@oar-sh/oar 0.9.8 → 0.9.10

package/server/routes/relay-event-routes.mjs

@@ -0,0 +1,157 @@
+'use strict';
+
+// Relay event subscriptions, for the browser: the active subscriptions (the
+// "watching" chip and the "watched" badges) and Unsubscribe. Agents use the
+// remote_relay tool instead; a request from another relay's agent is
+// refused here, so only this relay's user ends a subscription from outside
+// its conversation.
+//
+// And for paired relays: their agents subscribe to this relay's sessions
+// (POST /api/relay-events/remote/subscribe) and their relay fetches the
+// events (POST /api/relay-events/remote/pull, relay-event-link-service.mjs on
+// the other side). Only another relay's request is taken there, under the
+// inbound switch like a prompt; its subscriptions are filed under the relay
+// id it states, which never names a conversation here.
+
+import { REMOTE_RELAY_ERROR_CODES } from '../../shared/remote-relay-contract.mjs';
+import { admitRemoteRelayRequest, readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
+import { RelayEventError, cleanSubscriberRelayId } from '../services/relay-event-service.mjs';
+
+const RELAY_EVENT_ERROR_STATUS = Object.freeze({
+  invalid: [400, REMOTE_RELAY_ERROR_CODES.invalidInput],
+  notFound: [404, REMOTE_RELAY_ERROR_CODES.notFound],
+  ownSession: [400, REMOTE_RELAY_ERROR_CODES.ownSession],
+  limit: [409, REMOTE_RELAY_ERROR_CODES.subscriptionLimit],
+  unavailable: [503, REMOTE_RELAY_ERROR_CODES.unsupported],
+});
+
+function sendRelayEventError(res, error, what) {
+  if (error instanceof RelayEventError) {
+    const [status, code] = RELAY_EVENT_ERROR_STATUS[error.code] || [400, REMOTE_RELAY_ERROR_CODES.invalidInput];
+    return res.status(status).json({ error: error.message, code, ...(error.extra && typeof error.extra === 'object' ? error.extra : {}) });
+  }
+  return res.status(500).json({ error: `${what} failed: ${String(error?.message || error)}`, code: REMOTE_RELAY_ERROR_CODES.internal });
+}
+
+function asObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+export function registerRelayEventRoutes(app, deps) {
+  const {
+    auth,
+    relayEventService = null,
+    remoteRelayInbound = null,
+  } = deps;
+
+  function refuseRemote(req, res) {
+    const request = readRemoteRelayRequest(req, remoteRelayInbound || {});
+    if (!request.remote) return false;
+    res.status(403).json({ error: 'Relay event subscriptions are managed by this relay\'s user and its own agents only.' });
+    return true;
+  }
+
+  // GET /api/relay-events/subscriptions — every active subscription.
+  app.get('/api/relay-events/subscriptions', auth, (req, res) => {
+    if (refuseRemote(req, res)) return;
+    if (!relayEventService?.isAvailable?.()) return res.json({ available: false, subscriptions: [] });
+    res.json({ available: true, subscriptions: relayEventService.listActive() });
+  });
+
+  /**
+   * The paired relay a request comes from: its stated relay id, or null
+   * after answering. Refused: this relay's own agents and the browser (they
+   * have the tool and the routes above), any request while the inbound
+   * switch is off, and one that names no relay.
+   */
+  function admitPairedRelay(req, res) {
+    const request = admitRemoteRelayRequest(req, res, remoteRelayInbound);
+    if (!request) return null;
+    if (!request.remote || request.local) {
+      res.status(403).json({
+        error: 'Only another relay subscribes to sessions here this way; this relay\'s own agents use the remote_relay tool.',
+        code: REMOTE_RELAY_ERROR_CODES.forbidden,
+      });
+      return null;
+    }
+    const subscriber = cleanSubscriberRelayId(request.origin?.relayId);
