@oar-sh/oar 0.9.2 → 0.9.4

package/server/public/sw.js

@@ -205,6 +205,9 @@ const SYNC_DB_VERSION = 1;
 const SYNC_STORE_NAME = 'outbox';
 const SYNC_TAG = 'copilot-outbox';
 const SYNC_MAX_REPLAY_ATTEMPTS = 10;
+// Mirrors DRAFT_FLUSH_MAX_AGE_MS in app/conversation-draft-sync.mjs: a draft
+// flush replayed later than this would overwrite whatever the draft became.
+const SYNC_DRAFT_FLUSH_MAX_AGE_MS = 5 * 60 * 1000;
 
 function openSyncDb() {
   return new Promise((resolve, reject) => {
@@ -271,6 +274,10 @@ async function replaySyncOutbox() {
   try {
     const entries = await readSyncEntries(db);
     for (const { key, value } of entries) {
+      if (value?.kind === 'draft-flush' && !(Date.now() - Number(value.createdAt || 0) <= SYNC_DRAFT_FLUSH_MAX_AGE_MS)) {
+        await deleteSyncEntry(db, key);
+        continue;
+      }
       let response = null;
       try {
         response = await fetch(scopeUrl(String(value.path || '').replace(/^\//, '')), {

package/server/relay-tools.md

@@ -12,6 +12,8 @@ When using ask_user, ALWAYS include a `choices` array with 2-6 answer options so
 At runtime, inject the question and choices from a random item in your quiz pool.
 Only omit choices when the question genuinely requires freeform text input (e.g., "What is your name?").
 
+When the user may pick several of the choices (they are not mutually exclusive), set `"multi_select": true` if your ask_user tool offers that field; otherwise begin the question with "Select all that apply:". Either way, expect an answer that lists several choices separated by ", ".
+
 In autopilot, still call ask_user when user input is truly blocking, because the relay bridge can surface the question even when the direct SDK question hook is bypassed.
 
 For relay restarts in extension-managed mode, require explicit user permission first, then use the authenticated localhost API `POST /api/relay/shutdown`. Do not restart by killing processes or using respawn scripts.
@@ -24,4 +26,8 @@ Use `restart: true` in the request body when the user wants a real relay restart
 
 Publish a local web server or a static directory on a public preview URL so the user can open it from any device, or list/close existing previews. Use this whenever the user wants to see, try, or share something with a web UI — never ask them to open localhost or forward a port. For a dev server: call this FIRST with {action:"create", port} to get the basePath, then start the server configured to serve under that basePath (Vite --base, Next basePath, Express mount prefix); the proxy forwards X-Forwarded-Prefix but does not rewrite bodies, so root-absolute asset paths will not work. For plain files or a build output: pass {action:"create", dir} instead and the relay serves the directory itself — no dev server needed. Always tell the user the returned URL and that the link is public: anyone who has it can reach the app without logging in. Previews never expire on their own; close them with {action:"close"} when the user is done.
 
-There is no `preview` tool on this provider — use the authenticated localhost API (same auth as `POST /api/relay/shutdown`): `POST /api/previews` with `{ "conversationId": "<conv>", "port": 5173, "label": "web app" }` (or `"dir": "./dist"` instead of the port) publishes, `GET /api/previews` lists, `DELETE /api/previews/:token` closes the link without touching the dev server behind it. A 503 with `details` means the preview lane is disabled or misconfigured — surface those details, they are the operator's fix. See `docs/preview-servers.md`.
+If you have a `preview` tool, use it. Otherwise use the authenticated localhost API (same auth as `POST /api/relay/shutdown`): `POST /api/previews` with `{ "conversationId": "<conv>", "port": 5173, "label": "web app" }` (or `"dir": "./dist"` instead of the port) publishes, `GET /api/previews` lists, `DELETE /api/previews/:token` closes the link without touching the dev server behind it. A 503 with `details` means the preview lane is disabled or misconfigured — surface those details, they are the operator's fix. See `docs/preview-servers.md`.
+
+## Remote relays
+
+If you have a `remote_relay` tool, this relay is paired with other OAR relays and the tool works on them: list and read their sessions, prompt a session, start a new one and wait for its reply. Use it only when the user asks for work on another relay or mentions one, and start with `{"action":"list_relays"}`. A relay stays locked until the user mentions it in this conversation (`@name` or its plain name); a locked relay refuses everything except `list_relays`, so ask the user to mention it rather than retrying. Write actions may first wait for the user's approval. If a result lists `pendingQuestions`, the remote agent is waiting for an answer: ask the user (unless they told you to decide), then pass it on with `answer_question`. Always tell the user which relay and session you worked on.

