@oar-sh/oar 0.9.5 → 0.9.6

package/server/services/process-list-service.mjs

@@ -0,0 +1,122 @@
+'use strict';
+
+// The process table, read the way each platform allows, for the tree watch in
+// shared/worker-runtime/process-tree.mjs. Every entry carries the time the
+// process was started: that is what tells it from a later process that was
+// given its pid.
+//
+//  - Linux reads `/proc/<pid>/stat`, which needs no process and takes about
+//    3 ms for 160 processes (measured 2026-09-29). The start time is field 22,
+//    in clock ticks since boot.
+//  - Windows asks PowerShell, through the list the relay's process inspector
+//    already reads. It takes about a second, so it is never polled.
+//  - Every other platform asks `ps`, whose start time has a resolution of one
+//    second.
+
+import fs from 'fs';
+import { execFile } from 'child_process';
+
+import { createSessionWorkerProcessInspector } from './session-worker-process-service.mjs';
+
+const PS_TIMEOUT_MS = 10_000;
+
+/**
+ * One `/proc/<pid>/stat`. The name (field 2) is in parentheses and may hold
+ * spaces and parentheses of its own, so the fields after it are counted from
+ * the LAST closing one. A process that has ended and only waits to be
+ * collected (`Z`, `X`) is not running any more.
+ */
+export function parseProcStat(text) {
+  const raw = String(text || '');
+  const open = raw.indexOf('(');
+  const close = raw.lastIndexOf(')');
+  if (open < 1 || close < open) return null;
+  const processId = Number.parseInt(raw.slice(0, open), 10);
+  const fields = raw.slice(close + 2).trim().split(/\s+/);
+  const state = fields[0] || '';
+  const createdAt = Number(fields[19]);
+  if (!(processId > 0) || state === 'Z' || state === 'X' || !(createdAt > 0)) return null;
+  return {
+    processId,
+    parentProcessId: Number.parseInt(fields[1], 10) || 0,
+    name: raw.slice(open + 1, close),
+    createdAt,
+    // The runtime starts a command in a session of its own.
+    sessionLeader: Number.parseInt(fields[3], 10) === processId,
+  };
+}
+
+/** One line of `ps -o pid=,ppid=,stat=,lstart=,args=`. */
+export function parsePsLine(line) {
+  const match = String(line || '').match(
+    /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s*(.*)$/,
+  );
+  if (!match) return null;
+  const createdAt = Date.parse(match[4]);
+  if (/^[ZX]/.test(match[3]) || !(createdAt > 0)) return null;
+  return {
+    processId: Number.parseInt(match[1], 10),
+    parentProcessId: Number.parseInt(match[2], 10) || 0,
+    createdAt,
+    commandLine: match[5],
+  };
+}
+
+export function createProcessLister({
+  platform = process.platform,
+  readdirSyncImpl = fs.readdirSync,
+  readFileSyncImpl = fs.readFileSync,
+  execFileImpl = execFile,
+  inspector = null,
+} = {}) {
+  if (platform === 'win32') {
+    const windows = inspector || createSessionWorkerProcessInspector({ platform, execFileImpl });
+    return {
+      // A child keeps the pid of its parent after the parent has ended.
+      orphansKeepParent: true,
+      list: () => windows.readWindowsProcessSnapshot(),
+    };
+  }
+
+  if (platform === 'linux') {
+    const read = (pid) => {
+      try {
+        return parseProcStat(readFileSyncImpl(`/proc/${pid}/stat`, 'utf8'));
+      } catch {
+        // It ended between the directory listing and the read.
+        return null;
+      }
+    };
+    return {
+      orphansKeepParent: false,
+      list: () => readdirSyncImpl('/proc')
+        .filter((name) => /^\d+$/.test(String(name)))
+        .map((name) => read(name))
+        .filter(Boolean),
+      read,
+      describe(pid) {
+        try {
+          return String(readFileSyncImpl(`/proc/${pid}/cmdline`, 'utf8')).replace(/\0/g, ' ').trim();
+        } catch {
+          return '';
+        }
+      },
+    };
+  }
+
+  return {
+    orphansKeepParent: false,
+    list: () => new Promise((resolve, reject) => {
+      execFileImpl(
+        'ps',
+        ['-axww', '-o', 'pid=,ppid=,stat=,lstart=,args='],
+        // `lstart` is parsed as a date: keep it in the one language that is.
+        { timeout: PS_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, LC_ALL: 'C' } },
+        (error, stdout) => {
+          if (error) reject(error);
+          else resolve(String(stdout || '').split(/\r?\n/).map(parsePsLine).filter(Boolean));
+        },
+      );
+    }),
+  };
+}

