@oar-sh/oar 0.9.22 → 0.9.23

package/CHANGELOG.md

@@ -3,6 +3,99 @@
 All notable changes to OAR are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [0.9.23] — 2026-11-07
+
+Highlights: a dependency round. The Copilot, Claude and Cursor SDKs, zod,
+express, socket.io, ws and better-sqlite3 move to newer releases:
+the tree holds one zod, without CVE-2023-54404, and one express, and
+prebuild-install, which is no longer maintained, is gone. OAR's package has
+no install script any more, which package scanners flag. On Termux, 32-bit
+ARM and FreeBSD, run **`oar build-native`** once after updating to this
+version: it builds the SQLite binding, and later updates build it
+themselves.
+
+### Added
+
+- **`oar build-native`.** better-sqlite3 13 ships its SQLite binding for
+  Linux, macOS and Windows on x64 and arm64. On Android under Termux, 32-bit
+  ARM and FreeBSD, `oar build-native` compiles it in the installed package
+  (Python 3, make and a C++ compiler; on Termux `pkg install python clang
+  make`). The **Update** button and `oar update` run it there themselves
+  before the relay restarts; a build that fails ends the update in an error
+  and leaves the running relay alone. Elsewhere it has nothing to do, so an
+  installer may run it everywhere. A relay started without the binding says
+  which command to run and exits instead of printing a stack trace.
+- **What the agent SDKs contact.** docs/providers.md lists the services the
+  Copilot, Claude and Cursor SDKs and their CLIs talk to, and what the
+  Statsig client inside the Cursor SDK does.
+
+### Changed
+
+- **No install script.** OAR's package has no `preinstall` any more. From
+  0.9.14 to 0.9.22 it copied the data a relay before 0.9.14 kept inside the
+  package out before npm deleted it. npm 12 never ran it without
+  `--allow-scripts`, and package scanners flag every package that has one.
+  A copy those versions made is still taken over at the next start.
+- **`--allow-scripts=koffi`.** better-sqlite3 13 has no install script, so
+  a manual install with npm 12 is now
+  `npm install -g --allow-scripts=koffi @oar-sh/oar`; the installers, the
+  **Update** button and `oar update` pass it themselves.
+- **No terminal console.** The optional `tty-console` dependency is gone,
+  and neo-blessed with it. A relay started in a terminal prints its log
+  lines, each with its time, as under a service; routine worker lines are
+  no longer held back.
+- **Express 5.** The file routes take express 5's syntax and serve the
+  same paths. Static JavaScript is served as `text/javascript`.
+- `better-sqlite3` 13.0.3 (was 12.11.1); `prebuild-install`, which is no
+  longer maintained, and its subtree are gone. New in the tree:
+  `node-addon-api` 8.9.2, the headers of the source build.
+- `express` 5.3.0 (was 4.22.3), the major the MCP SDK already used: one
+  express instead of two, and array-flatten, mime 1 and the rest of express
+  4's subtree are gone.
+- `@anthropic-ai/claude-agent-sdk` 0.3.319 (was 0.3.304; bundled Claude
+  Code 2.1.319). The key chats (DeepSeek, Claude API) also pin the
+  cloud-sessions token and the two new switches that would let a folder's
+  settings widen which certificates Claude Code trusts.
+- `@cursor/sdk` 1.3.1 (was 1.0.38). Its context-compaction summaries are
+  not shown yet.
+- `@github/copilot-sdk` 1.0.29 (was 1.0.23; bundled Copilot CLI 1.0.107)
+  and `zod` 4.6.7 (was 4.4.3): one zod in the tree, without
+  CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5).
+- `socket.io` 4.8.4 (was 4.8.3) and `ws` 8.22.1 (was 8.21.3). `uuid` is
+  gone: Node's `crypto.randomUUID()` makes the same ids.
+- package.json names its author and its bug tracker.
+
+### Upgrade notes
+
+- **From 0.9.13 or older, copy the data out of the package first.** A relay
+  before 0.9.14 could keep its database, uploads and config inside the
+  package folder, which `npm install -g` deletes, and this version no longer
+  copies them out. Copy `data/`, `uploads/` and `config.json` from the
+  installed package's `server` folder into a new folder under
+  `rescued-package-data` in the data folder (for example
+  `~/.oar/data/rescued-package-data/before-update/`); the first start takes
+  them over. From 0.9.14 on there is nothing to do.
+- **Termux, 32-bit ARM, FreeBSD: the update from 0.9.22 needs
+  `oar build-native` once.** The Update button and `oar update` of 0.9.22
+  install 0.9.23 but do not build the binding, so the relay stops at its
+  first start on 0.9.23: its log names the command, and the page cannot
+  reach the relay. In Termux run:
+
+  ```sh
+  pkg install python clang make
+  oar build-native
+  oar start
+  ```
+
+  Later updates build the binding themselves, before the relay restarts.
+- **Linux needs glibc 2.34 or newer,** for example Debian 12, Ubuntu 22.04
+  or RHEL 9. The SQLite binding better-sqlite3 13 ships for Linux on x64
+  and arm64 needs it, and a binding built with `oar build-native` would not
+  be used there. On an older system a relay that updates to 0.9.23 stays
+  down at its first start and says to update the operating system; stay on
+  0.9.22 until the system is updated.
+- **No migration.** Going back to 0.9.22 needs no database step.
+
 ## [0.9.22] — 2026-11-05
 
 Highlights: questions that don't block move into the chat header. A **📓**

package/README.md

@@ -45,29 +45,29 @@ flowchart LR
 <table>
 <tr>
 <td width="42%" rowspan="4" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.22" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.23" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
 <br><sub>On a phone: the same conversations, installable as an app.</sub>
 </td>
 <td width="58%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.22" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.23" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
 <br><sub>Agents working in parallel, each with live token counts and its own Stop.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.22" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.23" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
 <br><sub>When the agent needs a decision, it asks, and waits for your answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.22" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
+<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.23" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
 <br><sub>Read the reasoning, not just the answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.22" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
+<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.23" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
 <br><sub>Agents that watch agents: woken by events, approving nothing.</sub>
 </td>
 </tr>
@@ -118,11 +118,11 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 <table>
 <tr>
 <td width="62%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.22" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.23" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
 <br><sub>Send a message while the agent works, and it steers the running turn.</sub>
 </td>
 <td width="38%" valign="top">
-<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.22" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
+<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.23" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
 <br><sub>What each plan has left, in one place.</sub>
 </td>
 </tr>
@@ -139,7 +139,7 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 - **Share** a conversation as a read-only link, hide single messages and the host's paths from it, and see when it was opened ([Sharing](docs/web-ui.md#sharing)).
 - **On your phone**: install OAR as an app and get push notifications; back walks through the conversations you opened, a pinch zooms the whole app, and held sideways it keeps a phone's layout ([Notifications and the app](docs/web-ui.md#notifications-and-the-app), [back and forward](docs/web-ui.md#back-and-forward), [zoom](docs/web-ui.md#zoom), [a phone held sideways](docs/web-ui.md#a-phone-held-sideways)).
 
-The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.22](CHANGELOG.md#0922--2026-11-05) as the latest.
+The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.23](CHANGELOG.md#0923--2026-11-07) as the latest.
 
 ## Remote access
 
@@ -190,7 +190,7 @@ flowchart LR
 
 You stay in charge: per paired relay you decide whether agents may only read, also prompt, or do everything, and in the `ask` and `plan` modes every write asks you first. A subscription only notifies; it approves nothing.
 