+    if (!subscriber) {
+      res.status(400).json({ error: 'The calling relay sent no relay id.', code: REMOTE_RELAY_ERROR_CODES.invalidInput });
+      return null;
+    }
+    if (!relayEventService?.isCrossRelayAvailable?.()) {
+      res.status(503).json({
+        error: 'Event subscriptions across relays are not available on this relay right now (see its server log).',
+        code: REMOTE_RELAY_ERROR_CODES.unsupported,
+      });
+      return null;
+    }
+    return subscriber;
+  }
+
+  // POST /api/relay-events/remote/subscribe — a paired relay's agent
+  // subscribes: `{ watcher: { conversationId, title }, subscriber: { name },
+  // scope, sessions, events, once, match, stalled_minutes, heartbeat_minutes,
+  // dry_run }`. A dry run checks everything and stores nothing.
+  app.post('/api/relay-events/remote/subscribe', auth, (req, res) => {
+    const subscriber = admitPairedRelay(req, res);
+    if (!subscriber) return;
+    const body = asObject(req.body);
+    const watcher = asObject(body.watcher);
+    try {
+      const subscription = relayEventService.subscribeServed({
+        subscriberRelayId: subscriber,
+        subscriberRelayName: String(asObject(body.subscriber).name || ''),
+        watcherId: String(watcher.conversationId || ''),
+        watcherTitle: String(watcher.title || ''),
+        scope: body.scope === 'all' ? 'all' : 'sessions',
+        sessionIds: Array.isArray(body.sessions) ? body.sessions.map((id) => String(id ?? '')) : [],
+        events: Array.isArray(body.events) ? body.events.map((type) => String(type ?? '')) : null,
+        once: body.once === true,
+        match: typeof body.match === 'string' ? body.match : '',
+        stalledMinutes: body.stalled_minutes ?? null,
+        heartbeatMinutes: body.heartbeat_minutes ?? null,
+        dryRun: body.dry_run === true,
+      });
+      res.json({ ok: true, ...(body.dry_run === true ? { dryRun: true } : {}), subscription });
+    } catch (error) {
+      sendRelayEventError(res, error, 'Subscribe');
+    }
+  });
+
+  // POST /api/relay-events/remote/pull — a paired relay fetches its events:
+  // `{ after, subscriptions: [{ id, watcher }], ended: [ids] }`.
+  app.post('/api/relay-events/remote/pull', auth, (req, res) => {
+    const subscriber = admitPairedRelay(req, res);
+    if (!subscriber) return;
+    const body = asObject(req.body);
+    try {
+      res.json({
+        ok: true,
+        ...relayEventService.pullServed({
+          subscriberRelayId: subscriber,
+          after: body.after,
+          subscriptions: Array.isArray(body.subscriptions) ? body.subscriptions : [],
+          ended: Array.isArray(body.ended) ? body.ended : [],
+        }),
+      });
+    } catch (error) {
+      sendRelayEventError(res, error, 'The event fetch');
+    }
+  });
+
+  // DELETE /api/relay-events/subscriptions/:id — the user's Unsubscribe.
+  app.delete('/api/relay-events/subscriptions/:id', auth, (req, res) => {
+    if (refuseRemote(req, res)) return;
+    if (!relayEventService?.isAvailable?.()) return res.status(503).json({ error: 'Relay event subscriptions are not available' });
+    try {
+      const ended = relayEventService.unsubscribe({ subscriptionId: String(req.params.id || '').trim(), reason: 'unsubscribed-by-user' });
+      res.json({ ok: true, ended });
+    } catch (error) {
+      if (error instanceof RelayEventError) {
+        return res.status(error.code === 'notFound' ? 404 : 400).json({ error: error.message, code: error.code });
+      }
+      res.status(500).json({ error: `Unsubscribe failed: ${String(error?.message || error)}` });
+    }
+  });
+}