package/server/services/relay-console-log.mjs

@@ -0,0 +1,199 @@
+'use strict';
+
+// The relay's console, kept in a file.
+//
+// The relay writes what it does to its console: a terminal, a tmux pane, a
+// service manager's journal or nothing at all, depending on how it was
+// started. After an incident or a restart that output is what one wants to
+// read, so the runtime copies it into `<log dir>/relay-console.log`, with a
+// time stamp per line and a size limit.
+//
+// The copy is taken from the console's methods rather than from stdout: the
+// terminal console (tty-console) redraws its prompt on stdout, and none of
+// that belongs in a log.
+
+import fs from 'fs';
+import path from 'path';
+import { format } from 'util';
+
+export const RELAY_CONSOLE_LOG_FILE = 'relay-console.log';
+export const RELAY_CONSOLE_LOG_DISABLE_ENV = 'OAR_NO_CONSOLE_LOG';
+
+const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+const DEFAULT_KEEP = 3;
+const LEVELS = Object.freeze(['log', 'info', 'warn', 'error', 'debug']);
+const ANSI_STYLE_PATTERN = /\u001b\[[0-9;]*m/g;
+// A token in a URL, whatever its value: the page is opened with `?token=`.
+const TOKEN_PARAM_PATTERN = /([?&]token=)[^&\s"'<>]+/gi;
+const SECRET_MIN_LENGTH = 6;
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Where the console log goes: the log directory the environment names, else
+ * `logs` under a data directory the environment names (a relay with its own
+ * data keeps its own log), else `logs` next to the server.
+ */
+export function resolveRelayConsoleLogPath({ env = process.env, serverDir, pathImpl = path } = {}) {
+  const logDir = String(env?.COPILOT_WEB_RELAY_LOG_DIR || '').trim();
+  const dataDir = String(env?.COPILOT_WEB_RELAY_DATA_DIR || '').trim();
+  const dir = logDir
+    || (dataDir ? pathImpl.join(dataDir, 'logs') : pathImpl.join(String(serverDir || process.cwd()), 'logs'));
+  return pathImpl.join(pathImpl.resolve(dir), RELAY_CONSOLE_LOG_FILE);
+}
+
+/**
+ * Copies what the relay writes to its console into `logPath`. Returns null
+ * when it is switched off or the file cannot be opened: a log problem must
+ * never stop the relay.
+ *
+ * `{ logPath, setSecrets(values), rewrap(), write(level, text), uninstall() }`:
+ * `setSecrets` names values that are never written (the auth token, once the
+ * config is read), or a function that returns them, asked at every write so
+ * a token that changes is covered; `rewrap` puts the copy in front again
+ * after something else replaced the console's methods.
+ */
+export function installRelayConsoleLog({
+  logPath,
+  env = process.env,
+  consoleImpl = console,
+  processImpl = process,
+  fsImpl = fs,
+  now = () => new Date(),
+  maxBytes = DEFAULT_MAX_BYTES,
+  keep = DEFAULT_KEEP,
+} = {}) {
+  if (String(env?.[RELAY_CONSOLE_LOG_DISABLE_ENV] || '').trim() === '1') return null;
+  const target = String(logPath || '').trim();
+  if (!target) return null;
+
+  let fd = null;
+  let size = 0;
+  let secretSource = () => [];
+  let secretKey = '';
+  let secretPattern = null;
+
+  function open() {
+    fsImpl.mkdirSync(path.dirname(target), { recursive: true });
+    fd = fsImpl.openSync(target, 'a');
+    try {
+      size = Number(fsImpl.fstatSync(fd).size) || 0;
+    } catch {
+      size = 0;
+    }
+  }
+
+  function close() {
+    if (fd === null) return;
+    try { fsImpl.closeSync(fd); } catch {}
+    fd = null;
+  }
+
