@oar-sh/oar 0.9.7 → 0.9.9

package/server/public/manifest.webmanifest

@@ -7,11 +7,11 @@
   "scope": "./",
   "display_override": ["standalone"],
   "display": "standalone",
-  "background_color": "#161b22",
-  "theme_color": "#161b22",
+  "background_color": "#0d1117",
+  "theme_color": "#0d1117",
   "icons": [
     {
-      "src": "app-icon.svg?v=25",
+      "src": "app-icon.svg?v=26",
       "sizes": "any",
       "type": "image/svg+xml",
       "purpose": "any"
@@ -27,6 +27,12 @@
       "sizes": "512x512",
       "type": "image/png",
       "purpose": "any"
+    },
+    {
+      "src": "app-icon-maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
     }
   ]
 }

package/server/public/sw.js

@@ -13,6 +13,11 @@ const STATIC_ASSETS = [
   'app-icon-512.png',
   'favicon.ico',
   'app-icon.svg',
+  'app-icon-light-192.png',
+  'app-icon-light-512.png',
+  'app-icon-light.svg',
+  'app-icon-maskable-512.png',
+  'app-icon-light-maskable-512.png',
 ];
 
 function sameOrigin(url) {
@@ -26,7 +31,7 @@ function isApiRequest(url) {
 function isPwaMetadataRequest(url) {
   if (!url.pathname.startsWith(REGISTRATION_SCOPE_PATH)) return false;
   const relativePath = url.pathname.slice(REGISTRATION_SCOPE_PATH.length);
-  return /^(?:manifest\.webmanifest|app-icon(?:-\d+)?\.png|app-icon\.svg|favicon\.ico)$/.test(relativePath);
+  return /^(?:manifest\.webmanifest|app-icon(?:-light)?(?:-maskable)?(?:-\d+)?\.(?:png|svg)|favicon\.ico)$/.test(relativePath);
 }
 
 function isApplicationModuleRequest(url) {

package/server/repositories/message-pin-statements.mjs

@@ -0,0 +1,39 @@
+'use strict';
+
+// Pinned messages: the pinned_at column detection and its SQL in one place.
+// The statements are null on a database the 0008 migration has not reached
+// yet; every caller treats that as "no pins".
+export function createMessagePinStatements(db) {
+  const messageColumns = new Set(
+    db.prepare(`PRAGMA table_info(messages)`).all().map((column) => String(column?.name || '').trim()),
+  );
+  const messagesSupportPins = messageColumns.has('pinned_at');
+  if (!messagesSupportPins) {
+    return {
+      messagesSupportPins,
+      setMessagePinnedAt: null,
+      listPinnedMessages: null,
+      countPinnedMessages: null,
+    };
+  }
+  return {
+    messagesSupportPins,
+    setMessagePinnedAt: db.prepare(`
+      UPDATE messages
+      SET pinned_at = ?
+      WHERE id = ? AND conversation_id = ?
+    `),
+    // Conversation order, not pin order: the list reads like a table of contents.
+    listPinnedMessages: db.prepare(`
+      SELECT id, role, text, mode, attachments, timestamp, pinned_at, hidden_from_shares
+      FROM messages
+      WHERE conversation_id = ? AND pinned_at IS NOT NULL
+      ORDER BY timestamp ASC
+    `),
+    countPinnedMessages: db.prepare(`
+      SELECT COUNT(*) AS cnt
+      FROM messages
+      WHERE conversation_id = ? AND pinned_at IS NOT NULL
+    `),
+  };
+}

package/server/repositories/message-repository.mjs

@@ -1,10 +1,12 @@
 'use strict';
 
 import { createShareVisibilityStatements } from './share-visibility-statements.mjs';
+import { createMessagePinStatements } from './message-pin-statements.mjs';
 import { sessionWorkerProviderSqlList } from '../../shared/provider-routing.mjs';
 
