@oar-sh/oar 0.9.5 → 0.9.7

package/server/server-runtime.mjs

@@ -39,10 +39,12 @@ import { registerAskUserRoutes } from './routes/ask-user-routes.mjs';
 import { registerRelayBoardRoutes } from './routes/relay-board-routes.mjs';
 import { registerCacheRoutes } from './routes/cache-routes.mjs';
 import { registerGitRoutes } from './routes/git-routes.mjs';
+import { registerClaudeCloudRoutes } from './routes/claude-cloud-routes.mjs';
 import { registerPreviewRoutes } from './routes/preview-routes.mjs';
 import { registerRemoteRelayRoutes } from './routes/remote-relay-routes.mjs';
 import { createRemoteRelayRepository } from './repositories/remote-relay-repository.mjs';
 import { createRemoteRelayClient } from './services/remote-relay-client.mjs';
+import { createRemoteRelayLoopbackClient } from './services/remote-relay-loopback.mjs';
 import { createRemoteRelayRegistry } from './services/remote-relay-registry-service.mjs';
 import { createRemoteRelayPairing } from './services/remote-relay-pairing.mjs';
 import { createRemoteRelayCallerContext } from './services/remote-relay-caller-context.mjs';
@@ -50,12 +52,23 @@ import { createRemoteRelayDispatcher } from './services/remote-relay-dispatcher.
 import { createDeleteArchiveService } from './services/delete-archive-service.mjs';
 import { createStatusEventService } from './services/status-event-service.mjs';
 import { createClaudeAuthService } from './services/claude-auth-service.mjs';
+import { createClaudeCloudCredentials } from '../shared/claude-cloud/credentials.mjs';
+import { createClaudeCloudClient } from '../shared/claude-cloud/api-client.mjs';
+import { resolveClaudeCloudBaseUrl } from '../shared/claude-cloud/base-url.mjs';
+import { createClaudeCloudSettingsService } from './services/claude-cloud-settings-service.mjs';
+import { createClaudeCloudSessionService } from './services/claude-cloud-session-service.mjs';
+import { createClaudeCloudRepoService, listRecentCloudSourcesFromStatements } from './services/claude-cloud-repo-service.mjs';
+import { createClaudeAccountUsageService } from './services/claude-account-usage-service.mjs';
+import { createGitRemoteService } from './services/git-remote-service.mjs';
 import { createCliInstallService, writeCliBinariesToConfigFile } from './services/cli-install-service.mjs';
 import { createGrokAuthService } from './services/grok-auth-service.mjs';
 import { sweepUnreferencedUploads, UNREFERENCED_UPLOADS_QUERY } from './services/upload-sweep.mjs';
 import webpush from 'web-push';
 import { createPushDispatchService, ensurePushVapidKeys } from './services/push-dispatch-service.mjs';
 import { createHostSuspendService } from './services/host-suspend-service.mjs';
+import { USAGE_LIMIT_ACCOUNT_SOCKET_EVENT, createUsageLimitPauseService } from './services/usage-limit-pause-service.mjs';
+import { buildClaudeAttributionSettings, normalizeClaudeAttributionMode, resolveClaudeAttributionMode, DEFAULT_CLAUDE_ATTRIBUTION_MODE } from '../shared/claude-attribution.mjs';
+import { createWorkerLaunchNoteService } from './services/worker-launch-note-service.mjs';
 import { createGitHubCiActivityService } from './services/github-ci-activity-service.mjs';
 import { runHostSuspendToRam } from './services/host-suspend-command.mjs';
 import { createActiveDeviceTracker } from './services/push-active-device-service.mjs';
@@ -92,7 +105,7 @@ import { createRelayCliLauncherService } from './services/relay-cli-launcher-ser
 import { createSessionWorkerRegistry } from './services/session-worker-registry-service.mjs';
 import { createSessionWorkerSupervisor } from './services/session-worker-supervisor-service.mjs';
 import { createSessionWorkerProcessInspector } from './services/session-worker-process-service.mjs';
-import { applyClaudeProviderEnvironment, applyCopilotSdkProviderEnvironment, applyCursorProviderEnvironment, applyGrokProviderEnvironment, applyOpenAIProviderEnvironment, copilotSdkEngineUnavailableReason, killTmuxSession, launchSessionCli } from './services/session-worker-launch-service.mjs';
+import { applyClaudeCloudProviderEnvironment, applyClaudeProviderEnvironment, applyCopilotSdkProviderEnvironment, applyCursorProviderEnvironment, applyGrokProviderEnvironment, applyOpenAIProviderEnvironment, copilotSdkEngineUnavailableReason, killTmuxSession, launchSessionCli } from './services/session-worker-launch-service.mjs';
 import { createSshTunnelManager } from './services/ssh-tunnel-manager-service.mjs';
 import { createCloudflaredTunnelManager } from './services/cloudflared-tunnel-service.mjs';
 import {
@@ -113,6 +126,7 @@ import {
   resolveLaunchWorkspaceRootPath,
 } from './services/workspace-root-defaults-service.mjs';
 import { maybeStartTtyConsole } from './tty-console-bootstrap.mjs';
+import { installRelayConsoleLog, resolveRelayConsoleLogPath } from './services/relay-console-log.mjs';
 import {
   computeFeatureFlagState,
   FEATURE_REGISTRY,
@@ -186,11 +200,18 @@ const PWA_SW_PATH = path.join(PUBLIC_DIR, 'sw.js');
 const SOCKET_IO_CLIENT_JS_PATH = path.join(__dirname, '..', 'node_modules', 'socket.io', 'client-dist', 'socket.io.js');
 const APP_CONFIG_PLACEHOLDER = /window\.__COPILOT_APP_CONFIG = \{ basePath: '[^']*' \};/;
 const PWA_VERSION_PLACEHOLDER = /const __PWA_VERSION = '[^']*';/;
+// The console goes to a terminal, a tmux pane or nowhere: keep a copy to read
+// after a restart or an incident.
+const relayConsoleLog = installRelayConsoleLog({
+  logPath: resolveRelayConsoleLogPath({ env: process.env, serverDir: __dirname }),
+});
 const ttyConsoleRuntime = await maybeStartTtyConsole({
   serverDir: __dirname,
   logsDir: path.join(__dirname, 'logs'),
   logger: console,
 });
+// The terminal console takes the console's methods over when it starts.
+relayConsoleLog?.rewrap();
 
