@oar-sh/oar 0.9.21 → 0.9.23

package/server/services/queue-waker.mjs

@@ -0,0 +1,127 @@
+'use strict';
+
+// What the relay does when its queue may hold work for a worker: hand rows to
+// the workers that are ready (the socket service's notify), make sure every
+// session with a pending row has a worker (the prime), and keep the prime's
+// maintenance pass armed while rows wait. The wakes come from the queue's
+// own writes (queue-wake-hook.mjs), from a retry time coming due, from gates
+// that lift, and from the backstop poll.
+
+/**
+ * The prime: every session that owns a pending row gets its worker started
+ * (rows in retry backoff included, so the worker is warm when the backoff
+ * matures; rows held at the usage limit are not listed until their reset).
+ */
+export function createPendingWorkerPrimer({
+  isEnabled = () => true,
+  listPendingOwnerSessionIds,
+  isKillBlocked = () => false,
+  // A session whose rows were failed instead of launched (a Claude API chat
+  // the key cannot serve): true to skip its launch.
+  failRowsWithoutLaunch = () => false,
+  ensureWorker,
+  // Rows were found: the maintenance pass keeps retrying until none is.
+  onRowsWaiting = () => {},
+  warn = () => {},
+  limit = 25,
+} = {}) {
+  return async function prime(reason = 'pending-worker-prime') {
+    if (!isEnabled()) return 0;
+    const rows = listPendingOwnerSessionIds(limit) || [];
+    if (rows.length) onRowsWaiting();
+    let requested = 0;
+    for (const row of rows) {
+      const sdkSessionId = String(row?.sdk_session_id || '').trim();
+      if (!sdkSessionId) continue;
+      if (isKillBlocked(sdkSessionId) === true) continue;
+      try {
+        // Per session: a throw here costs this session its launch, never the
+        // rest of the pass.
+        if (failRowsWithoutLaunch(sdkSessionId)) continue;
+      } catch (error) {
+        warn(`WORKER PRIME skipped session=${sdkSessionId.slice(0, 8)} err=${error?.message || error}`);
+        continue;
+      }
+      requested += 1;
+      try {
+        const result = await ensureWorker(sdkSessionId);
+        if (!result?.ok) {
+          warn(`WORKER PRIME blocked session=${sdkSessionId.slice(0, 8)} reason=${String(result?.error || reason || 'pending-worker-prime')}`);
+        }
+      } catch (error) {
+        warn(`WORKER PRIME failed session=${sdkSessionId.slice(0, 8)} reason=${String(reason || 'pending-worker-prime')} err=${error?.message || error}`);
+      }
+    }
+    return requested;
+  };
+}
+
+/**
+ * The wake. `wake(reason)` hands rows out at once, primes, and arms the
+ * maintenance pass; `wake(reason, { prime: false })` leaves the prime to that
+ * pass (a queue write: the send route launches its own worker, and a write
+ * burst must not run a prime per write). Primes never overlap: one asked for
+ * while one runs runs once after it. `primeFromBackstop` is the poll's share:
+ * a prime at most every `backstopPrimeGapMs`.
+ */
+export function createQueueWaker({
+  prime,
+  notify = () => {},
+  armPrime = () => {},
+  isReady = () => true,
+  backstopPrimeGapMs = 5_000,
+  now = () => Date.now(),
+  warn = () => {},
+} = {}) {
+  let primeRunning = false;
+  let primeAgain = null;
+  let lastBackstopPrimeAt = -Infinity;
+
+  async function runPrime(reason) {
+    if (primeRunning) {
+      primeAgain = reason;
+      return;
+    }
+    primeRunning = true;
+    try {
+      let next = reason;
+      while (next) {
+        primeAgain = null;
+        try {
+          await prime(next);
+        } catch (error) {
+          warn(`WORKER PRIME pass failed reason=${next} err=${error?.message || error}`);
+        }
+        next = primeAgain;
+      }
+    } finally {
+      primeRunning = false;
+    }
+  }
+
+  function wake(reason = 'queue-wake', { prime: withPrime = true } = {}) {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    try { notify(reason); } catch (error) {
+      warn(`queue notify failed reason=${reason} err=${error?.message || error}`);
+    }
+    if (withPrime) void runPrime(reason);
+    return true;
+  }
+
+  function primeFromBackstop(reason = 'backstop') {
+    if (!isReady()) return false;
+    try { armPrime(); } catch {}
+    const at = now();
+    if (at - lastBackstopPrimeAt < backstopPrimeGapMs) return false;
+    lastBackstopPrimeAt = at;
+    void runPrime(reason);
+    return true;
+  }
+
+  return {
+    wake,
+    primeFromBackstop,
+    status: () => ({ primeRunning, primeQueued: primeAgain !== null }),
+  };
+}

