@oar-sh/oar 0.9.20 → 0.9.22

package/server/services/queue-waker.mjs

@@ -0,0 +1,127 @@
+'use strict';
+
+// What the relay does when its queue may hold work for a worker: hand rows to
+// the workers that are ready (the socket service's notify), make sure every
+// session with a pending row has a worker (the prime), and keep the prime's
+// maintenance pass armed while rows wait. The wakes come from the queue's
+// own writes (queue-wake-hook.mjs), from a retry time coming due, from gates
+// that lift, and from the backstop poll.
+
+/**
+ * The prime: every session that owns a pending row gets its worker started
+ * (rows in retry backoff included, so the worker is warm when the backoff
+ * matures; rows held at the usage limit are not listed until their reset).
+ */
+export function createPendingWorkerPrimer({
+  isEnabled = () => true,
+  listPendingOwnerSessionIds,
+  isKillBlocked = () => false,
+  // A session whose rows were failed instead of launched (a Claude API chat
+  // the key cannot serve): true to skip its launch.
+  failRowsWithoutLaunch = () => false,
+  ensureWorker,
+  // Rows were found: the maintenance pass keeps retrying until none is.
+  onRowsWaiting = () => {},
+  warn = () => {},
+  limit = 25,
+} = {}) {
+  return async function prime(reason = 'pending-worker-prime') {
+    if (!isEnabled()) return 0;
+    const rows = listPendingOwnerSessionIds(limit) || [];
+    if (rows.length) onRowsWaiting();
+    let requested = 0;
+    for (const row of rows) {
+      const sdkSessionId = String(row?.sdk_session_id || '').trim();
+      if (!sdkSessionId) continue;
+      if (isKillBlocked(sdkSessionId) === true) continue;
+      try {
+        // Per session: a throw here costs this session its launch, never the
+        // rest of the pass.
+        if (failRowsWithoutLaunch(sdkSessionId)) continue;
+      } catch (error) {
+        warn(`WORKER PRIME skipped session=${sdkSessionId.slice(0, 8)} err=${error?.message || error}`);
+        continue;
+      }
+      requested += 1;
+      try {
+        const result = await ensureWorker(sdkSessionId);
+        if (!result?.ok) {
+          warn(`WORKER PRIME blocked session=${sdkSessionId.slice(0, 8)} reason=${String(result?.error || reason || 'pending-worker-prime')}`);
+        }
+      } catch (error) {
+        warn(`WORKER PRIME failed session=${sdkSessionId.slice(0, 8)} reason=${String(reason || 'pending-worker-prime')} err=${error?.message || error}`);
+      }
+    }
+    return requested;
+  };
+}
+
+/**
+ * The wake. `wake(reason)` hands rows out at once, primes, and arms the
+ * maintenance pass; `wake(reason, { prime: false })` leaves the prime to that
+ * pass (a queue write: the send route launches its own worker, and a write
+ * burst must not run a prime per write). Primes never overlap: one asked for
+ * while one runs runs once after it. `primeFromBackstop` is the poll's share:
+ * a prime at most every `backstopPrimeGapMs`.
+ */
+export function createQueueWaker({
+  prime,
+  notify = () => {},
+  armPrime = () => {},
+  isReady = () => true,
+  backstopPrimeGapMs = 5_000,
+  now = () => Date.now(),
+  warn = () => {},
+} = {}) {
+  let primeRunning = false;
+  let primeAgain = null;
+  let lastBackstopPrimeAt = -Infinity;
+
+  async function runPrime(reason) {
+    if (primeRunning) {
+      primeAgain = reason;
+      return;
+    }
+    primeRunning = true;
+    try {
+      let next = reason;
+      while (next) {
+        primeAgain = null;
+        try {
+          await prime(next);
+        } catch (error) {
+          warn(`WORKER PRIME pass failed reason=${next} err=${error?.message || error}`);
+        }
+        next = primeAgain;
+      }
+    } finally {
+      primeRunning = false;
+    }
+  }
+
+  function wake(reason = 'queue-wake', { prime: withPrime = true } = {}) {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    try { notify(reason); } catch (error) {
+      warn(`queue notify failed reason=${reason} err=${error?.message || error}`);
+    }
+    if (withPrime) void runPrime(reason);
+    return true;
+  }
+
+  function primeFromBackstop(reason = 'backstop') {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    const at = now();
+    if (at - lastBackstopPrimeAt < backstopPrimeGapMs) return false;
+    lastBackstopPrimeAt = at;
+    void runPrime(reason);
+    return true;
+  }
+
+  return {
+    wake,
+    primeFromBackstop,
+    status: () => ({ primeRunning, primeQueued: primeAgain !== null }),
+  };
+}