-<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.22"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.22"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.22" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
+<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.23"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.23"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.23" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
 
 How pairing, permissions and limits work is in [Agents working together](docs/agents-together.md).
 

package/bin/oar.js

@@ -14,6 +14,7 @@ import {
 } from '../server/services/oar-state-migration-service.mjs';
 import { readConfiguredDataDir, resolveDataDir, resolveUploadDir } from '../server/services/data-dir-resolution.mjs';
 import { RESCUE_DIR_NAME, TAKEOVER_PROGRESS_FILE } from '../server/services/earlier-database-service.mjs';
+import { NATIVE_BUILD_COMMAND, buildBetterSqlite3, needsSourceBuild } from '../server/services/native-addon-build-service.mjs';
 import { DB_FILE_NAME, DB_FILE_NAMES, LEGACY_DB_FILE_NAME, resolveDatabaseFile } from '../server/services/database-file.mjs';
 import { BACKUP_PROGRESS_FILE, BACKUP_WAIT_FILE, backupDatabase, configWarnings, describeBackups, sanitizeReason } from '../server/services/db-backup-service.mjs';
 import { defaultIsProcessAlive, lockHolderMayRun, processIdentity } from '../server/services/relay-singleton-guard.mjs';
@@ -2407,6 +2408,15 @@ async function runUpdate({ argv = [], env = process.env, logger = console, fetch
     return { code: 1, reason: 'npm-failed' };
   }
   logger.log(`[oar] Installed @oar-sh/oar@${target}.`);
+  // No prebuilt SQLite binding here: build it before the relay restarts on
+  // the new version (native-addon-build-service.mjs).
+  if (needsSourceBuild()) {
+    const build = await buildBetterSqlite3({ packageRoot, env: npm.env, spawnImpl, logger, onOutput: (text) => process.stdout.write(text) });
+    if (!build.ok) {
+      logger.error(`[oar] The relay keeps running the version it has loaded. Run ${NATIVE_BUILD_COMMAND}, then restart it.`);
+      return { code: 1, reason: 'native-build-failed' };
+    }
+  }
 
   // A running relay picks the new code up on restart; ask for the queue-idle
   // deferred one so no in-flight turn is cut off.
@@ -2446,6 +2456,23 @@ async function runUpdate({ argv = [], env = process.env, logger = console, fetch
   return { code: 0, reason: 'updated' };
 }
 
+/**
+ * `oar build-native [--force]`: the SQLite binding of better-sqlite3 where no
+ * prebuilt one ships (Termux, 32-bit ARM, FreeBSD); elsewhere nothing to do,
+ * so an installer may run it everywhere. `--force` builds anyway, which only
+ * tests the toolchain where a prebuilt binding ships: better-sqlite3 loads
+ * that one first.
+ */
+async function runBuildNative({ argv = [], env = process.env, logger = console, spawnImpl = spawn } = {}) {
+  const force = argv.includes('--force');
+  if (!force && !needsSourceBuild()) {
+    logger.log(`[oar] better-sqlite3 ships a prebuilt SQLite binding for ${process.platform}-${process.arch}; nothing to build.`);
+    return { code: 0, reason: 'prebuilt' };
+  }
+  const result = await buildBetterSqlite3({ packageRoot: resolvePackageRoot(), force, env, spawnImpl, logger, onOutput: (text) => process.stdout.write(text) });
+  return result.ok ? { code: 0, reason: 'built' } : { code: 1, reason: 'build-failed' };
+}
+
 /** `oar` without a command: the menu in a terminal, the status and the usage elsewhere. */
 async function runMenuCommand(options = {}) {
   const ctx = cliContext(options);
@@ -2495,6 +2522,7 @@ const COMMANDS = {
   doctor: runDoctor,
   backup: runBackup,
   update: runUpdate,
+  'build-native': runBuildNative,
   help: async ({ logger = console } = {}) => {
     logger.log(usageText());
     return { code: 0, reason: 'help' };

package/package.json

@@ -1,14 +1,18 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.22",
+  "version": "0.9.23",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",
+  "author": "Simon",
   "homepage": "https://oar.sh",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oar-sh/oar.git"
   },
+  "bugs": {
+    "url": "https://github.com/oar-sh/oar/issues"
+  },
   "engines": {
     "node": ">=22.13"
   },
@@ -41,7 +45,6 @@
     "LICENSE"
   ],
   "scripts": {
-    "preinstall": "node server/services/package-data-rescue-preinstall.mjs",
     "start": "node server/server.js",
     "copilot:relay": "gh copilot -- --allow-all",
     "test": "node --import ./scripts/node-test-keep-alive.mjs --import ./scripts/node-test-worktree-guard.mjs --test \"server/**/*.test.mjs\" \"shared/**/*.test.mjs\" \".github/extensions/web-relay/**/*.test.mjs\" \"scripts/**/*.test.mjs\"",
@@ -55,20 +58,16 @@
     "test:e2e:raw": "node ./node_modules/@playwright/test/cli.js test --config tests/playwright.config.mjs"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.304",
-    "@cursor/sdk": "1.0.38",
-    "@github/copilot-sdk": "1.0.23",
-    "better-sqlite3": "12.11.1",
-    "express": "4.22.3",
+    "@anthropic-ai/claude-agent-sdk": "0.3.319",
+    "@cursor/sdk": "1.3.1",
+    "@github/copilot-sdk": "1.0.29",
+    "better-sqlite3": "13.0.3",
+    "express": "5.3.0",
     "qrcode-terminal": "0.12.0",
-    "socket.io": "4.8.3",
-    "uuid": "14.0.1",
+    "socket.io": "4.8.4",
     "web-push": "3.6.7",
-    "ws": "8.21.3",
-    "zod": "4.4.3"
-  },
-  "optionalDependencies": {
-    "tty-console": "1.0.4"
+    "ws": "8.22.1",
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@playwright/test": "^1.60.0",

package/server/claude-worker/claude-cli-pinned-env.mjs

@@ -22,7 +22,7 @@
  * SSL_CERT_FILE and SSL_CERT_DIR: '' empties OpenSSL's and Node's system
  * store, so those two are pinned only when the worker sets them.
  *
- * Source: the names Claude Code 2.1.304 (the bundled CLI) reads, by a grep
+ * Source: the names Claude Code 2.1.319 (the bundled CLI) reads, by a grep
  * of the binary; the CLI's own lists of endpoints (with their selection
  * switches and companions) and credentials are in it as they are there. A
  * deny-list, because a settings layer can only pin names known in advance.
@@ -82,6 +82,7 @@ export const CLAUDE_CLI_PINNED_ENV = Object.freeze([
   'CLAUDE_CODE_OAUTH_REFRESH_TOKEN',
   'CLAUDE_CODE_OAUTH_SCOPES',
   'CLAUDE_CODE_OAUTH_CLIENT_ID',
+  'CLAUDE_CODE_SESSIONS_OAUTH_TOKEN',
   'ANTHROPIC_PROFILE',
   'ANTHROPIC_IDENTITY_TOKEN',
   'ANTHROPIC_IDENTITY_TOKEN_FILE',
@@ -106,6 +107,8 @@ export const CLAUDE_CLI_PINNED_ENV = Object.freeze([
   'NODE_TLS_REJECT_UNAUTHORIZED',
   'NODE_EXTRA_CA_CERTS',
   'CLAUDE_CODE_CERT_STORE',
+  'CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP',
+  'CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP',
   'CLAUDE_CODE_CLIENT_CERT',
   'CLAUDE_CODE_CLIENT_KEY',
   'CLAUDE_CODE_CLIENT_KEY_PASSPHRASE',

package/server/routes/messages-routes.mjs

@@ -163,6 +163,13 @@ export function shouldRequireNewOpenAIConversation({
   );
 }
 
