@oar-sh/oar 0.9.21 → 0.9.22

package/server/services/idle-timers.mjs

@@ -0,0 +1,184 @@
+'use strict';
+
+// Timers a relay keeps only while there is something to time: the CLI
+// presence deadline and the intervals armed by work and disarmed by their own
+// tick. An idle relay runs neither.
+
+// ─── CLI presence ──────────────────────────────────────────────────────────────
+
+// Whether "the CLI" (the relay's workers) has been heard from recently, kept
+// without a polling timer. Every touch moves the last-seen time; one one-shot
+// deadline timer, armed only while something was seen, notices when the
+// window ran out. A deadline that fires early (a touch moved last-seen) arms
+// again for the remainder, so an online relay wakes about once per window and
+// an offline one not at all.
+//
+// The window depends on the worker sockets: an idle worker beats only every
+// 30 s (shared/worker-runtime/worker-keepalive.mjs), so while a worker socket
+// is open the window is wide enough for one lost beat. With no socket left a
+// relay whose workers are all gone still reads offline within the short
+// window, as before.
+
+export const CLI_ONLINE_WINDOW_MS = 10_000;
+export const CLI_ONLINE_WINDOW_WITH_WORKER_SOCKETS_MS = 45_000;
+
+export function createCliPresence({
+  windowMs = CLI_ONLINE_WINDOW_MS,
+  socketWindowMs = CLI_ONLINE_WINDOW_WITH_WORKER_SOCKETS_MS,
+  // Called once when the window ran out after a touch (the deadline timer, or
+  // the last worker socket closing). The presence is cleared before the call.
+  onExpired = () => {},
+  now = () => Date.now(),
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+} = {}) {
+  let lastSeenMs = null;
+  let workerSocketCount = 0;
+  let deadlineTimer = null;
+
+  function currentWindowMs() {
+    return workerSocketCount > 0 ? socketWindowMs : windowMs;
+  }
+
+  function remainingMs() {
+    if (lastSeenMs === null) return 0;
+    return lastSeenMs + currentWindowMs() - now();
+  }
+
+  function disarm() {
+    if (!deadlineTimer) return;
+    clearTimeoutImpl(deadlineTimer);
+    deadlineTimer = null;
+  }
+
+  function arm(delayMs) {
+    disarm();
+    deadlineTimer = setTimeoutImpl(onDeadline, Math.max(1, delayMs));
+    deadlineTimer?.unref?.();
+  }
+
+  function expire() {
+    disarm();
+    lastSeenMs = null;
+    try { onExpired(); } catch {}
+  }
+
+  function onDeadline() {
+    deadlineTimer = null;
+    if (lastSeenMs === null) return;
+    const left = remainingMs();
+    if (left > 0) {
+      arm(left);
+      return;
+    }
+    expire();
+  }
+
+  function touch() {
+    lastSeenMs = now();
+    // An armed deadline is left alone: when it fires it finds the newer
+    // touch and arms again for what is left.
+    if (!deadlineTimer) arm(currentWindowMs());
+  }
+
+  /** The worker socket count changed: the window may have shrunk. */
+  function noteWorkerSocketCount(count) {
+    workerSocketCount = Math.max(0, Number(count) || 0);
+    if (lastSeenMs === null) return;
+    const left = remainingMs();
+    if (left <= 0) {
+      expire();
+      return;
+    }
+    arm(left);
+  }
+
+  /** Forget the last touch without calling onExpired (an explicit offline). */
+  function clear() {
+    disarm();
+    lastSeenMs = null;
+  }
+
+  function isFresh() {
+    return remainingMs() > 0;
+  }
+
+  return {
+    touch,
+    clear,
+    isFresh,
+    noteWorkerSocketCount,
+    status: () => ({
+      lastSeenMs,
+      workerSocketCount,
+      windowMs: currentWindowMs(),
+      armed: deadlineTimer !== null,
+    }),
+  };
+}
+
+// ─── Armable interval ──────────────────────────────────────────────────────────
+
+// An interval that runs only while there is something for it to do: armed by
+// whoever creates that work (a share viewer arriving, a pending row waiting
+// for its worker), disarmed by its own tick once the work is gone. An idle
+// relay then has no such timer at all. The timer is unref'd, and stop() (the
+// runtime's shutdown) disarms it for good.
+
+export function createArmableInterval({
+  intervalMs,
+  // One tick. Returns (or resolves to) `false` to disarm: nothing is left to
+  // do. Anything else keeps the interval running. An arm that lands while a
+  // tick is still running (the tick awaits) keeps the interval running even
+  // if that tick returns false: the work it was armed for may be newer than
+  // what the tick looked at.
+  tick,
+  onError = () => {},
+  setIntervalImpl = setInterval,
+  clearIntervalImpl = clearInterval,
+} = {}) {
+  if (typeof tick !== 'function') throw new Error('createArmableInterval requires tick');
+  const periodMs = Math.max(1, Number(intervalMs) || 1);
+  let timer = null;
+  let stopped = false;
+  let generation = 0;
+
+  function disarm() {
+    if (!timer) return;
+    clearIntervalImpl(timer);
+    timer = null;
+  }
+
+  async function runTick() {
+    const armedAt = generation;
+    let keep;
+    try {
+      keep = await tick();
+    } catch (error) {
+      try { onError(error); } catch {}
+      return;
+    }
+    if (keep === false && generation === armedAt) disarm();
+  }
+
+  function arm() {
+    if (stopped) return false;
+    generation += 1;
+    if (timer) return false;
+    timer = setIntervalImpl(() => { void runTick(); }, periodMs);
+    timer?.unref?.();
+    return true;
+  }
+
+  function stop() {
+    stopped = true;
+    disarm();
+  }
+
+  return {
+    arm,
+    disarm,
+    stop,
+    isArmed: () => timer !== null,
+  };
+}

