@oar-sh/oar 0.9.7 → 0.9.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",
@@ -50,9 +50,9 @@
     "test:e2e:raw": "node ./node_modules/@playwright/test/cli.js test --config tests/playwright.config.mjs"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.283",
-    "@cursor/sdk": "^1.0.32",
-    "@github/copilot-sdk": "^1.0.14",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.292",
+    "@cursor/sdk": "^1.0.36",
+    "@github/copilot-sdk": "^1.0.17",
     "better-sqlite3": "^12.10.0",
     "express": "^4.18.2",
     "qrcode-terminal": "^0.12.0",
@@ -63,7 +63,6 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "cloudflared": "^0.7.1",
     "tty-console": "^1.0.4"
   },
   "devDependencies": {

package/server/README.md

@@ -658,6 +658,24 @@ images, calling the OpenAI Images API directly rather than going through a CLI w
   is never silently lost.
 - `POST /api/shared/:token/presence` tracks shared-viewer presence, surfaced as a watcher count.
 
+## Pinned messages
+
+- `PATCH /api/conversation/:id/message/:messageId/pin` with `{ pinned: boolean }` sets or clears
+  `messages.pinned_at`. A conversation holds at most 100 pins; the next one is refused with `409`
+  and `code: "pin-limit"`. The answer is
+  `{ ok, conversationId, messageId, pinned, pins, pinsRevision }`.
+- `GET /api/conversation/:id` carries `pins`: every pinned message of the conversation in
+  conversation order, also those outside the requested history page, each as
+  `{ messageId, role, preview, timestamp, pinnedAt, attachmentCount, hiddenFromShares }`.
+  `preview` is plain text of at most 160 characters. Each message also carries `pinned`.
+- Every change is broadcast as the socket event `conversation_pins_updated` with
+  `{ conversationId, pins, revision }`. `revision` (`pinsRevision` in the HTTP answers) grows with
+  every change. A conversation load that left the relay before a change can reach the browser
+  after the change's own event; the browser keeps the list with the higher revision.
+- Shared views carry neither `pins` nor `pinned`: pins are the owner's bookmarks.
+- Pins belong to message rows. `/compact` starts a new conversation without them (they stay with
+  the archived one); re-importing an imported session keeps them, matched like hidden marks.
+
 ## Relay Mode Selection
 
 The composer also includes a per-message mode picker:
@@ -973,6 +991,7 @@ Queue metrics include `parkedCount` for turns deferred behind restart/rebind gat
 | POST | `/api/subagent-run` | (Worker) Register/update a subagent run for the active turn |
 | POST | `/api/conversation/:conversationId/subagent/:subagentRunId/cancel` | Request cancellation of one subagent run (unsupported by the Claude runtime) |
 | PATCH | `/api/conversation/:id/message/:messageId/share-visibility` | Hide or unhide a single message from shared views |
+| PATCH | `/api/conversation/:id/message/:messageId/pin` | `{ pinned }` → pin or unpin a single message; answers with the conversation's pin list and broadcasts `conversation_pins_updated` |
 | POST | `/api/conversation/:id/share` | Create or update the conversation's read-only share token |
 | GET | `/api/shared/:token` | Read-only shared conversation view (hidden messages filtered out) |
 | POST | `/api/shared/:token/presence` | Report shared-viewer presence for the watcher count |
@@ -1381,7 +1400,7 @@ service).
 | `cloudflaredTunnel.enabled` | `false` | Legacy alias for mode (`true` => `managed`) |
 | `cloudflaredTunnel.required` | `false` | Pause dequeue when the Cloudflare tunnel is disconnected in managed mode |
 | `cloudflaredTunnel.token` | — | Tunnel token from the router panel (never logged) |
-| `cloudflaredTunnel.binary` | *(auto)* | `cloudflared` path; falls back to the optional npm package, then `PATH` |
+| `cloudflaredTunnel.binary` | `cloudflared` | Path or command name of the `cloudflared` you installed (OAR ships none); defaults to `cloudflared` on `PATH`. Without one the tunnel stays off and the status says how to install it |
 | `cloudflaredTunnel.extraArgs` | `[]` | Extra arguments appended to `cloudflared tunnel run` |
 | `tunnelMarkerHeaders` | `[]` | Extra edge-injected header names that mark tunnel traffic for the session-worker path guard |
 

package/server/claude-worker/claude-sdk-adapter.mjs

@@ -55,17 +55,6 @@ export function claudeUltracodeFlagSettings(effort) {
   return { ultracode: null, enableWorkflows: null, effortLevel: effort || null };
 }
 