 // ─── Config ────────────────────────────────────────────────────────────────────
 const CONFIG_PATH    = process.env.COPILOT_WEB_RELAY_CONFIG
@@ -433,6 +454,7 @@ function getClaudeProviderSettings() {
     enabledModels: models,
     effortsByModel,
     modelsDiscovered,
+    attributionMode: normalizeClaudeAttributionMode(readAppSettingValue(CLAUDE_ATTRIBUTION_SETTING_KEY)) || DEFAULT_CLAUDE_ATTRIBUTION_MODE,
     providerType: 'claude',
   };
 }
@@ -451,10 +473,19 @@ function setClaudeProviderSettings(update = {}) {
   if (!isSafeClaudeModelId(normalizedModel)) {
     return { ok: false, error: 'Invalid Claude model ID' };
   }
+  const attributionMode = payload.attributionMode === undefined
+    ? undefined
+    : normalizeClaudeAttributionMode(payload.attributionMode);
+  if (attributionMode === null) {
+    return { ok: false, error: 'Invalid Claude attribution mode' };
+  }
   const nowIso = new Date().toISOString();
   const nextEnabled = typeof enabled === 'boolean' ? enabled : existing.enabled;
   stmts.upsertAppSetting.run(CLAUDE_ENABLED_SETTING_KEY, nextEnabled ? 'true' : 'false', nowIso);
   stmts.upsertAppSetting.run(CLAUDE_MODEL_SETTING_KEY, normalizedModel, nowIso);
+  if (attributionMode) {
+    stmts.upsertAppSetting.run(CLAUDE_ATTRIBUTION_SETTING_KEY, attributionMode, nowIso);
+  }
   if (Array.isArray(models)) {
     const normalizedModels = models
       .map((value) => String(value || '').trim())
@@ -483,9 +514,38 @@ function setClaudeProviderSettings(update = {}) {
     model: current.model,
     models: current.models,
     availableModels: current.availableModels,
+    attributionMode: current.attributionMode,
   };
 }
 
+/** The folder override of a workspace root, or null (inherit); tolerant of a missing table. */
+function workspaceRootAttributionMode(rootPath) {
+  const root = String(rootPath || '').trim();
+  if (!root || typeof stmts?.getWorkspaceRootSettings?.get !== 'function') return null;
+  try {
+    return normalizeClaudeAttributionMode(stmts.getWorkspaceRootSettings.get(normalizeWorkspaceRootKey(root))?.attribution_mode);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What a Claude session's commits and PRs say: the provider setting, the
+ * folder override of the conversation's workspace root on top, and the
+ * model's name in the trailer. null = the CLI's own attribution.
+ */
+function claudeAttributionForConversation(conv, modelId, { relayFolderFallback = true } = {}) {
+  // A Claude Cloud chat works in a sandbox, not in the relay's folder: only
+  // the folder it was started from (if any) can speak for it.
+  const root = String(conv?.runtime_workspace_root_path || conv?.configured_workspace_root_path || '').trim()
+    || (relayFolderFallback ? currentWorkspaceRootPath() : '');
+  const mode = resolveClaudeAttributionMode({
+    providerMode: getClaudeProviderSettings().attributionMode,
+    folderMode: workspaceRootAttributionMode(root),
+  });
+  return buildClaudeAttributionSettings({ mode, modelId });
+}
+
 const CLAUDE_MODEL_DISCOVERY_TIMEOUT_MS = 20_000;
 