+// The path a `{*splat}` route matched: express 5 hands it over as its
+// decoded segments, or not at all when the path ends at the slash.
+export function splatPath(req) {
+  const splat = req.params?.splat;
+  return Array.isArray(splat) ? splat.join('/') : String(splat || '');
+}
+
 function normalizeRequestedProviderType(value = '') {
   const normalized = String(value || '').trim().toLowerCase();
   if (normalized === 'openai' || normalized === 'openai-byok' || normalized === 'openai-image') return 'openai';
@@ -2142,8 +2149,6 @@ export function registerMessagesRoutes(app, deps) {
     deepseekClaudeConfigDir = '',
   } = deps;
 
-  const ttyConsoleActive = runtimeState?.ttyConsoleActive === true;
-
   // ─── Sub-agent runs: header, timeline, live events ─────────────────────────
   const subagentTimeline = createSubagentTimelineService({ db, stmts });
 
@@ -2255,18 +2260,6 @@ export function registerMessagesRoutes(app, deps) {
     LIMIT 1
   `);
 
-  function isAbnormalWorkerTelemetry(payload = {}, level = 'log') {
-    const normalizedLevel = String(level || 'log').trim().toLowerCase();
-    if (normalizedLevel === 'warn' || normalizedLevel === 'error') return true;
-    const event = String(payload?.event || '').trim().toLowerCase();
-    const state = String(payload?.state || '').trim().toLowerCase();
-    if (state === 'error') return true;
-    return event.includes('error')
-      || event.includes('failed')
-      || event.includes('failure')
-      || event.includes('blocked');
-  }
-
   function readBridgeIdentity(req) {
     return relayBridgeOwnerService?.normalizeIdentity?.({
       pid: req.headers['x-relay-process-pid'],
@@ -2340,8 +2333,6 @@ export function registerMessagesRoutes(app, deps) {
     const payload = extra && typeof extra === 'object'
       ? { ...envelope, ...extra }
       : envelope;
-    const shouldLog = !ttyConsoleActive || isAbnormalWorkerTelemetry(payload, level);
-    if (!shouldLog) return;
     const method = typeof console[level] === 'function' ? level : 'log';
     console[method](`[${ts()}] WORKER    ${JSON.stringify(payload)}`);
   }
@@ -4021,8 +4012,8 @@ export function registerMessagesRoutes(app, deps) {
     });
   });
 
-  app.get('/api/files/*', auth, (req, res) => {
-    const requestedPath = String(req.params?.[0] || '').trim();
+  app.get('/api/files/{*splat}', auth, (req, res) => {
+    const requestedPath = splatPath(req).trim();
     const rootOverride = resolveScopedWorkspaceRootPath(req);
     const filePath = resolveWorkspaceFilePath(requestedPath, rootOverride);
     if (!filePath) return res.status(400).json({ error: 'Invalid file path' });
@@ -4043,8 +4034,8 @@ export function registerMessagesRoutes(app, deps) {
     });
   });
 
-  app.get('/api/files-preview/*', auth, (req, res) => {
-    const requestedPath = String(req.params?.[0] || '').trim();
+  app.get('/api/files-preview/{*splat}', auth, (req, res) => {
+    const requestedPath = splatPath(req).trim();
     const normalizedPath = normalizeWorkspaceRelativePath(requestedPath);
     const rootOverride = resolveScopedWorkspaceRootPath(req);
     const filePath = resolveWorkspaceFilePath(requestedPath, rootOverride);

package/server/routes/sessions-routes.mjs

@@ -161,7 +161,7 @@ export { mapUsageSnapshotRow };
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SESSION_WORKER_STATUS_QUEUE_STATES = Object.freeze(['pending', 'processing', 'parked']);
 // Registry statuses that mean "this worker is currently running" (same triple
-// as countActiveCliWorkers in server-runtime.mjs).
+// as ACTIVE_SESSION_CWD_STATUSES in server-runtime.mjs).
 const SESSION_WORKER_ACTIVE_STATUSES = Object.freeze(['starting', 'ready', 'processing']);
 // A shared attachment's URL names its bytes (sha256 or a fixed generated-image
 // path), so a kept answer stays right.

package/server/server-runtime.mjs

@@ -4,7 +4,7 @@ import express from 'express';
 import http from 'http';
 import { Server } from 'socket.io';
 import { WebSocketServer } from 'ws';
-import { v4 as uuidv4 } from 'uuid';
+import { randomUUID as uuidv4 } from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { execFile, execFileSync, spawn } from 'child_process';
@@ -25,7 +25,7 @@ import {
 } from './services/workspace-root-path-policy.mjs';
 import { stopSessionWorkerProcesses } from './services/session-worker-stop-service.mjs';
 import { createDetachedWorkerWatch } from './services/detached-worker-watch-service.mjs';
-import { applyCdnNoStoreHeaders } from './services/file-serving.mjs';
+import { applyCdnNoStoreHeaders, sendOwnFile } from './services/file-serving.mjs';
 import { pickLiveTurnRowId } from './services/live-turn-picker.mjs';
 import { buildSteerSettleFailure, steerAgentLabelForProvider } from '../shared/steer-settle-failure.mjs';
 import { PLAN_BOARD_APPROVE_ONLY, planBoardShownActions } from '../shared/plan-board-actions.mjs';
@@ -196,8 +196,8 @@ import {
   resolveDefaultSessionWorkspaceRootState as resolveDefaultSessionWorkspaceRootStateFromService,
   resolveLaunchWorkspaceRootPath,
 } from './services/workspace-root-defaults-service.mjs';
-import { maybeStartTtyConsole } from './tty-console-bootstrap.mjs';
 import { installRelayConsoleLog, resolveRelayConsoleLogPath } from './services/relay-console-log.mjs';
+import { isMissingSqliteBindingError, missingSqliteBindingLines } from './services/native-addon-build-service.mjs';
 import {
   computeFeatureFlagState,
   FEATURE_REGISTRY,
@@ -327,13 +327,15 @@ const PWA_VERSION_PLACEHOLDER = /const __PWA_VERSION = '[^']*';/;
 // after a restart or an incident.
 const relayConsoleLogPath = resolveRelayConsoleLogPath({ env: process.env, serverDir: __dirname });
 const relayConsoleLog = installRelayConsoleLog({ logPath: relayConsoleLogPath });
-const ttyConsoleRuntime = await maybeStartTtyConsole({
-  serverDir: __dirname,
-  logsDir: path.join(__dirname, 'logs'),
-  logger: console,
-});
-// The terminal console takes the console's methods over when it starts.
-relayConsoleLog?.rewrap();
+// Where better-sqlite3 ships no binary (Termux, 32-bit ARM) the binding is
+// built by `oar build-native`; until then say so instead of a stack trace.
+try {
+  new Database(':memory:').close();
+} catch (error) {
+  if (!isMissingSqliteBindingError(error)) throw error;
+  for (const line of missingSqliteBindingLines({ error })) console.error(`[startup] ${line}`);
+  process.exit(1);
+}
 // TEMP and TMP for this relay and everything it starts (normalizeTempEnv).
 for (const change of normalizeTempEnv()) console.log(`[startup] ${change} (quotes taken off, or the folder is not there)`);
 