-/**
- * The flag-settings payload that moves a live session onto another auto-compact
- * window. `null` clears the flag layer back to the CLI's model-tuned default,
- * which is exactly what "Auto" means — leaving the previous window pinned would
- * make the setting one-way.
- */
-export function claudeAutoCompactFlagSettings(autoCompactWindow) {
-  const window = normalizeAutoCompactWindow(autoCompactWindow);
-  return { autoCompactWindow: window };
-}
-
 /**
  * The flag-settings payload that pins (or clears) `alwaysThinkingEnabled` on a
  * live session.

package/server/claude-worker/claude-session-process.mjs

@@ -5,6 +5,8 @@ import { randomUUID } from 'crypto';
 import { buildClaudeUserContent } from './claude-attachments.mjs';
 import {
   compactBoundaryActivityAction,
+  compactCancelledActivityAction,
+  compactPendingActivityAction,
   createSdkMessageNormalizer,
   displayToolName,
   formatApiRetryNotice,
@@ -20,7 +22,6 @@ import {
   readPlanUsage,
   normalizeClaudeEffort,
   claudeUltracodeFlagSettings,
-  claudeAutoCompactFlagSettings,
   claudeAttributionFlagSettings,
   claudeThinkingFlagSettings,
   applyThinkingDisplay,
@@ -29,6 +30,7 @@ import {
 } from './claude-sdk-adapter.mjs';
 import { parseThinkingDisplay, parseThinkingEnabled } from '../../shared/claude-thinking.mjs';
 import { sameClaudeAttribution } from '../../shared/claude-attribution.mjs';
+import { formatAutoCompactWindowLabel } from '../../shared/auto-compact-window.mjs';
 import { relocateClaudeTranscriptForCwd } from './claude-transcript-relocator.mjs';
 import {
   attemptFields,
@@ -447,8 +449,9 @@ export function createClaudeSessionRunner({
   idleShutdownMs = 10 * 60_000,
   getBackgroundTaskTimeoutMs = () => 0,
   // The per-conversation auto-compact window (token count, null = Auto). Read
-  // per turn rather than captured, so a slider change picked up on the next
-  // delivery reaches a process that is already running.
+  // per turn rather than captured: the CLI only takes it at spawn, so a
+  // slider change picked up on the next delivery respawns an idle process
+  // (adaptProcess).
   getAutoCompactWindow = () => null,
   // What this session's commits say (shared/claude-attribution.mjs); null
   // leaves the CLI's own attribution. Piggybacked on deliveries like the
@@ -583,6 +586,10 @@ export function createClaudeSessionRunner({
   // the same misattribution as a continuation whose init follows the push.
   let settingsReinitsOwed = 0;
   let settingsWindowOpen = false;
+  // Row publishes that the process-level bookkeeping of one SDK message
+  // decided on (the compaction entries); handleSdkMessage drains them right
+  // after it, before the message's own actions.
+  const queuedProcessActions = [];
   let lastReportedDeliveryReady = true;
   // Rows whose prompt the CLI consumed and whose settle marker is being saved
   // (id → relay message). Runner-level, not per process: a process dying
@@ -801,6 +808,15 @@ export function createClaudeSessionRunner({
     // Orphan/settled-task notification lines that arrived between turns belong
     // to the turn they triggered.
     const carried = proc.pendingActivities.splice(0);
+    // A compaction's buffered boundary lands on this turn. Shown as running
+    // on another row (a delivery still waiting), it is cancelled there.
+    if (proc.compactionNotice?.boundaryCarried) {
+      if (proc.compactionNotice.ctx === ctx) proc.compactionNotice = null;
+      else {
+        const cancel = takeCompactionCancel();
+        if (cancel) void publishProcessAction(cancel);
+      }
+    }
     if (carried.length) {
       const actions = carried.map((entry) => (typeof entry === 'string'
         ? { channel: 'activity', payload: { text: entry, subagentRunId: null } }
@@ -2093,6 +2109,54 @@ export function createClaudeSessionRunner({
     return Boolean(proc.activeCtx) && !proc.activeCtx.discarded;
   }
 