 // Discover the models the Claude Agent SDK can serve by asking a short-lived
@@ -1292,6 +1352,9 @@ const CLAUDE_MODEL_SETTING_KEY = 'claude_model';
 const CLAUDE_MODELS_SETTING_KEY = 'claude_models';
 const CLAUDE_ENABLED_MODELS_SETTING_KEY = 'claude_enabled_models';
 const CLAUDE_MODEL_EFFORTS_SETTING_KEY = 'claude_model_efforts';
+// oar | vanilla | off — what commits and PRs made in Claude sessions say
+// (shared/claude-attribution.mjs); absent means oar.
+const CLAUDE_ATTRIBUTION_SETTING_KEY = 'claude_attribution_mode';
 // The set of levels the SDK itself can report/accept as EffortLevel values.
 // Discovery results are filtered through this, so it must NOT contain the
 // relay's derived 'ultracode' sentinel — supportedModels() never reports it
@@ -1599,6 +1662,7 @@ const CURATED_MODEL_IDS = [
 ];
 
 let config = { ...DEFAULT_CONFIG };
+relayConsoleLog?.setSecrets(() => [config.authToken]);
 if (fs.existsSync(CONFIG_PATH)) {
   try { config = { ...config, ...JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')) }; }
   catch (e) { console.error('Failed to read config.json, using defaults.'); }
@@ -2472,6 +2536,59 @@ const claudeAuthService = createClaudeAuthService();
 // group.
 const grokAuthService = createGrokAuthService();
 
