@oar-sh/oar 0.9.2 → 0.9.4

package/server/services/session-worker-launch-service.mjs

@@ -6,6 +6,16 @@ import os from 'os';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+import {
+  OAR_MCP_SERVER_NAME,
+  OAR_MCP_SERVER_SCRIPT_PATH,
+  OAR_MCP_TOOL_TIMEOUT_MS,
+  buildOarMcpServerLaunch,
+  isOarMcpServerDisabled,
+} from '../mcp/oar-mcp-server.mjs';
+
+export { isOarMcpServerDisabled };
+
 function shellQuote(value) {
   return `'${String(value || '').replace(/'/g, `'\\''`)}'`;
 }
@@ -302,7 +312,7 @@ function resolveNodeWorkerDescriptor(env = {}) {
   };
 }
 
-function buildPosixWorkerLaunchCommand(targetSessionId, env = {}) {
+function buildPosixWorkerLaunchCommand(targetSessionId, env = {}, extraCliArgs = []) {
   const nodeWorker = resolveNodeWorkerDescriptor(env);
   if (nodeWorker) {
     const nodeExecutable = normalizeText(env?.COPILOT_WEB_RELAY_NODE) || 'node';
@@ -312,7 +322,88 @@ function buildPosixWorkerLaunchCommand(targetSessionId, env = {}) {
     || normalizeText(env?.COPILOT_CLI_EXECUTABLE)
     || normalizeText(env?.COPILOT_CLI_PATH)
     || 'copilot';
-  return `${shellQuote(cliExecutable)} --allow-all --session-id ${shellQuote(targetSessionId)}`;
+  const extra = (Array.isArray(extraCliArgs) ? extraCliArgs : []).map((arg) => ` ${shellQuote(arg)}`).join('');
+  return `${shellQuote(cliExecutable)} --allow-all --session-id ${shellQuote(targetSessionId)}${extra}`;
+}
+
+// ─── The OAR MCP server for the extension engine ─────────────────────────────
+//
+// The Copilot CLI takes extra MCP servers per run through
+// `--additional-mcp-config <json>`, where `<json>` may be `@<file>` (CLI
+// 1.0.83 `--help`: "JSON string or file path (prefix with @)"; the file is
+// read as UTF-8 and merged over ~/.copilot/mcp-config.json for that run
+// only). The config goes to a file rather than inline: the argument then
+// crosses cmd.exe/`start` on Windows and `sh -lc` + `script -c` on the tmux
+// path as one plain path, with no JSON to escape through two shells.
+//
+// Server entry shape (the CLI's own `copilot mcp add` writes the same):
+// `{ type: 'local', command, args, env, tools: ['*'], timeout }`. `timeout` is
+// the per-call limit in ms; without it the CLI cuts a tool call off at 180 s,
+// shorter than one remote_relay wait.
+