@@ -2112,7 +2114,6 @@ function workspaceRootPayload() {
 }
 
 const ACTIVE_SESSION_CWD_STATUSES = new Set(['starting', 'ready', 'processing']);
-const ACTIVE_TTY_CLI_WORKER_STATUSES = new Set(['starting', 'ready', 'processing']);
 
 function normalizeConversationWorkspaceRootPath(candidatePath) {
   const normalized = normalizeWorkspaceRootPath(candidatePath);
@@ -3760,27 +3761,6 @@ function queueCounts() {
   return { pendingCount: map.pending || 0, processingCount: map.processing || 0, parkedCount: map.parked || 0 };
 }
 
-function countActiveCliWorkers() {
-  const workers = sessionWorkerRegistry?.listWorkers?.() || [];
-  return workers.reduce((acc, worker) => {
-    const status = String(worker?.status || '').trim().toLowerCase();
-    return ACTIVE_TTY_CLI_WORKER_STATUSES.has(status) ? acc + 1 : acc;
-  }, 0);
-}
-
-function attachTtyConsoleRuntimeTitle(runtime) {
-  const addConsoleTitle = runtime?.tty?.addConsoleTitle;
-  if (typeof addConsoleTitle !== 'function') return;
-  addConsoleTitle(() => {
-    const counts = queueCounts();
-    const connectedClients = Number(io?.sockets?.sockets?.size || 0);
-    const activeCliWorkers = countActiveCliWorkers();
-    const cliState = cliOnline ? 'online' : 'offline';
-    return `Clients: ${connectedClients} :: Pen: ${counts.pendingCount} :: Proc: ${counts.processingCount} :: parked: ${counts.parkedCount} :: CLIs: ${activeCliWorkers} :: CLI: ${cliState}`;
-  });
-}
-attachTtyConsoleRuntimeTitle(ttyConsoleRuntime);
-
 // ─── Queued relay restart / shutdown ─────────────────────────────────────────
 // A request waits until no turn is processing and holds new turns meanwhile
 // (services/relay-shutdown-gate.mjs); past the maximum wait it asks instead
@@ -7430,6 +7410,12 @@ app.use(tunnelWorkerPathGuard.requestMiddleware);
 // Uploads travel as raw bodies on POST /api/upload (express.raw, capped by
 // MAX_UPLOAD_BYTES), so the JSON limit only bounds inline image data URLs.
 app.use(express.json({ limit: '20mb' }));
+// Express 5 leaves req.body undefined when no parser read a body (a GET, a
+// POST without a JSON body); the routes read it as express 4 gave it, {}.
+app.use((req, _res, next) => {
+  if (req.body === undefined) req.body = {};
+  next();
+});
 app.use((req, _res, next) => {
   stripRequestPathPrefix(req, remotePath);
   next();
@@ -7461,9 +7447,7 @@ app.use((req, res, next) => {
 });
 app.get('/socket.io/socket.io.js', (req, res, next) => {
   res.setHeader('Cache-Control', 'no-store');
-  res.sendFile(SOCKET_IO_CLIENT_JS_PATH, (error) => {
-    if (error) next(error);
-  });
+  sendOwnFile(res, SOCKET_IO_CLIENT_JS_PATH, next);
 });
 app.get('/manifest.webmanifest', (req, res, next) => {
   try {
@@ -7477,9 +7461,7 @@ app.get('/manifest.webmanifest', (req, res, next) => {
 });
 app.get('/sw.js', (req, res, next) => {
   res.setHeader('Cache-Control', 'no-store');
-  res.sendFile(PWA_SW_PATH, (error) => {
-    if (error) next(error);
-  });
+  sendOwnFile(res, PWA_SW_PATH, next);
 });
 app.get(['/', '/index.html'], (req, res, next) => {
   try {
@@ -7554,7 +7536,6 @@ const runtimeState = {
     // Resumed: what was queued while paused goes out now.
     if (wasPaused && !relayPaused) wakeSessionWorkerQueue('relay-resumed');
   },
-  get ttyConsoleActive() { return Boolean(ttyConsoleRuntime?.tty); },
   get relayShutdown() { return relayRestartQueue.getState(); },
   // A shutdown or restart waits for the processing turns: no pending row
   // goes out meanwhile (services/relay-restart-queue.mjs).
@@ -8219,7 +8200,7 @@ if (runtimeBindingsBootstrapped > 0) {
 
 function ts() { return new Date().toISOString().slice(11, 23); }
 function runtimeLogPrefix() {
-  return ttyConsoleRuntime?.tty ? '' : `[${ts()}] `;
+  return `[${ts()}] `;
 }
 
 // ─── Auth Middleware ──────────────────────────────────────────────────────────

package/server/services/earlier-database-service.mjs

@@ -12,7 +12,7 @@ import { resolveStateLayout } from './oar-state-layout.mjs';
 import { defaultIsProcessAlive, lockHolderMayRun, processStartedAt as defaultProcessStartedAt } from './relay-singleton-guard.mjs';
 
 const SHA256_NAME = /^[a-f0-9]{64}$/;
-// The install-time rescue's copies (package-data-rescue.mjs), in the data folder.
+// The copies the install-time rescue of 0.9.14 to 0.9.22 made, in the data folder.
 export const RESCUE_DIR_NAME = 'rescued-package-data';
 // What was looked at already: never offered again unless it changed.
 export const CHECKED_FILE = 'earlier-databases.json';

package/server/services/file-serving.mjs

@@ -60,6 +60,19 @@ export function withFileVersion(url, version) {
   return appendUrlParam(String(url || ''), 'v', String(version || ''));
 }
 
+/**
+ * One of the relay's own files (sw.js, the socket.io client) through
+ * res.sendFile, rooted at its folder. Given a bare absolute path, express 5's
+ * send refuses any path with a dot folder in it (dotfiles 'ignore' looks at
+ * every segment without a root): a 404 for an install under ~/.oar, nvm or
+ * ~/.npm-global. With the folder as root only the file name is looked at.
+ */
+export function sendOwnFile(res, absolutePath, next) {
+  res.sendFile(path.basename(absolutePath), { root: path.dirname(absolutePath) }, (error) => {
+    if (error) next(error);
+  });
+}
+
 /**
  * `cacheControl` replaces the no-store default for content whose URL names
  * its bytes (an upload addressed by its hash): such an answer may be kept.

