. The runtime's env is
 // inherited by tmux worker sessions and by the Copilot CLI it launches, and the
@@ -76,6 +77,64 @@ function waitForChildExit(child) {
   });
 }
 
+// A systemctl --user call of the handover: its result, never a throw.
+function runSystemctl(spawnSyncImpl, args) {
+  try {
+    return spawnSyncImpl('systemctl', ['--user', ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000 }) || { status: null };
+  } catch (error) {
+    return { status: null, error };
+  }
+}
+
+function systemctlFailure(result) {
+  if (result.error) return result.error.message || String(result.error);
+  const said = String(result.stderr || '').trim().split('\n')[0];
+  return `status ${result.status ?? 'none'}${said ? `: ${said}` : ''}`;
+}
+
+/**
+ * The runtime asked for a restart (exit 75). Under a user service whose main
+ * process this supervisor is, systemd restarts the whole service, so the new
+ * supervisor and runtime run the code on disk with fresh Node flags: true
+ * once systemd's stop (SIGTERM) has come. False, with one log line, wherever
+ * that cannot be done (not the unit's main process: a relay started inside a
+ * worker of the service), systemctl fails, or no stop comes within
+ * `handoverWaitMs`; the caller relaunches the runtime itself then.
+ */
+async function handRestartToSystemd({ hosting, spawnSyncImpl, pid, handoverWaitMs, shutdownRequested, isShuttingDown, delay, logger }) {
+  if (!hosting?.systemd || !hosting.userManager || !hosting.unit) return false;
+  const { unit } = hosting;
+  const main = runSystemctl(spawnSyncImpl, ['show', '-p', 'MainPID', '--value', unit]);
+  const mainPid = Number(String(main.stdout ?? '').trim());
+  if (main.status !== 0 || mainPid !== pid) {
+    const whose = main.status === 0 ? `its main process is ${mainPid || 'none'}` : `its main process could not be read (${systemctlFailure(main)})`;
+    logger?.log?.(`[relay] restart: not handed to systemd, ${unit} is not this supervisor's (pid ${pid}; ${whose}).`);
+    return false;
+  }
+  // Clears a failed state and the restart backoff; restart's answer alone decides.
+  runSystemctl(spawnSyncImpl, ['reset-failed', unit]);
+  // A stop that came in meanwhile wins: a queued restart could replace its job.
+  // The calls above block; a signal that arrived during them waits on the
+  // signal pipe, which only the loop's poll phase reads. This runs from the
+  // runtime's 'exit' callback, itself in a poll phase, so one setImmediate
+  // would run in the check phase right after it, before the pipe is read;
+  // the second runs after the next poll phase has delivered the signal.
+  await new Promise((resolve) => setImmediate(() => setImmediate(resolve)));
+  if (isShuttingDown()) {
+    logger?.log?.(`[relay] restart: a stop came in; not restarting ${unit}.`);
+    return true;
+  }
+  const restart = runSystemctl(spawnSyncImpl, ['restart', '--no-block', unit]);
+  if (restart.status !== 0) {
+    logger?.log?.(`[relay] restart: systemctl --user restart --no-block ${unit} failed (${systemctlFailure(restart)}).`);
+    return false;
+  }
+  logger?.log?.(`[relay] restart handed to systemd: ${unit} restarts with the code on disk.`);
+  const stopped = await Promise.race([shutdownRequested.then(() => true), Promise.resolve(delay(handoverWaitMs)).then(isShuttingDown)]);
+  if (!stopped) logger?.log?.(`[relay] restart: systemd did not stop ${unit} within ${Math.round(handoverWaitMs / 1000)} s.`);
+  return stopped;
+}
+
 export async function runDirectRelaySupervisor({
   scriptPath,
   args = [],
@@ -96,16 +155,26 @@ export async function runDirectRelaySupervisor({
   // crashes days apart are not a crash loop.
   crashCountResetMs = 10 * 60 * 1000,
   now = Date.now,
+  // How this process is run (detectRelayHosting); read at the first restart
+  // request when not given.
+  hosting = null,
+  spawnSyncImpl = spawnSync,
+  pid = process.pid,
+  // How long a restart handed to systemd waits for its SIGTERM.
+  handoverWaitMs = 30_000,
 } = {}) {
   let runtimeProc = null;
   let shuttingDown = false;
   let shutdownExitCode = 0;
+  let shutdownArrived;
+  const shutdownRequested = new Promise((resolve) => { shutdownArrived = resolve; });
 
