@oar-sh/oar 0.9.2 → 0.9.4

package/server/server-runtime.mjs

@@ -24,6 +24,9 @@ import {
   normalizeWorkspaceRootKey,
 } from './services/workspace-root-path-policy.mjs';
 import { stopSessionWorkerProcesses } from './services/session-worker-stop-service.mjs';
+import { pickLiveTurnRowId } from './services/live-turn-picker.mjs';
+import { buildSteerSettleFailure, steerAgentLabelForProvider } from '../shared/steer-settle-failure.mjs';
+import { sanitizeRelayQuestionContext as sanitizeRelayQuestionContextWith } from './services/relay-question-context.mjs';
 import { isRealPathWithinRoot } from './services/workspace-symlink-guard.mjs';
 import { applySchema } from './db-schema.mjs';
 import { createSessionRepository } from './repositories/session-repository.mjs';
@@ -37,6 +40,13 @@ import { registerRelayBoardRoutes } from './routes/relay-board-routes.mjs';
 import { registerCacheRoutes } from './routes/cache-routes.mjs';
 import { registerGitRoutes } from './routes/git-routes.mjs';
 import { registerPreviewRoutes } from './routes/preview-routes.mjs';
+import { registerRemoteRelayRoutes } from './routes/remote-relay-routes.mjs';
+import { createRemoteRelayRepository } from './repositories/remote-relay-repository.mjs';
+import { createRemoteRelayClient } from './services/remote-relay-client.mjs';
+import { createRemoteRelayRegistry } from './services/remote-relay-registry-service.mjs';
+import { createRemoteRelayPairing } from './services/remote-relay-pairing.mjs';
+import { createRemoteRelayCallerContext } from './services/remote-relay-caller-context.mjs';
+import { createRemoteRelayDispatcher } from './services/remote-relay-dispatcher.mjs';
 import { createDeleteArchiveService } from './services/delete-archive-service.mjs';
 import { createStatusEventService } from './services/status-event-service.mjs';
 import { createClaudeAuthService } from './services/claude-auth-service.mjs';
@@ -45,6 +55,9 @@ import { createGrokAuthService } from './services/grok-auth-service.mjs';
 import { sweepUnreferencedUploads, UNREFERENCED_UPLOADS_QUERY } from './services/upload-sweep.mjs';
 import webpush from 'web-push';
 import { createPushDispatchService, ensurePushVapidKeys } from './services/push-dispatch-service.mjs';
+import { createHostSuspendService } from './services/host-suspend-service.mjs';
+import { createGitHubCiActivityService } from './services/github-ci-activity-service.mjs';
+import { runHostSuspendToRam } from './services/host-suspend-command.mjs';
 import { createActiveDeviceTracker } from './services/push-active-device-service.mjs';
 import { registerPushRoutes } from './routes/push-routes.mjs';
 import { createImageOperationService } from './services/image-operation-service.mjs';
@@ -3133,6 +3146,36 @@ function getRelayShutdownState() {
   };
 }
 
+// Every client shows a banner while a shutdown/restart is queued, so the
+// state goes out on each transition (request, cancel, drain) and on connect.
