@oar-sh/oar 0.9.2 → 0.9.4

package/server/routes/sessions-routes.mjs

@@ -1,11 +1,11 @@
 'use strict';
+import { liveResendsByOriginal } from '../services/steer-resend.mjs';
 import { killTmuxSession } from '../services/session-worker-launch-service.mjs';
 
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { randomUUID } from 'crypto';
-import { spawn } from 'child_process';
 import { createSdkSessionSyncService } from '../services/sdk-session-sync-service.mjs';
 import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
@@ -35,6 +35,8 @@ import {
 import { workspaceRootDisplayName } from '../workspace-root.mjs';
 import { createKeyedMutex } from '../services/keyed-mutex-service.mjs';
 import { createFixedWindowRateLimiter } from '../services/rate-limit-service.mjs';
+import { parseRemoteRelayOriginJson } from '../repositories/remote-relay-repository.mjs';
+import { admitRemoteRelayRequest, publicRemoteRelayOrigin } from '../services/remote-relay-inbound.mjs';
 import {
   RELAUNCH_COALESCE_WINDOW_MS,
   buildRelaunchRequestKey,
@@ -685,26 +687,6 @@ function isOpenAIImageModelId(model = '') {
   return normalized.startsWith('gpt-image-') || normalized.startsWith('dall-e-');
 }
 
-function runHostSuspendToRam() {
-  if (process.platform !== 'win32') {
-    return { ok: false, statusCode: 501, error: 'Host suspend is only supported on Windows' };
-  }
-  try {
-    const child = spawn('rundll32.exe', ['powrprof.dll,SetSuspendState', '0,0,0'], {
-      detached: true,
-      stdio: 'ignore',
-      windowsHide: true,
-    });
-    child.unref?.();
-    return {
-      ok: true,
-      command: 'rundll32.exe powrprof.dll,SetSuspendState 0,0,0',
-    };
-  } catch (error) {
-    return { ok: false, statusCode: 500, error: error?.message || 'Failed to launch host suspend command' };
-  }
-}
-
 function isPidAlive(pidValue) {
   const pid = Number(pidValue);
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -947,13 +929,19 @@ export function normalizePreferredReasoningEffort(value) {
   return String(value || '').trim().toLowerCase();
 }
 
-const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
+// The web client caps what it saves at the same length (MAX_DRAFT_TEXT_LENGTH
+// in public/app/conversation-draft-sync.mjs); a test pins them together.
+export const MAX_CONVERSATION_DRAFT_LENGTH = 20_000;
 
 function normalizeConversationDraftText(value, { maxLength = MAX_CONVERSATION_DRAFT_LENGTH } = {}) {
   const text = String(value ?? '');
   if (!text.trim()) return '';
   if (text.length <= maxLength) return text;
-  return text.slice(0, maxLength);
+  // Never split a surrogate pair: SQLite would store the lone half as U+FFFD,
+  // and the client (which cuts the same way) would no longer match its draft.
+  const cut = text.slice(0, maxLength);
+  const last = cut.charCodeAt(cut.length - 1);
+  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
 }
 