   const requestShutdown = (signal = 'SIGTERM', exitCode = 0) => {
     if (shuttingDown) return;
     shuttingDown = true;
     shutdownExitCode = exitCode;
     stopChildProcess(runtimeProc, { signal });
+    shutdownArrived();
   };
 
   const handleSigInt = () => requestShutdown('SIGINT', 0);
@@ -165,8 +234,20 @@ export async function runDirectRelaySupervisor({
         : null;
       const signal = exitCode === null ? (result.signal || null) : null;
       if (exitCode === RELAY_RESTART_EXIT_CODE) {
-        logger?.log?.(`[relay] runtime requested restart; relaunching ${path.basename(String(scriptPath || ''))}...`);
         crashCount = 0;
+        const handedOver = await handRestartToSystemd({
+          hosting: hosting || detectRelayHosting({ env }),
+          spawnSyncImpl,
+          pid,
+          handoverWaitMs,
+          shutdownRequested,
+          isShuttingDown: () => shuttingDown,
+          delay,
+          logger,
+        });
+        // systemd's stop: this supervisor ends, systemd starts the next one.
+        if (handedOver || shuttingDown) return await exitImpl(shutdownExitCode);
+        logger?.log?.(`[relay] runtime requested restart; relaunching ${path.basename(String(scriptPath || ''))}...`);
         await delay(restartDelayMs);
         continue;
       }

package/server/relay-tools.md

@@ -39,10 +39,12 @@ A paired relay stays locked until the user mentions it in this conversation (`@n
 
 This relay itself is listed with "self": true when its owner switched agent sessions on, and is addressed by its name or as "this"; it needs no mention. Use it to hand parts of your task to other sessions:
 