package/server/services/relay-ask-service.mjs

@@ -108,6 +108,15 @@ export function createRelayAskService({
     }
   })();
   const available = !problem;
+  // The turn an ask was made in (migration 0037); without the column asks
+  // still work and store none.
+  const hasQueueId = available && (() => {
+    try {
+      return db.prepare(`PRAGMA table_info(relay_asks)`).all().some((column) => column.name === 'queue_id');
+    } catch {
+      return false;
+    }
+  })();
 
   const sql = available ? {
     insert: db.prepare(`
@@ -116,6 +125,12 @@ export function createRelayAskService({
          question, options_json, recommendation, detail, urgency, status, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
     `),
+    insertWithQueue: hasQueueId ? db.prepare(`
+      INSERT INTO relay_asks
+        (id, relay_id, remote_id, conversation_id, conversation_title, created_by, creator_json,
+         question, options_json, recommendation, detail, urgency, status, created_at, updated_at, queue_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)
+    `) : null,
     get: db.prepare(`SELECT * FROM relay_asks WHERE id = ?`),
     getMirror: db.prepare(`SELECT * FROM relay_asks WHERE relay_id = ? AND remote_id = ?`),
     // The Inbox: this relay's asks, pending and closed since.
@@ -131,6 +146,17 @@ export function createRelayAskService({
         AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
       ORDER BY created_at DESC, rowid DESC LIMIT ?
     `),
+    // A session's own cards: the asks in it kept here, none it only asked
+    // elsewhere and no mirrors.
+    listIn: db.prepare(`
+      SELECT * FROM relay_asks
+      WHERE conversation_id = ? AND relay_id = 'self'
+        AND (status = 'pending' OR (status <> 'pending' AND updated_at >= ?))
+      ORDER BY created_at DESC, rowid DESC LIMIT ?
+    `),
+    // What carryIn and carryBy are about to move.
+    listCarryIn: db.prepare(`SELECT id FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
+    listCarryBy: db.prepare(`SELECT id FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
     countPendingHere: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND status = 'pending'`),
     countPendingIn: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE relay_id = 'self' AND conversation_id = ? AND status = 'pending'`),
     countPendingBy: db.prepare(`SELECT COUNT(*) AS n FROM relay_asks WHERE created_by = ? AND status = 'pending'`),
@@ -228,6 +254,9 @@ export function createRelayAskService({
         ? { relay: creator.relayName || null, conversationId: creator.conversationId || null, title: creator.conversationTitle || null }
         : (toText(row.created_by) ? { conversationId: row.created_by, title: toText(asker?.title) || null } : null),
       onBehalf: creator ? true : (!!toText(row.created_by) && row.created_by !== row.conversation_id),
+      // The queue row of the turn that asked (null: on behalf, a paired
+      // relay's agent, or older); a mirror has none.
+      ...(mirror ? {} : { queueId: row.queue_id || null }),
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };
@@ -259,9 +288,10 @@ export function createRelayAskService({
   /**
    * Stores an ask about `conversationId` (a session of this relay). The asker
    * is `createdBy` (a conversation here: the same one, or a lead asking for
-   * another) or `creator` (a paired relay's agent). Returns the ask.
+   * another) or `creator` (a paired relay's agent). `queueId`: the queue row
+   * of the turn that asked, when it ran in this session. Returns the ask.
    */
-  function create({ conversationId, createdBy = null, creator = null, ...input } = {}) {
+  function create({ conversationId, createdBy = null, creator = null, queueId = null, ...input } = {}) {
     requireAvailable();
     const session = conversation(conversationId);
     if (!isLive(session)) {
@@ -281,7 +311,7 @@ export function createRelayAskService({
     const { question, options, recommendation, detail, urgency } = checked.value;
     const id = newId();
     const at = isoNow();
-    sql.insert.run(
+    const values = [
       id,
       SELF,
       null,
@@ -296,7 +326,9 @@ export function createRelayAskService({
       urgency,
       at,
       at,
-    );
+    ];
+    if (sql.insertWithQueue) sql.insertWithQueue.run(...values, clip(queueId, 200) || null);
+    else sql.insert.run(...values);
     const row = sql.get.get(id);
     const ask = shape(row);
     log(`${id} in ${shortId(session.id)} by ${remoteCreator ? `relay ${shortId(remoteCreator.relayId)}` : shortId(asker)}${urgency === 'now' ? ' (now)' : ''}`);
@@ -335,6 +367,20 @@ export function createRelayAskService({
     return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
   }
 