+  /**
+   * The row a running compaction is shown on: the active turn's, else the
+   * delivered message waiting for the turn the CLI compacts before. A
+   * compaction between turns with nothing waiting has no row to show it on.
+   */
+  function compactionNoticeContext() {
+    if (activeContextPublishes()) return proc.activeCtx;
+    return proc.pendingDelivered.find((entry) => !entry.steered)?.ctx || null;
+  }
+
+  /**
+   * `status: 'compacting'` puts a `pending` compaction entry on that row, at
+   * most once per compaction. Queued, not published here: handleSdkMessage
+   * publishes it ahead of the frame's own actions, so it stays in stream
+   * order with the boundary that replaces it.
+   */
+  function noteCompactionStarted() {
+    if (proc.compactionNotice && !proc.compactionNotice.boundaryCarried) return;
+    // An earlier compaction whose boundary still waits for a turn: its line
+    // gives way to this one.
+    const superseded = takeCompactionCancel();
+    if (superseded) queuedProcessActions.push(superseded);
+    const ctx = compactionNoticeContext();
+    if (!ctx) return;
+    proc.compactionNotice = { ctx };
+    queuedProcessActions.push({ ctx, action: compactPendingActivityAction() });
+  }
+
+  /**
+   * A compaction that ended without a boundary (failed, compacted nothing,
+   * went stale, or its process died): the row that shows it as running gets a
+   * `cancelled` entry, which takes the line away again. Nothing when no
+   * pending entry was published, or when the boundary already followed it.
+   */
+  function takeCompactionCancel(processRef = proc) {
+    const notice = processRef?.compactionNotice;
+    if (!notice) return null;
+    processRef.compactionNotice = null;
+    if (notice.ctx.finalized || notice.ctx.discarded) return null;
+    return { ctx: notice.ctx, action: compactCancelledActivityAction() };
+  }
+
+  async function publishProcessAction({ ctx, action }) {
+    await dispatchToContext(ctx, action).catch((error) => {
+      dbg('compaction entry publish failed', error?.message || String(error));
+    });
+  }
+
   /**
    * The CLI is compacting, or just did: a delivered turn is still coming.
    * Armed only while a delivered entry is actually waiting; which turn the
@@ -2216,8 +2280,14 @@ export function createClaudeSessionRunner({
       if (String(sdkMessage.status || '') === 'compacting') {
         proc.compactingSince = Date.now();
         armCompactReplayAdoption();
+        noteCompactionStarted();
       } else if (sdkMessage.permissionMode === undefined) {
         proc.compactingSince = 0;
+        // The boundary (which clears the notice) comes BEFORE this terminator
+        // when the compaction produced one; a notice still open here means
+        // it did not (a boundary buffered for the next turn keeps its notice).
+        const cancel = proc.compactionNotice?.boundaryCarried ? null : takeCompactionCancel();
+        if (cancel) queuedProcessActions.push(cancel);
         // A compaction that failed produces no boundary and no replay: the
         // turn just carries on uncompacted and attaches the normal way, so
         // leaving the adoption window open would only widen the chance of a
@@ -2231,6 +2301,23 @@ export function createClaudeSessionRunner({
     }
     if (subtype === 'compact_boundary') {
       proc.compactingSince = 0;
+      // The boundary entry supersedes the pending one on the row it lands on.
+      // A pending entry on another row (a waiting delivery, while the
+      // boundary goes to the turn the CLI opened itself) would show that row
+      // as compacting for its whole turn, so it is cancelled there.
+      // A buffered boundary has no row yet: the notice waits for the turn
+      // that takes it (activateContext).
+      if (proc.compactionNotice) {
+        if (!activeContextPublishes()) {
+          proc.compactionNotice.boundaryCarried = true;
+        } else {
+          if (proc.compactionNotice.ctx !== proc.activeCtx) {
+            const cancel = takeCompactionCancel();
+            if (cancel) queuedProcessActions.push(cancel);
+          }
+          proc.compactionNotice = null;
+        }
+      }
       armCompactReplayAdoption();
       // The boundary is a per-turn normalizer action, but a compaction at
       // resume — exactly what lowering the window causes — lands with no
@@ -2599,6 +2686,7 @@ export function createClaudeSessionRunner({
     const suppressed = maybeSuppressStopFollowUp(sdkMessage);
     if (suppressed === 'swallow') return;
     observeProcessLevel(sdkMessage);
+    for (const queued of queuedProcessActions.splice(0)) await publishProcessAction(queued);
     if (suppressed === 'observe-only') return;
     // Its traffic opens a continuation of its own instead of attaching to the
     // stopped steer waiting in pendingDelivered (which still settles stopped).
@@ -3042,6 +3130,12 @@ export function createClaudeSessionRunner({
     // answered instead of failing over minutes later.
     reapOvertakenDeliveredEntries(now);
     reapStalePendingDelivered(now);
+    // A compaction past the staleness cap is no longer held for; neither is
+    // the line that shows it running.
+    if (proc.compactionNotice && !proc.compactionNotice.boundaryCarried && !isCompacting()) {
+      const cancel = takeCompactionCancel();
+      if (cancel) void publishProcessAction(cancel);
+    }
     if (hasLiveWork()) {
       // Track how long background tasks alone have held the process, for the
       // user-configurable timeout (0 = unlimited).
@@ -3113,6 +3207,10 @@ export function createClaudeSessionRunner({
       processRef.taskPublishTimer = null;
     }
     stopWorkflowPoller(processRef);
+    // A compaction the process died in never ends with a boundary. Published
+    // before the contexts below are settled, so the entry lands on a row that
+    // is still open.
+    const compactionCancel = takeCompactionCancel(processRef);
     // The process took its background tasks with it; clear the panel — but
     // only when this process still owns it. A superseded process clearing the
     // panel would blank the replacement's live task set.
@@ -3134,6 +3232,7 @@ export function createClaudeSessionRunner({
     for (const entry of stoppedSteers) claimSettling(entry.ctx.message, 'stopped');
     processRef.activeCtx = null;
     if (proc === processRef) proc = null;
+    if (compactionCancel) await publishProcessAction(compactionCancel);
     for (const ctx of openContexts) {
       if (ctx.finalized) continue;
       if (streamError && !processRef.aborted && !ctx.interrupted) {
@@ -3168,7 +3267,7 @@ export function createClaudeSessionRunner({
   // ---------------------------------------------------------------------------
   // Spawn / adapt
 