+// ─── Claude Cloud (provider `claude-cloud`) ───────────────────────────────────
+// One credentials reader and one cloud client for the whole relay: the
+// settings tab (environments), and the archive of a deleted or archived
+// conversation's cloud session. The reader hands the Claude CLI's login to
+// the client only; nothing here stores, logs or forwards it, and the workers
+// read the credentials file themselves (the launch service hands a cloud
+// worker the login only where the relay itself runs on an environment token,
+// and then through the secret file, never a plain launch environment).
+// An expired login is nudged by letting the CLI look at its own status.
+const claudeCloudCredentials = createClaudeCloudCredentials({
+  nudge: async () => { await claudeAuthService.getStatus({ force: true }); },
+});
+// The Anthropic API, unless OAR_CLAUDE_CLOUD_API_BASE_URL names a fake one on
+// this machine (tests): base-url.mjs ignores every host that is not loopback.
+const claudeCloudClient = createClaudeCloudClient({
+  credentials: claudeCloudCredentials,
+  baseUrl: resolveClaudeCloudBaseUrl(process.env),
+});
+const claudeCloudSettingsService = createClaudeCloudSettingsService({
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, String(value), new Date().toISOString()),
+  deleteSetting: (key) => stmts.deleteAppSetting.run(key),
+  getClaudeProviderSettings,
+  claudeAuthService,
+  credentials: claudeCloudCredentials,
+  cloud: claudeCloudClient,
+  // A closure: the socket server is created further down the file.
+  emit: (event, payload) => io.emit(event, payload),
+});
+function getClaudeCloudProviderSettings() {
+  return claudeCloudSettingsService.getSettings();
+}
+const claudeCloudSessionService = createClaudeCloudSessionService({
+  stmts,
+  getCloudClient: () => claudeCloudClient,
+  emit: (event, payload) => io.emit(event, payload),
+});
+// The suggestions of the New Chat repository and branch fields: Anthropic's
+// list of what the Claude GitHub app can reach (while the provider is on),
+// the repositories of earlier cloud chats, and `git ls-remote` on the host.
+const claudeCloudRepoService = createClaudeCloudRepoService({
+  cloud: claudeCloudClient,
+  isEnabled: () => claudeCloudSettingsService.getSettings().enabled === true,
+  listRecentCloudSources: () => listRecentCloudSourcesFromStatements(stmts),
+});
+// The account's live usage for the Check Usage modal. The Claude Cloud switch
+// is the consent to use the Claude CLI's login, so nothing is read while it
+// is off.
+const claudeAccountUsageService = createClaudeAccountUsageService({
+  cloudClient: claudeCloudClient,
+  isEnabled: () => claudeCloudSettingsService.getSettings().enabled === true,
+});
+
 // ─── Provider CLI install / binary binding ────────────────────────────────────
 // A resolved CLI path is host state, not conversation state, so it lives beside
 // the port and the token in config.json rather than in the app_settings table
@@ -2574,6 +2691,8 @@ const sessionWorkerRegistry = createSessionWorkerRegistry();
 const sessionWorkerProcessInspector = createSessionWorkerProcessInspector({
   platform: process.platform,
   execFileSyncImpl: execFileSync,
+  execFileImpl: execFile,
+  logger: console,
 });
 function buildSessionWorkerLaunchEnv() {
   const normalizePathValue = (value) => {
@@ -2690,7 +2809,18 @@ function buildSessionWorkerLaunchEnvForSession(targetSessionId) {
   const providerType = String(runtimeSession?.provider_type || 'github').trim().toLowerCase();
   // Clear every provider's variables first (the appliers' kind-guarded deletes
   // keep the chained clears order-independent), then apply only the bound one.
-  const cleared = applyCopilotSdkProviderEnvironment(applyGrokProviderEnvironment(applyCursorProviderEnvironment(applyClaudeProviderEnvironment(applyOpenAIProviderEnvironment(sessionWorkerLaunchEnv)))));
+  const cleared = applyClaudeCloudProviderEnvironment(applyCopilotSdkProviderEnvironment(applyGrokProviderEnvironment(applyCursorProviderEnvironment(applyClaudeProviderEnvironment(applyOpenAIProviderEnvironment(sessionWorkerLaunchEnv))))));
+  // A Claude Cloud conversation gets its own worker and nothing else: it must
+  // never reach the Copilot CLI fall-through at the end of this function. The
+  // environment names the worker and the model, no credential.
+  if (providerType === 'claude-cloud') {
+    const cloudSettings = getClaudeCloudProviderSettings();
+    const cloudModel = String(runtimeSession?.provider_model || runtimeSession?.model || cloudSettings.defaultModel).trim();
+    return applyClaudeCloudProviderEnvironment(cleared, {
+      enabled: true,
+      model: cloudModel,
+    });
+  }
   if (providerType === 'claude') {
     const claudeSettings = getClaudeProviderSettings();
     const claudeModel = String(runtimeSession?.provider_model || runtimeSession?.model || claudeSettings.model).trim();
@@ -2763,8 +2893,18 @@ async function spawnSessionWorkerCli(targetSessionId, { allowProcessReuse = true
   if (!normalizedTargetSessionId) {
     throw new Error('missing-target-session-id');
   }
+  // An unreadable process list must not stop every launch on the relay
+  // (2026-10-01: a control byte in one command line did, for an hour).
+  const warnProcessListUnreadable = (error) => {
+    console.warn(`${runtimeLogPrefix()}worker launcher: process list unreadable, launching session=${normalizedTargetSessionId.slice(0, 8)} without the reuse check: ${error?.message || error}`);
+  };
   if (allowProcessReuse) {
-    const liveWorker = sessionWorkerProcessInspector.findProcessForSession(normalizedTargetSessionId);
+    let liveWorker = null;
+    try {
+      liveWorker = await sessionWorkerProcessInspector.findProcessForSessionAsync(normalizedTargetSessionId);
+    } catch (error) {
+      warnProcessListUnreadable(error);
+    }
     if (liveWorker?.processId) {
       const workerId = `worker-${normalizedTargetSessionId.slice(0, 8)}`;
       console.log(`${runtimeLogPrefix()}worker launcher: reused ${workerId} session=${normalizedTargetSessionId.slice(0, 8)} pid=${liveWorker.processId}`);
@@ -2782,6 +2922,7 @@ async function spawnSessionWorkerCli(targetSessionId, { allowProcessReuse = true
     execFileSyncImpl: execFileSync,
     processInspector: sessionWorkerProcessInspector,
     allowProcessReuse,
+    onProcessListError: warnProcessListUnreadable,
   });
   const workerPid = Number.isInteger(Number(launched?.pid)) ? Number(launched.pid) : null;
   const workerId = `worker-${normalizedTargetSessionId.slice(0, 8)}`;
@@ -2794,11 +2935,26 @@ async function spawnSessionWorkerCli(targetSessionId, { allowProcessReuse = true
   console.log(`${runtimeLogPrefix()}worker launcher: ${launchVerb} ${workerId} session=${normalizedTargetSessionId.slice(0, 8)} pid=${workerPid || 'none'} mode=${launchMode}${tmuxSessionName ? ` tmux=${tmuxSessionName}` : ''}`);
   return { workerId, pid: workerPid, reused: launched?.reused === true };
 }
+// The note in the conversation while a session's worker cannot be started
+// (worker-launch-note-service.mjs). `io` exists only later in boot; the
+// supervisor reports launch episodes at run time, never during boot.
+const workerLaunchNoteService = createWorkerLaunchNoteService({
+  db,
+  stmts,
+  emit: (event, payload) => io.emit(event, payload),
+  resolveConversationId: (sdkSessionId) => (
+    stmts.getConvBySdkSessionId?.get?.(sdkSessionId)?.id
+    || sessionWorkerRegistry.getWorker(sdkSessionId)?.conversationId
+    || null
+  ),
+  logger: console,
+});
 const sessionWorkerSupervisor = createSessionWorkerSupervisor({
   registry: sessionWorkerRegistry,
   spawnWorker: async (sdkSessionId, options = {}) => spawnSessionWorkerCli(sdkSessionId, options),
   diagnosticPlanReference: () => path.join(currentWorkspaceRootPath(), '.cursor', 'plans', 'worker-startup-monitoring-plan.md'),
   log: (message) => console.warn(`${runtimeLogPrefix()}${message}`),
+  onLaunchState: (event) => workerLaunchNoteService.handle(event),
 });
 // Feature flags moved from config.json into app_settings; adopt any legacy
 // `features` key once, then resolve the boot snapshot (defaults < stored rows
@@ -2866,14 +3022,11 @@ async function stopSessionWorkerForProviderRebind(sdkSessionId) {
   const currentWorker = sessionWorkerRegistry?.getWorker?.(sessionId) || null;
   sessionWorkerSupervisor?.markKilled?.(sessionId);
   const cancelledStart = await sessionWorkerSupervisor?.cancelPendingStart?.(sessionId, { wait: true });
+  // Read off the thread; an unreadable list throws, and this caller treats
+  // that as fatal (a rebind next to a process it could not see is worse).
   const discoveredProcesses = process.platform === 'win32'
-    ? (
-        sessionWorkerProcessInspector?.findWindowsProcessTreeForSession?.(sessionId)
-        || sessionWorkerProcessInspector?.findWindowsProcessesForSession?.(sessionId)
-        || sessionWorkerProcessInspector?.findProcessesForSession?.(sessionId)
-        || []
-      )
-    : (sessionWorkerProcessInspector?.findProcessesForSession?.(sessionId) || []);
+    ? await sessionWorkerProcessInspector.findWindowsProcessTreeForSessionAsync(sessionId, { fresh: true })
+    : await sessionWorkerProcessInspector.findProcessesForSessionAsync(sessionId, { fresh: true });
   const currentWorkerPid = Number(currentWorker?.pid);
   const hadActiveWorker = discoveredProcesses.some((entry) => isProcessAlive(Number(entry?.processId)))
     || (Number.isInteger(currentWorkerPid) && currentWorkerPid > 0 && isProcessAlive(currentWorkerPid))
@@ -3176,6 +3329,26 @@ function cancelRelayShutdown({ requestedBy = 'localhost-api' } = {}) {
   return { cancelled: true, dropped, ...relayShutdownStatePayload() };
 }
 