package/server/repositories/message-repository.mjs

@@ -7,6 +7,9 @@ export function createMessageRepository(db) {
     const shareVisibility = createShareVisibilityStatements(db);
     const queueHasImageOperationId = db.prepare(`PRAGMA table_info(queue)`).all()
         .some((column) => column.name === 'image_operation_id');
+    const messageColumns = new Set(db.prepare(`PRAGMA table_info(messages)`).all().map((column) => column.name));
+    const messagesHaveSourceId = messageColumns.has('source_message_id');
+    const messagesHaveResendOf = messageColumns.has('resend_of_message_id');
     const insertQueueSql = queueHasImageOperationId
         ? `INSERT INTO queue (id, conversation_id, runtime_session_id, is_new_conversation, model, model_variant_id, reasoning_effort, context_tier, relay_mode, text, attachments, status, timestamp, retry_count, next_attempt_at, owner_sdk_session_id, owner_assigned_at, owner_lease_expires_at, owner_last_claimed_at, image_operation_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, 0, NULL, ?, ?, ?, ?, ?)`
         : `INSERT INTO queue (id, conversation_id, runtime_session_id, is_new_conversation, model, model_variant_id, reasoning_effort, context_tier, relay_mode, text, attachments, status, timestamp, retry_count, next_attempt_at, owner_sdk_session_id, owner_assigned_at, owner_lease_expires_at, owner_last_claimed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, 0, NULL, ?, ?, ?, ?)`;
@@ -17,7 +20,7 @@ export function createMessageRepository(db) {
         getMessageByConversation: db.prepare(`SELECT * FROM messages WHERE id = ? AND conversation_id = ? LIMIT 1`),
         setMessageShareVisibility: shareVisibility.setMessageShareVisibility,
         getLatestConversationModel: db.prepare(`SELECT model FROM messages WHERE conversation_id = ? AND model IS NOT NULL AND model != '' ORDER BY timestamp DESC LIMIT 1`),
-        getRecentMessagesDesc: db.prepare(`SELECT role, text, timestamp FROM messages WHERE conversation_id = ? ORDER BY timestamp DESC LIMIT ?`),
+        getRecentMessagesDesc: db.prepare(`SELECT id, role, text, timestamp FROM messages WHERE conversation_id = ? ORDER BY timestamp DESC LIMIT ?`),
         insertMsg:      db.prepare(`INSERT INTO messages (id, conversation_id, role, text, model, mode, attachments, timestamp, model_requested, model_actual, model_origin) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
         // Provenance is derived from the authenticated responder identity at
         // /api/response time, never from the response payload.
@@ -117,10 +120,28 @@ export function createMessageRepository(db) {
         // response resolves to the row its operation id already created.
         findQByContinuationOp: db.prepare(`SELECT * FROM queue WHERE continuation_op_id = ?`),
         setMessageKind: db.prepare(`UPDATE messages SET kind = ? WHERE id = ?`),
+        // The durable answer→prompt link (the queue's copy is pruned), so a
+        // reload still anchors the reply under the message it answers.
+        setMessageSourceId: messagesHaveSourceId
+            ? db.prepare(`UPDATE messages SET source_message_id = ? WHERE id = ?`)
+            : null,
+        setMessageResendOf: messagesHaveResendOf
+            ? db.prepare(`UPDATE messages SET resend_of_message_id = ? WHERE id = ?`)
+            : null,
         // Quiet teardown for a continuation whose worker died: there is no
         // user to answer, so it fails without the terminal-failure ceremony.
         dropStaleContinuation: db.prepare(`UPDATE queue SET status = 'failed', processing_at = NULL, next_attempt_at = NULL, owner_lease_expires_at = NULL WHERE id = ? AND status = 'processing' AND kind = 'continuation'`),
-        findPending:    db.prepare(`SELECT * FROM queue WHERE status = 'pending' AND COALESCE(kind, '') != 'continuation' AND (next_attempt_at IS NULL OR next_attempt_at <= ?) ORDER BY retry_count ASC, CASE WHEN next_attempt_at IS NULL THEN 0 ELSE 1 END ASC, COALESCE(next_attempt_at, timestamp) ASC, timestamp ASC LIMIT 1`),
+        // Claim ordering (all findPending* variants and the owner-transfer
+        // scan): strict send order, rowid breaking same-millisecond ties.
+        // Neither retry_count nor next_attempt_at may rank rows: dead-worker
+        // recovery and /api/requeue bump retry_count, so ranking by it ran a
+        // recovered OLDER message after newer ones in the same conversation,
+        // and ranking expired-backoff rows behind fresh arrivals starved them
+        // for as long as new messages kept coming (live 2026-09-19: a
+        // steer-recovered row waited 5 minutes while newer messages jumped
+        // it). Head-of-line protection is the WHERE clause's next_attempt_at
+        // backoff plus MAX_REQUEUE_RETRIES, which fails a row for good.
+        findPending:    db.prepare(`SELECT * FROM queue WHERE status = 'pending' AND COALESCE(kind, '') != 'continuation' AND (next_attempt_at IS NULL OR next_attempt_at <= ?) ORDER BY timestamp ASC, rowid ASC LIMIT 1`),
         // Global fallback for requesters without a session identity (the legacy
         // Copilot relay CLI). Conversations bound to a session-worker provider
         // (claude/cursor/grok) are excluded outright: handing one of their turns
@@ -152,10 +173,8 @@ export function createMessageRepository(db) {
               'github'
             )) NOT IN (${sessionWorkerProviderSqlList()})
           ORDER BY
-            q.retry_count ASC,
-            CASE WHEN q.next_attempt_at IS NULL THEN 0 ELSE 1 END ASC,
-            COALESCE(q.next_attempt_at, q.timestamp) ASC,
-            q.timestamp ASC
+            q.timestamp ASC,
+            q.rowid ASC
           LIMIT 1
         `),
         findPendingForWorker: db.prepare(`
@@ -198,10 +217,8 @@ export function createMessageRepository(db) {
               ) = ? THEN 0
               ELSE 1
             END ASC,
-            q.retry_count ASC,
-            CASE WHEN q.next_attempt_at IS NULL THEN 0 ELSE 1 END ASC,
-            COALESCE(q.next_attempt_at, q.timestamp) ASC,
-            q.timestamp ASC
+            q.timestamp ASC,
+            q.rowid ASC
           LIMIT 1
         `),
         findPendingForSessionAffinity: db.prepare(`
@@ -220,10 +237,8 @@ export function createMessageRepository(db) {
               NULLIF(c.sdk_session_id, '')
             ) = ?
           ORDER BY
-            q.retry_count ASC,
-            CASE WHEN q.next_attempt_at IS NULL THEN 0 ELSE 1 END ASC,
-            COALESCE(q.next_attempt_at, q.timestamp) ASC,
-            q.timestamp ASC