-  function spawnProcess(message) {
+  function spawnProcess(message, { resume: resumeOverride = '' } = {}) {
     const relayMode = message.relayMode || 'agent';
     const model = resolvePerTurnModel(message);
     const effort = normalizeClaudeEffort(message.reasoningEffort);
@@ -3227,6 +3326,9 @@ export function createClaudeSessionRunner({
       // delivered entry may still adopt the turn the CLI re-opens afterwards.
       compactingSince: 0,
       compactReplayUntil: 0,
+      // { ctx } of the row a `pending` compaction entry was published on,
+      // until the boundary or a `cancelled` entry closes it.
+      compactionNotice: null,
       // A non-spawn init that opened a turn while a delivered row waited: the
       // turn is the CLI's own, so no compaction inside it may adopt that row.
       continuationInitPending: false,
@@ -3326,7 +3428,7 @@ export function createClaudeSessionRunner({
       }
     };
 
-    const resume = String(message.claudeNativeSessionId || claudeNativeSessionId || '').trim();
+    const resume = String(resumeOverride || message.claudeNativeSessionId || claudeNativeSessionId || '').trim();
     processRef.nativeSessionId = resume;
     // The CLI resolves `resume` inside the project directory for *this* CWD, so
     // a session whose workspace root changed has to bring its transcript along
@@ -3387,7 +3489,40 @@ export function createClaudeSessionRunner({
     settingsWindowOpen = true;
   }
 
-  async function adaptProcess(message) {
+  /**
+   * Whether the process may be released for a fresh one right now: nothing
+   * would die with it or be cut off by it — no turn, no delivery in flight, no
+   * open question, no compaction, no adoption window, no background agents or
+   * shells (nor a continuation one of them just announced), no Stop guard.
+   */
+  function canReleaseForRespawn() {
+    if (!proc || proc.closing || proc.aborted) return false;
+    if (hasLiveWork() || proc.liveTasks.size) return false;
+    if (Date.now() < proc.compactReplayUntil) return false;
+    return !proc.suppressingTurn;
+  }
+
+  /**
+   * The running CLI's compaction window (the one it was spawned with) and
+   * whether background work would block the respawn that applies another
+   * one. Rides the steering snapshot; the relay compares it with the stored
+   * window to tell the modal when a change applies. Null with no process.
+   */
+  function autoCompactWindowState() {
+    if (!proc || proc.closing || proc.aborted) return null;
+    return {
+      active: proc.autoCompactWindow,
+      backgroundWork: proc.liveTasks.size > 0 || isContinuationImminent(),
+    };
+  }
+
+  /**
+   * Prepare a live process for a turn-opening delivery. Returns null when the
+   * process was released instead (the caller cold-starts a fresh one).
+   * `delivery` is the delivery's own record: a window respawn is noted on it,
+   * and at most one is taken per delivery.
+   */
+  async function adaptProcess(message, delivery = {}) {
     const relayMode = message.relayMode || 'agent';
     const model = resolvePerTurnModel(message);
     const effort = normalizeClaudeEffort(message.reasoningEffort);
@@ -3402,6 +3537,25 @@ export function createClaudeSessionRunner({
       return null;
     }
 