+const countPendingRowsByOwnerSession = db.prepare(`
+  SELECT owner_sdk_session_id AS sdk_session_id, COUNT(*) AS n
+  FROM queue
+  WHERE status = 'pending' AND owner_sdk_session_id IS NOT NULL AND owner_sdk_session_id != ''
+  GROUP BY owner_sdk_session_id
+`);
+
+function countPendingRowsOfStoppedSessions() {
+  try {
+    let stalled = 0;
+    for (const row of countPendingRowsByOwnerSession.all()) {
+      const lifecycle = sessionWorkerSupervisor?.getLifecycleState?.(String(row.sdk_session_id || '').trim());
+      if (lifecycle?.retriesStopped === true) stalled += Number(row.n || 0);
+    }
+    return stalled;
+  } catch {
+    return 0;
+  }
+}
+
 function requestRelayShutdown({ reason = 'manual-request', requestedBy = 'localhost-api', restart = false } = {}) {
   const safeReason = String(reason || 'manual-request').trim().slice(0, 140) || 'manual-request';
   const safeRequestedBy = String(requestedBy || 'localhost-api').trim().slice(0, 80) || 'localhost-api';
@@ -3212,7 +3385,11 @@ function requestRelayShutdown({ reason = 'manual-request', requestedBy = 'localh
   const tryShutdownWhenIdle = () => {
     if (runtimeShutdownStarted) return;
     const counts = queueCounts();
-    const queueFree = (counts.pendingCount + counts.processingCount + counts.parkedCount) === 0;
+    // A row queued for a session whose launches the relay has stopped
+    // retrying makes no progress until somebody presses Retry; it must not
+    // hold the restart (which, fresh, is itself the next launch attempt).
+    const stalledPending = countPendingRowsOfStoppedSessions();
+    const queueFree = (counts.pendingCount - stalledPending + counts.processingCount + counts.parkedCount) <= 0;
     if (!queueFree) return;
     const requestInfo = pendingRelayShutdownRequest;
     pendingRelayShutdownRequest = null;
@@ -4964,12 +5141,19 @@ function collectHostActivity({ request = null } = {}) {
     if (!conversationId) continue;
     hostSuspendWatchedConversationIds.add(conversationId);
     const count = Number(row.cnt || 0);
+    // A turn paused at the Claude usage limit is work still owed: the host
+    // stays up for one that resumes by itself, not for one that waits for
+    // the user.
+    const pause = count === 1 ? usageLimitPauseService.getPause(conversationId) : null;
+    if (pause && !pause.auto) continue;
     blockers.push({
       kind: 'turn',
       conversationId,
       title: hostActivityTitle(conversationId, row.title),
       count,
-      detail: count > 1 ? `${count} turns running` : 'turn running',
+      detail: pause
+        ? `turn paused at the Claude ${pause.label} until ${pause.resumeAt}`
+        : (count > 1 ? `${count} turns running` : 'turn running'),
     });
   }
   for (const [key, entry] of backgroundTaskStore.sets) {
@@ -5017,6 +5201,15 @@ const hostSuspendService = createHostSuspendService({
   },
 });
 