+export function resolveOarMcpServerScriptPath(env = {}, { pathImpl = path } = {}) {
+  const repoRoot = normalizeText(env?.COPILOT_WEB_RELAY_ROOT);
+  if (repoRoot) return pathImpl.join(repoRoot, 'server', 'mcp', 'oar-mcp-server.mjs');
+  const serverDir = normalizeText(env?.COPILOT_WEB_RELAY_SERVER_DIR);
+  if (serverDir) return pathImpl.join(serverDir, 'mcp', 'oar-mcp-server.mjs');
+  return OAR_MCP_SERVER_SCRIPT_PATH;
+}
+
+/** The `--additional-mcp-config` document for one extension-engine session. */
+export function buildCopilotOarMcpConfig(targetSessionId, env = {}, {
+  nodePath = normalizeText(env?.COPILOT_WEB_RELAY_NODE) || process.execPath,
+  pathImpl = path,
+} = {}) {
+  const launch = buildOarMcpServerLaunch({
+    nodePath,
+    conversationId: targetSessionId,
+    env,
+    scriptPath: resolveOarMcpServerScriptPath(env, { pathImpl }),
+  });
+  return {
+    mcpServers: {
+      [OAR_MCP_SERVER_NAME]: {
+        type: 'local',
+        command: launch.command,
+        args: launch.args,
+        env: launch.env,
+        tools: ['*'],
+        timeout: OAR_MCP_TOOL_TIMEOUT_MS,
+      },
+    },
+  };
+}
+
+/**
+ * Writes the session's MCP config next to its worker log and returns the file
+ * path, or null — best-effort like the log itself: a session that cannot get
+ * the file still starts, just without the OAR tools. No secrets go in: the
+ * server reads the token from the relay config the file points at.
+ */
+export function prepareOarMcpConfigFile(targetSessionId, launchEnv = {}, {
+  fsImpl = fs,
+  pathImpl = path,
+  nodePath = undefined,
+} = {}) {
+  if (isOarMcpServerDisabled(launchEnv)) return null;
+  try {
+    const config = buildCopilotOarMcpConfig(targetSessionId, launchEnv, {
+      pathImpl,
+      ...(nodePath ? { nodePath } : {}),
+    });
+    const baseDir = resolveWorkerLogDir(launchEnv, { pathImpl });
+    fsImpl.mkdirSync(baseDir, { recursive: true });
+    const filePath = pathImpl.join(baseDir, `worker-${safeWorkerFileId(targetSessionId)}.mcp.json`);
+    fsImpl.writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    return filePath;
+  } catch {
+    return null;
+  }
+}
+
+function oarMcpCliArgs(configFilePath) {
+  const filePath = normalizeText(configFilePath);
+  return filePath ? ['--additional-mcp-config', `@${filePath}`] : [];
 }
 