+function relayShutdownStatePayload() {
+  return { ...getRelayShutdownState(), queue: queueCounts() };
+}
+function emitRelayShutdownState() {
+  try { io.emit('relay_shutdown_state', relayShutdownStatePayload()); } catch {}
+}
+
+function cancelRelayShutdown({ requestedBy = 'localhost-api' } = {}) {
+  if (runtimeShutdownStarted) {
+    return { cancelled: false, status: 'shutting_down', ...relayShutdownStatePayload() };
+  }
+  if (!pendingRelayShutdownRequest) {
+    return { cancelled: false, ...relayShutdownStatePayload() };
+  }
+  const dropped = pendingRelayShutdownRequest;
+  pendingRelayShutdownRequest = null;
+  if (runtimeTimers.shutdownDrain) {
+    try { clearInterval(runtimeTimers.shutdownDrain); } catch {}
+    runtimeTimers.shutdownDrain = null;
+  }
+  console.log(
+    `${runtimeLogPrefix()}Relay ${dropped.action || 'shutdown'} request cancelled by `
+    + `${String(requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api'}`,
+  );
+  emitRelayShutdownState();
+  return { cancelled: true, dropped, ...relayShutdownStatePayload() };
+}
+
 function requestRelayShutdown({ reason = 'manual-request', requestedBy = 'localhost-api', restart = false } = {}) {
   const safeReason = String(reason || 'manual-request').trim().slice(0, 140) || 'manual-request';
   const safeRequestedBy = String(requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
@@ -3185,12 +3228,14 @@ function requestRelayShutdown({ reason = 'manual-request', requestedBy = 'localh
     );
     sessionWorkerWebSocketService.emitDraining(`api-${action}:${requestInfo?.reason || 'manual-request'}`);
     void shutdownRuntime(`api-${action}:${requestInfo?.reason || 'manual-request'}`, { exitCode });
+    emitRelayShutdownState();
   };
 
   if (!runtimeTimers.shutdownDrain) {
     runtimeTimers.shutdownDrain = setInterval(tryShutdownWhenIdle, 1000);
   }
   tryShutdownWhenIdle();
+  if (pendingRelayShutdownRequest) emitRelayShutdownState();
   const counts = queueCounts();
   return {
     accepted: true,
@@ -4880,8 +4925,127 @@ const backgroundTaskStore = {
   },
 };
 
+// ─── Deferred host suspend ───────────────────────────────────────────────────
+// "💤 Suspend host" waits until nothing runs any more: no queued/processing
+// turn, no live background task of a live worker, no open CI run in a
+// workspace that was busy since the request. The relay-side signals are read
+// synchronously each tick; CI is refreshed in the background and read from
+// the last snapshot (a never-checked workspace counts as busy).
+const hostActivityWorkerStatuses = new Set(['starting', 'ready', 'processing']);
+function hostActivityPidAlive(pidValue) {
+  const pid = Number(pidValue);
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+function hostActivityWorkerAlive(key) {
+  const worker = sessionWorkerRegistry?.getWorker?.(key)
+    || sessionWorkerRegistry?.getWorkerByConversationId?.(key)
+    || null;
+  if (!worker) return false;
+  return hostActivityWorkerStatuses.has(String(worker.status || '').trim().toLowerCase())
+    && hostActivityPidAlive(worker.pid);
+}
+const hostSuspendWatchedConversationIds = new Set();
+const githubCiActivityService = createGitHubCiActivityService({ logger: console });
+function hostActivityTitle(conversationId, fallbackTitle = null) {
+  const title = String(fallbackTitle || stmts.getConv?.get?.(conversationId)?.title || '').trim();
+  return title || String(conversationId || '').slice(0, 8);
+}
+function collectHostActivity({ request = null } = {}) {
+  const blockers = [];
+  const turnsByConversation = stmts.listActiveQueueCountsByConversation?.all?.() || [];
+  for (const row of turnsByConversation) {
+    const conversationId = String(row.conversation_id || '');
+    if (!conversationId) continue;
+    hostSuspendWatchedConversationIds.add(conversationId);
+    const count = Number(row.cnt || 0);
+    blockers.push({
+      kind: 'turn',
+      conversationId,
+      title: hostActivityTitle(conversationId, row.title),
+      count,
+      detail: count > 1 ? `${count} turns running` : 'turn running',
+    });
+  }
+  for (const [key, entry] of backgroundTaskStore.sets) {
+    const tasks = Array.isArray(entry?.tasks) ? entry.tasks : [];
+    if (!tasks.length || !hostActivityWorkerAlive(key)) continue;
+    const worker = sessionWorkerRegistry?.getWorker?.(key) || sessionWorkerRegistry?.getWorkerByConversationId?.(key) || null;
+    const conversationId = String(worker?.conversationId || key);
+    hostSuspendWatchedConversationIds.add(conversationId);
+    const what = tasks.slice(0, 3).map((task) => String(task?.description || task?.taskType || 'task').slice(0, 80)).join('; ');
+    blockers.push({
+      kind: 'background',
+      conversationId,
+      title: hostActivityTitle(conversationId),
+      count: tasks.length,
+      detail: `${tasks.length} background agent${tasks.length === 1 ? '' : 's'}: ${what}`,
+    });
+  }
+  const runningSubagents = Number(stmts.countRunningSubagentRuns?.get?.()?.cnt || 0);
+  // CI is only worth a network round-trip for workspaces that were busy since
+  // the request (or, for the modal's peek, that are busy right now).