package/server/services/queue-wake-hook.mjs

@@ -0,0 +1,145 @@
+'use strict';
+
+// Wakes the relay's queue delivery from the database itself. Every write
+// that can make a queue row deliverable (a new pending row, a requeue, a
+// retry time or owner or provider changed, a turn ending, a pending row
+// cancelled or deleted) fires a TEMP trigger on this connection, which calls
+// a JS function that only notes the reason and schedules one wake for after
+// the current tick, so after the write's transaction. The function never
+// touches the database and never throws.
+//
+// No row path has to remember to wake the queue, and none added later can
+// forget: without it, a path that wrote a row and did not wake waited for
+// the next poll. The triggers are TEMP (this connection only, nothing in the
+// schema or the migrations). Their conditions name only the columns the
+// queue table has, a self-test compiles every trigger inside a rolled-back
+// savepoint, and on any error the triggers are dropped again and the caller
+// falls back to polling: a broken trigger would fail every write to the
+// queue.
+
+export const QUEUE_WAKE_FUNCTION = 'oar_queue_wake';
+const TRIGGER_PREFIX = 'oar_queue_wake_';
+const TRIGGER_NAMES = ['insert', 'pending', 'settle', 'leave_pending', 'delete'].map((name) => `${TRIGGER_PREFIX}${name}`);
+// A bulk statement calls the function once per row: the reasons of one tick
+// are kept as a small set.
+const MAX_REASONS = 8;
+
+function queueColumns(db) {
+  return new Set(db.prepare('PRAGMA table_info(queue)').all().map((column) => String(column.name)));
+}
+
+/** The CREATE TEMP TRIGGER statements, their conditions built from the columns there are. */
+export function buildQueueWakeTriggerSql(columns) {
+  const has = (name) => columns.has(name);
+  if (!has('status')) throw new Error('queue has no status column');
+  const changed = ["OLD.status IS NOT 'pending'"];
+  for (const column of ['next_attempt_at', 'owner_sdk_session_id', 'provider']) {
+    if (has(column)) changed.push(`OLD.${column} IS NOT NEW.${column}`);
+  }
+  const call = (reason) => `BEGIN SELECT ${QUEUE_WAKE_FUNCTION}('${reason}'); END`;
+  return [
+    // A new pending row.
+    `CREATE TEMP TRIGGER ${TRIGGER_PREFIX}insert AFTER INSERT ON main.queue
+      WHEN NEW.status = 'pending' ${call('insert')}`,
+    // A row that became pending, or a pending row whose retry time, owner or
+    // provider changed (a requeue, a hold released, a row moved to another
+    // worker). A claim leaves pending and a lease refresh stays processing:
+    // neither wakes.
+    `CREATE TEMP TRIGGER ${TRIGGER_PREFIX}pending AFTER UPDATE ON main.queue
+      WHEN NEW.status = 'pending' AND (${changed.join(' OR ')}) ${call('requeue')}`,
+    // A turn ended: its session's next row, or one held behind it by the plan
+    // boundary, may go now.
+    `CREATE TEMP TRIGGER ${TRIGGER_PREFIX}settle AFTER UPDATE ON main.queue
+      WHEN OLD.status = 'processing' AND NEW.status IS NOT 'processing' ${call('settle')}`,
+    // A pending row cancelled, failed or parked: a row held behind it may go.