+  // relay-console.log → .1 → .2 …; the oldest of `keep` is dropped.
+  function rotate() {
+    close();
+    try {
+      for (let index = keep; index >= 1; index -= 1) {
+        const from = index === 1 ? target : `${target}.${index - 1}`;
+        const to = `${target}.${index}`;
+        if (!fsImpl.existsSync(from)) continue;
+        try { fsImpl.rmSync(to, { force: true }); } catch {}
+        fsImpl.renameSync(from, to);
+      }
+    } catch {
+      // A file that cannot be moved (held open elsewhere) is written on.
+    }
+    open();
+  }
+
+  function currentSecretPattern() {
+    let values = [];
+    try {
+      values = secretSource() || [];
+    } catch {}
+    const secrets = (Array.isArray(values) ? values : [values])
+      .map((value) => String(value ?? '').trim())
+      .filter((value) => value.length >= SECRET_MIN_LENGTH);
+    const key = secrets.join('\n');
+    if (key !== secretKey) {
+      secretKey = key;
+      secretPattern = secrets.length ? new RegExp(secrets.map(escapeRegExp).join('|'), 'g') : null;
+    }
+    return secretPattern;
+  }
+
+  function scrub(text) {
+    const out = String(text).replace(ANSI_STYLE_PATTERN, '').replace(TOKEN_PARAM_PATTERN, '$1[token]');
+    const secrets = currentSecretPattern();
+    return secrets ? out.replace(secrets, '[token]') : out;
+  }
+
+  // Synchronous on purpose: the last lines before an exit are the ones an
+  // incident needs.
+  function write(level, text) {
+    if (fd === null) return;
+    try {
+      const stamp = now().toISOString();
+      const tag = level === 'log' ? '' : `${String(level).toUpperCase()} `;
+      const lines = scrub(text).split(/\r?\n/).map((line) => `${stamp} ${tag}${line}\n`).join('');
+      if (size > 0 && size + Buffer.byteLength(lines) > maxBytes) rotate();
+      if (fd === null) return;
+      size += fsImpl.writeSync(fd, lines);
+    } catch {
+      // A file that stopped taking writes (disk full, handle gone) is given up.
+      close();
+    }
+  }
+
+  try {
+    open();
+    if (size > maxBytes) rotate();
+  } catch {
+    close();
+    return null;
+  }
+
+  const wrapped = new Map();
+  function wrap() {
+    for (const level of LEVELS) {
+      const current = consoleImpl[level];
+      if (typeof current !== 'function' || current.relayConsoleLog === true) continue;
+      const copy = function relayConsoleCopy(...args) {
+        try {
+          write(level, format(...args));
+        } catch {}
+        return current.apply(this, args);
+      };
+      copy.relayConsoleLog = true;
+      copy.inner = current;
+      consoleImpl[level] = copy;
+      wrapped.set(level, copy);
+    }
+  }
+  wrap();
+
+  // Without a handler Node prints an uncaught error natively, past the console.
+  const onUncaught = (error, origin) => {
+    write('error', `${origin || 'uncaughtException'}: ${error?.stack || error?.message || error}`);
+  };
+  processImpl.on?.('uncaughtExceptionMonitor', onUncaught);
+
+  return {
+    logPath: target,
+    write,
+    rewrap: wrap,
+    setSecrets(values = []) {
+      secretSource = typeof values === 'function' ? values : () => values;
+    },
+    uninstall() {
+      for (const [level, copy] of wrapped) {
+        if (consoleImpl[level] === copy) consoleImpl[level] = copy.inner;
+      }
+      wrapped.clear();
+      processImpl.off?.('uncaughtExceptionMonitor', onUncaught);
+      close();
+    },
+  };
+}