+  /**
+   * A session's cards: the asks in it kept on this relay (not those it only
+   * asked elsewhere, no mirrors), pending first, then those closed in the
+   * last answeredKeepMs.
+   */
+  function listIn(conversationId) {
+    if (!available) return [];
+    const id = toText(conversationId);
+    if (!id) return [];
+    const since = new Date(now() - RELAY_ASK_LIMITS.answeredKeepMs).toISOString();
+    const rows = sql.listIn.all(id, since, RELAY_ASK_LIMITS.listMax);
+    return [...rows.filter((row) => row.status === 'pending'), ...rows.filter((row) => row.status !== 'pending')].map(shape);
+  }
+
   /** Who is told the outcome of a row here: its session and the conversation that asked. */
   function tell(row) {
     const ask = shape(row);
@@ -429,7 +475,19 @@ export function createRelayAskService({
     const from = toText(sourceId);
     const to = toText(targetId);
     if (!from || !to || from === to) return 0;
-    const moved = db.transaction(() => sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes)();
+    // The rows both updates touch, each once (a self-ask in and by the
+    // source is in both), so their cards follow to the successor.
+    const touched = new Set();
+    const moved = db.transaction(() => {
+      for (const row of sql.listCarryIn.all(from)) touched.add(row.id);
+      for (const row of sql.listCarryBy.all(from)) touched.add(row.id);
+      return sql.carryIn.run(to, from).changes + sql.carryBy.run(to, from).changes;
+    })();
+    for (const id of touched) {
+      const row = sql.get.get(id);
+      // A mirror's card lives on the paired relay: nothing to show here.
+      if (row && row.relay_id === SELF) changed(row);
+    }
     if (moved) log(`conv=${shortId(from)} compacted into ${shortId(to)}: ${moved} question${moved === 1 ? '' : 's'} moved`);
     return moved;
   }
@@ -586,6 +644,7 @@ export function createRelayAskService({
     get,
     listHere,
     listOf,
+    listIn,
     pendingCount,
     answer,
     dismiss,

package/server/services/relay-console-log.mjs

@@ -8,9 +8,8 @@
 // read, so the runtime copies it into `<log dir>/relay-console.log`, with a
 // time stamp per line and a size limit.
 //
-// The copy is taken from the console's methods rather than from stdout: the
-// terminal console (tty-console) redraws its prompt on stdout, and none of
-// that belongs in a log.
+// The copy is taken from the console's methods rather than from stdout, so
+// what a library writes to stdout directly stays out of it.
 
 import fs from 'fs';
 import path from 'path';

package/server/services/relay-event-service.mjs

@@ -107,7 +107,7 @@ import {
   relayEventQuietWindowEnd,
   relayEventTypesTake,
 } from '../../shared/relay-events.mjs';
-import { REMOTE_RELAY_APPROVAL_SOURCE } from '../../shared/relay-asks.mjs';
+import { REMOTE_RELAY_APPROVAL_SOURCE, isPersonOnlyQuestion } from '../../shared/relay-asks.mjs';
 
 export const RELAY_EVENT_SUBSCRIPTIONS_SOCKET_EVENT = 'relay_event_subscriptions';
 export const RELAY_EVENT_SELF_RELAY_ID = 'self';
@@ -1770,6 +1770,7 @@ export function createRelayEventService({
     prompt: 'text',
     questionId: 'text',
     approvalCard: 'bool',
+    personOnly: 'bool',
     // question_answered
     answer: 'text',
     choice: 'text',
@@ -2316,6 +2317,8 @@ export function createRelayEventService({
       options,
       questionId: toText(question.id),
       ...(toText(context?.source) === REMOTE_RELAY_APPROVAL_SOURCE ? { approvalCard: true } : {}),
+      // A Claude session's Safety check: the user's to answer.
+      ...(isPersonOnlyQuestion(context) ? { personOnly: true } : {}),
       // A question that does not block (relay_tool ask).
       ...(toText(question.kind) === 'ask' ? { kind: 'ask' } : {}),
     });