+    `CREATE TEMP TRIGGER ${TRIGGER_PREFIX}leave_pending AFTER UPDATE ON main.queue
+      WHEN OLD.status = 'pending' AND NEW.status NOT IN ('pending', 'processing') ${call('cancel')}`,
+    // A pending or running row deleted (the cancel routes): the same.
+    `CREATE TEMP TRIGGER ${TRIGGER_PREFIX}delete AFTER DELETE ON main.queue
+      WHEN OLD.status IN ('pending', 'processing') ${call('delete')}`,
+  ];
+}
+
+function dropTriggers(db) {
+  for (const name of TRIGGER_NAMES) {
+    try { db.exec(`DROP TRIGGER IF EXISTS temp.${name}`); } catch {}
+  }
+}
+
+/**
+ * Compiles every trigger by preparing a write of each kind, and runs one real
+ * update, inside a savepoint that is rolled back: a condition naming a column
+ * the table lacks fails here instead of on the first real write.
+ */
+function selfTestTriggers(db) {
+  db.exec('SAVEPOINT oar_queue_wake_self_test');
+  try {
+    db.prepare('UPDATE queue SET status = status WHERE rowid = (SELECT rowid FROM queue LIMIT 1)').run();
+    db.prepare('UPDATE queue SET status = status WHERE 0').run();
+    db.prepare('DELETE FROM queue WHERE 0').run();
+    db.prepare('INSERT INTO queue SELECT * FROM queue WHERE 0').run();
+  } finally {
+    db.exec('ROLLBACK TO oar_queue_wake_self_test');
+    db.exec('RELEASE oar_queue_wake_self_test');
+  }
+}
+
+/**
+ * Installs the triggers on `db`. `onWake(reason)` runs once per tick in which
+ * queue writes fired them, with the reasons joined. Returns `{ installed }`;
+ * when false the triggers are gone again and the caller must poll.
+ */
+export function installQueueWakeHook(db, {
+  onWake = () => {},
+  log = () => {},
+  schedule = setImmediate,
+  selfTest = selfTestTriggers,
+} = {}) {
+  const reasons = new Set();
+  let scheduled = false;
+  let muted = false;
+
+  function flush() {
+    scheduled = false;
+    const reason = [...reasons].join(',') || 'queue-write';
+    reasons.clear();
+    try {
+      onWake(reason);
+    } catch (error) {
+      log(`queue wake failed: ${error?.message || error}`);
+    }
+  }
+
+  // Called by SQLite from inside a write: no database access, no throw.
+  function wakeFromTrigger(reason) {
+    try {
+      if (muted) return null;
+      if (reasons.size < MAX_REASONS) reasons.add(String(reason || 'queue-write'));
+      if (!scheduled) {
+        scheduled = true;
+        schedule(flush);
+      }
+    } catch {}
+    return null;
+  }
+
+  try {
+    const sql = buildQueueWakeTriggerSql(queueColumns(db));
+    // The function first: a trigger calling a function that does not exist
+    // yet would fail the write.
+    db.function(QUEUE_WAKE_FUNCTION, { deterministic: false }, wakeFromTrigger);
+    dropTriggers(db);
+    for (const statement of sql) db.exec(statement);
+    muted = true;
+    try {
+      selfTest(db);
+    } finally {
+      muted = false;
+    }
+    return { installed: true, triggers: [...TRIGGER_NAMES] };
+  } catch (error) {
+    dropTriggers(db);
+    log(`queue wake triggers not installed, the queue is polled instead: ${error?.message || error}`);
+    return { installed: false, error };
+  }
+}