package/server/services/relay-ask-service.mjs

@@ -108,6 +108,15 @@ export function createRelayAskService({
     }
   })();
   const available = !problem;
+  // The turn an ask was made in (migration 0037); without the column asks
+  // still work and store none.
+  const hasQueueId = available && (() => {
+    try {
+      return db.prepare(`PRAGMA table_info(relay_asks)`).all().some((column) => column.name === 'queue_id');
+    } catch {
+      return false;
+    }
+  })();
 
   const sql = available ? {
     insert: db.prepare(`
@@ -116,6 +125,12 @@ export function createRelayAskService({
          question, options_json, recommendation, detail, urgency, status, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
     `),
+    insertWithQueue: hasQueueId ? db.prepare(`
+      INSERT INTO relay_asks
+        (id, relay_id, remote_id, conversation_id, conversation_title, created_by, creator_json,
+         question, options_json, recommendation, detail, urgency, status, created_at, updated_at, queue_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)
+    `) : null,
     get: db.prepare(`SELECT * FROM relay_asks WHERE id = ?`),
     getMirror: db.prepare(`SELECT * FROM relay_asks WHERE relay_id = ? AND remote_id = ?`),
     // The Inbox: this relay's asks, pending and closed since.
@@ -131,6 +146,17 @@ export function createRelayAskService({
         AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
       ORDER BY created_at DESC, rowid DESC LIMIT ?
     `),
+    // A session's own cards: the asks in it kept here, none it only asked
+    // elsewhere and no mirrors.
+    listIn: db.prepare(`
+      SELECT * FROM relay_asks
+      WHERE conversation_id = ? AND relay_id = 'self'
+        AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
+      ORDER BY created_at DESC, rowid DESC LIMIT ?
+    `),
+    // What carryIn and carryBy are about to move.
+    listCarryIn: db.prepare(`SELECT id FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
+    listCarryBy: db.prepare(`SELECT id FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
     countPendingHere: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND status = 'pending'`),
     countPendingIn: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
     countPendingBy: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
@@ -228,6 +254,9 @@ export function createRelayAskService({
         ? { relay: creator.relayName || null, conversationId: creator.conversationId || null, title: creator.conversationTitle || null }
         : (toText(row.created_by) ? { conversationId: row.created_by, title: toText(asker?.title) || null } : null),
       onBehalf: creator ? true : (!!toText(row.created_by) && row.created_by !== row.conversation_id),
+      // The queue row of the turn that asked (null: on behalf, a paired
+      // relay's agent, or older); a mirror has none.
+      ...(mirror ? {} : { queueId: row.queue_id || null }),
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };
@@ -259,9 +288,10 @@ export function createRelayAskService({
   /**
    * Stores an ask about `conversationId` (a session of this relay). The asker
    * is `createdBy` (a conversation here: the same one, or a lead asking for
-   * another) or `creator` (a paired relay's agent). Returns the ask.
+   * another) or `creator` (a paired relay's agent). `queueId`: the queue row
+   * of the turn that asked, when it ran in this session. Returns the ask.
    */
-  function create({ conversationId, createdBy = null, creator = null, ...input } = {}) {
+  function create({ conversationId, createdBy = null, creator = null, queueId = null, ...input } = {}) {
     requireAvailable();
     const session = conversation(conversationId);
     if (!isLive(session)) {
@@ -281,7 +311,7 @@ export function createRelayAskService({
     const { question, options, recommendation, detail, urgency } = checked.value;
     const id = newId();
     const at = isoNow();
-    sql.insert.run(
+    const values = [
       id,
       SELF,
       null,
@@ -296,7 +326,9 @@ export function createRelayAskService({
       urgency,
       at,
       at,
-    );
+    ];
+    if (sql.insertWithQueue) sql.insertWithQueue.run(...values, clip(queueId, 200) || null);
+    else sql.insert.run(...values);
     const row = sql.get.get(id);
     const ask = shape(row);
     log(`${id} in ${shortId(session.id)} by ${remoteCreator ? `relay ${shortId(remoteCreator.relayId)}` : shortId(asker)}${urgency === 'now' ? ' (now)' : ''}`);
@@ -335,6 +367,20 @@ export function createRelayAskService({
     return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
   }
 