+  const roots = [...hostSuspendWatchedConversationIds]
+    .map((conversationId) => {
+      try { return resolveConversationWorkspaceState({ conversationId })?.currentWorkspaceRootPath || ''; } catch { return ''; }
+    })
+    .filter(Boolean);
+  if (roots.length) void githubCiActivityService.describeRuns(roots).catch(() => {});
+  const ci = roots.length ? githubCiActivityService.snapshot(roots) : { repos: [], unknown: [], blockers: [] };
+  blockers.push(...ci.blockers);
+  if (!request && !hostSuspendService.getState().pending) hostSuspendWatchedConversationIds.clear();
+  return { blockers, runningSubagents, ci };
+}
+const hostSuspendService = createHostSuspendService({
+  collectActivity: collectHostActivity,
+  runSuspend: () => runHostSuspendToRam({ logger: console }),
+  logger: console,
+  onStateChange: (state) => {
+    if (state.status === 'idle') hostSuspendWatchedConversationIds.clear();
+    try { io.emit('host_suspend_state', state); } catch {}
+  },
+  onSuspended: () => {
+    void pushDispatchService.notifyHostSuspend({ body: 'All agents finished; the host is suspending now.' });
+  },
+  onDropped: (state, reason) => {
+    void pushDispatchService.notifyHostSuspend({ body: `Queued host suspend dropped: relay ${reason || 'restarting'}.` });
+  },
+});
+
+// The live turn among a conversation's processing rows. Mid-turn steering can
+// leave several processing at once — the running turn, steered messages the
+// CLI folded into it (no output of their own), a handed-off row still settling
+// — so the live turn is the row that produced output most recently; with
+// nothing to separate them yet, the oldest processing row (the turn a steered
+// message joins) wins. See live-turn-picker.mjs for why recency, not per-row
+// stream seq. Returns the whole row so callers get relay_mode/timestamps too.
+function resolveLiveTurnQueueRow(conversationId) {
+  const rows = stmts.listProcessingQueueByConversation?.all(conversationId)
+    || (stmts.getLatestProcessingQueueByConversation.get(conversationId)
+      ? [stmts.getLatestProcessingQueueByConversation.get(conversationId)]
+      : []);
+  if (!rows.length) return null;
+  if (rows.length === 1) return rows[0];
+  const byId = new Map(rows.map((row) => [String(row.id), row]));
+  const liveId = pickLiveTurnRowId(rows.map((row) => {
+    const output = stmts.getLastOutputAtByQueueMessage?.get({ id: row.id }) || null;
+    return {
+      id: String(row.id),
+      lastOutputAtMs: Date.parse(String(output?.last_output_at || '')) || 0,
+      streamDone: Number(output?.stream_done || 0) === 1,
+      processingAtMs: Date.parse(String(row.processing_at || row.timestamp || '')) || 0,
+    };
+  }));
+  return byId.get(liveId) || rows[0];
+}
+
 function inFlightStateForConversation(conversationId) {
-  const row = stmts.getLatestProcessingQueueByConversation.get(conversationId);
+  const row = resolveLiveTurnQueueRow(conversationId);
   if (!row) return null;
   const streamEvents = relayStreamEventsForQueueMessage(row.id);
   const lastStreamEvent = streamEvents.length ? streamEvents[streamEvents.length - 1] : null;
@@ -4906,17 +5070,17 @@ function inFlightStateForConversation(conversationId) {
 // retry_count like /api/requeue does, but bypasses that route's budget check,
 // so the sweep enforces it here). Minimal mirror of the route-side
 // failQueueMessage: mark failed, insert the assistant failure message, emit.