package/server/services/queue-waker.mjs

@@ -0,0 +1,127 @@
+'use strict';
+
+// What the relay does when its queue may hold work for a worker: hand rows to
+// the workers that are ready (the socket service's notify), make sure every
+// session with a pending row has a worker (the prime), and keep the prime's
+// maintenance pass armed while rows wait. The wakes come from the queue's
+// own writes (queue-wake-hook.mjs), from a retry time coming due, from gates
+// that lift, and from the backstop poll.
+
+/**
+ * The prime: every session that owns a pending row gets its worker started
+ * (rows in retry backoff included, so the worker is warm when the backoff
+ * matures; rows held at the usage limit are not listed until their reset).
+ */
+export function createPendingWorkerPrimer({
+  isEnabled = () => true,
+  listPendingOwnerSessionIds,
+  isKillBlocked = () => false,
+  // A session whose rows were failed instead of launched (a Claude API chat
+  // the key cannot serve): true to skip its launch.
+  failRowsWithoutLaunch = () => false,
+  ensureWorker,
+  // Rows were found: the maintenance pass keeps retrying until none is.
+  onRowsWaiting = () => {},
+  warn = () => {},
+  limit = 25,
+} = {}) {
+  return async function prime(reason = 'pending-worker-prime') {
+    if (!isEnabled()) return 0;
+    const rows = listPendingOwnerSessionIds(limit) || [];
+    if (rows.length) onRowsWaiting();
+    let requested = 0;
+    for (const row of rows) {
+      const sdkSessionId = String(row?.sdk_session_id || '').trim();
+      if (!sdkSessionId) continue;
+      if (isKillBlocked(sdkSessionId) === true) continue;
+      try {
+        // Per session: a throw here costs this session its launch, never the
+        // rest of the pass.
+        if (failRowsWithoutLaunch(sdkSessionId)) continue;
+      } catch (error) {
+        warn(`WORKER PRIME skipped session=${sdkSessionId.slice(0, 8)} err=${error?.message || error}`);
+        continue;
+      }
+      requested += 1;
+      try {
+        const result = await ensureWorker(sdkSessionId);
+        if (!result?.ok) {
+          warn(`WORKER PRIME blocked session=${sdkSessionId.slice(0, 8)} reason=${String(result?.error || reason || 'pending-worker-prime')}`);
+        }
+      } catch (error) {
+        warn(`WORKER PRIME failed session=${sdkSessionId.slice(0, 8)} reason=${String(reason || 'pending-worker-prime')} err=${error?.message || error}`);
+      }
+    }
+    return requested;
+  };
+}
+
+/**
+ * The wake. `wake(reason)` hands rows out at once, primes, and arms the
+ * maintenance pass; `wake(reason, { prime: false })` leaves the prime to that
+ * pass (a queue write: the send route launches its own worker, and a write
+ * burst must not run a prime per write). Primes never overlap: one asked for
+ * while one runs runs once after it. `primeFromBackstop` is the poll's share:
+ * a prime at most every `backstopPrimeGapMs`.
+ */
+export function createQueueWaker({
+  prime,
+  notify = () => {},
+  armPrime = () => {},
+  isReady = () => true,
+  backstopPrimeGapMs = 5_000,
+  now = () => Date.now(),
+  warn = () => {},
+} = {}) {
+  let primeRunning = false;
+  let primeAgain = null;
+  let lastBackstopPrimeAt = -Infinity;
+
+  async function runPrime(reason) {
+    if (primeRunning) {
+      primeAgain = reason;
+      return;
+    }
+    primeRunning = true;
+    try {
+      let next = reason;
+      while (next) {
+        primeAgain = null;
+        try {
+          await prime(next);
+        } catch (error) {
+          warn(`WORKER PRIME pass failed reason=${next} err=${error?.message || error}`);
+        }
+        next = primeAgain;
+      }
+    } finally {
+      primeRunning = false;
+    }
+  }
+
+  function wake(reason = 'queue-wake', { prime: withPrime = true } = {}) {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    try { notify(reason); } catch (error) {
+      warn(`queue notify failed reason=${reason} err=${error?.message || error}`);
+    }
+    if (withPrime) void runPrime(reason);
+    return true;
+  }
+
+  function primeFromBackstop(reason = 'backstop') {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    const at = now();
+    if (at - lastBackstopPrimeAt < backstopPrimeGapMs) return false;
+    lastBackstopPrimeAt = at;
+    void runPrime(reason);
+    return true;
+  }
+
+  return {
+    wake,
+    primeFromBackstop,
+    status: () => ({ primeRunning, primeQueued: primeAgain !== null }),
+  };
+}