package/server/services/remote-relay-dispatcher.mjs

@@ -44,7 +44,7 @@ import {
   isMissingRelayEventRoute,
   relayWithoutCrossRelayEventsText,
 } from './relay-event-link-service.mjs';
-import { RELAY_ASK_KIND, relayQuestionKind } from '../../shared/relay-asks.mjs';
+import { RELAY_ASK_KIND, isPersonOnlyQuestion, relayQuestionKind } from '../../shared/relay-asks.mjs';
 import { RELAY_ASK_REMOTE_PATHS, isMissingRelayAskRoute, relayWithoutAsksText } from './relay-ask-link-service.mjs';
 
 // The one place a `relay_tool` tool call is decided and carried out (plan
@@ -465,11 +465,13 @@ function relayTarget(relay) {
 /**
  * The question card's view of a relay question: what the agent needs to answer
  * it. Null for the remote's own remote-relay approval cards, which only its
- * user may answer (the remote hides them from us as well).
+ * user may answer (the remote hides them from us as well), and for a Claude
+ * session's Safety check card, which only the user may answer.
  */
 function mapPendingQuestion(question) {
   if (!isPlainObject(question) || !toText(question.id)) return null;
   if (isRemoteRelayApprovalQuestion(question)) return null;
+  if (isPersonOnlyQuestion(question.context)) return null;
   const kind = relayQuestionKind(question);
   if (kind === RELAY_ASK_KIND) {
     // A question that does not block: the user's to answer, the session works on.
@@ -1757,7 +1759,9 @@ export function createRemoteRelayDispatcher({
       budget -= text.length;
       const role = toText(row.role) || 'assistant';
       const via = toText(row?.origin?.relayName);
-      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities) : [];
+      // The newest lines, as the progress path reads them: the relay keeps the
+      // newest per thread now, so the first ones are not the start anyway.
+      const activities = includeActivity && role === 'assistant' ? activityTexts(row.activities, { fromEnd: true }) : [];
       out.unshift({
         id: toText(row.id),
         role,
@@ -2594,6 +2598,11 @@ export function createRemoteRelayDispatcher({
         `Question ${args.question_id} was not found on relay "${ctx.relay.name}".`);
     }
     const session = toText(question.conversationId) || null;
+    if (isPersonOnlyQuestion(question.context)) {
+      throw new DispatchFailure(403, REMOTE_RELAY_ERROR_CODES.forbidden,
+        `Question ${args.question_id} is a Safety check: Claude Code marks the call as person-only, so this card is the user's to answer, never an agent's. Leave it to the user.`,
+        { session });
+    }
     if (ctx.relay.local && session && isOwnConversation(ctx, session)) {
       throw new DispatchFailure(400, REMOTE_RELAY_ERROR_CODES.ownSession,
         `Question ${args.question_id} belongs to this conversation itself; an agent cannot answer its own question. It is the user's to answer.`,
@@ -3462,7 +3471,17 @@ export function createRemoteRelayDispatcher({
       };
     }
     const session = askSession(ctx, args);
-    const ask = relayAskCall(() => service.create({ conversationId: session, createdBy: ctx.conversationId, ...askInput(args) }));
+    const ask = relayAskCall(() => service.create({
+      conversationId: session,
+      createdBy: ctx.conversationId,
+      ...askInput(args),
+      // The queue id means "the turn that was live when the ask was made": a
+      // background sub-agent asking after its parent turn ended may record
+      // the user's next, unrelated turn (accepted; there is no worker
+      // attribution). An ask on behalf of another session stores null: the
+      // asking turn lives in another conversation.
+      queueId: session === ctx.conversationId ? (ctx.caller?.processingRowId || null) : null,
+    }));
     const forOther = session !== ctx.conversationId;
     return {
       summary: `ask → ${ctx.relay.name}${forOther ? ` session ${shortId(session)}` : ''}: question ${ask.id} pending${ask.urgency === 'now' ? ' (now)' : ''}`,

package/server/services/remote-relay-loopback.mjs

@@ -100,10 +100,10 @@ export function createRemoteRelayLoopbackClient({
       req.httpVersionMinor = 1;
       req.httpVersion = '1.1';
       if (hasBody) {
-        // What the wire would deliver: JSON, parsed. `_body` tells the JSON
-        // body parser the body is already there.
+        // What the wire would deliver: JSON, parsed. The headers carry no
+        // content-length or transfer-encoding, so the JSON body parser finds
+        // no body to read and leaves this one in place.
         req.body = JSON.parse(JSON.stringify(body));
-        req._body = true;
       }
       req.complete = true;
       req.push(null);

package/server/services/sdk-session-sync-service.mjs

@@ -1,6 +1,6 @@
 'use strict';
 