+            q.timestamp ASC,
+            q.rowid ASC
           LIMIT 1
         `),
         countQueueWorkForSessionAffinity: db.prepare(`
@@ -269,6 +284,13 @@ export function createMessageRepository(db) {
           LIMIT ?
         `),
         countStatus:    db.prepare(`SELECT status, COUNT(*) as cnt FROM queue WHERE status IN ('pending','processing','parked') GROUP BY status`),
+        // Deferred host suspend: which conversations still hold live turns.
+        listActiveQueueCountsByConversation: db.prepare(`
+          SELECT q.conversation_id, COUNT(*) AS cnt, MAX(c.title) AS title
+          FROM queue q LEFT JOIN conversations c ON c.id = q.conversation_id
+          WHERE q.status IN ('pending','processing','parked')
+          GROUP BY q.conversation_id
+        `),
         countRuntimeSessions: db.prepare(`SELECT COUNT(*) AS cnt FROM runtime_sessions WHERE status = 'active'`),
         setProcessing:  db.prepare(`UPDATE queue SET status = 'processing', processing_at = ?, attempt_id = ? WHERE id = ?`),
         setProcessingWithWorkerLease: db.prepare(`
@@ -301,7 +323,7 @@ export function createMessageRepository(db) {
         // Recovery clears only the lease, never the owner: a recovered row must
         // stay routed to its provider worker so the primer respawns that worker
         // instead of the row becoming claimable by the global relay poll.
-        recoverStale:   db.prepare(`UPDATE queue SET status = 'pending', processing_at = NULL, attempt_id = NULL, next_attempt_at = ?, owner_lease_expires_at = NULL, owner_last_claimed_at = NULL WHERE status = 'processing' AND COALESCE(kind, '') != 'continuation' AND processing_at < ?`),
+        recoverStale:   db.prepare(`UPDATE queue SET status = 'pending', processing_at = NULL, attempt_id = NULL, next_attempt_at = ?, owner_lease_expires_at = NULL, owner_last_claimed_at = NULL WHERE status = 'processing' AND COALESCE(kind, '') != 'continuation' AND consumed_at IS NULL AND processing_at < ?`),
         // Staleness is inactivity, not elapsed turn time: owner_last_claimed_at is
         // refreshed by every worker heartbeat for the message it is working on, so a
         // long-but-alive turn keeps moving the cutoff. processing_at is only the
@@ -311,7 +333,7 @@ export function createMessageRepository(db) {
         // A turn blocked on an unanswered AskUserQuestion is never stale — it is
         // waiting on the human, and relay_questions carries its own expiry.
         listRecoverableProcessing: db.prepare(`
-          SELECT id, conversation_id, kind, relay_mode, model, retry_count
+          SELECT id, conversation_id, kind, relay_mode, model, retry_count, consumed_at
           FROM queue
           WHERE status = 'processing'
             AND COALESCE(kind, '') != 'continuation'
@@ -332,6 +354,7 @@ export function createMessageRepository(db) {
               retry_count = retry_count + 1
           WHERE status = 'processing'
             AND COALESCE(kind, '') != 'continuation'
+            AND consumed_at IS NULL
             AND (
               COALESCE(owner_last_claimed_at, processing_at, timestamp) < @inactiveBefore
               OR (@ceilingBefore IS NOT NULL AND COALESCE(processing_at, timestamp) < @ceilingBefore)
@@ -347,7 +370,7 @@ export function createMessageRepository(db) {
         // worker can never collect its answer, so holding the row would leak
         // both the row and the question.
         listProcessingRowsForOwner: db.prepare(`
-          SELECT id, conversation_id, kind, retry_count
+          SELECT id, conversation_id, kind, retry_count, consumed_at, relay_mode, model
           FROM queue
           WHERE status = 'processing'
             AND NULLIF(owner_sdk_session_id, '') = ?
@@ -361,7 +384,28 @@ export function createMessageRepository(db) {
               owner_lease_expires_at = NULL,
               owner_last_claimed_at = NULL,
               retry_count = retry_count + 1
-          WHERE id = ? AND status = 'processing'
+          WHERE id = ? AND status = 'processing' AND consumed_at IS NULL
+        `),
+        // See the queue.consumed_at migration: at-most-once rows.
+        // Fenced like every other worker write: the row must be processing in
+        // this conversation, owned by the same worker session (NULL-safe, for
+        // routing-disabled installs), and — when the caller names one — still
+        // on the attempt it was pushed under.
+        markQueueConsumed: db.prepare(`
+          UPDATE queue
+          SET consumed_at = COALESCE(consumed_at, @at)
+          WHERE id = @id AND conversation_id = @conversationId AND status = 'processing'
+            AND NULLIF(owner_sdk_session_id, '') IS @owner
+            AND (@attemptId IS NULL OR attempt_id = @attemptId)
+        `),
+        // A consumed steer the CLI then replayed as a turn of its own is an
+        // ordinary in-flight row again.
+        clearQueueConsumed: db.prepare(`
+          UPDATE queue
+          SET consumed_at = NULL
+          WHERE id = @id AND conversation_id = @conversationId AND status = 'processing'
+            AND NULLIF(owner_sdk_session_id, '') IS @owner
+            AND (@attemptId IS NULL OR attempt_id = @attemptId)
         `),
         listProcessingOwnerSessionIds: db.prepare(`
           SELECT DISTINCT NULLIF(owner_sdk_session_id, '') AS sdk_session_id
@@ -390,6 +434,12 @@ export function createMessageRepository(db) {
         listConversationIdsWithActiveQueue: db.prepare(`SELECT DISTINCT conversation_id FROM queue WHERE status IN ('pending', 'processing', 'parked')`),
         deleteQueueById: db.prepare(`DELETE FROM queue WHERE id = ?`),
         getLatestProcessingQueueByConversation: db.prepare(`SELECT id, relay_mode, timestamp, processing_at FROM queue WHERE conversation_id = ? AND status = 'processing' ORDER BY COALESCE(processing_at, timestamp) DESC LIMIT 1`),
+        // All processing rows, oldest first. Mid-turn steering means a
+        // conversation can have more than one processing row at once (the live
+        // turn plus a steered message folded into it), so the single-row query
+        // above is ambiguous — callers that need "the live turn" resolve it
+        // from this list by which row is actually producing output.
+        listProcessingQueueByConversation: db.prepare(`SELECT id, relay_mode, timestamp, processing_at FROM queue WHERE conversation_id = ? AND status = 'processing' ORDER BY COALESCE(processing_at, timestamp) ASC`),
         parkPendingQueueForRestart: db.prepare(`
           UPDATE queue
           SET