 export function normalizeOptionalIsoTimestamp(value) {
@@ -1743,17 +1731,24 @@ export function buildConversationMessages({
       .map((row) => [String(row?.id || '').trim(), row])
       .filter(([id]) => !!id),
   );
+  // A stopped steer's marker says "Resent" from the data, so it holds across
+  // reloads and devices (the relay refuses a second Resend on the same basis).
+  const liveResends = liveResendsByOriginal(dbMessages, queueRows);
   const normalizedDbMessages = Array.isArray(dbMessages)
     ? dbMessages.map((message) => {
         const id = String(message?.id || '').trim();
+        // The queue's link is pruned with old rows; the message's own column
+        // keeps it, so a reload still anchors the reply under its prompt.
         const sourceMessageId = message?.role === 'assistant'
-          ? (responseMessageToSourceId.get(id) || undefined)
+          ? (responseMessageToSourceId.get(id) || String(message?.source_message_id || '').trim() || undefined)
           : undefined;
         // A user row's queue entry shares its id; assistant rows reach the same
         // entry through the response mapping. Both need it for the effort tag.
         const queueRow = sourceMessageId
           ? queueRowsById.get(sourceMessageId)
           : (message?.role === 'user' ? queueRowsById.get(id) : null);
+        // Provenance of a prompt another relay's agent sent: the bubble's badge.
+        const origin = message?.role === 'user' ? parseRemoteRelayOriginJson(message?.origin_json) : null;
         return {
           activities: message?.role === 'assistant' ? (relayActivitiesByMessageId.get(id) || []) : [],
           thoughts: message?.role === 'assistant' ? (relayThoughtsByMessageId.get(id) || []) : [],
@@ -1775,6 +1770,16 @@ export function buildConversationMessages({
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
+          // 'continuation' badges a self-started turn; 'absorbed' marks a
+          // reply that continues through the next (steered) user message;
+          // 'folded'/'stopped' are a steer's settle markers. Without this the
+          // live-appended badge/merge/marker vanished on reload.
+          kind: message?.kind || undefined,
+          resendOfMessageId: message?.role === 'user' ? (message?.resend_of_message_id || undefined) : undefined,
+          resentAs: (message?.role === 'assistant' && message?.kind === 'stopped' && sourceMessageId)
+            ? (liveResends.get(sourceMessageId) || undefined)
+            : undefined,
+          ...(origin ? { origin } : {}),
         };
       })
     : [];
@@ -2084,6 +2089,13 @@ export function registerSessionsRoutes(app, deps) {
     windowsBootAutostartService,
     isSha256,
     uploadPathForSha,
+    hostSuspendService = null,
+    collectHostActivity = null,
+    hostSuspendPlatform = process.platform,
+    // Remote relays (server/services/remote-relay-inbound.mjs): origin on
+    // conversations another relay's agent created, and the inbound switch.
+    // Absent in older wiring and most tests, where both are no-ops.
+    remoteRelayInbound = null,
   } = deps;
   const sdkSessionSyncService = createSdkSessionSyncService(db);
   // Generic synchronous transaction runner for the session-sync route: binding
@@ -2112,9 +2124,11 @@ export function registerSessionsRoutes(app, deps) {
     }
   }
 
-  const SDK_DELETE_WAIT_TIMEOUT_MS = 12_000;
-  const SDK_DELETE_POLL_MS = 200;
   const SDK_DELETE_STALE_PROCESSING_MS = 60_000;
+  const CLI_SESSION_DELETE_TIMEOUT_MS = 10_000;
+  const LIVE_WORKER_STATUSES = new Set(['starting', 'ready', 'processing']);
+  // A session id that is safe to join into a path under the session-state root.
+  const SESSION_FOLDER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
   const markConversationDeleted = db.prepare(`UPDATE conversations SET status = 'deleted', updated_at = ? WHERE id = ?`);
   const getActiveQueueForMessage = db.prepare(`
     SELECT id
@@ -2143,6 +2157,20 @@ export function registerSessionsRoutes(app, deps) {
     WHERE conversation_id = ?
       AND status IN ('pending', 'processing', 'parked')
   `);
+  const countProcessingConversationQueueRows = db.prepare(`
+    SELECT COUNT(*) AS count
+    FROM queue
+    WHERE conversation_id = ?
+      AND status = 'processing'
+  `);
+  const findOtherLiveConversationForSdkSession = db.prepare(`
+    SELECT id
+    FROM conversations
+    WHERE sdk_session_id = ?
+      AND id != ?
+      AND status != 'deleted'
+    LIMIT 1
+  `);
   const getConversationUsageSnapshotAggregate = db.prepare(`
     SELECT
       COUNT(*) AS snapshot_count,
@@ -2206,10 +2234,6 @@ export function registerSessionsRoutes(app, deps) {
   const sessionLaunchMutex = createKeyedMutex();
   const relaunchCoalescer = createRelaunchCoalescer({ windowMs: RELAUNCH_COALESCE_WINDOW_MS });
 
-  function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-
   // Layer every enabled provider's models onto the base Copilot catalog.
   function buildModelCatalogWithProviders(modelState, openAISettings = getOpenAIProviderSettings()) {
     return buildModelCatalogWithGrokProvider(
@@ -2292,16 +2316,121 @@ export function registerSessionsRoutes(app, deps) {
     return true;
   }
 