 export function createMessageRepository(db) {
     const shareVisibility = createShareVisibilityStatements(db);
+    const messagePins = createMessagePinStatements(db);
     const queueHasImageOperationId = db.prepare(`PRAGMA table_info(queue)`).all()
         .some((column) => column.name === 'image_operation_id');
     // A turn paused at the Claude usage limit (usage-limit-pause-service): a
@@ -27,6 +29,9 @@ export function createMessageRepository(db) {
         getSharedMessages: shareVisibility.getSharedMessages,
         getMessageByConversation: db.prepare(`SELECT * FROM messages WHERE id = ? AND conversation_id = ? LIMIT 1`),
         setMessageShareVisibility: shareVisibility.setMessageShareVisibility,
+        setMessagePinnedAt: messagePins.setMessagePinnedAt,
+        listPinnedMessages: messagePins.listPinnedMessages,
+        countPinnedMessages: messagePins.countPinnedMessages,
         getLatestConversationModel: db.prepare(`SELECT model FROM messages WHERE conversation_id = ? AND model IS NOT NULL AND model != '' ORDER BY timestamp DESC LIMIT 1`),
         getRecentMessagesDesc: db.prepare(`SELECT id, role, text, timestamp FROM messages WHERE conversation_id = ? ORDER BY timestamp DESC LIMIT ?`),
         insertMsg:      db.prepare(`INSERT INTO messages (id, conversation_id, role, text, model, mode, attachments, timestamp, model_requested, model_actual, model_origin) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),

package/server/routes/messages-routes.mjs

@@ -5,7 +5,7 @@ import path from 'path';
 import { randomUUID } from 'crypto';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
 import { resolveUploadMimeType } from '../services/mime-sniffer.mjs';
-import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
+import { fileVersionToken, serveFileWithRangeSupport, withFileVersion } from '../services/file-serving.mjs';
 import {
   shouldParkForRestart,
   parkPendingQueueForRestart,
@@ -71,6 +71,11 @@ const STRANDED_SESSION_HEARTBEAT_FRESH_MS = 15_000;
 const RELAY_QUESTION_FINALIZATION_HOLD_MS = 5_000;
 const AUTO_MODEL_SENTINEL = 'auto';
 const USAGE_FETCH_RETRY_DELAY_MS = 250;
+// Preview kinds whose bytes travel in the preview JSON; media and PDF are
+// fetched by the browser from the raw URL instead.
+const TEXT_PREVIEW_KINDS = new Set(['markdown', 'code', 'text']);
+// An upload's URL names its bytes (the sha256), so a kept answer stays right.
+const UPLOAD_CONTENT_CACHE_CONTROL = 'private, max-age=31536000, immutable';
 
 export function resolveOpenAIReasoningEffort(explicitReasoningEffort = '', model = '') {
   const explicit = String(explicitReasoningEffort || '').trim().toLowerCase();
@@ -1610,57 +1615,6 @@ export function cleanupPersistedGeneratedImagesForAssistantResponse({
   }
 }
 