+  /**
+   * A session's cards: the asks in it kept on this relay (not those it only
+   * asked elsewhere, no mirrors), pending first, then those closed in the
+   * last answeredKeepMs.
+   */
+  function listIn(conversationId) {
+    if (!available) return [];
+    const id = toText(conversationId);
+    if (!id) return [];
+    const since = new Date(now() - RELAY_ASK_LIMITS.answeredKeepMs).toISOString();
+    const rows = sql.listIn.all(id, since, RELAY_ASK_LIMITS.listMax);
+    return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
+  }
+
   /** Who is told the outcome of a row here: its session and the conversation that asked. */
   function tell(row) {
     const ask = shape(row);
@@ -429,7 +475,19 @@ export function createRelayAskService({
     const from = toText(sourceId);
     const to = toText(targetId);
     if (!from || !to || from === to) return 0;
-    const moved = db.transaction(() => sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes)();
+    // The rows both updates touch, each once (a self-ask in and by the
+    // source is in both), so their cards follow to the successor.
+    const touched = new Set();
+    const moved = db.transaction(() => {
+      for (const row of sql.listCarryIn.all(from)) touched.add(row.id);
+      for (const row of sql.listCarryBy.all(from)) touched.add(row.id);
+      return sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes;
+    })();
+    for (const id of touched) {
+      const row = sql.get.get(id);
+      // A mirror's card lives on the paired relay: nothing to show here.
+      if (row && row.relay_id === SELF) changed(row);
+    }
     if (moved) log(`conv=${shortId(from)} compacted into ${shortId(to)}: ${moved} question${moved === 1 ? '' : 's'} moved`);
     return moved;
   }
@@ -586,6 +644,7 @@ export function createRelayAskService({
     get,
     listHere,
     listOf,
+    listIn,
     pendingCount,
     answer,
     dismiss,

package/server/services/relay-event-service.mjs

@@ -107,7 +107,7 @@ import {
   relayEventQuietWindowEnd,
   relayEventTypesTake,
 } from '../../shared/relay-events.mjs';
-import { REMOTE_RELAY_APPROVAL_SOURCE } from '../../shared/relay-asks.mjs';
+import { REMOTE_RELAY_APPROVAL_SOURCE, isPersonOnlyQuestion } from '../../shared/relay-asks.mjs';
 
 export const RELAY_EVENT_SUBSCRIPTIONS_SOCKET_EVENT = 'relay_event_subscriptions';
 export const RELAY_EVENT_SELF_RELAY_ID = 'self';
@@ -1770,6 +1770,7 @@ export function createRelayEventService({
     prompt: 'text',
     questionId: 'text',
     approvalCard: 'bool',
+    personOnly: 'bool',
     // question_answered
     answer: 'text',
     choice: 'text',
@@ -2316,6 +2317,8 @@ export function createRelayEventService({
       options,
       questionId: toText(question.id),
       ...(toText(context?.source) === REMOTE_RELAY_APPROVAL_SOURCE ? { approvalCard: true } : {}),
+      // A Claude session's Safety check: the user's to answer.
+      ...(isPersonOnlyQuestion(context) ? { personOnly: true } : {}),
       // A question that does not block (relay_tool ask).
       ...(toText(question.kind) === 'ask' ? { kind: 'ask' } : {}),
     });

package/server/services/remote-relay-dispatcher.mjs

@@ -44,7 +44,7 @@ import {
   isMissingRelayEventRoute,
   relayWithoutCrossRelayEventsText,
 } from './relay-event-link-service.mjs';
-import { RELAY_ASK_KIND, relayQuestionKind } from '../../shared/relay-asks.mjs';
+import { RELAY_ASK_KIND, isPersonOnlyQuestion, relayQuestionKind } from '../../shared/relay-asks.mjs';
 import { RELAY_ASK_REMOTE_PATHS, isMissingRelayAskRoute, relayWithoutAsksText } from './relay-ask-link-service.mjs';
 