+const usageLimitPauseService = createUsageLimitPauseService({
+  db,
+  stmts,
+  emit: (event, payload) => io.emit(event, payload),
+  // A follow-up resumed by hand is due at once: wake its worker.
+  onQueueChanged: (reason) => { void primePendingSessionWorkers(reason); },
+  logger: console,
+});
+
 // The live turn among a conversation's processing rows. Mid-turn steering can
 // leave several processing at once — the running turn, steered messages the
 // CLI folded into it (no output of their own), a handed-off row still settling
@@ -5832,6 +6025,7 @@ async function requestSessionWorkerSocketDelivery({ sessionId, pid, reason = 'wo
     defaultRelayMode: DEFAULT_RELAY_MODE,
     defaultModel: DEFAULT_MODEL,
     getCursorProviderSettings,
+    getClaudeCloudProviderSettings,
   });
   if (out?.ownerSessionId) {
     const worker = sessionWorkerRegistry?.getWorker?.(out.ownerSessionId) || null;
@@ -5871,6 +6065,19 @@ async function requestSessionWorkerSocketDelivery({ sessionId, pid, reason = 'wo
           // keys are always present here.
           thinkingEnabled: parseThinkingEnabled(conv?.thinking_enabled),
           thinkingDisplay: parseThinkingDisplay(conv?.thinking_display),
+          // What this session's commits and PRs say (Claude and Claude
+          // Cloud): the finished settings object, or null for the CLI's own
+          // attribution. Always present on such a delivery, so the worker can
+          // tell "left as it was" (absent) from "vanilla" (null).
+          ...((() => {
+            const deliveredProvider = String(out.providerType || '').trim().toLowerCase();
+            if (deliveredProvider !== 'claude' && deliveredProvider !== 'claude-cloud') return {};
+            return {
+              attribution: claudeAttributionForConversation(conv, out.providerModel || out.model, {
+                relayFolderFallback: deliveredProvider === 'claude',
+              }),
+            };
+          })()),
         };
       })()),
     },
@@ -5929,19 +6136,21 @@ async function recoverUndeliveredSessionWorkerMessage({ pending = null, sessionI
 
 const WORKER_DEATH_GRACE_MS = 15_000;
 
-function isWorkerSessionProcessAlive(sessionId, hintPid = null) {
+async function isWorkerSessionProcessAlive(sessionId, hintPid = null) {
   // A merely-retained socket is not proof of life: a dead worker's socket
   // lingers until its close event lands, and counting it stalled recovery.
   // The socket only counts with a recent heartbeat or a PID that probes
   // alive; otherwise fall through to the process probes below.
   if (sessionWorkerWebSocketService?.hasLiveWorkerSocket?.(sessionId)) return true;
-  try {
-    if (sessionWorkerProcessInspector?.findProcessForSession?.(sessionId)) return true;
-  } catch {}
+  // The pids first: they cost nothing. The process list last: on win32 it is
+  // a PowerShell run (off the thread, shared and cached by the inspector).
   const registryPid = Number(sessionWorkerRegistry?.getWorker?.(sessionId)?.pid || 0);
   if (registryPid > 0 && isProcessAlive(registryPid)) return true;
   const pid = Number(hintPid || 0);
   if (pid > 0 && isProcessAlive(pid)) return true;
+  try {
+    if (await sessionWorkerProcessInspector?.findProcessForSessionAsync?.(sessionId)) return true;
+  } catch {}
   return false;
 }
 
@@ -6009,10 +6218,10 @@ function handleWorkerSocketClosed({ sessionId, pid = null } = {}) {
   // when it owned no rows (the hold can outlive them, e.g. a continuation's).
   const heldSteering = Boolean(sessionWorkerRegistry?.getWorker?.(sid)?.steering);
   if (!owned.length && !heldSteering) return;
-  const timer = setTimeout(() => {
+  const timer = setTimeout(async () => {
     try {
       if (runtimeShutdownStarted) return;
-      if (isWorkerSessionProcessAlive(sid, pid)) return; // reconnect or socket flap
+      if (await isWorkerSessionProcessAlive(sid, pid)) return; // reconnect or socket flap
       sessionWorkerRegistry?.clearSteering?.(sid);
       const stillOwned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
       if (!stillOwned.length) return;
@@ -6025,15 +6234,28 @@ function handleWorkerSocketClosed({ sessionId, pid = null } = {}) {
   timer.unref?.();
 }
 