package/server/services/relay-ask-service.mjs

@@ -108,6 +108,15 @@ export function createRelayAskService({
     }
   })();
   const available = !problem;
+  // The turn an ask was made in (migration 0037); without the column asks
+  // still work and store none.
+  const hasQueueId = available && (() => {
+    try {
+      return db.prepare(`PRAGMA table_info(relay_asks)`).all().some((column) => column.name === 'queue_id');
+    } catch {
+      return false;
+    }
+  })();
 
   const sql = available ? {
     insert: db.prepare(`
@@ -116,6 +125,12 @@ export function createRelayAskService({
          question, options_json, recommendation, detail, urgency, status, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
     `),
+    insertWithQueue: hasQueueId ? db.prepare(`
+      INSERT INTO relay_asks
+        (id, relay_id, remote_id, conversation_id, conversation_title, created_by, creator_json,
+         question, options_json, recommendation, detail, urgency, status, created_at, updated_at, queue_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)
+    `) : null,
     get: db.prepare(`SELECT * FROM relay_asks WHERE id = ?`),
     getMirror: db.prepare(`SELECT * FROM relay_asks WHERE relay_id = ? AND remote_id = ?`),
     // The Inbox: this relay's asks, pending and closed since.
@@ -131,6 +146,17 @@ export function createRelayAskService({
         AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
       ORDER BY created_at DESC, rowid DESC LIMIT ?
     `),
+    // A session's own cards: the asks in it kept here, none it only asked
+    // elsewhere and no mirrors.
+    listIn: db.prepare(`
+      SELECT * FROM relay_asks
+      WHERE conversation_id = ? AND relay_id = 'self'
+        AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
+      ORDER BY created_at DESC, rowid DESC LIMIT ?
+    `),
+    // What carryIn and carryBy are about to move.
+    listCarryIn: db.prepare(`SELECT id FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
+    listCarryBy: db.prepare(`SELECT id FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
     countPendingHere: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND status = 'pending'`),
     countPendingIn: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
     countPendingBy: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
@@ -228,6 +254,9 @@ export function createRelayAskService({
         ? { relay: creator.relayName || null, conversationId: creator.conversationId || null, title: creator.conversationTitle || null }
         : (toText(row.created_by) ? { conversationId: row.created_by, title: toText(asker?.title) || null } : null),
       onBehalf: creator ? true : (!!toText(row.created_by) && row.created_by !== row.conversation_id),
+      // The queue row of the turn that asked (null: on behalf, a paired
+      // relay's agent, or older); a mirror has none.
+      ...(mirror ? {} : { queueId: row.queue_id || null }),
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };
@@ -259,9 +288,10 @@ export function createRelayAskService({
   /**
    * Stores an ask about `conversationId` (a session of this relay). The asker
    * is `createdBy` (a conversation here: the same one, or a lead asking for
-   * another) or `creator` (a paired relay's agent). Returns the ask.
+   * another) or `creator` (a paired relay's agent). `queueId`: the queue row
+   * of the turn that asked, when it ran in this session. Returns the ask.
    */
-  function create({ conversationId, createdBy = null, creator = null, ...input } = {}) {
+  function create({ conversationId, createdBy = null, creator = null, queueId = null, ...input } = {}) {
     requireAvailable();
     const session = conversation(conversationId);
     if (!isLive(session)) {
@@ -281,7 +311,7 @@ export function createRelayAskService({
     const { question, options, recommendation, detail, urgency } = checked.value;
     const id = newId();
     const at = isoNow();
-    sql.insert.run(
+    const values = [
       id,
       SELF,
       null,
@@ -296,7 +326,9 @@ export function createRelayAskService({
       urgency,
       at,
       at,
-    );
+    ];
+    if (sql.insertWithQueue) sql.insertWithQueue.run(...values, clip(queueId, 200) || null);
+    else sql.insert.run(...values);
     const row = sql.get.get(id);
     const ask = shape(row);
     log(`${id} in ${shortId(session.id)} by ${remoteCreator ? `relay ${shortId(remoteCreator.relayId)}` : shortId(asker)}${urgency === 'now' ? ' (now)' : ''}`);
@@ -335,6 +367,20 @@ export function createRelayAskService({
     return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
   }
 