-- `create_session` starts a session with any provider that `relay_info` lists: a local one in a folder ("cwd"), or provider "claude-cloud" with "repo" (a GitHub URL or owner/repo) and an optional "branch". The provider ids are the target relay's, as `relay_info` shows them; an id it does not know is refused with the list it has. A session started before a relay update can use providers the update added, without a restart. At most 4 sessions you started may work at the same time; a fifth is refused until one finishes.
+- `create_session` starts a session with any provider that `relay_info` lists: a local one in a folder ("cwd"), or provider "claude-cloud" with "repo" (a GitHub URL or owner/repo) and an optional "branch". The provider ids are the target relay's, as `relay_info` shows them; an id it does not know is refused with the list it has. A session started before a relay update can use providers the update added, without a restart. Without "mode" the new session gets your session's relay mode. At most 4 sessions you started may work at the same time; a fifth is refused until one finishes.
 - The first `create_session` on this relay shows the user an approval card, once per conversation. A session that an agent created cannot create sessions itself (one level only), unless the owner allowed it for that session: `list_sessions` and `read_session` then show "mayCreateSessions": true. Only the owner sets that.
 - Sessions you start here are grouped under this session in the user's sidebar. `list_sessions` lists in the sidebar's order (a group sorts by its newest session, head first) and shows the group as a "group" field (id, name, role); `read_session` adds the group's live members with their state. `create_session` takes "group" (a group id, or its name in any case, from `relay_info`'s "groups") to put the new session into an existing group instead, here or on a paired relay; an unknown group is refused with the groups listed and nothing is created, and the result carries the "group". Renaming and dissolving groups is the user's.
-- `update_session` ("session" plus any of "model", "effort", "mode", "auto_compact_window", "title", "group", "thinking_enabled", "thinking_display", "cwd") changes another session's settings for its next turns without prompting it, here or on a paired relay, and answers the settings and "changed"; a group name that does not exist makes one, "none" takes the session out (a group the user made stays, even empty; one update_session made goes once empty), a new "cwd" restarts its CLI there (refused while it works), "auto_compact_window" 0 is the model default. The model is checked as for `send`. A failed call still lists in "changed" what it wrote before the failing step. A mode set this way lasts until the next `send` that names another mode or comes from a caller in another mode: a `send` without "mode" passes the caller's own mode.
+- `list_sessions` and `read_session` show a session's worker process, while it has one, as "worker" (kind, buildId, stale); "stale": true means it runs older code than that relay, which replaces it by itself once the session is idle, so there is nothing to do about it.
+- `update_session` ("session" plus any of "model", "effort", "mode", "auto_compact_window", "title", "group", "thinking_enabled", "thinking_display", "cwd", "planOnly") changes another session's settings for its next turns without prompting it, here or on a paired relay, and answers the settings and "changed"; a group name that does not exist makes one, "none" takes the session out (a group the user made stays, even empty; one update_session made goes once empty), a new "cwd" restarts its CLI there (refused while it works), "auto_compact_window" 0 is the model default. The model is checked as for `send`. A failed call still lists in "changed" what it wrote before the failing step. A mode set this way lasts until the next `update_session` that names another mode; a `send` that names a mode runs only that turn in it, and one without "mode" leaves the session in its own mode.
+- "planOnly": true makes a plan-only session: agents can't take it out of plan mode. Set it only when the user asks; plan mode alone never sets it. `create_session` with "planOnly": true and no "mode" starts in plan; with another mode named it is refused and nothing is created. A target relay too old for planOnly creates the session without the lock and says so in "planOnlyWarning". `update_session` with "planOnly": true sets it on an existing session (with "mode": "plan" unless it is in plan already). While it is set, a `send` or `update_session` that names another mode is refused with 409, code "plan_only" ("This session is plan-only; agents can't change its mode. Clear planOnly first, or ask the user."); a `send` without "mode" runs in the session's saved mode. To clear it, pass "planOnly": false in the same `update_session` that names the new mode (`{"planOnly":false,"mode":"agent"}`); alone, or with "mode": "plan", it is ignored, and on a plan-only session the answer notes "planOnly unchanged: clear it in the same call as the new mode." Use `update_session` for all this, not the preferences route (it refuses an agent's mode change with 409 and any planOnly change with 403). `list_sessions` and `read_session` show "planOnly": true. In a plan-only conversation you count as a plan-mode caller, also in the one agent turn after "Approve plan": your `create_session` defaults to plan and your write actions ask the user first.
 - Only a session your conversation started may be updated freely; any other (the user's, another agent's, the one that started you) needs the user's approval card once per conversation and relay (refused: `REMOTE_RELAY_PERMISSION`); never your own conversation.
 - A "model" for `create_session` or `send` must be an id `relay_info` lists for the provider (Claude also takes "opus", "sonnet", "haiku"). An unknown id is refused with the close matches and the valid ids (`Unknown model 'gpt-5-4' for Copilot on relay "…"; did you mean 'gpt-5.4'? Valid ids: … Nothing was sent.`), and nothing is created or sent: pick from the list instead of guessing. Copilot ids use dots (`claude-opus-5.5`, not the Claude form `claude-opus-5-5`); a hyphen form is refused with the close match named, and a Copilot session never moves to another provider because of its model name. If the answer has a "modelNote" saying the model could not be checked, the relay had no model list yet.
 - A new session knows nothing of this conversation: write a self-contained prompt. A Claude Cloud session works on a fresh clone in a sandbox at Anthropic, so name the branch it should work on and push.
@@ -51,7 +53,7 @@ This relay itself is listed with "self": true when its owner switched agent sess
 - Pass only the arguments an action takes. `create_session` and `update_session` refuse any other one, list their valid arguments, and change nothing; every other action still runs and names the arguments it did not take in "ignored".
 - `read_task_output` ("session", "task_id" from `read_session`'s tasks, optional "lines") reads the end of a background shell or Monitor task's output, also for an hour after it ended: the last lines, minutes since its last output, and pass/fail counts for a test run. Credentials are scrubbed out.
 