-function failRecoveredRowTerminally(row, reason) {
+function failRecoveredRowTerminally(row, reason, { failureRecord = null, failureText: presetText = null } = {}) {
   const now = new Date().toISOString();
   const responseId = uuidv4();
   const retryCount = Number(row?.retry_count || 0) + 1;
-  const failureText = `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
+  const failureText = presetText || `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
   const requestedModel = String(row?.model || '').trim() || null;
   const tx = db.transaction(() => {
     // setFailed is compare-and-set on status (processing/pending/parked): a
     // row that settled between the sweep's listing and this write must not
     // grow an orphan failure bubble on top of its real outcome.
-    const result = stmts.setFailed.run(JSON.stringify({
+    const result = stmts.setFailed.run(JSON.stringify(failureRecord || {
       kind: 'recovery-limit',
       error: 'recovery-limit',
       code: 'recovery-limit',
@@ -4940,6 +5104,7 @@ function failRecoveredRowTerminally(row, reason) {
       null,
       requestedModel ? 'user' : 'auto',
     );
+    stmts.setMessageSourceId?.run(row.id, responseId);
     stmts.linkActivityToResponse?.run(responseId, row.id);
     stmts.linkStreamEventsToResponse?.run(responseId, row.id);
     stmts.linkThoughtsToResponse?.run(responseId, row.id);
@@ -4954,7 +5119,20 @@ function failRecoveredRowTerminally(row, reason) {
     message: { role: 'assistant', text: failureText, model: requestedModel || 'unknown', mode: String(row?.relay_mode || '').trim() || null, timestamp: now },
   });
   io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
-  console.warn(`${runtimeLogPrefix()}RECOVERY LIMIT ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+  console.warn(`${runtimeLogPrefix()}${failureRecord ? 'CONSUMED FAILED' : 'RECOVERY LIMIT'} ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+}
+
+// A row whose prompt the worker's runtime already consumed (queue.consumed_at)
+// is at-most-once: recovery must never requeue it — a re-delivery would run the
+// prompt twice — so it fails terminally with the steer-settle wording, naming
+// the provider's runtime the way the workers' own settle wording does.
+function failConsumedRowTerminally(row, reason) {
+  const providerType = stmts.getRuntimeSessionByConversation?.get?.(row?.conversation_id)?.provider_type;
+  const failureRecord = buildSteerSettleFailure(row, { agentLabel: steerAgentLabelForProvider(providerType) });
+  failRecoveredRowTerminally(row, reason, {
+    failureRecord: { ...failureRecord, error: 'terminal-error', reason: String(reason || 'recovery') },
+    failureText: `${failureRecord.message} Error code: ${failureRecord.stableCode}. ${failureRecord.guidance}`,
+  });
 }
 
 function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso = null } = {}) {
@@ -4966,7 +5144,9 @@ function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso
     stmts.dropStaleContinuation?.run?.(row.id);
     io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
   }
-  const allRows = stmts.listRecoverableProcessing.all(params);
+  const listedRows = stmts.listRecoverableProcessing.all(params);
+  for (const row of listedRows.filter((entry) => entry?.consumed_at)) failConsumedRowTerminally(row, 'stale-recovery');
+  const allRows = listedRows.filter((entry) => !entry?.consumed_at);
   if (!allRows.length) return [];
   // Enforce the retry budget before requeueing: failing these rows first
   // flips them out of 'processing' so the recovery UPDATE below skips them.
@@ -5345,6 +5525,13 @@ const app        = express();
 // via config.trustProxy (e.g. a hop count or subnet).
 app.set('trust proxy', config.trustProxy ?? 'loopback');
 const httpServer = http.createServer(app);
+// Node closes an idle keep-alive connection after 5 s. A client that pools
+// connections (a fronting proxy such as Caddy or cloudflared, an API client)
+// can pick such a socket in the very moment the relay closes it; its request
+// is then reset before the relay reads a byte, and a POST is not replayed.