-function serveFileWithRangeSupport(req, res, filePath, meta, { safeName, cacheDelete = null } = {}) {
-  const fileSize = meta.size;
-  const name = safeName || path.basename(filePath).replace(/"/g, '');
-  const rangeHeader = req.headers['range'];
-
-  res.setHeader('Accept-Ranges', 'bytes');
-  res.setHeader('Cache-Control', 'no-store');
-  // Neutralize browser-executable types (HTML/SVG/XML), force nosniff, and
-  // sandbox the response so a worker-written workspace file can't run as script
-  // on this origin. Media stays inline for preview; everything else downloads.
-  applySafeServedContentHeaders(res, meta.contentType, { fileName: name });
-
-  const onStreamError = (error) => {
-    if (cacheDelete) cacheDelete(filePath);
-    if (res.headersSent) { res.destroy(error); return; }
-    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
-      res.status(404).json({ error: 'File not found' });
-      return;
-    }
-    res.status(500).json({ error: 'Failed to read file' });
-  };
-
-  if (rangeHeader) {
-    const match = /bytes=(\d+)-(\d*)/.exec(rangeHeader);
-    if (!match) {
-      res.setHeader('Content-Range', `bytes */${fileSize}`);
-      res.status(416).end();
-      return;
-    }
-    const start = parseInt(match[1], 10);
-    const end = match[2] ? parseInt(match[2], 10) : fileSize - 1;
-    if (start > end || start >= fileSize || end >= fileSize) {
-      res.setHeader('Content-Range', `bytes */${fileSize}`);
-      res.status(416).end();
-      return;
-    }
-    const chunkSize = end - start + 1;
-    res.setHeader('Content-Range', `bytes ${start}-${end}/${fileSize}`);
-    res.setHeader('Content-Length', String(chunkSize));
-    res.status(206);
-    const stream = fs.createReadStream(filePath, { start, end });
-    stream.on('error', onStreamError);
-    stream.pipe(res);
-  } else {
-    res.setHeader('Content-Length', String(fileSize));
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', onStreamError);
-    stream.pipe(res);
-  }
-}
-
 // Structural sanitizer for the workflow-progress digest a Claude session
 // worker attaches to its background-task rows (docs/plans/workflow-progress-tree.md,
 // Phase 2). The relay never trusts worker JSON: strings are trimmed and
@@ -1769,6 +1723,10 @@ export function registerMessagesRoutes(app, deps) {
     fetchLinuxDirectoryEntries,
     mapLinuxDirectoryEntry,
     readWorkspaceFileMeta,
+    // The cache readWorkspaceFileMeta fills. The routes drop an entry when a
+    // read shows it is out of date; the name was used here without ever
+    // being handed in, so each of those paths threw a ReferenceError.
+    workspaceFileMetaCache,
     resolveWorkspaceFilePath,
     normalizeWorkspaceRelativePath,
     previewLanguageForWorkspaceFile,
@@ -3408,9 +3366,10 @@ export function registerMessagesRoutes(app, deps) {
     if (!file) return res.status(404).json({ error: 'Not found' });
     const filePath = uploadPathForSha(sha256);
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Missing file on disk' });
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
-    applySafeServedContentHeaders(res, file.mime_type, { fileName: file.name || file.file_name || '' });
-    fs.createReadStream(filePath).pipe(res);
+    serveFileWithRangeSupport(req, res, filePath, { contentType: file.mime_type }, {
+      safeName: String(file.name || file.file_name || '').replace(/"/g, ''),
+      cacheControl: UPLOAD_CONTENT_CACHE_CONTROL,
+    });
   });
 
   app.get('/api/generated-image/:conversationId/:messageId/:imageId/content', auth, (req, res) => {
@@ -3483,6 +3442,9 @@ export function registerMessagesRoutes(app, deps) {
     const filePath = resolveWorkspaceFilePath(requestedPath, rootOverride);
     if (!filePath || !normalizedPath) return res.status(400).json({ error: 'Invalid file path' });
 
+    // The preview carries the version the download link is built from, so
+    // it reads the file's metadata fresh, not from the short-lived cache.
+    workspaceFileMetaCache.delete(filePath);
     let meta = null;
     try {
       meta = readWorkspaceFileMeta(filePath);
@@ -3538,10 +3500,12 @@ export function registerMessagesRoutes(app, deps) {
       size,
       truncated,
       previewBytes: contentBuffer.length,
-      rawUrl: `${remotePath}/api/files/${normalizedWebPath.split('/').map((part) => encodeURIComponent(part)).join('/')}${scopeSuffix}`,
+      mtimeMs: meta.mtimeMs ?? null,
+      version: fileVersionToken(meta),
+      rawUrl: withFileVersion(`${remotePath}/api/files/${normalizedWebPath.split('/').map((part) => encodeURIComponent(part)).join('/')}${scopeSuffix}`, fileVersionToken(meta)),
     };
 