 // The one place a `relay_tool` tool call is decided and carried out (plan
@@ -147,6 +147,9 @@ const CATALOG_PROVIDER_LABELS = Object.freeze({
 });
 // Worker statuses that mean "working on something right now" (scope active).
 const WORKING_WORKER_STATUSES = new Set(['starting', 'processing']);
+// A worker process that is up; the one a session's `worker` field names when
+// the registry holds more than one entry for its conversation.
+const LIVE_WORKER_STATUSES = new Set(['starting', 'ready', 'processing']);
 // Terminal turn failures are stored as ordinary assistant rows; these are the
 // texts the relay writes for them (buildTerminalFailureTextForChat and the two
 // recovery-limit paths in messages-routes / server-runtime). Each is the whole
@@ -194,6 +197,11 @@ function shortId(value) {
   return toText(value).slice(0, 8) || '-';
 }
 
+/** A session item's `worker` field, left out when the relay has no worker registered for it. */
+function workerField(worker) {
+  return worker ? { worker: { ...worker } } : {};
+}
+
 function nonNegativeInt(value) {
   const number = Number(value);
   return Number.isInteger(number) && number >= 0 ? number : 0;
@@ -457,11 +465,13 @@ function relayTarget(relay) {
 /**
  * The question card's view of a relay question: what the agent needs to answer
  * it. Null for the remote's own remote-relay approval cards, which only its
- * user may answer (the remote hides them from us as well).
+ * user may answer (the remote hides them from us as well), and for a Claude
+ * session's Safety check card, which only the user may answer.
  */
 function mapPendingQuestion(question) {
   if (!isPlainObject(question) || !toText(question.id)) return null;
   if (isRemoteRelayApprovalQuestion(question)) return null;
+  if (isPersonOnlyQuestion(question.context)) return null;
   const kind = relayQuestionKind(question);
   if (kind === RELAY_ASK_KIND) {
     // A question that does not block: the user's to answer, the session works on.
@@ -1494,17 +1504,42 @@ export function createRemoteRelayDispatcher({
     };
   }
 
-  async function liveWorkerConversationIds(ctx) {
+  /**
+   * The target relay's session workers, from its /api/status: `working`, the
+   * conversations whose worker is starting or running a turn, and
+   * `workerFor(conversationId)`, that conversation's `worker` field (kind,
+   * build id, and whether it runs other code than that relay, which the relay
+   * judges against its own build id and recycles once idle), or null. A relay
+   * that predates build ids gives null build ids and never `stale`; one that
+   * cannot be read gives nothing.
+   */
+  async function sessionWorkers(ctx) {
+    const working = new Set();
+    const byConversation = new Map();
     try {
       const status = await call(ctx, 'GET', '/api/status');
       const workers = Array.isArray(status?.sessionWorker?.workers) ? status.sessionWorker.workers : [];
-      return new Set(workers
-        .filter((worker) => WORKING_WORKER_STATUSES.has(toText(worker?.status).toLowerCase()))
-        .map((worker) => toText(worker?.conversationId))
-        .filter(Boolean));
-    } catch {
-      return new Set();
-    }
+      for (const worker of workers) {
+        const conversationId = toText(worker?.conversationId);
+        if (!conversationId) continue;
+        const workerStatus = toText(worker?.status).toLowerCase();
+        if (WORKING_WORKER_STATUSES.has(workerStatus)) working.add(conversationId);
+        const known = byConversation.get(conversationId);
+        if (known && (known.live || !LIVE_WORKER_STATUSES.has(workerStatus))) continue;
+        byConversation.set(conversationId, {
+          live: LIVE_WORKER_STATUSES.has(workerStatus),
+          field: {
+            kind: toText(worker?.kind) || null,
+            buildId: toText(worker?.buildId) || null,
+            stale: worker?.stale === true,
+          },
+        });
+      }
+    } catch {}
+    return {
+      working,
+      workerFor: (conversationId) => byConversation.get(toText(conversationId))?.field || null,
+    };
   }
 
   /** The session group of a listed row: id, display name and the row's role. */
@@ -1521,7 +1556,7 @@ export function createRemoteRelayDispatcher({
     };
   }
 