package/server/services/remote-relay-caller-context.mjs

@@ -120,11 +120,16 @@ function describeRemoteTurn(action, args, caller) {
  * run, then the prompt (or the answer) it wants to send, so the user decides
  * on the actual words. `caller` is the calling session's context.
  */
-export function formatRemoteRelayApprovalPrompt({ relay, action, args = {}, caller = null } = {}) {
+export function formatRemoteRelayApprovalPrompt({ relay, action, args = {}, caller = null, agentPrompts = 0 } = {}) {
   const name = toText(relay?.name) || 'a remote relay';
   const verb = APPROVAL_VERBS[action] || toText(action).replace(/_/g, ' ') || 'act';
   const target = args.session ? ` (session ${shortId(args.session)})` : '';
-  const lines = [`Allow the agent to ${verb} on relay "${name}"${target}?`];
+  const lines = [];
+  // The loop guard's card: agents that prompt each other without the user.
+  if (agentPrompts > 0) {
+    lines.push(`The agent has sent ${agentPrompts} prompts to agents on other relays since your last message. Let it go on?`);
+  }
+  lines.push(`Allow the agent to ${verb} on relay "${name}"${target}?`);
   if (action === 'send' || action === 'create_session') {
     const details = describeRemoteTurn(action, args, caller);
     if (details) lines.push(details);
@@ -198,29 +203,34 @@ export function createRemoteRelayCallerContext({
     return rows.find((row) => row.id === liveId) || rows[0];
   }
 
-  function originHops(messageId) {
-    const origin = messageId ? repository?.getMessageOrigin?.(messageId) : null;
+  function messageOrigin(messageId) {
+    return (messageId ? repository?.getMessageOrigin?.(messageId) : null) || null;
+  }
+
+  function originHops(origin) {
     const hops = Number(origin?.hops);
     return Number.isInteger(hops) && hops >= 0 ? hops : 0;
   }
 
   /**
-   * A turn's hops: those of its own user message, or for a continuation row
-   * (no message of its own) those of the latest user message before it, the
-   * turn whose background work it continues.
+   * Where a turn's prompt came from (null for a human's): the origin of its
+   * own user message, or for a continuation row (no message of its own) that
+   * of the latest user message before it, the turn whose background work it
+   * continues.
    */
-  function rowHops(conversationId, row) {
-    if (toText(row.kind).toLowerCase() !== 'continuation') return originHops(row.id);
+  function rowOrigin(conversationId, row) {
+    if (toText(row.kind).toLowerCase() !== 'continuation') return messageOrigin(row.id);
     const at = toText(row.timestamp) || toText(row.processing_at);
     const message = at
       ? getLatestUserMessageAtOrBefore.get(conversationId, at)
       : getLatestUserMessage.get(conversationId);
-    return originHops(message?.id);
+    return messageOrigin(message?.id);
   }
 
   /**
    * `{ conversationId, title, provider, model, effort, mode, processingRowId,
-   * attemptId, userMessageId, hops }` for the conversation making the call.
+   * attemptId, userMessageId, hops, originRelayIds }` for the conversation
+   * making the call.
    * `effort` is the reasoning effort of the live turn, else the one the
    * conversation prefers ('' when neither is known).
    * `hops` is how many relays the current turn's prompt already crossed: 0
@@ -229,6 +239,8 @@ export function createRemoteRelayCallerContext({
    * conversation's processing rows wins (a background continuation counts as
    * the turn it continues); without a turn (an off-turn call) the latest user
    * message decides.
+   * `originRelayIds` are the relays (their instance ids) those prompts came
+   * from: empty when the agent acts on the user's words alone.
    */
   function getCallerContext(conversationId) {
     const id = toText(conversationId);
@@ -236,9 +248,11 @@ export function createRemoteRelayCallerContext({
     const runtime = getRuntimeSession.get(id) || null;
     const rows = listProcessingRows.all(id);
     const live = liveTurnRow(id, rows);
-    const hops = rows.length
-      ? Math.max(...rows.map((row) => rowHops(id, row)))
-      : originHops(getLatestUserMessage.get(id)?.id);
+    const origins = (rows.length
+      ? rows.map((row) => rowOrigin(id, row))
+      : [messageOrigin(getLatestUserMessage.get(id)?.id)]).filter(Boolean);
+    const hops = Math.max(0, ...origins.map(originHops));
+    const originRelayIds = [...new Set(origins.map((origin) => toText(origin.relayId)))];
     return {
       conversationId: id,
       title: toText(conversation?.title),
@@ -250,6 +264,7 @@ export function createRemoteRelayCallerContext({
       attemptId: toText(live?.attempt_id) || null,
       userMessageId: live?.id || null,
       hops,
+      originRelayIds,
     };
   }
 