-  async function waitForSdkDeleteCompletion(sdkSessionId, timeoutMs = SDK_DELETE_WAIT_TIMEOUT_MS) {
-    const sid = String(sdkSessionId || '').trim();
-    if (!sid) return { completed: false };
-    const startedAt = Date.now();
-    while ((Date.now() - startedAt) < timeoutMs) {
-      const row = stmts.getSdkDeleteRequestBySessionId.get(sid);
-      if (!row) return { completed: true };
-      await sleep(SDK_DELETE_POLL_MS);
-    }
-    return { completed: false };
+  /**
+   * Whether a conversation is still working, which blocks deleting it: a turn
+   * is running (including one waiting on a question card or an approval) or
+   * background tasks are live. Both only count while the session's worker is
+   * alive: a dead worker runs nothing, and the processing rows or task set it
+   * left behind would otherwise make the conversation undeletable. A session
+   * the registry has never seen may still be running a turn, so its
+   * processing rows count.
+   *
+   * A worker's pid decides whether it is alive; its status only when it has
+   * none. A turn that fails marks a worker that is still running 'error',
+   * and it stays so until its next turn, background tasks and all.
+   */
+  function describeConversationActivity(conversationId, workerSessionId) {
+    const worker = sessionWorkerRegistry?.getWorker?.(workerSessionId) || null;
+    const workerAlive = !!worker && (worker.pid
+      ? isPidAlive(worker.pid)
+      : LIVE_WORKER_STATUSES.has(String(worker.status || '').trim().toLowerCase()));
+    const processingCount = Number(countProcessingConversationQueueRows.get(conversationId)?.count || 0);
+    const taskKeys = [...new Set([conversationId, workerSessionId])];
+    const liveTasks = workerAlive ? taskKeys.flatMap((key) => backgroundTaskStore?.get?.(key) || []) : [];
+    return {
+      turnRunning: processingCount > 0 && (workerAlive || !worker),
+      backgroundTaskCount: liveTasks.length,
+      // Tasks the panel shows no Stop button for (Copilot detached shells).
+      unstoppableTaskCount: liveTasks.filter((task) => task?.stoppable === false).length,
+    };
+  }
+
+  function withDeadline(promise, timeoutMs, label) {
+    let timer = null;
+    return Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs} ms`)), timeoutMs);
+        timer.unref?.();
+      }),
+    ]).finally(() => clearTimeout(timer));
+  }
+
+  /**
+   * The Claude CLI's footprint for one session: its transcript
+   * (`<projectDir>/<nativeSessionId>.jsonl`) and the per-session folder beside
+   * it. Nothing else in the project folder is touched — it holds every other
+   * session of that workspace and the project memory.
+   */
+  function deleteClaudeCliSession({ conversation, runtimeSession }) {
+    const nativeSessionId = String(runtimeSession?.claude_native_session_id || '').trim();
+    if (!nativeSessionId || typeof resolveClaudeSessionRoot !== 'function') return { deleted: null };
+    const anchors = resolveClaudeSessionRoot({
+      claudeNativeSessionId: nativeSessionId,
+      workspaceRootPath: String(
+        conversation?.runtime_workspace_root_path || conversation?.configured_workspace_root_path || '',
+      ).trim(),
+    });
+    if (!anchors?.projectDirPath) return { deleted: null };
+    const projectDir = path.resolve(anchors.projectDirPath);
+    const targets = [anchors.transcriptPath, anchors.sessionRootExists ? anchors.sessionRootPath : '']
+      .filter(Boolean)
+      .map((target) => path.resolve(target))
+      .filter((target) => path.dirname(target) === projectDir
+        && [nativeSessionId, `${nativeSessionId}.jsonl`].includes(path.basename(target)));
+    for (const target of targets) fs.rmSync(target, { recursive: true, force: true });
+    return { deleted: targets.length > 0 };
+  }
+
+  /**
+   * The Copilot session, through the runtime's own deleteSession(). When that
+   * fails the request goes on the SDK delete queue, which a CLI-side consumer
+   * (the extension engine) still works off.
+   */
+  async function deleteCopilotCliSession({ sdkSessionId, conversationId }) {
+    const stateRoot = String(resolveSessionStateRoot?.() || '').trim();
+    const sessionDir = stateRoot && SESSION_FOLDER_ID_PATTERN.test(sdkSessionId) ? path.join(stateRoot, sdkSessionId) : '';
+    // A conversation deleted before its first turn has no session on disk yet
+    // (the runtime would answer "Session file not found").
+    if (sessionDir && !fs.existsSync(sessionDir)) return { deleted: null };
+    if (typeof sdkSessionImportService?.deleteSession !== 'function') return { deleted: null };
+    try {
+      await withDeadline(
+        sdkSessionImportService.deleteSession(sdkSessionId),
+        CLI_SESSION_DELETE_TIMEOUT_MS,
+        'Copilot deleteSession()',
+      );
+      return { deleted: true };
+    } catch (error) {
+      const reason = String(error?.message || error);
+      if (/Session file not found/i.test(reason)) {
+        // The runtime keeps no session for it, only this session's own
+        // folder (a run that never wrote its session file): nothing to retry.
+        if (sessionDir) fs.rmSync(sessionDir, { recursive: true, force: true });
+        return { deleted: sessionDir ? true : null };
+      }
+      console.warn(`[delete] Copilot session ${shortId(sdkSessionId)} was not deleted: ${reason}`);
+      enqueueSdkDeleteRequest(sdkSessionId, conversationId);
+      return { deleted: false, queued: true };
+    }
+  }
+
+  /** The conversation's CLI-side session, per provider; null where the relay keeps none. */
+  async function deleteCliSession({ conversation, conversationId, sdkSessionId, runtimeSession }) {
+    const provider = String(runtimeSession?.provider_type || '').trim().toLowerCase();
+    try {
+      if (provider === 'claude') return deleteClaudeCliSession({ conversation, runtimeSession });
+      if (!sdkSessionId) return { deleted: null };
+      if (!provider || provider === 'github' || provider === 'openai') {
+        return await deleteCopilotCliSession({ sdkSessionId, conversationId });
+      }
+      return { deleted: null };
+    } catch (error) {
+      // The conversation is already tombstoned: a file the OS will not let go
+      // of must not leave it half deleted.
+      console.warn(`[delete] CLI session of ${shortId(conversationId)} was not deleted: ${error?.message || error}`);
+      return { deleted: false };
+    }
   }
 