+    // The window is spawn-only: a running CLI ignores a flag-layer
+    // autoCompactWindow in either direction (probe 2026-10-03). A changed
+    // window is applied by releasing the process the way an idle release does
+    // and letting this delivery cold-start a fresh one on the same session.
+    // Nothing else is set on the old process first — the new one is spawned
+    // with every current setting. Blocked (background work), the delivery
+    // runs on the old process and the next turn-opening one tries again.
+    const autoCompactWindow = normalizeAutoCompactWindow(getAutoCompactWindow());
+    if (autoCompactWindow !== proc.autoCompactWindow && !delivery.windowRespawn && canReleaseForRespawn()) {
+      delivery.windowRespawn = {
+        from: proc.autoCompactWindow,
+        to: autoCompactWindow,
+        resume: String(proc.nativeSessionId || '').trim(),
+      };
+      gracefulShutdown('compact-window');
+      await drainClosingProcess(10_000);
+      return null;
+    }
+
     const permissionMode = permissionModeForRelayMode(relayMode);
     if (permissionMode !== proc.permissionMode) {
       expectSettingsReinit();
@@ -3441,20 +3595,9 @@ export function createClaudeSessionRunner({
       });
       proc.effort = effort;
     }
-    // The window is a delivery-scoped setting, not a per-message one: it only
-    // reaches a live process through the flag layer, and `null` (Auto) has to
-    // be pushed too or clearing the slider would never take effect.
-    const autoCompactWindow = normalizeAutoCompactWindow(getAutoCompactWindow());
-    if (autoCompactWindow !== proc.autoCompactWindow) {
-      expectSettingsReinit();
-      await Promise.resolve(proc.turn.applyFlagSettings?.(claudeAutoCompactFlagSettings(autoCompactWindow))).catch((error) => {
-        dbg('applyFlagSettings autoCompactWindow failed', error?.message || String(error));
-      });
-      proc.autoCompactWindow = autoCompactWindow;
-    }
-    // Attribution follows the window's pattern: a changed value (a settings
-    // change, a model switch that renames the trailer) reaches the live CLI
-    // through the flag layer, before the turn that may commit.
+    // Attribution: a changed value (a settings change, a model switch that
+    // renames the trailer) reaches the live CLI through the flag layer, before
+    // the turn that may commit.
     const attribution = getAttribution() || null;
     if (!sameClaudeAttribution(attribution, proc.attribution)) {
       if (attribution === null) {
@@ -3476,7 +3619,7 @@ export function createClaudeSessionRunner({
         proc.attribution = attribution;
       }
     }
-    // Thinking is NOT a symmetric copy of the window block: the probe
+    // Thinking is not symmetric either: the probe
     // (2026-08-26, docs/plans/claude-thinking-control.md) showed the two
     // directions of the on/off axis are not equally reachable mid-session.
     const thinkingState = getThinking() || {};
@@ -3615,7 +3758,9 @@ export function createClaudeSessionRunner({
     // A closing/aborted process is about to die — nothing about its last turn
     // should hold the composer of the worker that replaces it.
     if (!proc || proc.closing || proc.aborted) {
-      return { turnActive: false, canSteer: false, holdReason: null, messageId: null, supported: true };
+      return {
+        turnActive: false, canSteer: false, holdReason: null, messageId: null, supported: true, autoCompactWindow: null,
+      };
     }
     const ctx = proc.activeCtx || null;
     const ctxLive = Boolean(ctx && !ctx.finalized && !ctx.discarded && !ctx.interrupted);
@@ -3625,6 +3770,7 @@ export function createClaudeSessionRunner({
     const openingDelivery = proc.pendingDelivered.find((entry) => !entry.steered) || null;
     const turnActive = ctxLive || Boolean(openingDelivery);
     const canSteer = canAcceptSteering();
+    const autoCompactWindow = autoCompactWindowState();
     let holdReason = null;
     if (turnActive && !canSteer) {
       if (proc.pendingControlRequests > 0) holdReason = 'question';
@@ -3641,7 +3787,7 @@ export function createClaudeSessionRunner({
     // `supported` is the worker-advertised opt-in the client's composer reads
     // (the same flag the Copilot SDK worker publishes) — its only steering
     // gate, so every snapshot carries it, idle ones included.
-    return { turnActive, canSteer, holdReason, messageId, supported: true };
+    return { turnActive, canSteer, holdReason, messageId, supported: true, autoCompactWindow };
   }
 