package/server/services/native-addon-build-service.mjs

@@ -0,0 +1,224 @@
+/**
+ * better-sqlite3 13 ships its binary for linux (glibc and musl), darwin and
+ * win32 on x64 and arm64, and runs no install script. Anywhere else (Android
+ * under Termux, 32-bit ARM, FreeBSD) the first database open finds no binary
+ * and throws: the binding has to be compiled from the sources the package
+ * ships. OAR runs that build itself, after an update (the Update button,
+ * `oar update`) and as `oar build-native`, never as an install script of its
+ * own package: one would bring back the install-script warning every package
+ * scanner shows for OAR, and npm 12 skips it unless the user allows it.
+ *
+ * The build is node-gyp's, the one npm bundles (npx's as the fallback), in the
+ * package's own folder with `--force_build=1`, as the package's
+ * `build-release` script runs it. It needs Python 3, make and a C++ compiler.
+ */
+import { spawn as defaultSpawn } from 'child_process';
+import fs from 'fs';
+import { createRequire } from 'module';
+import path from 'path';
+
+import { killTree, runToCompletion, tailOf } from './cli-process-runner.mjs';
+
+export const BETTER_SQLITE3_PREBUILD_PLATFORMS = Object.freeze(['linux', 'darwin', 'win32']);
+export const BETTER_SQLITE3_PREBUILD_ARCHS = Object.freeze(['x64', 'arm64']);
+export const NATIVE_BUILD_COMMAND = 'oar build-native';
+// sqlite3.c is one large file: a phone takes minutes for it.
+export const NATIVE_BUILD_TIMEOUT_MS = 30 * 60_000;
+export const TERMUX_BUILD_TOOLS = 'pkg install python clang make';
+
+const BINDING_FILE = path.join('build', 'Release', 'better_sqlite3.node');
+
+/** True where better-sqlite3 has no prebuilt binary and must be compiled. */
+export function needsSourceBuild({ platform = process.platform, arch = process.arch } = {}) {
+  return !(BETTER_SQLITE3_PREBUILD_PLATFORMS.includes(platform) && BETTER_SQLITE3_PREBUILD_ARCHS.includes(arch));
+}
+
+/** The folder of the better-sqlite3 this package loads, or null. */
+export function resolveBetterSqlite3Dir({ packageRoot, requireFrom = createRequire } = {}) {
+  try {
+    const require = requireFrom(path.join(path.resolve(String(packageRoot || '.')), 'package.json'));
+    return path.dirname(require.resolve('better-sqlite3/package.json'));
+  } catch {
+    return null;
+  }
+}
+
+/** The error better-sqlite3 throws when it finds neither a prebuilt nor a built binary. */
+export function isMissingSqliteBindingError(error) {
+  const code = String(error?.code || '');
+  return (code === 'MODULE_NOT_FOUND' || code === 'ERR_DLOPEN_FAILED')
+    && /better_sqlite3\.node|better-sqlite3[\\/]prebuilds[\\/][^\\/]+\.node/.test(String(error?.message || ''));
+}
+
+/**
+ * The lines a relay prints, instead of a stack trace, when it cannot open a
+ * database because the binding is missing.
+ */
+export function missingSqliteBindingLines({ platform = process.platform, arch = process.arch, error = null } = {}) {
+  const target = `${platform}-${arch}`;
+  if (!needsSourceBuild({ platform, arch })) {
+    // There, but not loadable on this system. better-sqlite3 loads its
+    // prebuilt binding before a built one, so no build here would be used.
+    if (String(error?.code || '') === 'ERR_DLOPEN_FAILED') {
+      return [
+        `The SQLite binding that better-sqlite3 ships for ${target} does not load on this system (${String(error?.message || '').split('\n')[0]}).`,
+        'Its C library is too old for it, or the system is not one the binding supports.',
+        'Update the operating system, or run the relay on a supported one.',
+      ];
+    }
+    return [
+      `The SQLite binding of better-sqlite3 for ${target} is missing from the installed package (${String(error?.message || '').split('\n')[0]}).`,
+      'Reinstall OAR: npm install -g @oar-sh/oar',
+    ];
+  }
+  return [
+    `better-sqlite3 has no prebuilt SQLite binding for ${target}, and it has not been built here yet.`,
+    `Build it with: ${NATIVE_BUILD_COMMAND}`,
+    platform === 'android'
+      ? `It needs Python 3, make and a C++ compiler: ${TERMUX_BUILD_TOOLS}`
+      : 'It needs Python 3, make and a C++ compiler.',
+  ];
+}
+
+// The node-gyp that ships inside npm, beside this Node; null when there is none.
+function bundledNodeGyp({ execPath, platform, existsImpl, realpathImpl }) {
+  const pathImpl = platform === 'win32' ? path.win32 : path.posix;
+  const nodeDir = pathImpl.dirname(String(execPath || ''));
+  const npmRoots = [];
+  if (platform !== 'win32') {
+    // <prefix>/bin/npm is a link to <prefix>/lib/node_modules/npm/bin/npm-cli.js.
+    try { npmRoots.push(pathImpl.dirname(pathImpl.dirname(realpathImpl(pathImpl.join(nodeDir, 'npm'))))); } catch {}
+    npmRoots.push(pathImpl.join(nodeDir, '..', 'lib', 'node_modules', 'npm'));
+  } else {
+    npmRoots.push(pathImpl.join(nodeDir, 'node_modules', 'npm'));
+  }
+  for (const root of npmRoots) {
+    const file = pathImpl.join(root, 'node_modules', 'node-gyp', 'bin', 'node-gyp.js');
+    if (existsImpl(file)) return file;
+  }
+  return null;
+}
+
+/**
+ * How to run node-gyp: npm's own (npm_config_node_gyp when npm set it), else
+ * `npx --yes node-gyp`. Returns { command, args, env }.
+ */
+export function resolveNodeGypInvocation({
+  execPath = process.execPath,
+  platform = process.platform,
+  env = process.env,
+  existsImpl = fs.existsSync,
+  realpathImpl = fs.realpathSync,
+} = {}) {
+  const pathImpl = platform === 'win32' ? path.win32 : path.posix;
+  const nodeDir = pathImpl.dirname(String(execPath || ''));
+  const separator = platform === 'win32' ? ';' : ':';
+  const pathKey = Object.keys(env || {}).find((key) => key.toUpperCase() === 'PATH') || 'PATH';
+  // node-gyp runs `node` from the gyp files: this Node first on its PATH.
+  const childEnv = { ...env, [pathKey]: [nodeDir, String(env?.[pathKey] || '')].filter(Boolean).join(separator) };
+  // Node for Termux has no android_ndk_path in its common.gypi, which gyp
+  // then refuses as undefined; an empty one builds with Termux's own clang.
+  if (platform === 'android' && !/\bandroid_ndk_path=/.test(String(env?.GYP_DEFINES || ''))) {
+    childEnv.GYP_DEFINES = [String(env?.GYP_DEFINES || '').trim(), "android_ndk_path=''"].filter(Boolean).join(' ');
+  }
+  const fromNpm = String(env?.npm_config_node_gyp || '').trim();
+  const gyp = (fromNpm && existsImpl(fromNpm) ? fromNpm : null) || bundledNodeGyp({ execPath, platform, existsImpl, realpathImpl });
+  if (gyp) return { command: execPath, args: [gyp], env: childEnv };
+  if (platform === 'win32') {
+    // npx.cmd runs through a shell, which splits a path with a space in it
+    // (C:\Program Files): this Node with npm's npx-cli.js, else npx.cmd by name.
+    const npxCli = pathImpl.join(nodeDir, 'node_modules', 'npm', 'bin', 'npx-cli.js');
+    if (existsImpl(npxCli)) return { command: execPath, args: [npxCli, '--yes', 'node-gyp'], env: childEnv };
+    return { command: 'npx.cmd', args: ['--yes', 'node-gyp'], env: childEnv };
+  }
+  const npx = pathImpl.join(nodeDir, 'npx');
+  return { command: existsImpl(npx) ? npx : 'npx', args: ['--yes', 'node-gyp'], env: childEnv };
+}
+
+// What a failed build's output says is missing, as one line to act on.
+function missingToolHint(output, platform) {
+  const text = String(output || '');
+  const missing = /find Python|Could not find any Python|python3?: (?:not found|command not found)/i.test(text)
+    || /make: (?:not found|command not found)|not found: make|spawn make ENOENT/i.test(text)
+    || /(?:c\+\+|g\+\+|clang\+\+|cc|clang): (?:not found|command not found)|No such file or directory.*(?:c\+\+|g\+\+|clang)/i.test(text);
+  if (!missing) return null;
+  return platform === 'android'
+    ? `Install the build tools first: ${TERMUX_BUILD_TOOLS}, then run ${NATIVE_BUILD_COMMAND} again.`
+    : `Install Python 3, make and a C++ compiler (build-essential on Debian and Ubuntu), then run ${NATIVE_BUILD_COMMAND} again.`;
+}
+
+// Opens a database in a child Node with the binding just built, named by its
+// path: the default loader would take a prebuilt one first where one ships.
+function bindingLoads({ dir, execPath, spawnImpl, env }) {
+  const binding = path.join(dir, BINDING_FILE);
+  const script = `const Database = require(${JSON.stringify(dir)}); new Database(':memory:', { nativeBinding: ${JSON.stringify(binding)} }).close();`;
+  return runToCompletion(
+    () => spawnImpl(execPath, ['-e', script], { stdio: ['ignore', 'pipe', 'pipe'], env, windowsHide: true }),
+    { timeoutMs: 60_000 },
+  );
+}
+
+/**
+ * Builds the binding when this platform has no prebuilt one. `force` builds
+ * where one ships too, to check the toolchain; better-sqlite3 still loads its
+ * prebuilt binding first there. Resolves (never rejects) with { ok, status, error?, hint? }:
+ * status 'prebuilt' (nothing to do), 'built', 'failed'. Every line of the
+ * build goes to `onOutput`; what it says about itself goes to `logger.log`.
+ */
+export async function buildBetterSqlite3({
+  packageRoot,
+  force = false,
+  platform = process.platform,
+  arch = process.arch,
+  execPath = process.execPath,
+  env = process.env,
+  spawnImpl = defaultSpawn,
+  existsImpl = fs.existsSync,
+  realpathImpl = fs.realpathSync,
+  requireFrom = createRequire,
+  timeoutMs = NATIVE_BUILD_TIMEOUT_MS,
+  onOutput = null,
+  onChild = null,
+  logger = console,
+} = {}) {
+  if (!force && !needsSourceBuild({ platform, arch })) return { ok: true, status: 'prebuilt' };
+  const dir = resolveBetterSqlite3Dir({ packageRoot, requireFrom });
+  if (!dir) {
+    const error = `better-sqlite3 is not installed under ${packageRoot}`;
+    logger.error?.(`[oar] ${error}.`);
+    return { ok: false, status: 'failed', error };
+  }
+  const gyp = resolveNodeGypInvocation({ execPath, platform, env, existsImpl, realpathImpl });
+  const args = [...gyp.args, 'rebuild', '--release', '--force_build=1'];
+  logger.log?.(`[oar] Building the SQLite binding of better-sqlite3 for ${platform}-${arch} in ${dir}; this takes a few minutes.`);
+  const result = await runToCompletion(
+    () => spawnImpl(gyp.command, args, {
+      cwd: dir,
+      env: gyp.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...(platform === 'win32' ? { windowsHide: true, shell: /\.cmd$/i.test(gyp.command) } : { detached: true }),
+    }),
+    {
+      timeoutMs,
+      killChild: (child, signal) => killTree(child, signal, { platform }),
+      onChild,
+      onOutput,
+    },
+  );
+  if (!result.ok || !existsImpl(path.join(dir, BINDING_FILE))) {
+    const error = result.error || `node-gyp exited with code ${result.code}`;
+    const hint = missingToolHint(result.output, platform);
+    logger.error?.(`[oar] The build of the SQLite binding failed: ${error}.`);
+    if (hint) logger.error?.(`[oar] ${hint}`);
+    else logger.error?.(`[oar] The end of its output:\n${tailOf(result.output, 2_000)}`);
+    return { ok: false, status: 'failed', error, ...(hint ? { hint } : {}) };
+  }
+  const check = await bindingLoads({ dir, execPath, spawnImpl, env: gyp.env });
+  if (!check.ok) {
+    const error = `the built binding does not load: ${tailOf(check.output || check.error || '', 500).trim()}`;
+    logger.error?.(`[oar] ${error}`);
+    return { ok: false, status: 'failed', error };
+  }
+  logger.log?.('[oar] The SQLite binding is built.');
+  return { ok: true, status: 'built' };
+}