+  /**
+   * A session's cards: the asks in it kept on this relay (not those it only
+   * asked elsewhere, no mirrors), pending first, then those closed in the
+   * last answeredKeepMs.
+   */
+  function listIn(conversationId) {
+    if (!available) return [];
+    const id = toText(conversationId);
+    if (!id) return [];
+    const since = new Date(now() - RELAY_ASK_LIMITS.answeredKeepMs).toISOString();
+    const rows = sql.listIn.all(id, since, RELAY_ASK_LIMITS.listMax);
+    return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
+  }
+
   /** Who is told the outcome of a row here: its session and the conversation that asked. */
   function tell(row) {
     const ask = shape(row);
@@ -429,7 +475,19 @@ export function createRelayAskService({
     const from = toText(sourceId);
     const to = toText(targetId);
     if (!from || !to || from === to) return 0;
-    const moved = db.transaction(() => sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes)();
+    // The rows both updates touch, each once (a self-ask in and by the
+    // source is in both), so their cards follow to the successor.
+    const touched = new Set();
+    const moved = db.transaction(() => {
+      for (const row of sql.listCarryIn.all(from)) touched.add(row.id);
+      for (const row of sql.listCarryBy.all(from)) touched.add(row.id);
+      return sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes;
+    })();
+    for (const id of touched) {
+      const row = sql.get.get(id);
+      // A mirror's card lives on the paired relay: nothing to show here.
+      if (row && row.relay_id === SELF) changed(row);
+    }
     if (moved) log(`conv=${shortId(from)} compacted into ${shortId(to)}: ${moved} question${moved === 1 ? '' : 's'} moved`);
     return moved;
   }
@@ -586,6 +644,7 @@ export function createRelayAskService({
     get,
     listHere,
     listOf,
+    listIn,
     pendingCount,
     answer,
     dismiss,

package/server/services/relay-event-service.mjs

@@ -107,7 +107,7 @@ import {
   relayEventQuietWindowEnd,
   relayEventTypesTake,
 } from '../../shared/relay-events.mjs';
-import { REMOTE_RELAY_APPROVAL_SOURCE } from '../../shared/relay-asks.mjs';
+import { REMOTE_RELAY_APPROVAL_SOURCE, isPersonOnlyQuestion } from '../../shared/relay-asks.mjs';
 
 export const RELAY_EVENT_SUBSCRIPTIONS_SOCKET_EVENT = 'relay_event_subscriptions';
 export const RELAY_EVENT_SELF_RELAY_ID = 'self';
@@ -1770,6 +1770,7 @@ export function createRelayEventService({
     prompt: 'text',
     questionId: 'text',
     approvalCard: 'bool',
+    personOnly: 'bool',
     // question_answered
     answer: 'text',
     choice: 'text',
@@ -2316,6 +2317,8 @@ export function createRelayEventService({
       options,
       questionId: toText(question.id),
       ...(toText(context?.source) === REMOTE_RELAY_APPROVAL_SOURCE ? { approvalCard: true } : {}),
+      // A Claude session's Safety check: the user's to answer.
+      ...(isPersonOnlyQuestion(context) ? { personOnly: true } : {}),
       // A question that does not block (relay_tool ask).
       ...(toText(question.kind) === 'ask' ? { kind: 'ask' } : {}),
     });