package/server/repositories/question-repository.mjs

@@ -25,6 +25,21 @@ export function createQuestionRepository(db) {
         linkActivityToResponse: db.prepare(`UPDATE relay_activity SET response_message_id = ? WHERE queue_message_id = ? AND response_message_id IS NULL`),
         listActivityByResponse: db.prepare(`SELECT text, subagent_run_id, metadata_json FROM relay_activity WHERE response_message_id = ? ORDER BY id ASC`),
         listActivityByQueueMessage: db.prepare(`SELECT text, subagent_run_id, metadata_json FROM relay_activity WHERE queue_message_id = ? ORDER BY id ASC`),
+        // When a queue row last produced output — its newest stream snapshot
+        // (rows are rewritten in place and re-stamped per update) or activity
+        // line. The live-turn picker compares rows by this, never by the
+        // per-row stream seq. `stream_done` is 1 once the row's main-thread
+        // snapshot is final: a row settling after a handoff re-stamps its
+        // snapshot with done=1, which must not read as live output.
+        getLastOutputAtByQueueMessage: db.prepare(`
+          SELECT
+            (SELECT MAX(at) FROM (
+              SELECT MAX(created_at) AS at FROM relay_stream_events WHERE queue_message_id = @id
+              UNION ALL
+              SELECT MAX(created_at) AS at FROM relay_activity WHERE queue_message_id = @id
+            )) AS last_output_at,
+            (SELECT MAX(done) FROM relay_stream_events WHERE queue_message_id = @id AND subagent_run_id IS NULL) AS stream_done
+        `),
         deleteConvActivity: db.prepare(`DELETE FROM relay_activity WHERE conversation_id = ?`),
 