package/server/services/oar-cli-helpers.mjs

@@ -86,6 +86,7 @@ const CLI_COMMANDS = {
   autostart: { words: ['signin', 'boot', 'off', 'status'], flags: ['--replace'] },
   uninstall: { flags: ['--purge'] },
   update: { flags: ['--beta'], values: ['--to'] },
+  'build-native': { flags: ['--force'] },
   copilot: { flags: ['--install-extension', '--no-install-extension'], values: ['--port', '--migrate-from'], forwards: true },
 };
 
@@ -116,6 +117,9 @@ export function usageText() {
     '  oar backup [--reason <text>]',
     '                         A copy of the database into the backup folder (safe while the relay runs)',
     '  oar update [--beta] [--to <version>]',
+    '  oar build-native [--force]',
+    '                         Build the SQLite binding where no prebuilt one ships (Termux, 32-bit ARM);',
+    '                         --force builds where one ships too, which only tests the build tools',
     '  oar help               This text',
     '  oar --version',
   ].join('\n');
@@ -401,11 +405,10 @@ export function buildServicePath({ nodeBin, envPath = '', homeDir = '' } = {}) {
  * native binary). npm 12 runs no install script it was not told to allow, and
  * a global install has no package.json of its own to say so; npm 10 and 11
  * accept the flag and run the scripts as before. `npm-install-scripts.test.mjs`
- * holds this list to the lockfile.
+ * holds this list to the lockfile. better-sqlite3 13 has no install script:
+ * where it ships no binary, OAR builds it (native-addon-build-service.mjs).
  */
-// @oar-sh/oar itself: its preinstall copies the data an earlier version
-// kept inside the package before npm deletes it (package-data-rescue.mjs).
-export const NPM_INSTALL_SCRIPT_PACKAGES = Object.freeze(['@oar-sh/oar', 'better-sqlite3', 'koffi']);
+export const NPM_INSTALL_SCRIPT_PACKAGES = Object.freeze(['koffi']);
 export const NPM_ALLOW_SCRIPTS_ARG = `--allow-scripts=${NPM_INSTALL_SCRIPT_PACKAGES.join(',')}`;
 
 /**

package/server/services/relay-console-log.mjs

@@ -8,9 +8,8 @@
 // read, so the runtime copies it into `<log dir>/relay-console.log`, with a
 // time stamp per line and a size limit.
 //
-// The copy is taken from the console's methods rather than from stdout: the
-// terminal console (tty-console) redraws its prompt on stdout, and none of
-// that belongs in a log.
+// The copy is taken from the console's methods rather than from stdout, so
+// what a library writes to stdout directly stays out of it.
 
 import fs from 'fs';
 import path from 'path';

package/server/services/remote-relay-loopback.mjs

@@ -100,10 +100,10 @@ export function createRemoteRelayLoopbackClient({
       req.httpVersionMinor = 1;
       req.httpVersion = '1.1';
       if (hasBody) {
-        // What the wire would deliver: JSON, parsed. `_body` tells the JSON
-        // body parser the body is already there.
+        // What the wire would deliver: JSON, parsed. The headers carry no
+        // content-length or transfer-encoding, so the JSON body parser finds
+        // no body to read and leaves this one in place.
         req.body = JSON.parse(JSON.stringify(body));
-        req._body = true;
       }
       req.complete = true;
       req.push(null);

package/server/services/sdk-session-sync-service.mjs

@@ -1,6 +1,6 @@
 'use strict';
 