   function finalizeDeletedConversationsForSdkSession(sdkSessionId) {
@@ -2436,7 +2565,7 @@ export function registerSessionsRoutes(app, deps) {
       (stmts.getSharedMessages || stmts.getMessages).all(resolvedConversationId),
     );
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -2495,7 +2624,11 @@ export function registerSessionsRoutes(app, deps) {
     });
     messages = messages.map((message) => {
       const sourceMessageId = responseMessageToSourceId.get(String(message.id || '').trim()) || message.sourceMessageId || undefined;
-      const nextMessage = sourceMessageId ? { ...message, sourceMessageId } : message;
+      const withSource = sourceMessageId ? { ...message, sourceMessageId } : message;
+      // A public share never shows another relay's address or ids.
+      const nextMessage = withSource.origin
+        ? { ...withSource, origin: publicRemoteRelayOrigin(withSource.origin) }
+        : withSource;
       const attachments = Array.isArray(nextMessage?.attachments)
         ? nextMessage.attachments.map((attachment) => rewriteSharedGeneratedImageAttachmentContentUrl(rewriteSharedAttachmentContentUrl(attachment, shareToken), shareToken))
         : nextMessage?.attachments;
@@ -2644,6 +2777,8 @@ export function registerSessionsRoutes(app, deps) {
         draftAttachments: parseDraftAttachmentsColumn(r.draft_attachments),
         draftUpdatedAt: r.draft_updated_at || null,
         draftUpdatedByClientId: r.draft_updated_by_client_id || null,
+        // Set on conversations another relay's agent created ("via <relay>").
+        origin: parseRemoteRelayOriginJson(r.origin_json),
       };
     });
 