   /**
@@ -3682,6 +3828,22 @@ export function createClaudeSessionRunner({
       syncDeliveryReadiness();
     };
     syncDeliveryReadiness();
+    // This delivery's own record: a window respawn taken for it (one at most).
+    const delivery = { windowRespawn: null };
+    // Its note goes on this message's row, once, whichever delivery's spawn
+    // the message then runs on.
+    let respawnNoted = false;
+    const noteWindowRespawn = () => {
+      if (!delivery.windowRespawn || respawnNoted) return;
+      respawnNoted = true;
+      const { from, to } = delivery.windowRespawn;
+      publisher.postActivity(
+        message,
+        `Restarted the session to apply the compaction window (${formatAutoCompactWindowLabel(from)} → ${formatAutoCompactWindowLabel(to)})`,
+        null,
+        { kind: 'compact_window_respawn', from, to },
+      );
+    };
     try {
       // A steered delivery (a turn is live) must not run the settings diffs:
       // setModel/effort/mode against a mid-flight turn would disturb the very
@@ -3691,7 +3853,7 @@ export function createClaudeSessionRunner({
       // lost — the steered message's own model/mode intent applies from the
       // next turn on, same as Claude Code.
       if (proc && !proc.closing && !proc.aborted && !proc.activeCtx) {
-        await adaptProcess(message);
+        await adaptProcess(message, delivery);
       }
       if (!proc || proc.closing || proc.aborted) {
         // Awaited only when there is one: a cold spawn with the decision
@@ -3704,20 +3866,26 @@ export function createClaudeSessionRunner({
         if (!remoteRelayGate.isSettled?.()) await remoteRelayGate.ready();
         // Another delivery spawned while this one waited: join that process
         // like any delivery (between turns: adapt; mid-turn: steer below).
-        if (proc && !proc.closing && !proc.aborted && !proc.activeCtx) await adaptProcess(message);
+        if (proc && !proc.closing && !proc.aborted && !proc.activeCtx) await adaptProcess(message, delivery);
         // What it joined may be gone by now: that adapt can recycle the
         // process (a mode change), and a process can wind down under any of
         // these waits. Only a live one takes the push below.
         if (proc && (proc.closing || proc.aborted)) await drainClosingProcess();
-        if (!proc) spawnProcess(message);
+        // A window respawn resumes the session the released process ran.
+        const respawnResume = delivery.windowRespawn?.resume || '';
+        if (!proc) spawnProcess(message, { resume: respawnResume });
+        noteWindowRespawn();
         // A cold start is the one moment a turn can sit silent for many
         // seconds (transcript load + first request); say so instead of
         // showing bare dots. Posted once here — not in spawnProcess — so a
         // push-race respawn cannot duplicate the line.
-        publisher.postActivity(message, (message.claudeNativeSessionId || claudeNativeSessionId)
+        publisher.postActivity(message, (respawnResume || message.claudeNativeSessionId || claudeNativeSessionId)
           ? 'Starting the Claude CLI (cold start — resuming the session transcript)…'
           : 'Starting the Claude CLI (cold start)…');
       }
+      // Released for the window, then joined a process another delivery
+      // spawned in the meantime.
+      noteWindowRespawn();
       const content = buildClaudeUserContent(message);
       for (let attempt = 0; attempt < 2; attempt += 1) {
         const procRef = proc;
@@ -3763,7 +3931,7 @@ export function createClaudeSessionRunner({
           // Belt and braces: the stream was already ending, but make sure the
           // superseded CLI cannot linger next to its replacement.
           try { procRef.turn.close?.(); } catch {}
-          spawnProcess(message);
+          spawnProcess(message, { resume: delivery.windowRespawn?.resume || '' });
           continue;
         }
         // Pushed: the pending entry now holds the gate on its own.