-import { v4 as uuidv4 } from 'uuid';
+import { randomUUID as uuidv4 } from 'crypto';
 
 function normalizeId(value) {
   return String(value || '').trim();

package/server/services/update-install-service.mjs

@@ -11,6 +11,7 @@ import {
   stripTerminalEscapes,
   tailOf,
 } from './cli-process-runner.mjs';
+import { NATIVE_BUILD_COMMAND, buildBetterSqlite3, needsSourceBuild } from './native-addon-build-service.mjs';
 import { NPM_ALLOW_SCRIPTS_ARG, resolveNpmInvocation } from './oar-cli-helpers.mjs';
 import { compareSemverIsh, parseSemverIsh } from '../../shared/update-semver.mjs';
 
@@ -107,6 +108,8 @@ export function createUpdateInstallService({
   spawnImpl = defaultSpawn,
   env = process.env,
   platform = process.platform,
+  arch = process.arch,
+  buildNativeAddons = buildBetterSqlite3,
   setTimeoutImpl = setTimeout,
   clearTimeoutImpl = clearTimeout,
   nowImpl = Date.now,
@@ -242,15 +245,43 @@ export function createUpdateInstallService({
     );
     activeChild = null;
     flushLogNow();
-    finishedAt = new Date(nowImpl()).toISOString();
 
     if (!result.ok) {
+      finishedAt = new Date(nowImpl()).toISOString();
       state = UPDATE_INSTALL_STATES.ERROR;
       lastError = result.error || `npm exited with code ${result.code}`;
       broadcast();
       return { ok: false, statusCode: 500, error: lastError };
     }
 
+    // No prebuilt SQLite binding here: build it before the restart, which
+    // would start on none (native-addon-build-service.mjs). A failed build
+    // keeps this relay running on the binding it has loaded.
+    if (needsSourceBuild({ platform, arch })) {
+      const toLog = (line) => appendLog(`${line}\n`);
+      const build = await buildNativeAddons({
+        packageRoot,
+        platform,
+        arch,
+        execPath,
+        env: npm.env,
+        spawnImpl,
+        onOutput: (text) => appendLog(text),
+        onChild: (child) => { activeChild = child; },
+        logger: { log: toLog, error: toLog },
+      });
+      activeChild = null;
+      flushLogNow();
+      if (!build.ok) {
+        finishedAt = new Date(nowImpl()).toISOString();
+        state = UPDATE_INSTALL_STATES.ERROR;
+        lastError = `${UPDATE_PACKAGE_NAME}@${target} is installed, but its SQLite binding did not build (${build.error}). Run ${NATIVE_BUILD_COMMAND}, then restart the relay.`;
+        broadcast();
+        return { ok: false, statusCode: 500, error: lastError };
+      }
+    }
+    finishedAt = new Date(nowImpl()).toISOString();
+
     // Persist the attempt BEFORE the restart request: the next boot compares
     // the running version against it and turns "nothing changed" into a
     // visible failure carrying this log tail.

package/server/services/package-data-rescue-preinstall.mjs

@@ -1,22 +0,0 @@
-/**
- * The `preinstall` of @oar-sh/oar. Nothing of OAR loads before the `try`:
- * a module of this package that cannot load (a broken file, a missing one)
- * must not fail the install on any platform. Only a copy of an old
- * database that failed (RescueCopyError) exits 1, so npm stops the update
- * and puts the old package, data and all, back in place; anything else is
- * one line and exit 0, as this script only ever copies. See
- * package-data-rescue.mjs.
- */
-import { fileURLToPath } from 'node:url';
-
-try {
-  const { rescuePackageData } = await import('./package-data-rescue.mjs');
-  rescuePackageData({ packageRoot: fileURLToPath(new URL('../..', import.meta.url)) });
-} catch (error) {
-  if (error?.rescueCopyFailed === true) {
-    console.error(`[oar] ${error.message}`);
-    process.exitCode = 1;
-  } else {
-    console.error(`[oar] Did not copy the data of the version being replaced: ${error?.message || error}`);
-  }
-}