@@ -3181,7 +3316,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(conversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(conversationId);
@@ -3285,6 +3420,7 @@ export function registerSessionsRoutes(app, deps) {
       draftAttachments: parseDraftAttachmentsColumn(conv.draft_attachments),
       draftUpdatedAt: conv.draft_updated_at || null,
       draftUpdatedByClientId: conv.draft_updated_by_client_id || null,
+      origin: parseRemoteRelayOriginJson(conv.origin_json),
       messages: history.messages,
       pageInfo: history.pageInfo,
       refreshed: true,
@@ -3583,7 +3719,7 @@ export function registerSessionsRoutes(app, deps) {
     });
     const dbMessages = stmts.getMessages.all(resolvedConversationId);
     const queueRows = db.prepare(`
-      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model
+      SELECT id, response_message_id, text, timestamp, retry_count, reasoning_effort, model, status
       FROM queue
       WHERE conversation_id = ?
     `).all(resolvedConversationId);
@@ -3680,6 +3816,10 @@ export function registerSessionsRoutes(app, deps) {
       updatedAt: conv.updated_at,
       sessionUsageSummary,
       inFlight,
+      // A queued (pending/parked) row counts too: inFlight covers only the
+      // processing one. Another relay's agent tells "still queued" from
+      // "cancelled" with it.
+      activeTurn: Number(stmts.getConversationActiveQueueCount?.get?.(resolvedConversationId)?.count || 0) > 0,
       backgroundTasks: backgroundTaskStore?.get?.(resolvedConversationId) || [],
       previews: listConversationPreviews?.(resolvedConversationId) || [],
       preferredRelayMode: preferences.preferredRelayMode,
@@ -3689,6 +3829,8 @@ export function registerSessionsRoutes(app, deps) {
       draftAttachments: parseDraftAttachmentsColumn(conv.draft_attachments),
       draftUpdatedAt: conv.draft_updated_at || null,
       draftUpdatedByClientId: conv.draft_updated_by_client_id || null,
+      // Set on conversations another relay's agent created ("via <relay>").
+      origin: parseRemoteRelayOriginJson(conv.origin_json),
       messages: history.messages,
       pageInfo: history.pageInfo,
     });
@@ -3854,15 +3996,30 @@ export function registerSessionsRoutes(app, deps) {
     if (!existing || String(existing.status || '').trim() === 'deleted') {
       return res.status(404).json({ error: 'Conversation not found' });
     }
-    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt ?? req.body?.base_draft_updated_at;
-    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined;
+    // A null base means "I have seen no draft" and conflicts with any versioned
+    // draft — but only from clients that declare the versioned protocol. Older
+    // tabs also send an explicit null (after every keystroke), and a 409 there
+    // would revert their typing, so for them null stays unconditional.
+    const baseDraftUpdatedAtValue = req.body?.baseDraftUpdatedAt !== undefined
+      ? req.body.baseDraftUpdatedAt
+      : req.body?.base_draft_updated_at;
+    const speaksVersionedDraftProtocol = Number(req.body?.draftSyncVersion) >= 2;
+    const comparesDraftVersion = baseDraftUpdatedAtValue !== undefined
+      && (baseDraftUpdatedAtValue !== null || speaksVersionedDraftProtocol);
     const normalizedBaseDraftUpdatedAt = normalizeOptionalIsoTimestamp(baseDraftUpdatedAtValue);
     const suppliedBaseTimestamp = String(baseDraftUpdatedAtValue ?? '').trim();
     if (comparesDraftVersion && suppliedBaseTimestamp && !normalizedBaseDraftUpdatedAt) {
       return res.status(400).json({ error: 'Invalid baseDraftUpdatedAt timestamp' });
     }
     const existingDraftUpdatedAt = normalizeOptionalIsoTimestamp(existing.draft_updated_at);
-    if (hasConversationDraftVersionConflict({
+    // A pagehide copy taken while this client's own send was in flight carries
+    // the pre-send base; the send transaction has since moved the version. That
+    // move (recorded with the sender's client id) is the only mismatch it may
+    // pass — a newer draft from anyone else still conflicts.
+    const acceptsOwnSendVersion = req.body?.acceptOwnSend === true
+      && !!senderClientId
+      && String(existing.draft_updated_by_client_id || '') === senderClientId;
+    if (!acceptsOwnSendVersion && hasConversationDraftVersionConflict({
       existingDraftUpdatedAt,
       baseDraftUpdatedAt: normalizedBaseDraftUpdatedAt,
       compareEnabled: comparesDraftVersion,
@@ -3874,6 +4031,7 @@ export function registerSessionsRoutes(app, deps) {
         conflict: true,
         conversationId,
         draftText: String(existing.draft_text || ''),
+        draftAttachments: parseDraftAttachmentsColumn(existing.draft_attachments),
         draftUpdatedAt: existingDraftUpdatedAt,
         draftUpdatedByClientId: existing.draft_updated_by_client_id || null,
       });
@@ -4275,44 +4433,135 @@ export function registerSessionsRoutes(app, deps) {
     }
 