 export function normalizeTmuxSessionName(targetSessionId) {
@@ -418,20 +509,28 @@ export function createWorkerSecretEnvFile(env = {}, {
  * incident undiagnosable. Best-effort by design: a log problem must never
  * block a worker spawn. Naive rotation: >10 MB rolls to `<file>.1`.
  */
+function resolveWorkerLogDir(launchEnv = {}, { pathImpl = path } = {}) {
+  const explicitDir = normalizeText(launchEnv?.COPILOT_WEB_RELAY_LOG_DIR);
+  const serverDir = normalizeText(launchEnv?.COPILOT_WEB_RELAY_SERVER_DIR);
+  // `new URL(...).pathname` yields '/C:/git/...' on Windows, which pathImpl.join
+  // then mangles into '\C:\git\...'; fileURLToPath decodes it to a real host path.
+  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+  return explicitDir
+    || (serverDir ? pathImpl.join(serverDir, 'logs') : pathImpl.join(moduleDir, '..', 'logs'));
+}
+
+function safeWorkerFileId(targetSessionId) {
+  return String(targetSessionId || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 64) || 'worker';
+}
+
 export function prepareWorkerLogFile(targetSessionId, launchEnv = {}, {
   fsImpl = fs,
   pathImpl = path,
 } = {}) {
   try {
-    const explicitDir = normalizeText(launchEnv?.COPILOT_WEB_RELAY_LOG_DIR);
-    const serverDir = normalizeText(launchEnv?.COPILOT_WEB_RELAY_SERVER_DIR);
-    // `new URL(...).pathname` yields '/C:/git/...' on Windows, which pathImpl.join
-    // then mangles into '\C:\git\...'; fileURLToPath decodes it to a real host path.
-    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-    const baseDir = explicitDir
-      || (serverDir ? pathImpl.join(serverDir, 'logs') : pathImpl.join(moduleDir, '..', 'logs'));
+    const baseDir = resolveWorkerLogDir(launchEnv, { pathImpl });
     fsImpl.mkdirSync(baseDir, { recursive: true });
-    const safeId = String(targetSessionId || '').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 64) || 'worker';
+    const safeId = safeWorkerFileId(targetSessionId);
     const logPath = pathImpl.join(baseDir, `worker-${safeId}.log`);
     try {
       const stats = fsImpl.statSync(logPath);
@@ -446,6 +545,9 @@ export function prepareWorkerLogFile(targetSessionId, launchEnv = {}, {
 export function buildTmuxWorkerShellCommand(targetSessionId, env = {}, {
   secretEnvFilePath = '',
   workerLogPath = '',
+  // Extension engine only: appended to the CLI command, each shell-quoted
+  // (and quoted again with it for `script -c`).
+  extraCliArgs = [],
 } = {}) {
   const launchEnv = {
     ...env,
@@ -503,6 +605,10 @@ export function buildTmuxWorkerShellCommand(targetSessionId, env = {}, {
     'GROK_RELAY_MODEL',
     'GROK_CLI_COMMAND',
     'GROK_ALWAYS_APPROVE',
+    // The OAR MCP server kill switch (the Grok worker reads it too), and the
+    // extension engine's "it is attached" marker.
+    'OAR_MCP_SERVER',
+    'OAR_MCP_SERVER_ATTACHED',
     'SESSION_ID',
     'COPILOT_WORKSPACE_ROOT',
     'INIT_CWD',
@@ -515,7 +621,7 @@ export function buildTmuxWorkerShellCommand(targetSessionId, env = {}, {
   const secretPrefix = normalizedSecretEnvFilePath
     ? `. ${shellQuote(normalizedSecretEnvFilePath)} || exit $?; rm -f ${shellQuote(normalizedSecretEnvFilePath)}; rmdir ${shellQuote(path.dirname(normalizedSecretEnvFilePath))}; `
     : '';
-  const workerCommand = buildPosixWorkerLaunchCommand(targetSessionId, launchEnv);
+  const workerCommand = buildPosixWorkerLaunchCommand(targetSessionId, launchEnv, extraCliArgs);
   if (resolveNodeWorkerDescriptor(launchEnv)) {
     // Node workers (Claude, Cursor, Grok) are plain processes; no pseudo-TTY
     // needed. Their output is teed to the worker log so a crash leaves a
@@ -574,6 +680,9 @@ export async function launchSessionCli({
   detachedPollDelayMs = 200,
   allowProcessReuse = true,
   createSecretEnvFileImpl = createWorkerSecretEnvFile,
+  // Extension engine: writes the session's OAR MCP config, returns its path
+  // (or null to launch without it).
+  prepareOarMcpConfigImpl = prepareOarMcpConfigFile,
 } = {}) {
   const target = String(targetSessionId || '').trim();
   if (!target) throw new Error('missing-target-session-id');
@@ -610,6 +719,14 @@ export async function launchSessionCli({
     ...launchEnv,
     SESSION_ID: target,
   };
+  // The extension engine gets the OAR MCP server (remote_relay + preview) the
+  // node workers carry in-process; every launch path appends the same args.
+  const extensionCliArgs = resolveNodeWorkerDescriptor(launchSessionEnv)
+    ? []
+    : oarMcpCliArgs(prepareOarMcpConfigImpl(target, launchSessionEnv));
+  // Tells the in-CLI web-relay extension that `preview` is a real tool in this
+  // session, so its prompt context need not teach the HTTP fallback.
+  if (extensionCliArgs.length) launchSessionEnv.OAR_MCP_SERVER_ATTACHED = '1';
 