-On this relay and on a paired one, `subscribe` ("sessions": ids, or ["all"]) wakes you when something happens in the sessions you watch, instead of polling them. Leave "events" out unless you need more: the default (question_asked, error, turn_end, subagent_finished, task_failed, stalled, all_idle) wakes you for questions, errors, replies, finished sub-agents, failed tasks (a non-zero exit included), stalls and all_idle, but not for each shell command that ended well. To get those too, pass that list plus "task_finished" (and "task_started" for the starts); each one costs you a turn, so do it only if you must follow every command. "relay_restarted" (this relay only, never in the default) wakes you when the relay runs again after a restart, with who requested it and why; named alone it needs no sessions.
+On this relay and on a paired one, `subscribe` ("sessions": ids, or ["all"]) wakes you when something happens in the sessions you watch, instead of polling them. Leave "events" out unless you need more: the default (question_asked, error, turn_end, subagent_finished, task_failed, stalled, all_idle, board_settled) wakes you for questions, errors, replies, finished sub-agents, failed tasks (a non-zero exit included), stalls, all_idle and a plan card the user settled (board_settled: the button chosen and the message it queued, if any), but not for each shell command that ended well. To get those too, pass that list plus "task_finished" (and "task_started" for the starts); each one costs you a turn, so do it only if you must follow every command. "relay_restarted" (this relay only, never in the default) wakes you when the relay runs again after a restart, with who requested it and why; named alone it needs no sessions.
 
 Each wake-up costs you a turn; these `subscribe` options cut them (questions and errors always come at once):
 - "digest_minutes": N gathers the subscription's other events into one message every N minutes (1 to 1440).

package/server/repositories/message-repository.mjs

@@ -5,6 +5,33 @@ import { createMessagePinStatements } from './message-pin-statements.mjs';
 import { createConversationHistoryPageStatements } from '../services/conversation-history-page.mjs';
 import { sessionWorkerProviderSqlList } from '../../shared/provider-routing.mjs';
 