-import { v4 as uuidv4 } from 'uuid';
+import { randomUUID as uuidv4 } from 'crypto';
 
 function normalizeId(value) {
   return String(value || '').trim();

package/server/services/session-history-refresh-service.mjs

@@ -367,6 +367,9 @@ export function createSessionHistoryRefreshService({
           timestamp,
           activity.subagentRunId,
           activity.metadata ? JSON.stringify(activity.metadata) : null,
+          // turn_seq: an imported turn has no order of its own; it keeps the
+          // grouped layout.
+          null,
         );
       }
       const thoughts = ensureArray(message?.thoughts)
@@ -386,6 +389,7 @@ export function createSessionHistoryRefreshService({
           thought.done ? 1 : 0,
           timestamp,
           thought.subagentRunId,
+          null, // turn_seq, as for the activity rows above
         );
       }
     }

package/server/services/session-worker-supervisor-service.mjs

@@ -88,6 +88,12 @@ export function createSessionWorkerSupervisor({
   // short enough that stopping a turn and immediately sending a new message
   // does not add 30s in front of the worker's boot.
   killBlockGraceMs = 3_000,
+  // A kill's block on new launches and deliveries for the session ended (its
+  // grace ran out, or the marker was cleared): (sessionId). The relay hands
+  // out what waited for it.
+  onKillBlockLifted = null,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
   isPidAlive = defaultIsPidAlive,
   diagnosticPlanReference = null,
   log = null,
@@ -98,6 +104,8 @@ export function createSessionWorkerSupervisor({
 
   const pendingStarts = new Map();
   const lifecycleBySession = new Map();
+  // sessionId → the timer that reports the end of its kill block.
+  const killBlockTimers = new Map();
   const retryLimit = Math.max(0, clampInt(maxRestartRetries, 5));
   const backoffBaseMs = Math.max(1, clampInt(restartBackoffBaseMs, 1_000));
   const backoffMaxMs = Math.max(backoffBaseMs, clampInt(restartBackoffMaxMs, 30_000));
@@ -301,9 +309,35 @@ export function createSessionWorkerSupervisor({
     });
   }
 
+  function reportKillBlockLifted(sessionId) {
+    if (typeof onKillBlockLifted !== 'function') return;
+    try { onKillBlockLifted(sessionId); } catch {}
+  }
+
+  function clearKillBlockTimer(sessionId) {
+    const timer = killBlockTimers.get(sessionId);
+    if (!timer) return false;
+    clearTimeoutImpl(timer);
+    killBlockTimers.delete(sessionId);
+    return true;
+  }
+
   function markKilled(sessionId) {
     if (!normalizeSessionId(sessionId)) return null;
     const killed = setLifecycle(sessionId, { killedAtMs: nowMs() });
+    // The block itself is read off the clock (isKillBlocked); this timer only
+    // says when it ends, so the rows that waited go out then.
+    if (killGraceMs > 0 && typeof onKillBlockLifted === 'function') {
+      clearKillBlockTimer(sessionId);
+      const timer = setTimeoutImpl(() => {
+        killBlockTimers.delete(sessionId);
+        if (!isKillBlocked(sessionId)) reportKillBlockLifted(sessionId);
+        // A few ms past the grace: the timer's clock and nowMs() may differ
+        // by a tick.
+      }, killGraceMs + 5);
+      timer?.unref?.();
+      killBlockTimers.set(sessionId, timer);
+    }
     return toLifecycleSnapshot(sessionId, killed);
   }
 
@@ -489,10 +523,12 @@ export function createSessionWorkerSupervisor({
       patch.degradedAtMs = null;
       patch.uiState = 'white';
     }
+    const liftsKillBlock = resetKilledMarker && clearKillBlockTimer(sessionId);
     if (resetKilledMarker) {
       patch.killedAtMs = null;
     }
     const cleared = setLifecycle(sessionId, patch);
+    if (liftsKillBlock) reportKillBlockLifted(sessionId);
     return toLifecycleSnapshot(sessionId, cleared);
   }