package/server/services/remote-relay-dispatcher.mjs

@@ -44,7 +44,7 @@ import {
   isMissingRelayEventRoute,
   relayWithoutCrossRelayEventsText,
 } from './relay-event-link-service.mjs';
-import { RELAY_ASK_KIND, relayQuestionKind } from '../../shared/relay-asks.mjs';
+import { RELAY_ASK_KIND, isPersonOnlyQuestion, relayQuestionKind } from '../../shared/relay-asks.mjs';
 import { RELAY_ASK_REMOTE_PATHS, isMissingRelayAskRoute, relayWithoutAsksText } from './relay-ask-link-service.mjs';
 
 // The one place a `relay_tool` tool call is decided and carried out (plan
@@ -465,11 +465,13 @@ function relayTarget(relay) {
 /**
  * The question card's view of a relay question: what the agent needs to answer
  * it. Null for the remote's own remote-relay approval cards, which only its
- * user may answer (the remote hides them from us as well).
+ * user may answer (the remote hides them from us as well), and for a Claude
+ * session's Safety check card, which only the user may answer.
  */
 function mapPendingQuestion(question) {
   if (!isPlainObject(question) || !toText(question.id)) return null;
   if (isRemoteRelayApprovalQuestion(question)) return null;
+  if (isPersonOnlyQuestion(question.context)) return null;
   const kind = relayQuestionKind(question);
   if (kind === RELAY_ASK_KIND) {
     // A question that does not block: the user's to answer, the session works on.
@@ -1757,7 +1759,9 @@ export function createRemoteRelayDispatcher({
       budget -= text.length;
       const role = toText(row.role) || 'assistant';
       const via = toText(row?.origin?.relayName);
-      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities) : [];
+      // The newest lines, as the progress path reads them: the relay keeps the
+      // newest per thread now, so the first ones are not the start anyway.
+      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities, { fromEnd: true }) : [];
       out.unshift({
         id: toText(row.id),
         role,
@@ -2594,6 +2598,11 @@ export function createRemoteRelayDispatcher({
         `Question ${args.question_id} was not found on relay "${ctx.relay.name}".`);
     }
     const session = toText(question.conversationId) || null;
+    if (isPersonOnlyQuestion(question.context)) {
+      throw new DispatchFailure(403, REMOTE_RELAY_ERROR_CODES.forbidden,
+        `Question ${args.question_id} is a Safety check: Claude Code marks the call as person-only, so this card is the user's to answer, never an agent's. Leave it to the user.`,
+        { session });
+    }
     if (ctx.relay.local && session && isOwnConversation(ctx, session)) {
       throw new DispatchFailure(400, REMOTE_RELAY_ERROR_CODES.ownSession,
         `Question ${args.question_id} belongs to this conversation itself; an agent cannot answer its own question. It is the user's to answer.`,
@@ -3462,7 +3471,17 @@ export function createRemoteRelayDispatcher({
       };
     }
     const session = askSession(ctx, args);
-    const ask = relayAskCall(() => service.create({ conversationId: session, createdBy: ctx.conversationId, ...askInput(args) }));
+    const ask = relayAskCall(() => service.create({
+      conversationId: session,
+      createdBy: ctx.conversationId,
+      ...askInput(args),
+      // The queue id means "the turn that was live when the ask was made": a
+      // background sub-agent asking after its parent turn ended may record
+      // the user's next, unrelated turn (accepted; there is no worker
+      // attribution). An ask on behalf of another session stores null: the
+      // asking turn lives in another conversation.
+      queueId: session === ctx.conversationId ? (ctx.caller?.processingRowId || null) : null,
+    }));
     const forOther = session !== ctx.conversationId;
     return {
       summary: `ask → ${ctx.relay.name}${forOther ? ` session ${shortId(session)}` : ''}: question ${ask.id} pending${ask.urgency === 'now' ? ' (now)' : ''}`,