+// Holding idle connections longer than those pools do closes that window.
+httpServer.keepAliveTimeout = 65_000;
+httpServer.headersTimeout = 66_000;
 httpServer.prependListener('request', (req, _res) => {
   rewriteSocketIoRequestPath(req, remotePath);
 });
@@ -5772,6 +5959,10 @@ function recoverDeadWorkerProcessingRows(sessionId, reason) {
       io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
       continue;
     }
+    if (row.consumed_at) {
+      failConsumedRowTerminally(row, `worker-died-${reason}`);
+      continue;
+    }
     if (Number(row.retry_count || 0) + 1 >= MAX_REQUEUE_RETRIES) {
       failRecoveredRowTerminally(row, `worker-died-${reason}`);
       continue;
@@ -5814,11 +6005,15 @@ function handleWorkerSocketClosed({ sessionId, pid = null } = {}) {
   const sid = String(sessionId || '').trim();
   if (!sid) return;
   const owned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
-  if (!owned.length) return;
+  // A dead worker's steering snapshot must not keep holding the composer even
+  // when it owned no rows (the hold can outlive them, e.g. a continuation's).
+  const heldSteering = Boolean(sessionWorkerRegistry?.getWorker?.(sid)?.steering);
+  if (!owned.length && !heldSteering) return;
   const timer = setTimeout(() => {
     try {
       if (runtimeShutdownStarted) return;
       if (isWorkerSessionProcessAlive(sid, pid)) return; // reconnect or socket flap
+      sessionWorkerRegistry?.clearSteering?.(sid);
       const stillOwned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
       if (!stillOwned.length) return;
       console.warn(`${runtimeLogPrefix()}WORKER DIED session=${sid.slice(0, 8)} rows=${stillOwned.length} trigger=socket-close — recovering owned turns`);
@@ -5986,6 +6181,7 @@ const runtimeState = {
   set relayPaused(value) { relayPaused = value; },
   get ttyConsoleActive() { return Boolean(ttyConsoleRuntime?.tty); },
   get relayShutdown() { return getRelayShutdownState(); },
+  get hostSuspend() { return hostSuspendService.getState(); },
   get activeBridgeOwner() { return relayBridgeOwnerService.getOwner(); },
   get workerWebSocketStatus() { return sessionWorkerWebSocketService.status(); },
   get tmuxInspectorStatus() { return tmuxInspectorSocketService.status(); },
@@ -6002,6 +6198,82 @@ const windowsBootAutostartService = createWindowsBootAutostartService({
 });
 
 const gitChangesService = createGitChangesService();
+
+// ─── Remote Relays ────────────────────────────────────────────────────────────
+// Other OAR relays this one is paired with, so its agents can work there. Built
+// before the shared route deps: the message, session and question routes read
+// the registry for mentions, unlocks and the inbound switch.
+// Null when migration 0005 failed this boot (db-schema retries it next boot):
+// remotes still list and pair, nothing unlocks until then.
+const remoteRelayRepository = (() => {
+  try {
+    return createRemoteRelayRepository(db);
+  } catch (error) {
+    console.warn(`[remote-relays] unlock storage unavailable: ${error?.message || error}`);
+    return null;
+  }
+})();
+const remoteRelayClient = createRemoteRelayClient({
+  // A closure: the registry owning the instance id is declared just below.
+  getOwnRelayId: () => remoteRelayRegistry.instanceId(),
+  getOwnToken: () => config.authToken,
+});
+const remoteRelayRegistry = createRemoteRelayRegistry({
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, value, new Date().toISOString()),
+  client: remoteRelayClient,
+  repository: remoteRelayRepository,
+  getOwnToken: () => config.authToken,
+  getSelfName: getPwaAppName,
+  hostname: os.hostname(),
+  platform: process.platform,
+  version: RUNNING_VERSION,
+  emit: (event, payload) => io.emit(event, payload),
+  logger: console,
+});
+const remoteRelayPairing = createRemoteRelayPairing({
+  registry: remoteRelayRegistry,
+  client: remoteRelayClient,
+  getOwnToken: () => config.authToken,
+});
+// What the inbound routes need: no tokens, only ids, names and state.