         // relay stream events — every update carries the full text-so-far
@@ -97,6 +112,9 @@ export function createQuestionRepository(db) {
           FROM subagent_runs
           WHERE queue_message_id = ? AND status = 'running'
         `),
+        countRunningSubagentRuns: db.prepare(`
+          SELECT COUNT(*) AS cnt FROM subagent_runs WHERE status = 'running'
+        `),
         closeRunningSubagentRunsByQueueMessage: db.prepare(`
           UPDATE subagent_runs
           SET status = ?, updated_at = ?, completed_at = COALESCE(completed_at, ?)

package/server/repositories/remote-relay-repository.mjs

@@ -0,0 +1,75 @@
+'use strict';
+
+import { normalizeRemoteRelayOrigin } from '../../shared/remote-relay-contract.mjs';
+
+// Storage for remote relays that is not app settings: which remote relays a
+// conversation has unlocked (the user mentioned them), and the provenance of
+// messages and conversations another relay's agent created. Tables and
+// columns come from migrations/0005-remote-relays.mjs.
+
+function parseOrigin(json) {
+  if (!json) return null;
+  try {
+    return normalizeRemoteRelayOrigin(JSON.parse(json));
+  } catch {
+    return null;
+  }
+}
+
+export function createRemoteRelayRepository(db) {
+  const hasUnlock = db.prepare(`SELECT 1 FROM conversation_remote_relay_unlocks WHERE conversation_id = ? AND remote_relay_id = ?`);
+  const listUnlocks = db.prepare(`SELECT remote_relay_id, message_id, created_at FROM conversation_remote_relay_unlocks WHERE conversation_id = ? ORDER BY created_at ASC`);
+  const insertUnlock = db.prepare(`INSERT OR IGNORE INTO conversation_remote_relay_unlocks (conversation_id, remote_relay_id, message_id, created_at) VALUES (?, ?, ?, ?)`);
+  const deleteUnlocksForRelay = db.prepare(`DELETE FROM conversation_remote_relay_unlocks WHERE remote_relay_id = ?`);
+  const deleteUnlocksForConversation = db.prepare(`DELETE FROM conversation_remote_relay_unlocks WHERE conversation_id = ?`);
+  const setMessageOrigin = db.prepare(`UPDATE messages SET origin_json = ? WHERE id = ?`);
+  const getMessageOrigin = db.prepare(`SELECT origin_json FROM messages WHERE id = ?`);
+  const setConversationOrigin = db.prepare(`UPDATE conversations SET origin_json = ? WHERE id = ?`);
+  const getConversationOrigin = db.prepare(`SELECT origin_json FROM conversations WHERE id = ?`);
+
+  return {
+    hasUnlock(conversationId, remoteRelayId) {
+      return !!hasUnlock.get(String(conversationId || ''), String(remoteRelayId || ''));
+    },
+    /** `[{ remoteRelayId, messageId, createdAt }]`, oldest first. */
+    listUnlocks(conversationId) {
+      return listUnlocks.all(String(conversationId || '')).map((row) => ({
+        remoteRelayId: row.remote_relay_id,
+        messageId: row.message_id || null,
+        createdAt: row.created_at,
+      }));
+    },
+    /** True when this call created the unlock (false when it already existed). */
+    recordUnlock(conversationId, remoteRelayId, messageId = null, nowIso = new Date().toISOString()) {
+      const conversation = String(conversationId || '').trim();
+      const relay = String(remoteRelayId || '').trim();
+      if (!conversation || !relay) return false;
+      return insertUnlock.run(conversation, relay, messageId ? String(messageId) : null, nowIso).changes > 0;
+    },
+    forgetRelay(remoteRelayId) {
+      return deleteUnlocksForRelay.run(String(remoteRelayId || '')).changes;
+    },
+    forgetConversation(conversationId) {
+      return deleteUnlocksForConversation.run(String(conversationId || '')).changes;
+    },
+    setMessageOrigin(messageId, origin) {
+      const normalized = normalizeRemoteRelayOrigin(origin);
+      return setMessageOrigin.run(normalized ? JSON.stringify(normalized) : null, String(messageId || '')).changes > 0;
+    },
+    getMessageOrigin(messageId) {
+      return parseOrigin(getMessageOrigin.get(String(messageId || ''))?.origin_json);
+    },
+    setConversationOrigin(conversationId, origin) {
+      const normalized = normalizeRemoteRelayOrigin(origin);
+      return setConversationOrigin.run(normalized ? JSON.stringify(normalized) : null, String(conversationId || '')).changes > 0;
+    },
+    getConversationOrigin(conversationId) {
+      return parseOrigin(getConversationOrigin.get(String(conversationId || ''))?.origin_json);
+    },
+  };
+}
+
+/** Parses an `origin_json` column value read by other queries. */
+export function parseRemoteRelayOriginJson(json) {
+  return parseOrigin(json);
+}

package/server/repositories/session-repository.mjs

@@ -1,9 +1,6 @@
 'use strict';
 