-function sweepDeadWorkerProcessingRows() {
+// One sweep at a time: a slow process list must not pile sweeps up.
+let deadWorkerSweepInFlight = false;
+async function sweepDeadWorkerProcessingRows() {
   if (featureFlags?.SESSION_WORKER_ROUTING_ENABLED !== true) return 0;
   if (runtimeShutdownStarted) return 0;
+  if (deadWorkerSweepInFlight) return 0;
+  deadWorkerSweepInFlight = true;
+  try {
+    return await sweepDeadWorkerProcessingRowsOnce();
+  } finally {
+    deadWorkerSweepInFlight = false;
+  }
+}
+
+async function sweepDeadWorkerProcessingRowsOnce() {
   const owners = stmts.listProcessingOwnerSessionIds?.all?.(25) || [];
   let recovered = 0;
   for (const owner of owners) {
     const sid = String(owner?.sdk_session_id || '').trim();
     if (!sid) continue;
-    if (isWorkerSessionProcessAlive(sid)) continue;
+    // The owners share one list: the inspector caches it for a moment.
+    if (await isWorkerSessionProcessAlive(sid)) continue;
     console.warn(`${runtimeLogPrefix()}WORKER DEAD session=${sid.slice(0, 8)} trigger=sweep — recovering owned turns`);
     recovered += recoverDeadWorkerProcessingRows(sid, 'sweep');
   }
@@ -6057,7 +6279,11 @@ const sessionWorkerWebSocketService = createSessionWorkerWebSocketService({
   pollIntervalMs: 500,
   logger: console,
 });
-runtimeTimers.deadWorkerSweep = setInterval(sweepDeadWorkerProcessingRows, 30_000);
+runtimeTimers.deadWorkerSweep = setInterval(() => {
+  sweepDeadWorkerProcessingRows().catch((error) => {
+    console.warn(`${runtimeLogPrefix()}WORKER SWEEP failed: ${error?.message || error}`);
+  });
+}, 30_000);
 if (typeof runtimeTimers.deadWorkerSweep.unref === 'function') runtimeTimers.deadWorkerSweep.unref();
 const tmuxInspectorAccessPolicy = createTmuxInspectorAccessPolicy({
   sessionWorkerRegistry,
@@ -6182,6 +6408,9 @@ const runtimeState = {
   get ttyConsoleActive() { return Boolean(ttyConsoleRuntime?.tty); },
   get relayShutdown() { return getRelayShutdownState(); },
   get hostSuspend() { return hostSuspendService.getState(); },
+  get usageLimit() {
+    return { account: usageLimitPauseService.getAccountState(), pauses: usageLimitPauseService.listPauses() };
+  },
   get activeBridgeOwner() { return relayBridgeOwnerService.getOwner(); },
   get workerWebSocketStatus() { return sessionWorkerWebSocketService.status(); },
   get tmuxInspectorStatus() { return tmuxInspectorSocketService.status(); },
@@ -6198,6 +6427,8 @@ const windowsBootAutostartService = createWindowsBootAutostartService({
 });
 
 const gitChangesService = createGitChangesService();
+// GET /api/git/remote: where a folder lives on GitHub (New Chat, Claude Cloud).
+const gitRemoteService = createGitRemoteService({ gitChangesService });
 