+/**
+ * The claim's plan-boundary hold, part of every findPending*
+ * statement: a pending row waits while its conversation has a live turn on
+ * the other side of plan mode, because handing it to the worker would steer
+ * it into that turn and switch what the turn may do. The conversation's later
+ * rows wait behind it whatever their mode, so one conversation keeps its
+ * order, while the claim goes on to other conversations' rows.
+ * `PLAN_BOUNDARY_HOLD_MARK` lets a test find any claim without it.
+ */
+export const PLAN_BOUNDARY_HOLD_MARK = '/* plan-boundary-hold */';
+
+export function planBoundaryHoldSql(alias) {
+  return `${PLAN_BOUNDARY_HOLD_MARK} NOT EXISTS (
+    SELECT 1
+    FROM queue held
+    JOIN queue live
+      ON live.conversation_id = held.conversation_id
+     AND live.status = 'processing'
+     AND live.id != held.id
+    WHERE held.conversation_id = ${alias}.conversation_id
+      AND held.status = 'pending'
+      AND COALESCE(held.kind, '') != 'continuation'
+      AND (held.timestamp < ${alias}.timestamp OR (held.timestamp = ${alias}.timestamp AND held.rowid <= ${alias}.rowid))
+      AND (LOWER(TRIM(COALESCE(live.relay_mode, ''))) = 'plan') != (LOWER(TRIM(COALESCE(held.relay_mode, ''))) = 'plan')
+  )`;
+}
+
 export function createMessageRepository(db) {
     const shareVisibility = createShareVisibilityStatements(db);
     const messagePins = createMessagePinStatements(db);
@@ -187,7 +214,7 @@ export function createMessageRepository(db) {
         // steer-recovered row waited 5 minutes while newer messages jumped
         // it). Head-of-line protection is the WHERE clause's next_attempt_at
         // backoff plus MAX_REQUEUE_RETRIES, which fails a row for good.
-        findPending:    db.prepare(`SELECT * FROM queue WHERE status = 'pending' AND COALESCE(kind, '') != 'continuation' AND (next_attempt_at IS NULL OR next_attempt_at <= ?) ORDER BY timestamp ASC, rowid ASC LIMIT 1`),
+        findPending:    db.prepare(`SELECT q.* FROM queue q WHERE q.status = 'pending' AND COALESCE(q.kind, '') != 'continuation' AND (q.next_attempt_at IS NULL OR q.next_attempt_at <= ?) AND ${planBoundaryHoldSql('q')} ORDER BY q.timestamp ASC, q.rowid ASC LIMIT 1`),
         // Global fallback for requesters without a session identity (the legacy
         // Copilot relay CLI). Conversations bound to a session-worker provider
         // (claude/cursor/grok) are excluded outright: handing one of their turns
@@ -218,6 +245,7 @@ export function createMessageRepository(db) {
               NULLIF(rsc.provider_type, ''),
               'github'
             )) NOT IN (${sessionWorkerProviderSqlList()})
+            AND ${planBoundaryHoldSql('q')}
           ORDER BY
             q.timestamp ASC,
             q.rowid ASC
@@ -254,6 +282,7 @@ export function createMessageRepository(db) {
                 NULLIF(c.sdk_session_id, '')
               ) = ?
             )
+            AND ${planBoundaryHoldSql('q')}
           ORDER BY
             CASE
               WHEN COALESCE(
@@ -282,6 +311,7 @@ export function createMessageRepository(db) {
               NULLIF(rs.sdk_session_id, ''),
               NULLIF(c.sdk_session_id, '')
             ) = ?
+            AND ${planBoundaryHoldSql('q')}
           ORDER BY
             q.timestamp ASC,
             q.rowid ASC
@@ -431,6 +461,29 @@ export function createMessageRepository(db) {
           WHERE status = 'processing'
             AND NULLIF(owner_sdk_session_id, '') = ?
         `),
+        // The worker recycle's quiet window (worker-recycle-service.mjs): the
+        // last time the session had a delivery or a turn end, as an ISO
+        // string, or NULL when the queue holds no row of it. Over the rows the
+        // session owns: a row is stamped with its owner at enqueue under
+        // session-worker routing and at the latest by its claim, and a
+        // conversation rebound to another session leaves its old rows with the
+        // session that ran them. The queue keeps no completion time
+        // (setDone clears processing_at), so a turn's end is its response
+        // message's timestamp; the claim and the heartbeat lease
+        // (owner_last_claimed_at) and the assignment stand for the delivery.
+        // Each column is COALESCEd: SQLite's multi-argument MAX() is NULL as
+        // soon as one argument is.
+        getOwnerLastActivityAt: db.prepare(`
+          SELECT MAX(NULLIF(MAX(
+            COALESCE(q.processing_at, ''),
+            COALESCE(q.owner_assigned_at, ''),
+            COALESCE(q.owner_last_claimed_at, ''),
+            COALESCE(m.timestamp, '')
+          ), '')) AS last_activity_at
+          FROM queue q
+          LEFT JOIN messages m ON m.id = q.response_message_id
+          WHERE NULLIF(q.owner_sdk_session_id, '') = ?
+        `),
         recoverProcessingRowKeepOwner: db.prepare(`
           UPDATE queue
           SET status = 'pending',

package/server/repositories/remote-relay-repository.mjs

@@ -75,6 +75,12 @@ export function createRemoteRelayRepository(db) {
   const getMayCreateSessions = hasMayCreateColumn
     ? db.prepare(`SELECT may_create_sessions FROM conversations WHERE id = ?`)
     : null;
+  // Plan-only (migration 0035). Without the column no session is.
+  const hasPlanOnlyColumn = db.prepare(`PRAGMA table_info(conversations)`).all()
+    .some((column) => column.name === 'plan_only');
+  const getPlanOnly = hasPlanOnlyColumn
+    ? db.prepare(`SELECT plan_only FROM conversations WHERE id = ?`)
+    : null;
 
   return {
     hasUnlock(conversationId, remoteRelayId) {
@@ -161,6 +167,10 @@ export function createRemoteRelayRepository(db) {
     mayCreateSessions(conversationId) {
       return Number(getMayCreateSessions?.get(String(conversationId || ''))?.may_create_sessions) === 1;
     },
+    /** Is this conversation plan-only (agents cannot take it out of plan mode)? */
+    planOnly(conversationId) {
+      return Number(getPlanOnly?.get(String(conversationId || ''))?.plan_only) === 1;
+    },
   };
 }
 