-  function mapSession(row, workerIds, ctx = null, groups = null) {
+  function mapSession(row, workers, ctx = null, groups = null) {
     const id = toText(row?.id);
     const via = toText(row?.origin?.relayName);
     // A session an agent of that relay created there, and from which session.
@@ -1531,7 +1566,7 @@ export function createRemoteRelayDispatcher({
       title: toText(row?.title),
       provider: toText(row?.runtimeProviderType) || 'github',
       model: toText(row?.runtimeProviderModel) || toText(row?.runtimeModel) || toText(row?.preferredModel) || null,
-      active: row?.activeTurn === true || !!workerIds?.has(id) || isBusyState(row?.sessionState),
+      active: row?.activeTurn === true || !!workers?.working.has(id) || isBusyState(row?.sessionState),
       ...sessionActivityFields(row),
       updatedAt: row?.updatedAt || null,
       messageCount: nonNegativeInt(row?.messageCount),
@@ -1623,10 +1658,12 @@ export function createRemoteRelayDispatcher({
       cursor = decodeCursor(args.cursor, ['beforeConversationId', 'beforeUpdatedAt', 'beforeGroupId']);
       if (!cursor) throw invalidInput('cursor is not a nextCursor from list_sessions');
     }
-    const workerIds = scope === 'active' ? await liveWorkerConversationIds(ctx) : null;
+    // The active scope filters on the workers, so it reads them first; the
+    // others read them once the list is known, for the `worker` fields only.
+    const workers = scope === 'active' ? await sessionWorkers(ctx) : null;
     const filtering = !!query || scope === 'active';
     const keep = (row) => (!query || toText(row?.title).toLowerCase().includes(query))
-      && (scope !== 'active' || row?.activeTurn === true || workerIds.has(toText(row?.id)) || isBusyState(row?.sessionState));
+      && (scope !== 'active' || row?.activeTurn === true || workers.working.has(toText(row?.id)) || isBusyState(row?.sessionState));
 
     const sessions = [];
     const seen = new Set();
@@ -1649,7 +1686,7 @@ export function createRemoteRelayDispatcher({
         // A group served again whole (its cursor row vanished) repeats rows.
         if (seen.has(toText(row?.id))) continue;
         seen.add(toText(row?.id));
-        if (keep(row)) sessions.push(mapSession(row, workerIds, ctx, groups));
+        if (keep(row)) sessions.push(mapSession(row, workers, ctx, groups));
         if (sessions.length >= limit) break;
       }
       scanned += consumed;
@@ -1667,6 +1704,12 @@ export function createRemoteRelayDispatcher({
       hasMore = consumed < rows.length || response?.pageInfo?.hasMore === true;
       if (sessions.length >= limit || !hasMore || !rows.length) break;
     }
+    // Each session's worker process, while the relay has one registered for it.
+    const workerInfo = workers || (sessions.length ? await sessionWorkers(ctx) : null);
+    for (let index = 0; index < sessions.length; index += 1) {
+      const worker = workerInfo?.workerFor(sessions[index].id);
+      if (worker) sessions[index] = { ...sessions[index], ...workerField(worker) };
+    }
 