   if (isTmuxAvailable({ platform, execFileSyncImpl })) {
     const sessionName = normalizeTmuxSessionName(target);
@@ -647,6 +764,7 @@ export async function launchSessionCli({
         buildTmuxWorkerShellCommand(target, launchSessionEnv, {
           secretEnvFilePath: secretEnvFile?.filePath,
           workerLogPath: tmuxWorkerLogPath || '',
+          extraCliArgs: extensionCliArgs,
         }),
       ], {
         env: tmuxEnv,
@@ -717,10 +835,11 @@ export async function launchSessionCli({
         '--allow-all',
         '--session-id',
         target,
+        ...extensionCliArgs,
       ])
     : (nodeWorker
       ? [nodeWorker.scriptPath, '--session-id', target]
-      : ['--allow-all', '--session-id', target]);
+      : ['--allow-all', '--session-id', target, ...extensionCliArgs]);
   // POSIX node workers tee stdout/stderr into the worker log (a crash must
   // leave a trail). On win32 the `start` intermediary opens its own console,
   // so fd inheritance cannot reach the worker — its window shows the output.

package/server/services/session-worker-registry-service.mjs

@@ -60,6 +60,54 @@ function normalizeStatus(value) {
   return ALLOWED_STATUSES.has(mapped) ? mapped : 'new';
 }
 
+const STEERING_HOLD_REASONS = new Set(['question', 'compaction', 'adoption', 'delivery', 'other']);
+const STEERING_MESSAGE_ID_MAX_LENGTH = 64;
+const STEERING_CANCELLABLE_IDS_MAX = 50;
+
+// Queue message ids the worker still holds pushed-but-unconsumed (the Copilot
+// SDK's queued lane): trimmed strings only, deduped, capped — a worker cannot
+// grow the status payload without bound.
+function normalizeSteeringCancellableIds(raw) {
+  if (!Array.isArray(raw)) return [];
+  const seen = new Set();
+  const ids = [];
+  for (const value of raw) {
+    if (typeof value !== 'string') continue;
+    const id = value.trim();
+    if (!id || id.length > STEERING_MESSAGE_ID_MAX_LENGTH || seen.has(id)) continue;
+    seen.add(id);
+    ids.push(id);
+    if (ids.length >= STEERING_CANCELLABLE_IDS_MAX) break;
+  }
+  return ids;
+}
+
+// The worker's composer-facing steering snapshot, published on its heartbeat.
+// Callers follow the registry convention of spreading the existing entry into
+// upserts, so an update without `steering` keeps the last known snapshot.
+// Exported so the heartbeat route compares apples to apples: normalizing there
+// with different rules would make an unknown holdReason never converge and
+// re-upsert on every heartbeat.
+//
+// `supported` is the worker's opt-in to mid-turn steering and the client
+// composer's only steering gate: a worker that never sets it — the extension
+// path, or a Claude worker old enough to send the 4-field snapshot — keeps
+// "Queue". `cancellableIds` lists the pushed rows the worker can still pull
+// back out of its runtime (un-steer).
+export function normalizeWorkerSteeringSnapshot(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const holdReason = String(raw.holdReason || '').trim().toLowerCase();
+  const messageId = String(raw.messageId || '').trim().slice(0, STEERING_MESSAGE_ID_MAX_LENGTH);
+  return {
+    turnActive: raw.turnActive === true,
+    canSteer: raw.canSteer === true,
+    holdReason: STEERING_HOLD_REASONS.has(holdReason) ? holdReason : null,
+    messageId: messageId || null,
+    supported: raw.supported === true,
+    cancellableIds: normalizeSteeringCancellableIds(raw.cancellableIds),
+  };
+}
+
 function sanitizeState(raw = null) {
   const nowIso = new Date().toISOString();
   const base = raw && typeof raw === 'object' ? raw : {};
@@ -74,11 +122,23 @@ function sanitizeState(raw = null) {
     queueDepth: toNonNegativeInt(base.queueDepth, 0),
     retryCount: toNonNegativeInt(base.retryCount, 0),
     lastError: String(base.lastError || '').trim() || null,
+    steering: normalizeWorkerSteeringSnapshot(base.steering),
     updatedAt: normalizeTimestamp(base.updatedAt, nowIso),
     createdAt,
   };
 }
 