     try {
-      const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
-      if (!sdkSessionId) {
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-        cleanupGeneratedImagesForConversation({
-          conversationId: id,
-          sdkSessionId: null,
-          messageRows: stmts.getMessages?.all?.(id) || [],
-          parseAttachments,
-          hydrateAttachment,
-          resolveSessionStateRoot,
-        });
-        const orphanedUploads = collectOrphanedUploadsFromConversation(id);
-        hardDeleteConversationRows(id);
-        deleteOrphanedUploads(orphanedUploads);
-        io.emit('conversation_deleted', { conversationId: id });
-        return res.json({ ok: true });
-      }
-
-      markConversationDeleted.run(new Date().toISOString(), id);
-      stmts.markDeletedSdkSession.run(sdkSessionId, new Date().toISOString());
-      if (sdkSessionId !== id) {
-        // Also tombstone the conversation id itself for legacy/synthetic sdk id fallback paths.
-        stmts.markDeletedSdkSession.run(id, new Date().toISOString());
-      }
-      enqueueSdkDeleteRequest(sdkSessionId, id);
-      const awaited = await waitForSdkDeleteCompletion(sdkSessionId);
-      if (awaited.completed) return res.json({ ok: true });
-
-      io.emit('conversation_delete_pending', { conversationId: id });
-      return res.json({ ok: true, pending: true });
+      // Session workers are keyed by the SDK session id, which is the
+      // conversation id until a session is bound. Serialized with launches and
+      // relaunches of that session, and with a second delete of it.
+      const workerSessionId = String(existing.sdk_session_id || '').trim() || id;
+      const outcome = await sessionLaunchMutex.runExclusive(
+        workerSessionId,
+        () => deleteConversationNow(id),
+      );
+      return res.status(outcome.statusCode).json(outcome.body);
     } catch (error) {
       console.warn(`[archive] Delete failed for ${id}: ${error?.message || error}`);
       return res.status(500).json({ error: 'Failed to delete conversation' });
     }
   });
 