     const nextCursor = scope === 'all' && hasMore && cursor ? encodeCursor(cursor) : null;
     const note = filtering && hasMore && sessions.length < limit && scope !== 'all'
@@ -1716,7 +1759,9 @@ export function createRemoteRelayDispatcher({
       budget -= text.length;
       const role = toText(row.role) || 'assistant';
       const via = toText(row?.origin?.relayName);
-      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities) : [];
+      // The newest lines, as the progress path reads them: the relay keeps the
+      // newest per thread now, so the first ones are not the start anyway.
+      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities, { fromEnd: true }) : [];
       out.unshift({
         id: toText(row.id),
         role,
@@ -1749,7 +1794,12 @@ export function createRemoteRelayDispatcher({
       query: { limit: args.last, beforeMessageId: before?.beforeMessageId, beforeTimestamp: before?.beforeTimestamp, groupMembers: 1 },
     });
     const conversationId = toText(conversation?.id) || args.session;
-    const pendingQuestions = await loadPendingQuestions(ctx, conversationId, { includeAsks: true });
+    // Neither read rejects: a relay that cannot say leaves the fields out.
+    const [pendingQuestions, workers] = await Promise.all([
+      loadPendingQuestions(ctx, conversationId, { includeAsks: true }),
+      sessionWorkers(ctx),
+    ]);
+    const worker = workers.workerFor(conversationId);
     const { messages, omitted } = shapeMessages(conversation?.messages, {
       maxChars: args.max_chars,
       includeActivity: args.include_activity,
@@ -1798,6 +1848,7 @@ export function createRemoteRelayDispatcher({
         ...(via ? { via } : {}),
         ...(conversation?.mayCreateSessions === true ? { mayCreateSessions: true } : {}),
         ...(conversation?.planOnly === true ? { planOnly: true } : {}),
+        ...workerField(worker),
         ...(group ? { group } : {}),
         openUrl: remoteConversationUrl(ctx.relay.url, conversationId) || null,
       },
@@ -2547,6 +2598,11 @@ export function createRemoteRelayDispatcher({
         `Question ${args.question_id} was not found on relay "${ctx.relay.name}".`);
     }
     const session = toText(question.conversationId) || null;
+    if (isPersonOnlyQuestion(question.context)) {
+      throw new DispatchFailure(403, REMOTE_RELAY_ERROR_CODES.forbidden,
+        `Question ${args.question_id} is a Safety check: Claude Code marks the call as person-only, so this card is the user's to answer, never an agent's. Leave it to the user.`,
+        { session });
+    }
     if (ctx.relay.local && session && isOwnConversation(ctx, session)) {
       throw new DispatchFailure(400, REMOTE_RELAY_ERROR_CODES.ownSession,
         `Question ${args.question_id} belongs to this conversation itself; an agent cannot answer its own question. It is the user's to answer.`,
@@ -3415,7 +3471,17 @@ export function createRemoteRelayDispatcher({
       };
     }
     const session = askSession(ctx, args);
-    const ask = relayAskCall(() => service.create({ conversationId: session, createdBy: ctx.conversationId, ...askInput(args) }));
+    const ask = relayAskCall(() => service.create({
+      conversationId: session,
+      createdBy: ctx.conversationId,
+      ...askInput(args),
+      // The queue id means "the turn that was live when the ask was made": a
+      // background sub-agent asking after its parent turn ended may record
+      // the user's next, unrelated turn (accepted; there is no worker
+      // attribution). An ask on behalf of another session stores null: the
+      // asking turn lives in another conversation.
+      queueId: session === ctx.conversationId ? (ctx.caller?.processingRowId || null) : null,
+    }));
     const forOther = session !== ctx.conversationId;
     return {
       summary: `ask → ${ctx.relay.name}${forOther ? ` session ${shortId(session)}` : ''}: question ${ask.id} pending${ask.urgency === 'now' ? ' (now)' : ''}`,

package/server/services/session-activity-tracker.mjs

@@ -83,7 +83,7 @@ export function resolveBootReportingWindowMs(env = process.env, log = () => {})
 export const UNREPORTED_BACKGROUND_TASK_ID = 'unreported-background-work';
 // It stays until the worker reports, and a worker on older code never does
 // for a task that prints nothing: the way out is the session's Kill session.
-export const UNREPORTED_BACKGROUND_TASK_DESCRIPTION = 'background work, details not reported since the relay restarted (Kill session in its ⋯ menu ends it)';
+export const UNREPORTED_BACKGROUND_TASK_DESCRIPTION = 'background work, details not reported since the relay restarted (Kill session in its ︙ menu ends it)';
 // A `running` background run row that its worker's task set does not list
 // and nothing has updated for this long is not running work (see
 // `runListedByWorker`).

package/server/services/session-history-refresh-service.mjs

@@ -367,6 +367,9 @@ export function createSessionHistoryRefreshService({
           timestamp,
           activity.subagentRunId,
           activity.metadata ? JSON.stringify(activity.metadata) : null,
+          // turn_seq: an imported turn has no order of its own; it keeps the
+          // grouped layout.
+          null,
         );
       }
       const thoughts = ensureArray(message?.thoughts)
@@ -386,6 +389,7 @@ export function createSessionHistoryRefreshService({
           thought.done ? 1 : 0,
           timestamp,
           thought.subagentRunId,
+          null, // turn_seq, as for the activity rows above
         );
       }
     }

package/server/services/session-launch-mutex-service.mjs

@@ -0,0 +1,23 @@
+/**
+ * The per-session launch mutex, one for the whole relay process, keyed by
+ * sdkSessionId.
+ *
+ * What runs under it: the Change CWD relaunch, the launch route and the
+ * delete and archive routes (sessions-routes.mjs), the worker recycle's
+ * recycle, archived stop and launch retry (worker-recycle-service.mjs), and
+ * the archived sweep at relay start (sweepArchivedWorkers there). What does
+ * not: the Claude billing swap, which keeps the old worker away from the
+ * rows by its own delivery fence; the send path's ensureWorker; and the kill
+ * route (messages-routes.mjs), so a Kill that lands in a recycle's window
+ * between its stop and its launch (about 3 s) can look undone, because the
+ * launch starts a fresh idle worker. No turn is cut by that. Taking the
+ * mutex in those places is a follow-up.
+ *
+ * It used to be built inside the sessions routes' registration, where nothing
+ * outside the routes could take it, so a recycle could stop a worker while a
+ * relaunch was half done. A module singleton is the one place both import.
+ */
+
+import { createKeyedMutex } from './keyed-mutex-service.mjs';
+
+export const sessionLaunchMutex = createKeyedMutex();