+// Statuses that mean the process a snapshot described is gone or not yet
+// replaced by one that has reported. 'error' counts only on the way IN: a
+// live worker marked errored (a requeue retry) keeps heartbeating, and its
+// next snapshot must stick rather than be cleared on every upsert.
+const WORKER_GONE_STATUSES = new Set(['new', 'starting', 'stopped', 'error']);
+
+function isWorkerReplacedOrGone(existing, next) {
+  if (existing.pid && next.pid !== existing.pid) return true;
+  return next.status !== existing.status && WORKER_GONE_STATUSES.has(next.status);
+}
+
 function toSnapshot(entry) {
   return Object.freeze({ ...entry });
 }
@@ -163,12 +223,26 @@ export function createSessionWorkerRegistry() {
       createdAt: existing?.createdAt || state.createdAt,
       updatedAt: new Date().toISOString(),
     });
+    // A steering snapshot describes one live worker process. Callers spread
+    // the old entry into every upsert, so without this a crashed worker's
+    // hold outlived it and the composer showed it until a replacement
+    // heartbeated — indefinitely, if none ever did.
+    if (existing && isWorkerReplacedOrGone(existing, next)) next.steering = null;
     clearIndexesForSession(existing);
     bySession.set(state.sdkSessionId, next);
     updateIndexesForSession(next);
     return toSnapshot(next);
   }
 
+  /** Drop a session's steering snapshot (its worker process is known dead). */
+  function clearSteering(sdkSessionId) {
+    const sessionId = normalizeSessionId(sdkSessionId);
+    const existing = sessionId ? bySession.get(sessionId) : null;
+    if (!existing?.steering) return false;
+    bySession.set(sessionId, { ...existing, steering: null, updatedAt: new Date().toISOString() });
+    return true;
+  }
+
   function removeWorker(sdkSessionId) {
     const sessionId = normalizeSessionId(sdkSessionId);
     if (!sessionId) return false;
@@ -224,6 +298,7 @@ export function createSessionWorkerRegistry() {
     getWorkerByRuntimeSessionId,
     listWorkers,
     upsertWorker,
+    clearSteering,
     removeWorker,
     rekeyWorker,
     clearAll,

package/server/services/session-worker-supervisor-service.mjs

@@ -482,10 +482,16 @@ export function createSessionWorkerSupervisor({
     if (current && !isTransitionAllowed(current.status, requestedStatus)) {
       return current;
     }
+    // The steering snapshot is the worker's to set (its heartbeat) and the
+    // registry's to clear (process gone or replaced). Callers build nextState
+    // from an older copy of the entry — ensureWorker from the 'starting' one,
+    // taken before the new process heartbeated — so passing theirs through
+    // would overwrite the snapshot the worker sent in the meantime.
+    const { steering: _staleSteering, ...patch } = nextState;
     const next = registry.upsertWorker({
       ...(current || {}),
       sdkSessionId: sessionId,
-      ...nextState,
+      ...patch,
       status: requestedStatus,
       updatedAt: nowIso(),
     });

package/server/services/session-worker-websocket-service.mjs

@@ -91,6 +91,13 @@ function queueSnapshotChanged(left, right) {
 // heartbeats and a retained socket no longer proves the worker is alive.
 const WORKER_SOCKET_LIVENESS_MAX_SILENCE_MS = 30_000;
 