@@ -270,8 +285,11 @@ export function createRemoteRelayCallerContext({
    * denied, timed out, cancelled with the turn, or no turn to ask on (fails
    * closed with REMOTE_RELAY_NO_ACTIVE_TURN). Waits as long as the question
    * lives (8 h by default); `signal` withdraws the card early.
+   * `agentPrompts` (the loop guard) is how many prompts the agent has sent to
+   * other relays' agents since the user last wrote; the card then asks for
+   * that, in any relay mode.
    */
-  async function requestApproval({ conversationId, callerContext, relay, action, args = {}, signal } = {}) {
+  async function requestApproval({ conversationId, callerContext, relay, action, args = {}, signal, agentPrompts = 0 } = {}) {
     const rowId = toText(callerContext?.processingRowId);
     const row = rowId ? getQueueRow.get(rowId) : null;
     if (!row || row.status !== 'processing') {
@@ -285,10 +303,12 @@ export function createRemoteRelayCallerContext({
     const createdAt = now().toISOString();
     const questionId = String(uuid());
     const relayMode = normalizeMode(row.relay_mode);
-    const prompt = formatRemoteRelayApprovalPrompt({ relay, action, args, caller: callerContext });
+    const prompt = formatRemoteRelayApprovalPrompt({ relay, action, args, caller: callerContext, agentPrompts });
     const context = sanitizeRelayQuestionContext({
       source: REMOTE_RELAY_APPROVAL_SOURCE,
-      rationale: `Write actions on other relays need approval in ${relayMode} mode.`,
+      rationale: agentPrompts > 0
+        ? 'Agents on different relays that keep prompting each other need your go from time to time.'
+        : `Write actions on other relays need approval in ${relayMode} mode.`,
       queueMessageId: row.id,
       conversationId: toText(conversationId) || row.conversation_id,
       relayMode,

package/server/services/remote-relay-dispatcher.mjs

@@ -2,6 +2,7 @@
 
 import { randomUUID as nodeRandomUUID } from 'crypto';
 
+import { isFailureNoteText } from '../../shared/failure-note-text.mjs';
 import {
   REMOTE_RELAY_APPROVAL_MODES,
   REMOTE_RELAY_EFFORT_PATTERN,
@@ -9,6 +10,7 @@ import {
   REMOTE_RELAY_LIMITS,
   REMOTE_RELAY_PROVIDERS,
   isRemoteRelayApprovalQuestion,
+  isRemoteRelayPromptAction,
   isRemoteRelayWriteAction,
   normalizeRemoteRelayOrigin,
   remoteConversationUrl,
@@ -90,7 +92,6 @@ const WORKING_WORKER_STATUSES = new Set(['starting', 'processing']);
 // marker counts only there: a normal reply that quotes a relay error further
 // down is a reply, not a failure.
 const FAILURE_TEXT_PATTERNS = Object.freeze([
-  /^(?:(?!\n[ \t]*\r?\n)[\s\S]){0,600}?\berror code:\s*relay\.[a-z0-9-]+\.(?=\s|$)/i,
   /^relay recovery limit reached after \d+ attempts/i,
   /^relay timeout after \d+ attempts/i,
 ]);
@@ -184,7 +185,7 @@ function compactQuery(query = {}) {
 
 function looksLikeFailureText(text) {
   const value = toText(text);
-  return FAILURE_TEXT_PATTERNS.some((pattern) => pattern.test(value));
+  return isFailureNoteText(value) || FAILURE_TEXT_PATTERNS.some((pattern) => pattern.test(value));
 }
 
 function normalizeProvider(value) {
@@ -534,6 +535,10 @@ export function createRemoteRelayDispatcher({
   const inflightByConversation = new Map();
   const callTimesByConversation = new Map();
   const writeTimesByConversation = new Map();
+  // The loop guard: prompts sent to other relays' agents per conversation,
+  // counted from the user's latest own message. Kept in memory: a restart
+  // ends a loop of agents by itself.
+  const agentPromptsByConversation = new Map();
 