-import { createShareVisibilityStatements } from './share-visibility-statements.mjs';
-
 export function createSessionRepository(db) {
-    const shareVisibility = createShareVisibilityStatements(db);
     const runtimeSessionColumns = new Set(
       db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((column) => String(column?.name || '').trim()),
     );
@@ -12,6 +9,11 @@ export function createSessionRepository(db) {
     const runtimeProviderSelect = runtimeSessionsSupportProviders
       ? 'rs.model AS runtime_model, rs.provider_type AS runtime_provider_type, rs.provider_model AS runtime_provider_model'
       : 'rs.model AS runtime_model, NULL AS runtime_provider_type, NULL AS runtime_provider_model';
+    // Provenance of conversations another relay's agent created (migration
+    // 0005); NULL on a schema that predates it.
+    const conversationsHaveOrigin = db.prepare(`PRAGMA table_info(conversations)`).all()
+      .some((column) => String(column?.name || '').trim() === 'origin_json');
+    const conversationOriginSelect = conversationsHaveOrigin ? 'c.origin_json' : 'NULL AS origin_json';
     return {
         // conversations
         getConv:        db.prepare(`SELECT * FROM conversations WHERE id = ? AND status != 'deleted'`),
@@ -19,7 +21,7 @@ export function createSessionRepository(db) {
         getConvBySdkSessionId: db.prepare(`SELECT * FROM conversations WHERE sdk_session_id = ? AND status != 'deleted' ORDER BY updated_at DESC LIMIT 1`),
         listConvIdsMissingRuntimeSession: db.prepare(`SELECT c.id AS id FROM conversations c LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE rs.id IS NULL AND c.status != 'deleted'`),
         runtimeSessionsSupportProviders,
-        listConvs:      db.prepare(`SELECT c.id, c.title, c.title_source, c.archived, c.compacted_into, c.compacted_from, c.sdk_session_id, c.preferred_relay_mode, c.preferred_model, c.preferred_reasoning_effort, c.configured_workspace_root_path, c.runtime_workspace_root_path, c.draft_text, c.draft_updated_at, c.draft_updated_by_client_id, c.draft_attachments, c.created_at, c.updated_at, rs.id AS runtime_session_id, rs.strategy AS runtime_strategy, rs.status AS runtime_status, rs.last_used_at AS runtime_last_used_at, ${runtimeProviderSelect}, COUNT(m.id) as message_count FROM conversations c LEFT JOIN messages m ON m.conversation_id = c.id LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE c.status != 'deleted' AND (? = 1 OR c.archived = 0) GROUP BY c.id ORDER BY CASE WHEN c.sdk_session_id IS NULL OR c.sdk_session_id = '' THEN 1 ELSE 0 END ASC, c.updated_at DESC`),
+        listConvs:      db.prepare(`SELECT c.id, c.title, c.title_source, c.archived, c.compacted_into, c.compacted_from, c.sdk_session_id, c.preferred_relay_mode, c.preferred_model, c.preferred_reasoning_effort, c.configured_workspace_root_path, c.runtime_workspace_root_path, c.draft_text, c.draft_updated_at, c.draft_updated_by_client_id, c.draft_attachments, ${conversationOriginSelect}, c.created_at, c.updated_at, rs.id AS runtime_session_id, rs.strategy AS runtime_strategy, rs.status AS runtime_status, rs.last_used_at AS runtime_last_used_at, ${runtimeProviderSelect}, COUNT(m.id) as message_count FROM conversations c LEFT JOIN messages m ON m.conversation_id = c.id LEFT JOIN runtime_sessions rs ON rs.conversation_id = c.id WHERE c.status != 'deleted' AND (? = 1 OR c.archived = 0) GROUP BY c.id ORDER BY CASE WHEN c.sdk_session_id IS NULL OR c.sdk_session_id = '' THEN 1 ELSE 0 END ASC, c.updated_at DESC`),
         insertConv:     db.prepare(`INSERT OR IGNORE INTO conversations (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)`),
         updateConvTime: db.prepare(`UPDATE conversations SET updated_at = ? WHERE id = ?`),
         updateConvTitle: db.prepare(`UPDATE conversations SET title = ?, title_source = 'manual' WHERE id = ?`),
@@ -36,36 +38,15 @@ export function createSessionRepository(db) {
         archiveConv:    db.prepare(`UPDATE conversations SET archived = 1, updated_at = ? WHERE id = ?`),
         deleteConv:     db.prepare(`DELETE FROM conversations WHERE id = ?`),
 