package/server/repositories/session-repository.mjs

@@ -45,6 +45,10 @@ export function createSessionRepository(db) {
     const conversationsHaveMayCreateSessions = db.prepare(`PRAGMA table_info(conversations)`).all()
       .some((column) => String(column?.name || '').trim() === 'may_create_sessions');
     const conversationMayCreateSelect = conversationsHaveMayCreateSessions ? 'c.may_create_sessions' : 'NULL AS may_create_sessions';
+    // Plan-only (migration 0035), the same way.
+    const conversationsHavePlanOnly = db.prepare(`PRAGMA table_info(conversations)`).all()
+      .some((column) => String(column?.name || '').trim() === 'plan_only');
+    const conversationPlanOnlySelect = conversationsHavePlanOnly ? 'c.plan_only' : 'NULL AS plan_only';
     return {
         // conversations
         getConv:        db.prepare(`SELECT * FROM conversations WHERE id = ? AND status != 'deleted'`),
@@ -53,7 +57,8 @@ export function createSessionRepository(db) {
         listConvIdsMissingRuntimeSession: db.prepare(`SELECT c.id AS id FROM conversations c LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE rs.id IS NULL AND c.status != 'deleted'`),
         runtimeSessionsSupportProviders,
         conversationsHaveMayCreateSessions,
-        listConvs:      db.prepare(`SELECT c.id, c.title, c.title_source, c.archived, c.compacted_into, c.compacted_from, c.sdk_session_id, c.preferred_relay_mode, c.preferred_model, c.preferred_reasoning_effort, c.configured_workspace_root_path, c.runtime_workspace_root_path, c.draft_text, c.draft_updated_at, c.draft_updated_by_client_id, c.draft_attachments, ${conversationOriginSelect}, ${conversationCloudSelect}, ${conversationGroupSelect}, ${conversationMayCreateSelect}, c.created_at, c.updated_at, rs.id AS runtime_session_id, rs.strategy AS runtime_strategy, rs.status AS runtime_status, rs.last_used_at AS runtime_last_used_at, ${runtimeProviderSelect}, COUNT(m.id) as message_count FROM conversations c LEFT JOIN messages m ON m.conversation_id = c.id LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE c.status != 'deleted' AND (? = 1 OR c.archived = ?) GROUP BY c.id ORDER BY CASE WHEN c.sdk_session_id IS NULL OR c.sdk_session_id = '' THEN 1 ELSE 0 END ASC, c.updated_at DESC`),
+        conversationsHavePlanOnly,
+        listConvs:      db.prepare(`SELECT c.id, c.title, c.title_source, c.archived, c.compacted_into, c.compacted_from, c.sdk_session_id, c.preferred_relay_mode, c.preferred_model, c.preferred_reasoning_effort, c.configured_workspace_root_path, c.runtime_workspace_root_path, c.draft_text, c.draft_updated_at, c.draft_updated_by_client_id, c.draft_attachments, ${conversationOriginSelect}, ${conversationCloudSelect}, ${conversationGroupSelect}, ${conversationMayCreateSelect}, ${conversationPlanOnlySelect}, c.created_at, c.updated_at, rs.id AS runtime_session_id, rs.strategy AS runtime_strategy, rs.status AS runtime_status, rs.last_used_at AS runtime_last_used_at, ${runtimeProviderSelect}, COUNT(m.id) as message_count FROM conversations c LEFT JOIN messages m ON m.conversation_id = c.id LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE c.status != 'deleted' AND (? = 1 OR c.archived = ?) GROUP BY c.id ORDER BY CASE WHEN c.sdk_session_id IS NULL OR c.sdk_session_id = '' THEN 1 ELSE 0 END ASC, c.updated_at DESC`),
         insertConv:     db.prepare(`INSERT OR IGNORE INTO conversations (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)`),
         updateConvTime: db.prepare(`UPDATE conversations SET updated_at = ? WHERE id = ?`),
         updateConvTitle: db.prepare(`UPDATE conversations SET title = ?, title_source = 'manual' WHERE id = ?`),
@@ -95,6 +100,25 @@ export function createSessionRepository(db) {
         getRuntimeSessionBySdkSessionId: db.prepare(`SELECT * FROM runtime_sessions WHERE sdk_session_id = ?`),
         getRuntimeSessionById: db.prepare(`SELECT * FROM runtime_sessions WHERE id = ?`),
         listRuntimeSessions: db.prepare(`SELECT rs.*, c.title AS conversation_title, c.updated_at AS conversation_updated_at FROM runtime_sessions rs LEFT JOIN conversations c ON c.id = rs.conversation_id ORDER BY rs.last_used_at DESC`),
+        // The session ids of archived conversations: the worker sweep at relay
+        // start stops what still runs for them. A runtime session id is unique
+        // (idx_runtime_sessions_sdk_session_id), but a conversation's own
+        // sdk_session_id is not: an id that a conversation in use (not
+        // archived, not deleted) names too is left out, so that
+        // conversation's worker is never stopped for an archived one.
+        listArchivedRuntimeSessionIds: db.prepare(`
+          SELECT DISTINCT rs.sdk_session_id AS sdk_session_id
+          FROM runtime_sessions rs
+          JOIN conversations c ON c.id = rs.conversation_id
+          WHERE c.archived = 1
+            AND NULLIF(rs.sdk_session_id, '') IS NOT NULL
+            AND NOT EXISTS (
+              SELECT 1 FROM conversations live_c
+              WHERE live_c.sdk_session_id = rs.sdk_session_id
+                AND COALESCE(live_c.archived, 0) = 0
+                AND live_c.status != 'deleted'
+            )
+        `),
         insertRuntimeSession: db.prepare(runtimeSessionsSupportProviders
           ? `INSERT INTO runtime_sessions (id, conversation_id, strategy, runtime_key, model, status, created_at, last_used_at, sdk_session_id, provider_type, provider_model) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?, ?)`
           : `INSERT INTO runtime_sessions (id, conversation_id, strategy, runtime_key, model, status, created_at, last_used_at, sdk_session_id) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?)`),