   // ─── Bookkeeping ───────────────────────────────────────────────────────────
 
@@ -556,6 +561,31 @@ export function createRemoteRelayDispatcher({
     }
   }
 
+  /**
+   * Why a relay is open to a conversation: 'user' (the user mentioned it),
+   * 'contact' (an agent on that relay wrote to the conversation, so it may be
+   * answered), or null (locked).
+   */
+  function relayAccess(conversationId, relay) {
+    if (isUnlocked(conversationId, relay?.id)) return 'user';
+    try {
+      if (toText(relay?.relayId) && repository?.hasContactFrom?.(conversationId, relay.relayId)) return 'contact';
+    } catch {}
+    return null;
+  }
+
+  function agentPrompts(conversationId) {
+    let since = null;
+    try {
+      since = repository?.latestHumanMessageId?.(conversationId) || null;
+    } catch {}
+    const kept = agentPromptsByConversation.get(conversationId);
+    if (kept && kept.since === since) return kept;
+    const fresh = { since, count: 0 };
+    agentPromptsByConversation.set(conversationId, fresh);
+    return fresh;
+  }
+
   function adjustInflight(conversationId, delta) {
     const next = inflight(conversationId) + delta;
     if (next > 0) inflightByConversation.set(conversationId, next);
@@ -1594,7 +1624,7 @@ export function createRemoteRelayDispatcher({
       online: toText(relay.lastStatus).toLowerCase() === 'online',
       version: relay.version || null,
       permission: relay.permission,
-      unlocked: isUnlocked(conversationId, relay.id),
+      unlocked: relayAccess(conversationId, relay) !== null,
     }));
     const unlocked = listed.filter((relay) => relay.unlocked).length;
     return {
@@ -1604,7 +1634,7 @@ export function createRemoteRelayDispatcher({
         summary: `list_relays: ${listed.length} relay${listed.length === 1 ? '' : 's'}, ${unlocked} unlocked`,
         self: { name: (await registry.selfName?.()) || null },
         relays: listed,
-        hint: 'Mention @name in the chat to unlock a relay.',
+        hint: 'The user unlocks a relay by mentioning @name in the chat; a relay whose agent wrote to this conversation is open as well.',
       },
     };
   }
@@ -1635,7 +1665,8 @@ export function createRemoteRelayDispatcher({
       return result;
     };
 
-    if (!isUnlocked(conversationId, relay.id)) {
+    const access = relayAccess(conversationId, relay);
+    if (!access) {
       return finish(failure(403, REMOTE_RELAY_ERROR_CODES.locked,
         `Relay "${relay.name}" is locked in this conversation. Ask the user to mention @${relay.name} (or its name) in a message to allow work there.`,
         { relay: relay.name }));
@@ -1649,9 +1680,16 @@ export function createRemoteRelayDispatcher({
     const caller = { conversationId, ...((await getCallerContext(conversationId, req)) || {}) };
     caller.mode = toText(caller.mode).toLowerCase();
     const hops = nonNegativeInt(caller.hops) + 1;
-    if (hops > REMOTE_RELAY_LIMITS.hopLimit) {
+    // The hop limit stops a prompt from travelling on to a third relay. A
+    // relay the user unlocked here stays in reach whatever prompts arrive,
+    // the relay the prompts came from may always be answered, and reading
+    // carries nothing on.
+    const origins = Array.isArray(caller.originRelayIds) ? caller.originRelayIds.map(toText) : [];
+    const answering = !!toText(relay.relayId) && origins.length > 0
+      && origins.every((id) => id === toText(relay.relayId));
+    if (write && access !== 'user' && !answering && hops > REMOTE_RELAY_LIMITS.hopLimit) {
       return finish(failure(403, REMOTE_RELAY_ERROR_CODES.hopLimit,
-        `This turn was started by another relay's agent (hop ${hops - 1}); forwarding it again would pass the limit of ${REMOTE_RELAY_LIMITS.hopLimit} hops.`,
+        `This turn acts on a prompt from another relay's agent (hop ${hops - 1}); passing it on to relay "${relay.name}" would pass the limit of ${REMOTE_RELAY_LIMITS.hopLimit} hops. The user can allow it by mentioning @${relay.name} in this conversation.`,
         { relay: relay.name }));
     }
 