 // ─── Remote Relays ────────────────────────────────────────────────────────────
 // Other OAR relays this one is paired with, so its agents can work there. Built
@@ -6238,7 +6469,7 @@ const remoteRelayPairing = createRemoteRelayPairing({
 });
 // What the inbound routes need: no tokens, only ids, names and state.
 const remoteRelayInbound = {
-  listRelays: () => remoteRelayRegistry.list().map(({ id, name, url, lastStatus, version }) => ({ id, name, url, lastStatus, version })),
+  listRelays: () => remoteRelayRegistry.list().map(({ id, relayId, name, url, lastStatus, version }) => ({ id, relayId, name, url, lastStatus, version })),
   selfNames: () => [remoteRelayRegistry.selfName()],
   inboundEnabled: () => remoteRelayRegistry.getSelfSettings().inboundEnabled,
   recordUnlock: (conversationId, relayId, messageId) => remoteRelayRepository?.recordUnlock(conversationId, relayId, messageId) ?? false,
@@ -6263,9 +6494,18 @@ const remoteRelayCallerContext = createRemoteRelayCallerContext({
   uuid: uuidv4,
   logger: console,
 });
+// Agent sessions: this relay as a target of its own agents. Their calls reach
+// the routes below in-process, the way a paired relay's reach them over HTTP.
+const remoteRelayLoopbackClient = createRemoteRelayLoopbackClient({
+  handle: (req, res) => app(req, res),
+  getOwnRelayId: () => remoteRelayRegistry.instanceId(),
+  getOwnToken: () => config.authToken,
+});
 const remoteRelayDispatcher = createRemoteRelayDispatcher({
   registry: remoteRelayRegistry,
   client: remoteRelayClient,
+  localClient: remoteRelayLoopbackClient,
+  getAgentSessionsSettings: () => remoteRelayRegistry.getAgentSessionsSettings(),
   repository: remoteRelayRepository,
   getCallerContext: (conversationId) => remoteRelayCallerContext.getCallerContext(conversationId),
   requestApproval: (request) => remoteRelayCallerContext.requestApproval(request),
@@ -6277,6 +6517,7 @@ const remoteRelayDispatcher = createRemoteRelayDispatcher({
 const sharedRouteDeps = {
   auth,
   gitChangesService,
+  gitRemoteService,
   currentWorkspaceRootPath,
   io,
   db,
@@ -6339,6 +6580,12 @@ const sharedRouteDeps = {
   getGrokProviderSettings,
   setGrokProviderSettings,
   refreshGrokProviderModels,
+  getClaudeCloudProviderSettings,
+  claudeCloudSettingsService,
+  claudeCloudSessionService,
+  claudeCloudRepoService,
+  // The login's state for the workers' nudge route (never the token).
+  claudeCloudLoginStatus: { describe: () => claudeCloudCredentials.describe() },
   reconcileUnstartedConversationProviders,
   rebindUnstartedOpenAIConversationModel,
   getOrCreateConversation,
@@ -6426,6 +6673,7 @@ const sharedRouteDeps = {
   getCursorDashboardTokenSettings,
   setCursorDashboardTokenSettings,
   planUsageService,
+  claudeAccountUsageService,
   getCursorPlanAllowanceSettings,
   setCursorPlanAllowanceSettings,
   getGrokPlanAllowanceSettings,
@@ -6461,6 +6709,7 @@ const sharedRouteDeps = {
   relayShutdownStatePayload,
   hostSuspendService,
   collectHostActivity,
+  usageLimitPauseService,
   markSharedViewerPresence,
   getSharedWatcherCount,
   statusEventService,
@@ -6483,6 +6732,7 @@ registerAskUserRoutes(app, sharedRouteDeps);
 registerRelayBoardRoutes(app, sharedRouteDeps);
 registerCacheRoutes(app, sharedRouteDeps);
 registerGitRoutes(app, sharedRouteDeps);
+registerClaudeCloudRoutes(app, sharedRouteDeps);
 registerPushRoutes(app, {
   auth,
   pushDispatchService,
@@ -6635,7 +6885,16 @@ function auth(req, res, next) {
 function getOrCreateConversation(id, firstLine) {
   const now = new Date().toISOString();
   stmts.insertConv.run(id, (firstLine || 'Untitled').slice(0, 80), now, now);
-  return stmts.getConv.get(id);
+  const conv = stmts.getConv.get(id);
+  // A message into an archived conversation (an agent's, through a paired
+  // relay, say) brings it back to the live list: its worker starts again
+  // for the delivery, and an archived chat must not work unseen.
+  if (conv && Number(conv.archived || 0) === 1 && typeof stmts.unarchiveConv?.run === 'function') {
+    stmts.unarchiveConv.run(now, id);
+    io.emit('conversation_archived', { conversationId: id, archived: false });
+    return stmts.getConv.get(id);
+  }
+  return conv;
 }
 
 function ensureRuntimeSessionBinding(
@@ -6685,10 +6944,14 @@ function ensureRuntimeSessionBinding(
         ? 'cursor'
         : (normalizedRequestedProviderType === 'grok'
           ? 'grok'
-          : (normalizedRequestedProviderType === 'github'
-            ? 'github'
-            : (openAISettings?.enabled ? 'openai' : 'github')))));
-  const resolvedProviderModel = (resolvedProviderType === 'openai' || resolvedProviderType === 'claude' || resolvedProviderType === 'cursor' || resolvedProviderType === 'grok')
+          // Without this entry a `claude-cloud` request would fall to the
+          // default below and bind a GitHub (Copilot CLI) session.
+          : (normalizedRequestedProviderType === 'claude-cloud'
+            ? 'claude-cloud'
+            : (normalizedRequestedProviderType === 'github'
+              ? 'github'
+              : (openAISettings?.enabled ? 'openai' : 'github'))))));
+  const resolvedProviderModel = (resolvedProviderType === 'openai' || resolvedProviderType === 'claude' || resolvedProviderType === 'cursor' || resolvedProviderType === 'grok' || resolvedProviderType === 'claude-cloud')
     ? (String(providerModel || normalizedModel || '').trim() || null)
     : null;
   try {
@@ -6851,6 +7114,7 @@ io.on('connection', (socket) => {
   // Pending host suspend / relay restart banners must survive a reconnect.
   try { socket.emit('host_suspend_state', hostSuspendService.getState()); } catch {}
   try { socket.emit('relay_shutdown_state', relayShutdownStatePayload()); } catch {}
+  try { socket.emit(USAGE_LIMIT_ACCOUNT_SOCKET_EVENT, usageLimitPauseService.getAccountState()); } catch {}
   // Visibility heartbeats for push suppression; also clears a stale
   // deviceVisible flag restored by connectionStateRecovery.
   activeDeviceTracker.registerSocket(socket);