-    if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+    if (TEXT_PREVIEW_KINDS.has(kind)) {
       payload.content = contentBuffer.toString('utf8');
     }
 
@@ -3917,6 +3881,8 @@ export function registerMessagesRoutes(app, deps) {
       const filePath = normalizeLinuxAbsolutePath(requestedPath);
       if (!filePath) return res.status(400).json({ error: 'Invalid Linux file path' });
 
+      // Fresh metadata: the download link's version comes from this answer.
+      workspaceFileMetaCache.delete(filePath);
       let meta = null;
       try {
         meta = readWorkspaceFileMeta(filePath);
@@ -3969,10 +3935,12 @@ export function registerMessagesRoutes(app, deps) {
         size,
         truncated,
         previewBytes: contentBuffer.length,
-        rawUrl: `${remotePath}/api/drives/file?path=${encodeURIComponent(filePath)}`,
+        mtimeMs: meta.mtimeMs ?? null,
+        version: fileVersionToken(meta),
+        rawUrl: withFileVersion(`${remotePath}/api/drives/file?path=${encodeURIComponent(filePath)}`, fileVersionToken(meta)),
       };
 
-      if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+      if (TEXT_PREVIEW_KINDS.has(kind)) {
         payload.content = contentBuffer.toString('utf8');
       }
 
@@ -3989,6 +3957,8 @@ export function registerMessagesRoutes(app, deps) {
         return res.status(400).json({ error: 'Invalid drive file path' });
       }
 
+      // Fresh metadata: the download link's version comes from this answer.
+      workspaceFileMetaCache.delete(filePath);
       let meta = null;
       try {
         meta = readWorkspaceFileMeta(filePath);
@@ -4043,10 +4013,12 @@ export function registerMessagesRoutes(app, deps) {
         size,
         truncated,
         previewBytes: contentBuffer.length,
-        rawUrl: `${remotePath}/api/drives/file?path=${encodeURIComponent(normalizedWebPath)}`,
+        mtimeMs: meta.mtimeMs ?? null,
+        version: fileVersionToken(meta),
+        rawUrl: withFileVersion(`${remotePath}/api/drives/file?path=${encodeURIComponent(normalizedWebPath)}`, fileVersionToken(meta)),
       };
 
-      if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+      if (TEXT_PREVIEW_KINDS.has(kind)) {
         payload.content = contentBuffer.toString('utf8');
       }
 
@@ -5147,7 +5119,9 @@ export function registerMessagesRoutes(app, deps) {
           // in either must reach the status payload (composer gate, bubble
           // Cancel), so it counts as a change like the hold fields do.
           || (stored.supported === true) !== (steering.supported === true)
-          || storedCancellableIds.join('\n') !== steering.cancellableIds.join('\n');
+          || storedCancellableIds.join('\n') !== steering.cancellableIds.join('\n')
+          // The running CLI's compaction window (context-usage modal).
+          || JSON.stringify(stored.autoCompactWindow ?? null) !== JSON.stringify(steering.autoCompactWindow ?? null);
         if (workerForSteering && changed) {
           sessionWorkerRegistry?.upsertWorker?.({ ...workerForSteering, steering });
           // Pushed rather than left for the clients' status poll: the