+// Protocol features this relay understands, advertised in server.hello. A
+// worker that updated on disk before the relay restarted must not rely on
+// them otherwise: an older relay ignores worker.unready / hello ready:false
+// and treats a `steering-held` requeue as a failure (retry, backoff,
+// worker marked errored).
+export const WORKER_PROTOCOL_CAPABILITIES = Object.freeze(['worker-unready', 'steering-held']);
+
 export function createSessionWorkerWebSocketService({
   WebSocketServerImpl,
   httpServer,
@@ -378,6 +385,7 @@ export function createSessionWorkerWebSocketService({
     emitEvent(ws, {
       type: 'server.hello',
       reason: 'connected',
+      capabilities: WORKER_PROTOCOL_CAPABILITIES,
       queue: normalizeQueueSnapshot(queueCounts()),
       sessionId: identity.sessionId,
       timestamp: nowIso(),
@@ -396,12 +404,15 @@ export function createSessionWorkerWebSocketService({
       if (payload.type === 'worker.hello') {
         if (!bindSocketIdentity(ws, meta, payload)) return;
         meta.lastSeenAtMs = nowMsSafe();
-        meta.ready = true;
+        // A worker holding deliveries (open question card, compaction) binds
+        // its identity with hello but must not be handed work.
+        meta.ready = payload.ready !== false;
         meta.lastHelloAt = nowIso();
         noteHeartbeat(meta, 'worker-hello');
         emitEvent(ws, {
           type: 'server.hello',
           reason: 'ack',
+          capabilities: WORKER_PROTOCOL_CAPABILITIES,
           queue: normalizeQueueSnapshot(queueCounts()),
           sessionId: meta.sessionId,
           timestamp: nowIso(),
@@ -418,6 +429,17 @@ export function createSessionWorkerWebSocketService({
         void maybeDeliverToSocket(ws, String(payload.reason || 'worker-ready'));
         return;
       }
+      if (payload.type === 'worker.unready') {
+        // Readiness is otherwise sticky until the next delivery: a ready sent
+        // while the worker could steer would still stand after a hold began,
+        // and the delivery it drew would only be handed back.
+        if (!bindSocketIdentity(ws, meta, payload)) return;
+        meta.lastSeenAtMs = nowMsSafe();
+        meta.ready = false;
+        meta.lastUnreadyAt = nowIso();
+        noteHeartbeat(meta, String(payload.reason || 'worker-unready'));
+        return;
+      }
       if (payload.type === 'worker.ping') {
         if (!bindSocketIdentity(ws, meta, payload)) return;
         meta.lastSeenAtMs = nowMsSafe();

package/server/services/steer-resend.mjs

@@ -0,0 +1,45 @@
+// Resend of a steer a Stop cut off unanswered (kind='stopped'): shared by the
+// POST /api/message guard and the transcript payload, so "Resent" on screen
+// and the relay's refusal of a second Resend agree.
+
+/**
+ * Whether an earlier Resend still stands. A cancelled queued message loses
+ * its queue row; a failed one keeps it as 'failed'; a finished one may have
+ * been pruned from the queue, which its answer (linked by source) proves.
+ */
+export function isLiveResend({ hasQueueRow = false, queueStatus = null, answered = false } = {}) {
+  if (hasQueueRow) {
+    return !['failed', 'cancelled'].includes(String(queueStatus || '').trim().toLowerCase());
+  }
+  return !!answered;
+}
+
+/**
+ * Original message id → the id of a Resend of it that still stands, from one
+ * conversation's messages (DB rows) and queue rows ({ id, status }).
+ */
+export function liveResendsByOriginal(dbMessages = [], queueRows = []) {
+  const queueById = new Map((Array.isArray(queueRows) ? queueRows : [])
+    .map((row) => [String(row?.id || '').trim(), row]));
+  const answeredSources = new Set();
+  for (const message of Array.isArray(dbMessages) ? dbMessages : []) {
+    if (message?.role !== 'assistant') continue;
+    const source = String(message?.source_message_id || '').trim();
+    if (source) answeredSources.add(source);
+  }
+  for (const row of queueById.values()) {
+    if (row?.response_message_id) answeredSources.add(String(row.id || '').trim());
+  }
+  const result = new Map();
+  for (const message of Array.isArray(dbMessages) ? dbMessages : []) {
+    if (message?.role !== 'user') continue;
+    const original = String(message?.resend_of_message_id || '').trim();
+    if (!original || result.has(original)) continue;
+    const id = String(message?.id || '').trim();
+    const queueRow = queueById.get(id);
+    if (isLiveResend({ hasQueueRow: !!queueRow, queueStatus: queueRow?.status, answered: answeredSources.has(id) })) {
+      result.set(original, id);
+    }
+  }
+  return result;
+}