package/server/routes/claude-cloud-routes.mjs

@@ -6,6 +6,9 @@
 //                                     environment, account, login state
 //   POST /api/settings/claude-cloud   { enabled?, defaultModel?, environmentId? }
 //   POST /api/claude-cloud-session    the worker's binding report
+//   GET  /api/claude-cloud-session    `?conversationId=` (or the sdk session
+//                                     id) → the stored binding a starting
+//                                     worker attaches to
 //   GET  /api/claude-cloud/repos      the repositories New Chat may suggest
 //                                     (`?refresh=1` reads them afresh)
 //   GET  /api/claude-cloud/branches   `?repo=<owner/name or URL>` → its branches
@@ -77,6 +80,22 @@ export function registerClaudeCloudRoutes(app, deps = {}) {
       if (!result.ok) return res.status(result.statusCode || 400).json({ error: result.error });
       return res.json({ ok: true, cloud: result.cloud });
     });
+
+    // GET /api/claude-cloud-session?conversationId=<id> — a starting Claude
+    // Cloud worker asks which cloud session it is bound to and from which
+    // sequence to read on, so it opens the event stream before any delivery
+    // (a relaunched worker follows the turns the session starts by itself
+    // from its start). The id may be the conversation id or the sdk session
+    // id. `{ ok, sessionId, lastSequence }`, `sessionId: null` when there is
+    // no cloud session; 404 only for an unknown conversation.
+    app.get('/api/claude-cloud-session', auth, (req, res) => {
+      touchCli();
+      const raw = req.query?.conversationId ?? req.query?.sdkSessionId;
+      const id = Array.isArray(raw) ? raw[0] : raw;
+      const result = claudeCloudSessionService.describeStoredBinding(typeof id === 'string' ? id : '');
+      if (!result.ok) return res.status(result.statusCode || 400).json({ error: result.error });
+      return res.json({ ok: true, sessionId: result.sessionId, lastSequence: result.lastSequence });
+    });
   }
 
   if (claudeCloudLoginStatus) {