package/server/routes/sessions-routes.mjs

@@ -7,8 +7,9 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 import { randomUUID } from 'crypto';
 import { createSdkSessionSyncService } from '../services/sdk-session-sync-service.mjs';
-import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
+import { serveFileWithRangeSupport } from '../services/file-serving.mjs';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
+import { MESSAGE_PIN_LIMIT, buildPinList } from '../services/message-pin-list.mjs';
 import { persistConversationPreferences } from '../services/conversation-preferences-service.mjs';
 import { parseAutoCompactWindow } from '../../shared/auto-compact-window.mjs';
 import { CLAUDE_ATTRIBUTION_MODES, DEFAULT_CLAUDE_ATTRIBUTION_MODE, claudeAttributionModelLabel, claudeAttributionTrailer, normalizeClaudeAttributionMode, resolveClaudeAttributionMode } from '../../shared/claude-attribution.mjs';
@@ -21,7 +22,7 @@ import {
   withClaudeUltracodeTier,
 } from '../services/provider-reasoning-effort.mjs';
 import { mapUsageSnapshotRow, fetchUsageSummaryPromise } from '../services/usage-snapshot-helpers.mjs';
-import { readStoredClaudeContextUsage } from '../services/claude-context-usage.mjs';
+import { readStoredClaudeContextUsage, resolveAutoCompactWindowStatus } from '../services/claude-context-usage.mjs';
 import { buildContextUsageView } from '../services/context-usage-view.mjs';
 import { cleanupGeneratedImagesForConversation as cleanupGeneratedImagesForConversationDefault } from '../services/generated-image-cleanup-service.mjs';
 import { stopSessionWorkerProcesses } from '../services/session-worker-stop-service.mjs';
@@ -88,6 +89,9 @@ const SESSION_WORKER_STATUS_QUEUE_STATES = Object.freeze(['pending', 'processing
 // Registry statuses that mean "this worker is currently running" (same triple
 // as countActiveCliWorkers in server-runtime.mjs).
 const SESSION_WORKER_ACTIVE_STATUSES = Object.freeze(['starting', 'ready', 'processing']);
+// A shared attachment's URL names its bytes (sha256 or a fixed generated-image
+// path), so a kept answer stays right.
+const SHARED_CONTENT_CACHE_CONTROL = 'private, max-age=31536000, immutable';
 
 function normalizeWorkerStatusText(value, fallback = null) {
   const text = String(value || '').trim();
@@ -1834,6 +1838,7 @@ export function buildConversationMessages({
           attachments: message?.attachments || [],
           mode: message?.mode || undefined,
           hiddenFromShares: Number(message?.hidden_from_shares || 0) === 1,
+          pinned: !!message?.pinned_at,
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
@@ -2218,6 +2223,23 @@ export function registerSessionsRoutes(app, deps) {
       AND (id = ? OR response_message_id = ?)
     LIMIT 1
   `);
+  function listConversationPins(conversationId) {
+    return buildPinList(stmts.listPinnedMessages?.all?.(conversationId) || []);
+  }
+  // Orders the pin lists a browser receives. A conversation load that left
+  // before a pin change can arrive after the change's own socket event; with
+  // the revision the browser can tell the older list from the newer one. In
+  // memory only: a restart starts above every revision handed out before.
+  const pinRevisionFloor = Date.now();
+  const pinRevisionByConversation = new Map();
+  function conversationPinRevision(conversationId) {
+    return pinRevisionByConversation.get(conversationId) || pinRevisionFloor;
+  }
+  function bumpConversationPinRevision(conversationId) {
+    const next = Math.max(Date.now(), conversationPinRevision(conversationId) + 1);
+    pinRevisionByConversation.set(conversationId, next);
+    return next;
+  }
   const listSessionWorkerQueueRows = db.prepare(`
     SELECT id, conversation_id, runtime_session_id, owner_sdk_session_id, status
     FROM queue
@@ -2712,7 +2734,9 @@ export function registerSessionsRoutes(app, deps) {
     });
     messages = messages.map((message) => {
       const sourceMessageId = responseMessageToSourceId.get(String(message.id || '').trim()) || message.sourceMessageId || undefined;
-      const withSource = sourceMessageId ? { ...message, sourceMessageId } : message;
+      // Pins are the owner's bookmarks: a public share never learns of them.
+      const { pinned: _pinned, ...unpinnedMessage } = message;
+      const withSource = sourceMessageId ? { ...unpinnedMessage, sourceMessageId } : unpinnedMessage;
       // A public share never shows another relay's address or ids.
       const nextMessage = withSource.origin
         ? { ...withSource, origin: publicRemoteRelayOrigin(withSource.origin) }
@@ -3212,6 +3236,7 @@ export function registerSessionsRoutes(app, deps) {
         return {
           snapshot: stored.snapshot,
           contextUsage: stored.contextUsage,
+          modelContextLimit: stored.modelContextLimit,
           eventsPath: null,
           error: stored.snapshot
             ? null
@@ -3231,6 +3256,15 @@ export function registerSessionsRoutes(app, deps) {
     const conversationRow = resolveConversationByIdOrSdkSessionId(
       String(runtimeSession?.conversation_id || '').trim() || lookupId,
     );
+    const autoCompactWindow = parseAutoCompactWindow(conversationRow?.auto_compact_window);
+    // Only the local Claude worker runs a CLI whose window the slider sets;
+    // it reports that CLI on its heartbeat's steering snapshot.
+    const windowStatus = resolveAutoCompactWindowStatus({
+      storedWindow: autoCompactWindow,
+      steering: providerType === 'claude' && copilotSessionId
+        ? sessionWorkerRegistry?.getWorker?.(copilotSessionId)?.steering || null
+        : null,
+    });
 