package/server/claude-worker/sdk-message-normalizer.mjs

@@ -75,6 +75,34 @@ export function compactBoundaryActivityAction(sdkMessage) {
   };
 }
 
+/**
+ * The compaction's start and its end without a result, as entries of the same
+ * kind as the boundary: the transcript reads the LAST compaction entry of a
+ * message, so a `pending` one shows the running compaction, the boundary
+ * replaces it with the result, and `cancelled` takes the line away again.
+ */
+export function compactPendingActivityAction() {
+  return {
+    channel: 'activity',
+    payload: {
+      text: 'Compacting context…',
+      subagentRunId: null,
+      metadata: { kind: 'compact_boundary', state: 'pending' },
+    },
+  };
+}
+
+export function compactCancelledActivityAction() {
+  return {
+    channel: 'activity',
+    payload: {
+      text: 'Compaction ended without a result',
+      subagentRunId: null,
+      metadata: { kind: 'compact_boundary', state: 'cancelled' },
+    },
+  };
+}
+
 // MCP tools reach the transcript namespaced as `mcp__<server>__<tool>`; which
 // server carries a tool is relay plumbing, so the chip shows the bare name.
 const MCP_TOOL_NAME = /^mcp__(?:.+?)__(.+)$/;

package/server/db-schema.mjs

@@ -13,6 +13,7 @@ import { migrateSteerSettleMarkers } from './migrations/0004-steer-settle-marker
 import { migrateRemoteRelays } from './migrations/0005-remote-relays.mjs';
 import { migrateWorkspaceRootSettings } from './migrations/0006-workspace-root-settings.mjs';
 import { migrateClaudeCloud } from './migrations/0007-claude-cloud.mjs';
+import { migrateMessagePins } from './migrations/0008-message-pins.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -734,6 +735,13 @@ try {
 } catch (error) {
   console.warn(`[claude-cloud] migration 0007 failed; retrying on next boot: ${error?.message || error}`);
 }
+// Pinned messages: one additive column and its partial index. Readers tolerate
+// their absence (no pins), so a failure is logged and retried next boot like 0007.
+try {
+  migrateMessagePins(db);
+} catch (error) {
+  console.warn(`[message-pins] migration 0008 failed; retrying on next boot: ${error?.message || error}`);
+}
 
 const runtimeSessionColumns = db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((c) => c.name);
 if (runtimeSessionColumns.length) {

package/server/migrations/0008-message-pins.mjs

@@ -0,0 +1,85 @@
+'use strict';
+
+/**
+ * Migration: pinned messages.
+ *
+ * 1. `messages.pinned_at` — when the user pinned the message (ISO time); NULL
+ *    means not pinned. A pin is a property of the message row, like
+ *    `hidden_from_shares`, so it goes away with the row.
+ * 2. `idx_messages_pinned` — a partial index over the pinned rows only: the
+ *    pin list travels with every conversation load.
+ *
+ * Additive and idempotent. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0008-message-pins.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function indexExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`)
+    .get(name);
+}
+
+function columnNames(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((column) => String(column.name)));
+}
+
+export function migrateMessagePins(db) {
+  if (!tableExists(db, 'messages')) return { applied: false, columnsAdded: 0, indexesAdded: 0 };
+  let columnsAdded = 0;
+  let indexesAdded = 0;
+  if (!columnNames(db, 'messages').has('pinned_at')) {
+    db.exec(`ALTER TABLE messages ADD COLUMN pinned_at TEXT`);
+    columnsAdded += 1;
+  }
+  if (!indexExists(db, 'idx_messages_pinned')) {
+    db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_messages_pinned
+      ON messages(conversation_id, timestamp)
+      WHERE pinned_at IS NOT NULL
+    `);
+    indexesAdded += 1;
+  }
+  return { applied: columnsAdded + indexesAdded > 0, columnsAdded, indexesAdded };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateMessagePins(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0008 on ${dbPath}`);
+    console.log(result.applied
+      ? `  message pins: columns added ${result.columnsAdded}, indexes added ${result.indexesAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0008 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}