package/server/services/package-data-rescue.mjs

@@ -1,139 +0,0 @@
-/**
- * The preinstall's work (package-data-rescue-preinstall.mjs), on every
- * platform. Relays before 0.9.14 could run on the database and uploads
- * inside the package (Windows autostart, a plain `gh copilot`), and
- * `npm i -g` deletes the old package. While install scripts run, npm keeps
- * it as its retired folder (npmRetiredPath; a scan for npm-shaped names only
- * when that is missing): its database (-wal, -shm), Cursor stores, uploads
- * and config.json are copied, copy only, to
- * `<data folder>/rescued-package-data/<time>/` (written as `.partial`, then
- * renamed), and the relay takes them over at its next start. Any of them
- * makes the old package a source (its uploads beyond the README.md and
- * image_input.md it ships). Nothing to copy, or not an installed package:
- * nothing happens, nothing is printed. A failed copy throws
- * RescueCopyError: exit 1, npm puts the old package back. npm hides a successful script's output, hence the README.txt.
- */
-import crypto from 'crypto';
-import fs from 'fs';
-import path from 'path';
-
-import { DB_FILE_NAMES, sideFiles } from './database-file.mjs';
-import { RESCUE_DIR_NAME, copyMissing, isRetiredName } from './earlier-database-service.mjs';
-import { resolveRelayStateDirs, resolveStateLayout } from './oar-state-layout.mjs';
-
-// Old packages only ever held the name before 0.9.20; a later one may hold oar.db.
-const DB_FILES = DB_FILE_NAMES.flatMap(sideFiles);
-
-// What a relay left in a package's server folder; a folder that cannot be
-// read throws (no copy failure: nothing was detected yet).
-function hasRelayData(fsImpl, serverDir) {
-  const has = (...parts) => fsImpl.existsSync(path.join(serverDir, ...parts));
-  const anyUpload = (...parts) => has(...parts) && fsImpl.readdirSync(path.join(serverDir, ...parts)).some((name) => /^[a-f0-9]{64}$/.test(name));
-  return DB_FILE_NAMES.some((name) => has('data', name)) || has('data', 'cursor-agents') || has('config.json') || anyUpload('uploads') || anyUpload('data', 'uploads');
-}
-
-/** Where npm's reify moves a package it replaces (@npmcli/arborist retire-path.js). */
-export function npmRetiredPath(packageDir) {
-  const hash = crypto.createHash('sha1').update(packageDir).digest('base64').replace(/[^a-zA-Z0-9]+/g, '').slice(0, 8);
-  return path.resolve(path.dirname(packageDir), `.${path.basename(packageDir)}-${hash}`);
-}
-
-/** A copy of an old database failed: the one error that stops the install. */
-export class RescueCopyError extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = 'RescueCopyError';
-    this.rescueCopyFailed = true;
-  }
-}
-
-/**
- * Returns { status: 'not-installed' | 'nothing' | 'rescued', rescued: [{ from,
- * to }] }; throws a RescueCopyError, naming what to save, when a copy fails.
- */
-export function rescuePackageData({
-  packageRoot,
-  env = process.env,
-  platform = process.platform,
-  now = () => new Date(),
-  fsImpl = fs,
-  logger = console,
-} = {}) {
-  const resolvedRoot = path.resolve(String(packageRoot || ''));
-  const scope = path.dirname(resolvedRoot);
-  if (path.basename(scope) !== '@oar-sh' || path.basename(path.dirname(scope)) !== 'node_modules') {
-    return { status: 'not-installed', rescued: [] };
-  }
-  // Detection: npm's retired name, else a scan for npm-shaped names (a path
-  // in another case hashes differently). Failing here is no copy failure.
-  let sources;
-  try {
-    const exact = npmRetiredPath(resolvedRoot);
-    const retired = fsImpl.existsSync(exact)
-      ? [exact]
-      : fsImpl.readdirSync(scope).filter((name) => isRetiredName(name, path.basename(resolvedRoot))).map((name) => path.join(scope, name));
-    sources = retired.filter((dir) => hasRelayData(fsImpl, path.join(dir, 'server')));
-  } catch (error) {
-    throw new Error(`Could not look for the data of the version being replaced: ${error?.message || error}`, { cause: error });
-  }
-  if (!sources.length) return { status: 'nothing', rescued: [] };
-
-  // Old data is there: any failure from here stops the install.
-  const exists = (file) => fsImpl.existsSync(file);
-  const kept = path.join(resolvedRoot, 'server');
-  const copyFailed = (from, to, error) => new RescueCopyError(
-    `Could not copy the data of the version being replaced (${from}) to ${to}: ${error?.message || error}. `
-    + `The update stops and the version installed stays as it is; copy ${path.join(kept, 'data')} and ${path.join(kept, 'uploads')} somewhere safe by hand, then update again.`,
-    { cause: error },
-  );
-  let rescueRoot;
-  try {
-    const layout = resolveStateLayout({ packageRoot: resolvedRoot, env, platform });
-    rescueRoot = path.join(resolveRelayStateDirs({ packageRoot: resolvedRoot, env, platform, layout }).dataDir, RESCUE_DIR_NAME);
-  } catch (error) {
-    throw copyFailed(path.join(sources[0], 'server'), 'the OAR data folder', error);
-  }
-  const stamp = now().toISOString().replace(/[:.]/g, '-');
-  const rescued = [];
-  for (const [index, source] of sources.entries()) {
-    const serverDir = path.join(source, 'server');
-    let target = path.join(rescueRoot, sources.length > 1 ? `${stamp}-${index}` : stamp);
-    // Written under a .partial name and renamed when complete: a half copy
-    // is never taken for a rescue.
-    try {
-      for (let n = 1; exists(target) || exists(`${target}.partial`); n += 1) target = `${path.join(rescueRoot, stamp)}-${n}`;
-      const partial = `${target}.partial`;
-      fsImpl.mkdirSync(rescueRoot, { recursive: true });
-      fsImpl.mkdirSync(partial);
-      fsImpl.mkdirSync(path.join(partial, 'data'));
-      for (const name of DB_FILES) {
-        const from = path.join(serverDir, 'data', name);
-        if (exists(from)) fsImpl.copyFileSync(from, path.join(partial, 'data', name), fs.constants.COPYFILE_EXCL);
-      }
-      if (exists(path.join(serverDir, 'data', 'cursor-agents'))) {
-        copyMissing(fsImpl, path.join(serverDir, 'data', 'cursor-agents'), path.join(partial, 'data', 'cursor-agents'));
-      }
-      // Uploads of server/uploads and server/data/uploads, content-addressed.
-      for (const uploads of [path.join(serverDir, 'uploads'), path.join(serverDir, 'data', 'uploads')]) {
-        if (exists(uploads)) copyMissing(fsImpl, uploads, path.join(partial, 'uploads'));
-      }
-      if (exists(path.join(serverDir, 'config.json'))) {
-        fsImpl.copyFileSync(path.join(serverDir, 'config.json'), path.join(partial, 'config.json'), fs.constants.COPYFILE_EXCL);
-      }
-      fsImpl.writeFileSync(path.join(partial, 'README.txt'), [
-        `Copied by the @oar-sh/oar update on ${now().toISOString()} from`,
-        `${serverDir}`,
-        'before npm deleted the version it replaced. The relay takes the',
-        'database in data\\ over at its next start if it is newer than the',
-        'one it has. Nothing here is deleted by OAR.',
-        '',
-      ].join('\r\n'));
-      fsImpl.renameSync(partial, target);
-    } catch (error) {
-      throw copyFailed(serverDir, target, error);
-    }
-    rescued.push({ from: serverDir, to: target });
-    logger.log?.(`[oar] Copied the data of the version being replaced from ${serverDir} to ${target}; the relay takes it over at its next start.`);
-  }
-  return { status: 'rescued', rescued };
-}

package/server/tty-console-bootstrap.mjs

@@ -1,75 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { createRequire } from 'module';
-
-function existingDirectories(paths = []) {
-  const out = [];
-  for (const candidate of paths) {
-    const normalized = String(candidate || '').trim();
-    if (!normalized) continue;
-    try {
-      if (fs.statSync(normalized).isDirectory()) out.push(normalized);
-    } catch {}
-  }
-  return out;
-}
-
-function resolveTtyConsoleRoot() {
-  const require = createRequire(import.meta.url);
-  return path.dirname(require.resolve('tty-console'));
-}
-
-export async function maybeStartTtyConsole({
-  serverDir,
-  logsDir,
-  logger = console,
-} = {}) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
-
-  const resolvedServerDir = path.resolve(String(serverDir || process.cwd()).trim() || process.cwd());
-  const resolvedLogsDir = path.resolve(String(logsDir || path.join(resolvedServerDir, 'logs')).trim() || path.join(resolvedServerDir, 'logs'));
-  fs.mkdirSync(resolvedLogsDir, { recursive: true });
-
-  let ttyConsoleModule;
-  try {
-    ttyConsoleModule = await import('tty-console');
-  } catch (error) {
-    const code = String(error?.code || '').trim();
-    if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND') {
-      logger?.log?.('[server] tty-console not installed; continuing without terminal console.');
-      return null;
-    }
-    logger?.warn?.(`[server] tty-console load failed: ${error?.message || error}`);
-    return null;
-  }
-
-  const ttyConsoleApi = ttyConsoleModule?.default || ttyConsoleModule;
-  const ConsoleCtor = ttyConsoleApi?.Console;
-  if (typeof ConsoleCtor !== 'function') {
-    logger?.warn?.('[server] tty-console loaded but Console export was unavailable.');
-    return null;
-  }
-
-  const ttyConsoleRoot = resolveTtyConsoleRoot();
-  const bundledCommandsDir = path.join(ttyConsoleRoot, 'commands');
-  const localCommandsDir = path.join(resolvedServerDir, 'commands');
-  const commandsDirs = existingDirectories([bundledCommandsDir, localCommandsDir]);
-  const configPath = path.join(resolvedLogsDir, 'console_config.json');
-  const historyPath = path.join(resolvedLogsDir, 'console_history.json');
-
-  const consoleOptions = {
-    configPath,
-    historyPath,
-    exitOnStop: false,
-  };
-  if (commandsDirs.length === 1) {
-    consoleOptions.commandsDir = commandsDirs[0];
-  } else if (commandsDirs.length > 1) {
-    consoleOptions.commandsDir = commandsDirs;
-  }
-
-  const runtime = new ConsoleCtor(consoleOptions);
-  runtime.start?.();
-  logger?.log?.(`[server] tty-console started (${commandsDirs.join(', ')})`);
-  return runtime;
-}