     return {
       conversationId: lookupId,
@@ -3238,7 +3272,10 @@ export function registerSessionsRoutes(app, deps) {
       // for the modal's refresh handle), so the id a preferences PATCH needs is
       // reported separately.
       resolvedConversationId: conversationRow?.id || null,
-      autoCompactWindow: parseAutoCompactWindow(conversationRow?.auto_compact_window),
+      autoCompactWindow,
+      activeAutoCompactWindow: windowStatus.activeAutoCompactWindow,
+      autoCompactWindowDeferred: windowStatus.autoCompactWindowDeferred,
+      modelContextLimit: parsed.modelContextLimit ?? null,
       thinkingEnabled: parseThinkingEnabled(conversationRow?.thinking_enabled),
       thinkingDisplay: parseThinkingDisplay(conversationRow?.thinking_display),
       // What this folder's Claude commits say (the 🧠 modal's override row).
@@ -3587,6 +3624,9 @@ export function registerSessionsRoutes(app, deps) {
       cloud: conversationCloudPayload(conv, runtimeSession),
       messages: history.messages,
       pageInfo: history.pageInfo,
+      // A re-import can move a pin onto a new message id.
+      pins: listConversationPins(conversationId),
+      pinsRevision: conversationPinRevision(conversationId),
       refreshed: true,
     });
   });
@@ -3764,20 +3804,14 @@ export function registerSessionsRoutes(app, deps) {
     if (!file) return res.status(404).json({ error: 'Shared attachment not found' });
     const filePath = uploadPathForSha(sha256);
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Missing file on disk' });
-    // Unauthenticated share viewers: neutralize executable types (HTML/SVG),
-    // force nosniff + sandbox so an attachment can't run as script on this origin.
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
+    // Unauthenticated share viewers: the serving helper neutralizes executable
+    // types (HTML/SVG) and forces nosniff + sandbox so an attachment can't run
+    // as script on this origin; ranges let a shared video seek.
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, file.mime_type, { fileName: file.name || file.file_name || '' });
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: file.mime_type }, {
+      safeName: String(file.name || file.file_name || '').replace(/"/g, ''),
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   app.get('/api/shared/:token/generated-image/:messageId/:imageId/content', (req, res) => {
@@ -3819,18 +3853,10 @@ export function registerSessionsRoutes(app, deps) {
       return res.status(404).json({ error: 'Shared attachment not found' });
     }
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Shared attachment not found' });
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, attachment.type);
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: attachment.type }, {
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   // GET /api/conversation/:id — get paginated conversation history
@@ -3987,6 +4013,9 @@ export function registerSessionsRoutes(app, deps) {
       backgroundTasks: backgroundTaskStore?.get?.(resolvedConversationId) || [],
       usageLimitPause: usageLimitPauseService?.getPause?.(resolvedConversationId) || null,
       previews: listConversationPreviews?.(resolvedConversationId) || [],
+      // Every pin of the conversation, also those outside this history page.