+  /** DELETE /api/conversation/:id under its session's lock; see the route. */
+  async function deleteConversationNow(id) {
+    const existing = stmts.getConvAnyStatus.get(id);
+    if (!existing) return { statusCode: 200, body: { ok: true, alreadyDeleted: true } };
+    const sdkSessionId = String(existing.sdk_session_id || '').trim() || null;
+    const workerSessionId = sdkSessionId || id;
+
+    const activity = describeConversationActivity(id, workerSessionId);
+    if (activity.turnRunning) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'turn-running',
+          message: 'This conversation is still working on a reply. Stop it, then delete it.',
+        },
+      };
+    }
+    if (activity.backgroundTaskCount > 0) {
+      return {
+        statusCode: 409,
+        body: {
+          ok: false,
+          error: 'conversation-active',
+          reason: 'background-tasks',
+          // Kill session stops the session's worker, and the delete counts no
+          // tasks for a conversation whose worker is gone.
+          message: activity.unstoppableTaskCount > 0
+            ? 'Background tasks are still running in this conversation, and some have no Stop button. Use Kill session in its ⋯ menu, then delete it.'
+            : 'Background tasks are still running in this conversation. Stop them in the task panel, then delete it.',
+        },
+      };
+    }
+
+    // A worker and CLI session that another live conversation still uses
+    // stay; only this conversation's own data goes.
+    const sharedWithConversationId = sdkSessionId
+      ? String(findOtherLiveConversationForSdkSession.get(sdkSessionId, id)?.id || '').trim() || null
+      : null;
+    // A Copilot session the relay only imported, and never ran, belongs to
+    // whoever started it in the CLI. Deleting the conversation hides and
+    // tombstones it, and nothing more: the relay started no process for it
+    // (the process scan would find that user's own `copilot --resume`), and
+    // its CLI session stays. Asked before the stop, which removes the registry
+    // entry that shows the relay has run it.
+    const importedOnly = !!sdkSessionId && sdkSessionImportService?.isImportedOnly?.(sdkSessionId) === true;
+
+    // An idle worker is stopped before anything is deleted: the route used to
+    // leave it running (and holding its workspace) until the relay restarted.
+    // Nothing is touched when it will not die.
+    let workerStopped = false;
+    if (!sharedWithConversationId && !importedOnly) {
+      const stopped = await stopIdleWorkspaceRootSession({
+        sdkSessionId: workerSessionId,
+        worker: sessionWorkerRegistry?.getWorker?.(workerSessionId) || null,
+        sessionWorkerSupervisor,
+        sessionWorkerRegistry,
+        sessionWorkerProcessInspector,
+        stopOverrides: sessionWorkerStopOverrides,
+      });
+      if (!stopped.ok) {
+        return {
+          statusCode: 409,
+          body: {
+            ok: false,
+            error: 'worker-stop-failed',
+            message: "Couldn't stop this conversation's session, so nothing was deleted. Try again in a moment.",
+            remainingPids: stopped.remainingPids || [],
+          },
+        };
+      }
+      workerStopped = (stopped.stoppedPids || []).length > 0;
+      // Re-armed after the stop, which can outlast the kill block's grace
+      // window: nothing may respawn a worker for the rows deleted below.
+      sessionWorkerSupervisor?.markKilled?.(workerSessionId);
+      for (const key of new Set([id, workerSessionId])) backgroundTaskStore?.replace?.(key, []);
+    }
+
+    const deletedAt = new Date().toISOString();
+    markConversationDeleted.run(deletedAt, id);
+    // Tombstones keep the SDK session importer from bringing it back.
+    stmts.markDeletedSdkSession.run(sdkSessionId || id, deletedAt);
+    if (sdkSessionId && sdkSessionId !== id) stmts.markDeletedSdkSession.run(id, deletedAt);
+
+    const cliSession = sharedWithConversationId || importedOnly
+      ? { deleted: null }
+      : await deleteCliSession({
+        conversation: existing,
+        conversationId: id,
+        sdkSessionId,
+        runtimeSession: stmts.getRuntimeSessionByConversation?.get?.(id) || null,
+      });
+
+    cleanupGeneratedImagesForConversation({
+      conversationId: id,
+      sdkSessionId,
+      messageRows: stmts.getMessages?.all?.(id) || [],
+      parseAttachments,
+      hydrateAttachment,
+      resolveSessionStateRoot,
+    });
+    const orphanedUploads = collectOrphanedUploadsFromConversation(id);
+    hardDeleteConversationRows(id);
+    remoteRelayInbound?.repository?.forgetConversation?.(id);
+    deleteOrphanedUploads(orphanedUploads);
+    if (sdkSessionId && !cliSession.queued) stmts.deleteSdkDeleteRequest?.run?.(sdkSessionId);
+    io.emit('conversation_deleted', { conversationId: id });
+    return { statusCode: 200, body: { ok: true, workerStopped, cliSessionDeleted: cliSession.deleted } };
+  }
+
   // POST /api/conversation/:id/archive — archive conversation
   app.post('/api/conversation/:id/archive', auth, async (req, res) => {
+    if (!admitRemoteRelayRequest(req, res, remoteRelayInbound)) return;
     const id = String(req.params.id || '').trim();
     if (!id) return res.status(400).json({ error: 'Missing conversation id' });
     try {
@@ -4330,6 +4579,10 @@ export function registerSessionsRoutes(app, deps) {
   });
 