-        // messages
-        getMessages:    db.prepare(`SELECT * FROM messages WHERE conversation_id = ? ORDER BY timestamp ASC`),
-        getSharedMessages: shareVisibility.getSharedMessages,
-        getMessageByConversation: db.prepare(`SELECT * FROM messages WHERE id = ? AND conversation_id = ? LIMIT 1`),
-        setMessageShareVisibility: shareVisibility.setMessageShareVisibility,
+        // Queue and message statements live in message-repository.mjs — the
+        // single source of truth. Copies used to live here too; the runtime's
+        // {...sessionRepo, ...messageRepo} spread shadowed all of them, and the
+        // dead copies silently fossilized (this one's findPending predated the
+        // continuation-row exclusion — claiming through it would have replayed
+        // a background continuation as a user prompt). The two counts below are
+        // the only message/queue statements this repository actually owns.
         getConversationMessageCount: db.prepare(`SELECT COUNT(*) AS count FROM messages WHERE conversation_id = ?`),
         getConversationActiveQueueCount: db.prepare(`SELECT COUNT(*) AS count FROM queue WHERE conversation_id = ? AND status IN ('pending', 'processing', 'parked')`),
-        getLatestConversationModel: db.prepare(`SELECT model FROM messages WHERE conversation_id = ? AND model IS NOT NULL AND model != '' ORDER BY timestamp DESC LIMIT 1`),
-        getRecentMessagesDesc: db.prepare(`SELECT role, text, timestamp FROM messages WHERE conversation_id = ? ORDER BY timestamp DESC LIMIT ?`),
-        insertMsg:      db.prepare(`INSERT INTO messages (id, conversation_id, role, text, model, mode, attachments, timestamp, model_requested, model_actual, model_origin) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
-
-        // queue
-        insertQ:        db.prepare(`INSERT INTO queue (id, conversation_id, runtime_session_id, is_new_conversation, model, model_variant_id, reasoning_effort, relay_mode, text, attachments, status, timestamp, retry_count, next_attempt_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, 0, NULL)`),
-        findPending:    db.prepare(`SELECT * FROM queue WHERE status = 'pending' AND (next_attempt_at IS NULL OR next_attempt_at <= ?) ORDER BY retry_count ASC, CASE WHEN next_attempt_at IS NULL THEN 0 ELSE 1 END ASC, COALESCE(next_attempt_at, timestamp) ASC, timestamp ASC LIMIT 1`),
-        countStatus:    db.prepare(`SELECT status, COUNT(*) as cnt FROM queue WHERE status IN ('pending','processing','parked') GROUP BY status`),
-        countRuntimeSessions: db.prepare(`SELECT COUNT(*) AS cnt FROM runtime_sessions WHERE status = 'active'`),
-        setProcessing:  db.prepare(`UPDATE queue SET status = 'processing', processing_at = ? WHERE id = ?`),
-        setQueueRuntimeSession: db.prepare(`UPDATE queue SET runtime_session_id = ? WHERE id = ?`),
-        setQueueResponseMessageId: db.prepare(`UPDATE queue SET response_message_id = ? WHERE id = ?`),
-        setDone:        db.prepare(`UPDATE queue SET status = 'done', response = ?, processing_at = NULL, next_attempt_at = NULL WHERE id = ? AND status IN ('processing', 'pending')`),
-        setFailed:      db.prepare(`UPDATE queue SET status = 'failed', response = ?, processing_at = NULL, next_attempt_at = NULL WHERE id = ?`),
-        deleteConvQ:    db.prepare(`DELETE FROM queue WHERE conversation_id = ?`),
-        findQById:      db.prepare(`SELECT * FROM queue WHERE id = ?`),
-        pruneQueue:     db.prepare(`DELETE FROM queue WHERE status = 'done' AND id NOT IN (SELECT id FROM queue WHERE status = 'done' ORDER BY timestamp DESC LIMIT 200)`),
-        recoverStale:   db.prepare(`UPDATE queue SET status = 'pending', processing_at = NULL, next_attempt_at = ? WHERE status = 'processing' AND processing_at < ?`),
-        listRecoverableProcessing: db.prepare(`SELECT id, conversation_id FROM queue WHERE status = 'processing' AND processing_at < ?`),
-        recoverProcessingBefore: db.prepare(`UPDATE queue SET status = 'pending', processing_at = NULL, next_attempt_at = ? WHERE status = 'processing' AND processing_at < ?`),
-        listQueueForPauseDrop: db.prepare(`SELECT id, conversation_id FROM queue WHERE status IN ('pending', 'processing', 'parked')`),
-        deleteQueueById: db.prepare(`DELETE FROM queue WHERE id = ?`),
-        getLatestProcessingQueueByConversation: db.prepare(`SELECT id, relay_mode, timestamp, processing_at FROM queue WHERE conversation_id = ? AND status = 'processing' ORDER BY COALESCE(processing_at, timestamp) DESC LIMIT 1`),
 