@@ -1664,7 +1702,32 @@ export function createRemoteRelayDispatcher({
 
     adjustInflight(conversationId, 1);
     try {
-      if (write && REMOTE_RELAY_APPROVAL_MODES.includes(caller.mode)) {
+      const prompting = isRemoteRelayPromptAction(action);
+      let asked = false;
+      if (prompting && agentPrompts(conversationId).count >= REMOTE_RELAY_LIMITS.agentPromptsBeforeAsking) {
+        // Agents that prompt each other can go on without the user for good:
+        // from time to time the user is asked, in any relay mode.
+        const decision = await requestApproval({
+          conversationId,
+          callerContext: caller,
+          relay: relayTarget(relay),
+          action,
+          args,
+          summary: summarizeRemoteRelayCall({ action, ...args, relay: relay.name }),
+          signal,
+          agentPrompts: agentPrompts(conversationId).count,
+        });
+        const approved = decision === true || decision?.approved === true;
+        if (!approved) {
+          const code = toText(decision?.code) || REMOTE_RELAY_ERROR_CODES.approvalDenied;
+          const error = toText(decision?.error)
+            || `The agent has sent ${agentPrompts(conversationId).count} prompts to other relays' agents since the user last wrote, and the user did not allow more for now.`;
+          return finish(failure(403, code, error, { relay: relay.name }));
+        }
+        agentPrompts(conversationId).count = 0;
+        asked = true;
+      }
+      if (!asked && write && REMOTE_RELAY_APPROVAL_MODES.includes(caller.mode)) {
         const decision = await requestApproval({
           conversationId,
           callerContext: caller,
@@ -1685,6 +1748,7 @@ export function createRemoteRelayDispatcher({
 
       const ctx = { relay, caller, hops, conversationId, signal };
       const body = await ACTIONS[action](ctx, args);
+      if (prompting) agentPrompts(conversationId).count += 1;
       const { summary, ...rest } = body;
       return finish({
         status: 200,

package/server/services/remote-relay-inbound.mjs

@@ -161,6 +161,41 @@ export function formatRemoteRelayMentionHint(relays = []) {
   return `<system_reminder>The user mentioned ${subject}. The ${REMOTE_RELAY_TOOL_NAME} tool can list, read, prompt and create sessions there.</system_reminder>`;
 }
 
+/**
+ * The paired relay a remote prompt came from: `{ relayId, name }` (`relayId`
+ * is the local registry id), or null when the sender is not paired here or
+ * names no relay id.
+ */
+export function findOriginRemoteRelay(inbound, origin) {
+  const instance = String(origin?.relayId || '').trim();
+  if (!inbound || typeof inbound.listRelays !== 'function' || !instance) return null;
+  try {
+    const listed = inbound.listRelays();
+    const relay = (Array.isArray(listed) ? listed : [])
+      .find((entry) => String(entry?.relayId || '').trim() === instance);
+    return relay ? { relayId: String(relay.id || ''), name: String(relay.name || relay.id || '') } : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The reminder the agent gets with a prompt another relay's agent sent: that
+ * relay is open to this conversation, and where the sender's session is. ''
+ * when the sender is not a paired relay. Like the mention hint, it rides in
+ * the queued prompt only.
+ */
+export function formatRemoteRelayOriginHint(relay, origin) {
+  const name = hintText(relay?.name);
+  if (!name) return '';
+  const session = hintText(origin?.conversationId, 80);
+  const where = session ? `relay "${name}", session "${session}"` : `relay "${name}"`;
+  return `<system_reminder>This prompt came from an agent on the paired OAR relay "${name}". `
+    + 'Your reply to it is handed back to that agent by itself. '
+    + `For more than the reply (reading its session, a question, a later report) the ${REMOTE_RELAY_TOOL_NAME} tool is open for that relay in this conversation: ${where}. `
+    + 'A prompt you send there while its turn is still running is steered into that turn.</system_reminder>';
+}
+
 /** The queued prompt with the mention hint after the user's text. */
 export function withRemoteRelayMentionHint(promptText, hint) {
   const text = String(promptText ?? '');