+const remoteRelayInbound = {
+  listRelays: () => remoteRelayRegistry.list().map(({ id, name, url, lastStatus, version }) => ({ id, name, url, lastStatus, version })),
+  selfNames: () => [remoteRelayRegistry.selfName()],
+  inboundEnabled: () => remoteRelayRegistry.getSelfSettings().inboundEnabled,
+  recordUnlock: (conversationId, relayId, messageId) => remoteRelayRepository?.recordUnlock(conversationId, relayId, messageId) ?? false,
+  describeRelay: (id) => {
+    const relay = remoteRelayRegistry.get(id);
+    return relay ? { id: relay.id, name: relay.name, online: relay.lastStatus === 'online', version: relay.version } : null;
+  },
+  repository: remoteRelayRepository,
+};
+// The remote_relay tool: who is calling (live turn, provider, model, mode,
+// hops) and the Allow / Deny card write actions need in ask/plan mode.
+const remoteRelayCallerContext = createRemoteRelayCallerContext({
+  db,
+  repository: remoteRelayRepository,
+  questions: stmts,
+  resolveLiveTurnQueueRow,
+  formatQuestionRow,
+  normalizeRelayMode,
+  defaultRelayMode: DEFAULT_RELAY_MODE,
+  emit: (event, payload) => io.emit(event, payload),
+  notifyQuestion: (question) => pushDispatchService.notifyQuestion?.(question),
+  uuid: uuidv4,
+  logger: console,
+});
+const remoteRelayDispatcher = createRemoteRelayDispatcher({
+  registry: remoteRelayRegistry,
+  client: remoteRelayClient,
+  repository: remoteRelayRepository,
+  getCallerContext: (conversationId) => remoteRelayCallerContext.getCallerContext(conversationId),
+  requestApproval: (request) => remoteRelayCallerContext.requestApproval(request),
+  emitStatusEvent: ({ type, ...details }) => statusEventService.recordEvent(type, details),
+  resolveConversationId: (id) => resolveConversationRecord({ conversationId: id, sdkSessionId: id })?.id || id,
+  logger: console,
+});
+
 const sharedRouteDeps = {
   auth,
   gitChangesService,
@@ -6113,6 +6385,7 @@ const sharedRouteDeps = {
   previewCardsForResponse,
   sanitizeActivityText,
   inFlightStateForConversation,
+  resolveLiveTurnQueueRow,
   backgroundTaskStore,
   // A closure, not the registry itself: this deps object is built before the
   // preview lane is constructed further down the file.
@@ -6184,6 +6457,10 @@ const sharedRouteDeps = {
   getPwaAppName,
   setPwaAppName,
   requestRelayShutdown,
+  cancelRelayShutdown,
+  relayShutdownStatePayload,
+  hostSuspendService,
+  collectHostActivity,
   markSharedViewerPresence,
   getSharedWatcherCount,
   statusEventService,
@@ -6198,6 +6475,7 @@ const sharedRouteDeps = {
   windowsAutostartService,
   windowsBootAutostartService,
   pushDispatchService,
+  remoteRelayInbound,
 };
 registerMessagesRoutes(app, sharedRouteDeps);
 registerSessionsRoutes(app, sharedRouteDeps);
@@ -6210,6 +6488,12 @@ registerPushRoutes(app, {
   pushDispatchService,
   getPushVapidPublicKey: () => pushVapidKeys.publicKey,
 });
+registerRemoteRelayRoutes(app, {
+  auth,
+  registry: remoteRelayRegistry,
+  pairing: remoteRelayPairing,
+  dispatcher: remoteRelayDispatcher,
+});
 function markCliOffline(reason = 'offline', { clearOwner = true } = {}) {
   cliLastSeen = null;
   const wasOnline = cliOnline;
@@ -6523,25 +6807,10 @@ function sanitizeRelayQuestionRequest(requestBody) {
   }
 }
 
+// The allow-list lives in services/relay-question-context.mjs (unit-tested);
+// this binds it to the relay's own mode normalizer.