package/shared/background-task-timeout.mjs

@@ -2,14 +2,22 @@
 // persistent Claude CLI process alive, shared so the settings slider and the
 // worker enforcing it agree on bounds and formatting.
 //
-// 0 means no limit — the default: a process holding live tasks stays up until
-// the tasks finish, the user stops them from the composer panel, or the
-// worker/relay goes down. Mirrors shared/turn-ceiling.mjs.
+// The default is 4 hours: long enough for real long-running work to finish,
+// short enough that a forgotten shell or agent does not keep its runtime
+// alive indefinitely. 0 (chosen explicitly) means no limit: a process holding
+// live tasks stays up until the tasks finish, the user stops them from the
+// composer panel, or the worker/relay goes down. Mirrors
+// shared/turn-ceiling.mjs.
+//
+// The browser mirrors the default in
+// server/public/app/background-task-timeout-options.mjs (only server/public is
+// served), and the slider's static markup in server/public/index.html starts
+// at it; unit tests pin both to this module.
 
 export const BACKGROUND_TASK_TIMEOUT_MIN_MINUTES = 0;
 export const BACKGROUND_TASK_TIMEOUT_MAX_MINUTES = 600;
 export const BACKGROUND_TASK_TIMEOUT_STEP_MINUTES = 5;
-export const DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES = 0;
+export const DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES = 240;
 
 /** 0 disables the timeout entirely (unlimited). */
 export function normalizeBackgroundTaskTimeoutMinutes(value, fallback = DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES) {

package/shared/control-poller.mjs

@@ -63,7 +63,10 @@ export function createControlPoller({
 
     dbg('abort_turn control received', control.id);
     try {
-      await onAbortTurn();
+      // The control names the row the user stopped. A runner that owns several
+      // rows at once (a turn plus the messages steered into it) needs it to
+      // tell the stopped row from the ones it must settle itself.
+      await onAbortTurn(control);
       await api('POST', `/api/control/${encodeURIComponent(control.id)}/result`, {
         ok: true,
         note: abortAckNote,

package/shared/question-multi-select.mjs

@@ -0,0 +1,16 @@
+// Whether a choice question reads as "pick several" — for providers whose
+// ask-user tool has no multi-select flag (Copilot's `ask_user`; Claude's
+// AskUserQuestion carries `multiSelect: true` itself). The card then offers
+// checkmarks instead of one-shot buttons and answers with the selected labels
+// joined by ", ". Conservative on purpose: an ordinary "which one?" keeps its
+// buttons, because a wrongly multi-select card costs the user a second click
+// while a wrongly single-select one forces them into the free-text field.
+export function looksLikeMultiSelectQuestion(questionText, choices = []) {
+  if (!Array.isArray(choices) || choices.length < 2) return false;
+  const text = String(questionText || '');
+  return /\ball that apply\b/i.test(text)
+    || /\bmulti-?select\b/i.test(text)
+    || /\b(select|choose|pick|check|tick|enable|turn on)\b[^.!?\n]{0,40}\b(all|multiple|several|any number|one or more|as many|more than one)\b/i.test(text)
+    || /\bmultiple (choices|options|selections|answers)\b/i.test(text)
+    || /\bone or more\b/i.test(text);
+}

package/shared/relay-stop-failure.mjs

@@ -0,0 +1,15 @@
+// The terminal outcome of a turn the user stopped — what the relay records
+// when a worker acknowledges an abort control. Shared so a worker that dies
+// before its ack lands fails the stopped row the same way instead of letting
+// it be requeued (a requeue re-runs a prompt the user explicitly stopped).
+export function buildRelayStopFailure() {
+  return {
+    kind: 'turn-aborted',
+    error: 'turn-aborted',
+    code: 'turn-aborted',
+    stableCode: 'relay.turn-aborted',
+    message: 'System note: This turn was stopped from the relay UI before completion.',
+    guidance: 'Send a new message to continue when you are ready.',
+    failedAt: new Date().toISOString(),
+  };
+}