+      pins: listConversationPins(resolvedConversationId),
+      pinsRevision: conversationPinRevision(resolvedConversationId),
       preferredRelayMode: preferences.preferredRelayMode,
       preferredModel: preferences.preferredModel,
       preferredReasoningEffort: preferences.preferredReasoningEffort,
@@ -4046,6 +4075,57 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // Pin or unpin one message. Unlike share visibility this may change while
+  // the message's turn runs (nothing public depends on it), and every open
+  // client learns of it through the socket instead of reloading.
+  app.patch('/api/conversation/:id/message/:messageId/pin', auth, (req, res) => {
+    const conversationId = String(req.params.id || '').trim();
+    const messageId = String(req.params.messageId || '').trim();
+    if (!conversationId || !messageId) {
+      return res.status(400).json({ error: 'Missing conversation or message id' });
+    }
+    if (typeof req.body?.pinned !== 'boolean') {
+      return res.status(400).json({ error: 'pinned must be a boolean' });
+    }
+
+    const conv = stmts.getConvAnyStatus.get(conversationId);
+    if (!conv || String(conv.status || '').trim().toLowerCase() === 'deleted') {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+    const message = stmts.getMessageByConversation?.get(messageId, conversationId) || null;
+    if (!message) return res.status(404).json({ error: 'Message not found' });
+    if (!stmts.setMessagePinnedAt || !stmts.countPinnedMessages) {
+      return res.status(503).json({ error: 'Pinning messages is unavailable until the relay restarts' });
+    }
+
+    const pinned = req.body.pinned === true;
+    const currentlyPinned = !!message.pinned_at;
+    if (currentlyPinned !== pinned) {
+      if (pinned && Number(stmts.countPinnedMessages.get(conversationId)?.cnt || 0) >= MESSAGE_PIN_LIMIT) {
+        return res.status(409).json({
+          error: `This conversation already has ${MESSAGE_PIN_LIMIT} pinned messages. Unpin one first.`,
+          code: 'pin-limit',
+          limit: MESSAGE_PIN_LIMIT,
+        });
+      }
+      stmts.setMessagePinnedAt.run(pinned ? new Date().toISOString() : null, messageId, conversationId);
+    }
+
+    const pins = listConversationPins(conversationId);
+    if (currentlyPinned !== pinned) {
+      const revision = bumpConversationPinRevision(conversationId);
+      io?.emit?.('conversation_pins_updated', { conversationId, pins, revision });
+    }
+    return res.json({
+      ok: true,
+      conversationId,
+      messageId,
+      pinned,
+      pins,
+      pinsRevision: conversationPinRevision(conversationId),
+    });
+  });
+
   app.patch('/api/conversation/:id', auth, (req, res) => {
     const conversationId = String(req.params.id || '').trim();
     const result = persistConversationTitle({
@@ -5448,6 +5528,7 @@ export function registerSessionsRoutes(app, deps) {
         reconnectAttempts: runtimeState.cloudflaredTunnelState?.reconnectAttempts ?? 0,
         connectedSince: runtimeState.cloudflaredTunnelState?.connectedSince ?? null,
         lastError: runtimeState.cloudflaredTunnelState?.lastError ?? null,
+        binaryMissing: runtimeState.cloudflaredTunnelState?.binaryMissing ?? false,
         valid: runtimeState.cloudflaredTunnelState?.valid ?? true,
       },
       workerWebSocket: runtimeState.workerWebSocketStatus || null,