   app.post('/api/conversation/bootstrap', auth, async (req, res) => {
+    // Another relay's agent starting a session: refused while the inbound
+    // switch is off, otherwise the conversation keeps its provenance.
+    const remoteRequest = admitRemoteRelayRequest(req, res, remoteRelayInbound);
+    if (!remoteRequest) return;
     const clientSessionId = String(ensureSessionId(req, res) || '').trim();
     const now = new Date().toISOString();
     let conversationId = '';
@@ -4625,6 +4878,7 @@ export function registerSessionsRoutes(app, deps) {
       // single canonical tuple.
       const commitBootstrapState = db.transaction(() => {
         stmts.insertConv.run(conversationId, title, now, now);
+        if (remoteRequest.origin) remoteRelayInbound?.repository?.setConversationOrigin?.(conversationId, remoteRequest.origin);
         const boundRuntimeSession = ensureRuntimeSessionBinding(
           conversationId,
           selectedModel,
@@ -4744,6 +4998,7 @@ export function registerSessionsRoutes(app, deps) {
         ok: true,
         conversationId,
         conversation,
+        origin: parseRemoteRelayOriginJson(conversation?.origin_json),
         runtimeSessionId: runtimeSession?.id || null,
         ownerSessionId,
         worker: ownerWorker,
@@ -4845,6 +5100,7 @@ export function registerSessionsRoutes(app, deps) {
       activeBridgeOwner: runtimeState.activeBridgeOwner || null,
       restartOrchestrator: relayRestartOrchestrator?.getState?.() || null,
       relayShutdown: runtimeState.relayShutdown || null,
+      hostSuspend: runtimeState.hostSuspend || null,
       platform: process.platform,
       features: featureFlags || {},
       sessionWorker: sessionWorkerStatus,
@@ -5939,21 +6195,59 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // Deferred host suspend: the request is queued and fulfilled by the
+  // host-suspend service once nothing runs any more (see
+  // docs/plans/2026-09-27-deferred-host-suspend.md).
+  app.get('/api/host/suspend', auth, (req, res) => {
+    if (!hostSuspendService) {
+      return res.status(501).json({ ok: false, error: 'Host suspend is unavailable' });
+    }
+    const state = hostSuspendService.refresh();
+    let activity = null;
+    if (!state.pending && typeof collectHostActivity === 'function') {
+      try {
+        activity = collectHostActivity({ request: null });
+      } catch (error) {
+        activity = { blockers: [], error: String(error?.message || error) };
+      }
+    }
+    return res.json({
+      ok: true,
+      supported: hostSuspendPlatform === 'win32',
+      state,
+      blockers: state.pending ? state.blockers : (activity?.blockers || []),
+      activity,
+    });
+  });
+
   app.post('/api/host/suspend', auth, (req, res) => {
-    const result = runHostSuspendToRam();
-    if (!result?.ok) {
-      return res.status(result?.statusCode || 500).json({
-        ok: false,
-        error: result?.error || 'Failed to suspend host',
-      });
+    if (!hostSuspendService) {
+      return res.status(501).json({ ok: false, error: 'Host suspend is unavailable' });
+    }
+    if (hostSuspendPlatform !== 'win32') {
+      return res.status(501).json({ ok: false, error: 'Host suspend is only supported on Windows' });
     }
+    const reason = String(req.body?.reason || 'manual-suspend').trim().slice(0, 140) || 'manual-suspend';
+    const requestedBy = String(req.body?.requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
+    const result = hostSuspendService.request({ reason, requestedBy });
     return res.status(202).json({
       ok: true,
       queued: true,
-      command: result.command,
+      accepted: result.accepted !== false,
+      alreadyPending: !!result.alreadyPending,
+      state: result.state,
     });
   });
 
+  app.post('/api/host/suspend/cancel', auth, (req, res) => {
+    if (!hostSuspendService) {
+      return res.status(501).json({ ok: false, error: 'Host suspend is unavailable' });
+    }
+    const requestedBy = String(req.body?.requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
+    const result = hostSuspendService.cancel({ requestedBy });
+    return res.json({ ok: true, cancelled: !!result.cancelled, state: result.state });
+  });
+
   app.get('/api/restart-orchestrator', auth, (req, res) => {
     ensureSessionId(req, res);
     return res.json({ orchestrator: relayRestartOrchestrator?.getState?.() || null });