package/server/services/session-worker-registry-service.mjs

@@ -1,5 +1,7 @@
 'use strict';
 
+import { normalizeBuildId } from '../../shared/build-id.mjs';
+
 function normalizeSessionId(value) {
   const text = String(value || '').trim();
   return text || null;
@@ -141,6 +143,12 @@ export function normalizeWorkerSteeringSnapshot(raw) {
     const tasks = Number(raw.backgroundTaskCount);
     snapshot.backgroundTaskCount = Number.isInteger(tasks) && tasks > 0 ? Math.min(tasks, 999) : 0;
   }
+  // Whether the worker's CLI child still runs. The recycle replaces a worker
+  // only once that child is gone, because a live CLI may hold scheduled jobs
+  // of its own (CronCreate, ScheduleWakeup) that a stop would lose. Only a
+  // worker that reports it carries the key: an absent key means "cannot say",
+  // which the recycle treats differently from false.
+  if (typeof raw.cliAlive === 'boolean') snapshot.cliAlive = raw.cliAlive;
   return snapshot;
 }
 
@@ -160,6 +168,12 @@ function sanitizeState(raw = null) {
     lastError: String(base.lastError || '').trim() || null,
     steering: normalizeWorkerSteeringSnapshot(base.steering),
     kind: normalizeWorkerKind(base.kind),
+    // The build id of the code the worker process started on, as it stated
+    // it; null when it did not say or said something malformed.
+    buildId: normalizeBuildId(base.buildId),
+    // When the relay first heard of the current pid: the process's age as far
+    // as the relay can tell, without asking the OS. Null without a pid.
+    startedAt: normalizeTimestamp(base.startedAt, null),
     updatedAt: normalizeTimestamp(base.updatedAt, nowIso),
     createdAt,
   };
@@ -266,11 +280,33 @@ export function createSessionWorkerRegistry() {
     // heartbeated — indefinitely, if none ever did.
     // The kind is the same: a process's own word. An upsert that does not
     // state it keeps the known one, unless the process it described is gone.
+    // The build id and the start time follow the same rule.
     const statesKind = Object.prototype.hasOwnProperty.call(rawState, 'kind');
+    const statesBuildId = Object.prototype.hasOwnProperty.call(rawState, 'buildId');
+    const statesStartedAt = Object.prototype.hasOwnProperty.call(rawState, 'startedAt');
     if (!statesKind) next.kind = existing?.kind || null;
+    if (!statesBuildId) next.buildId = existing?.buildId || null;
+    if (!statesStartedAt) next.startedAt = existing?.startedAt || null;
     if (existing && isWorkerReplacedOrGone(existing, next)) {
       next.steering = null;
       if (!statesKind) next.kind = null;
+      if (!statesBuildId) next.buildId = null;
+      if (!statesStartedAt) next.startedAt = null;
+    }
+    // A pid the entry did not have before is the first the relay hears of
+    // that process, so its start time is now. Callers spread the old entry
+    // into the upsert that brings the new pid, so a stated startedAt counts
+    // only when it is not the old process's own.
+    // The build id is that process's own word as well, and it arrives with its
+    // hello or heartbeat, not with the upsert that brings the pid. A build id
+    // equal to the old entry's is the old process's, spread in, and would make
+    // a recycled worker read as the old code (or an old worker as current)
+    // until the new one spoke; it is dropped. A different one was stated for
+    // this process and stays.
+    if (next.pid && next.pid !== existing?.pid) {
+      const statedOwnStart = statesStartedAt && next.startedAt && next.startedAt !== existing?.startedAt;
+      if (!statedOwnStart) next.startedAt = new Date().toISOString();
+      if (next.buildId && next.buildId === existing?.buildId) next.buildId = null;
     }
     clearIndexesForSession(existing);
     bySession.set(state.sdkSessionId, next);