 function sanitizeRelayQuestionContext(rawContext) {
-  if (!rawContext || typeof rawContext !== 'object' || Array.isArray(rawContext)) return null;
-  const context = {};
-  if (typeof rawContext.source === 'string' && rawContext.source.trim()) {
-    context.source = rawContext.source.trim().slice(0, 64);
-  }
-  if (typeof rawContext.rationale === 'string' && rawContext.rationale.trim()) {
-    context.rationale = rawContext.rationale.trim().slice(0, 240);
-  }
-  if (typeof rawContext.queueMessageId === 'string' && rawContext.queueMessageId.trim()) {
-    context.queueMessageId = rawContext.queueMessageId.trim();
-  }
-  if (typeof rawContext.conversationId === 'string' && rawContext.conversationId.trim()) {
-    context.conversationId = rawContext.conversationId.trim();
-  }
-  if (typeof rawContext.relayMode === 'string' && rawContext.relayMode.trim()) {
-    context.relayMode = normalizeRelayMode(rawContext.relayMode) || DEFAULT_RELAY_MODE;
-  }
-  return Object.keys(context).length ? context : null;
+  return sanitizeRelayQuestionContextWith(rawContext, { normalizeRelayMode, defaultRelayMode: DEFAULT_RELAY_MODE });
 }
 
 
@@ -6579,6 +6848,9 @@ io.on('connection', (socket) => {
   });
   // Send current CLI status immediately on connect
   socket.emit('cli_status', { online: cliOnline });
+  // Pending host suspend / relay restart banners must survive a reconnect.
+  try { socket.emit('host_suspend_state', hostSuspendService.getState()); } catch {}
+  try { socket.emit('relay_shutdown_state', relayShutdownStatePayload()); } catch {}
   // Visibility heartbeats for push suppression; also clears a stale
   // deviceVisible flag restored by connectionStateRecovery.
   activeDeviceTracker.registerSocket(socket);
@@ -6713,6 +6985,9 @@ function shutdownRuntime(reason = 'unknown', { exitCode = 0 } = {}) {
   runtimeShutdownStarted = true;
   console.log(`${runtimeLogPrefix()}Runtime shutdown started (${reason}, exitCode=${runtimeShutdownExitCode})`);
   clearRuntimeTimers();
+  // A queued host suspend is in-memory only; drop it loudly rather than let
+  // the next runtime forget about it in silence.
+  try { hostSuspendService.dispose({ reason }); } catch {}
   try { updateCheckService?.stop(); } catch {}
   // Started here (flips the importer's closing flag synchronously) but awaited
   // below before the transports close: fire-and-forget disposal let a
@@ -6741,6 +7016,7 @@ function shutdownRuntime(reason = 'unknown', { exitCode = 0 } = {}) {
   sshTunnelManager.stop();
   cloudflaredTunnelManager.stop();
   previewHealthProbe.stop();
+  try { remoteRelayRegistry.stopHealthLoop(); } catch {}
   // Previews are in-memory by design: a restart is the only implicit cleanup,
   // so every public link dies with the process.
   previewRegistry.clear();
@@ -6873,6 +7149,8 @@ httpServer.listen(config.port, listenHost, () => {
   // Start SSH tunnel after server is listening
   sshTunnelManager.start();
   cloudflaredTunnelManager.start();
+  // Status, version and renames of paired relays; a first pass right away.
+  remoteRelayRegistry.startHealthLoop();
   // A preview-lane failure must never take the relay with it: the listener is
   // optional infrastructure, so a bind error is logged and the relay carries on
   // without previews.