         // runtime sessions
         getRuntimeSessionByConversation: db.prepare(`SELECT * FROM runtime_sessions WHERE conversation_id = ?`),

package/server/routes/ask-user-routes.mjs

@@ -1,6 +1,8 @@
 'use strict';
 
 import { createAskUserRoutingService } from '../services/ask-user-routing-service.mjs';
+import { admitRemoteRelayRequest, readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
+import { isRemoteRelayApprovalQuestion } from '../../shared/remote-relay-contract.mjs';
 import {
   extractRequestedSchema,
   normalizeSchema,
@@ -33,6 +35,21 @@ function firstKnownValue(source, keyPaths = []) {
   return null;
 }
 
+/**
+ * A stored question row that is this relay's Allow / Deny card for one of its
+ * own agent's calls to another relay (remote-relay-caller-context.mjs). The
+ * context lives in the row's request envelope.
+ */
+function isRemoteRelayApprovalRow(row) {
+  let envelope = null;
+  try {
+    envelope = JSON.parse(String(row?.request || ''));
+  } catch {
+    return false;
+  }
+  return isRemoteRelayApprovalQuestion(envelope);
+}
+
 function extractContinuationOwnership(rawRequest) {
   const parsed = rawRequest && typeof rawRequest === 'object' ? rawRequest : null;
   if (!parsed) {
@@ -99,6 +116,9 @@ export function registerAskUserRoutes(app, deps) {
     DEFAULT_RELAY_MODE,
     sessionWorkerRegistry,
     pushDispatchService,
+    // Remote relays: another relay's agent answering a question is refused
+    // while the inbound switch is off. Absent in older wiring (no-op).
+    remoteRelayInbound = null,
   } = deps;
 
   const continuationRoutingEnabled = runtimeState?.featureFlags?.SESSION_WORKER_CONTINUATION_ROUTING_ENABLED === true;
@@ -108,16 +128,26 @@ export function registerAskUserRoutes(app, deps) {
     sessionWorkerRegistry,
   });
 
+  // A request from another relay's agent, by the test the inbound switch
+  // applies (X-OAR-Remote-Origin or a body origin). Made even without the
+  // remote-relay deps: an approval card is only ever this relay's user's.
+  function fromRemoteRelay(req) {
+    return readRemoteRelayRequest(req, remoteRelayInbound || {}).remote;
+  }
+
   app.get('/api/relay-questions', auth, (req, res) => {
     const conversationId = req.query.conversationId ? String(req.query.conversationId) : null;
     const status = String(req.query.status || 'pending').trim() || 'pending';
-    const rows = stmts.listQuestions.all(status, conversationId, conversationId);
+    let rows = stmts.listQuestions.all(status, conversationId, conversationId);
+    if (fromRemoteRelay(req)) rows = rows.filter((row) => !isRemoteRelayApprovalRow(row));
     res.json({ questions: rows.map(formatQuestionRow) });
   });
 
   app.get('/api/relay-question/:id', auth, (req, res) => {
     const row = stmts.getQuestion.get(req.params.id);
-    if (!row) return res.status(404).json({ error: 'Not found' });
+    if (!row || (isRemoteRelayApprovalRow(row) && fromRemoteRelay(req))) {
+      return res.status(404).json({ error: 'Not found' });
+    }
     res.json({ question: formatQuestionRow(row) });
   });
 
@@ -220,6 +250,7 @@ export function registerAskUserRoutes(app, deps) {
   });
 
   app.post('/api/relay-question/:id/answer', auth, (req, res) => {
+    if (!admitRemoteRelayRequest(req, res, remoteRelayInbound)) return;
     const id = String(req.params.id || '').trim();
     const { answer, structuredAnswer, sdk_session_id, continuation_id, continuation_question_id } = req.body;
     const sdkSessionId = normalizeId(sdk_session_id);
@@ -228,6 +259,12 @@ export function registerAskUserRoutes(app, deps) {
 
     const row = stmts.getQuestion.get(id);
     if (!row) return res.status(404).json({ error: 'Not found' });
+    // Allow / Deny on this relay's own call to another relay is its user's
+    // decision; the relay that call went to must never make it.
+    if (isRemoteRelayApprovalRow(row) && fromRemoteRelay(req)) {
+      console.warn(`[${ts()}] QUESTION  reject id=${id.slice(0, 8)} reason=remote-relay-approval-from-remote`);
+      return res.status(403).json({ error: 'Only this relay\'s user can answer a remote relay approval' });
+    }
     if (row.status !== 'pending') return res.status(409).json({ error: `Question already ${row.status}` });
 
     const schema = parseQuestionRequest(row.request_schema);
@@ -287,6 +324,9 @@ export function registerAskUserRoutes(app, deps) {
   app.post('/api/relay-question/:id/timeout', auth, (req, res) => {
     const row = stmts.getQuestion.get(req.params.id);
     if (!row) return res.status(404).json({ error: 'Not found' });
+    if (isRemoteRelayApprovalRow(row) && fromRemoteRelay(req)) {
+      return res.status(403).json({ error: 'Only this relay\'s user can answer a remote relay approval' });
+    }
     if (row.status !== 'pending') return res.json({ ok: true, question: formatQuestionRow(row) });
 
     const result = stmts.timeoutQuestion.run(row.id);