package/server/routes/remote-relay-routes.mjs

@@ -8,6 +8,9 @@
 // No response carries a stored token: the registry's public views drop it, and
 // the pairing service's answers never contain one.
 
+import { REMOTE_RELAY_ERROR_CODES } from '../../shared/remote-relay-contract.mjs';
+import { readRemoteRelayRequest } from '../services/remote-relay-inbound.mjs';
+
 function sendResult(res, result, fallbackStatus = 400) {
   const { status, ...payload } = result || {};
   const code = Number.isInteger(status) ? status : (payload.ok === false ? fallbackStatus : 200);
@@ -26,6 +29,9 @@ export function registerRemoteRelayRoutes(app, deps) {
     // WP2's dispatcher: `{ dispatch({ conversationId, action, args, req }) →
     // Promise<{ status, body }>, inflight(conversationId) → number }`.
     dispatcher = null,
+    // The inbound facts (remote-relay-inbound.mjs): which requests come from
+    // another relay.
+    remoteRelayInbound = null,
   } = deps;
 
   // Static paths first: Express would otherwise hand them to /:id.
@@ -85,6 +91,15 @@ export function registerRemoteRelayRoutes(app, deps) {
   // POST /api/remote-relays/tool — every provider adapter's remote_relay call.
   app.post('/api/remote-relays/tool', auth, async (req, res) => {
     if (!dispatcher) return res.status(503).json({ error: 'Remote relay dispatcher unavailable' });
+    // The tool acts for one of this relay's conversations: another relay
+    // never calls it (it would act, or subscribe, for a conversation it does
+    // not host). Its agents reach this relay through the routes it calls.
+    if (readRemoteRelayRequest(req, remoteRelayInbound).remote) {
+      return res.status(403).json({
+        error: 'The remote_relay tool of this relay is for its own sessions; another relay cannot call it.',
+        code: REMOTE_RELAY_ERROR_CODES.forbidden,
+      });
+    }
     // A worker that gives up on the call (turn stopped, worker gone) closes
     // the request: withdraw its approval card and stop waiting for the reply.
     const controller = new AbortController();

package/server/routes/sessions-routes.mjs

@@ -7,8 +7,9 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 import { randomUUID } from 'crypto';
 import { createSdkSessionSyncService } from '../services/sdk-session-sync-service.mjs';
-import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
+import { serveFileWithRangeSupport } from '../services/file-serving.mjs';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
+import { MESSAGE_PIN_LIMIT, buildPinList } from '../services/message-pin-list.mjs';
 import { persistConversationPreferences } from '../services/conversation-preferences-service.mjs';
 import { parseAutoCompactWindow } from '../../shared/auto-compact-window.mjs';
 import { CLAUDE_ATTRIBUTION_MODES, DEFAULT_CLAUDE_ATTRIBUTION_MODE, claudeAttributionModelLabel, claudeAttributionTrailer, normalizeClaudeAttributionMode, resolveClaudeAttributionMode } from '../../shared/claude-attribution.mjs';
@@ -68,6 +69,11 @@ import {
   TURN_CEILING_STEP_MINUTES,
   parseTurnCeilingUpdate,
 } from '../../shared/turn-ceiling.mjs';
+import {
+  DEFAULT_SUBAGENT_RECORD_RETENTION_DAYS,
+  SUBAGENT_RECORD_RETENTION_CHOICES,
+  parseSubagentRecordRetentionUpdate,
+} from '../../shared/subagent-record-retention.mjs';
 import {
   DEFAULT_BACKGROUND_TASK_TIMEOUT_MINUTES,
   BACKGROUND_TASK_TIMEOUT_MAX_MINUTES,
@@ -88,6 +94,9 @@ const SESSION_WORKER_STATUS_QUEUE_STATES = Object.freeze(['pending', 'processing
 // Registry statuses that mean "this worker is currently running" (same triple
 // as countActiveCliWorkers in server-runtime.mjs).
 const SESSION_WORKER_ACTIVE_STATUSES = Object.freeze(['starting', 'ready', 'processing']);
+// A shared attachment's URL names its bytes (sha256 or a fixed generated-image
+// path), so a kept answer stays right.
+const SHARED_CONTENT_CACHE_CONTROL = 'private, max-age=31536000, immutable';
 
 function normalizeWorkerStatusText(value, fallback = null) {
   const text = String(value || '').trim();
@@ -1834,6 +1843,7 @@ export function buildConversationMessages({
           attachments: message?.attachments || [],
           mode: message?.mode || undefined,
           hiddenFromShares: Number(message?.hidden_from_shares || 0) === 1,
+          pinned: !!message?.pinned_at,
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
@@ -2155,6 +2165,8 @@ export function registerSessionsRoutes(app, deps) {
     resolveCursorSessionRoot = null,
     getTurnCeilingMinutes = () => DEFAULT_TURN_CEILING_MINUTES,
     setTurnCeilingMinutes = () => ({ ok: false, error: 'Turn ceiling settings are unavailable' }),
+    getSubagentRecordRetentionDays = () => DEFAULT_SUBAGENT_RECORD_RETENTION_DAYS,
+    setSubagentRecordRetentionDays = () => ({ ok: false, error: 'Sub-agent record settings are unavailable' }),
     getFeatureFlagsSettingsState = () => [],
     setFeatureFlagSetting = () => ({ ok: false, error: 'Feature settings are unavailable' }),
     getPwaAppName = () => '',
@@ -2176,8 +2188,47 @@ export function registerSessionsRoutes(app, deps) {
     // conversations another relay's agent created, and the inbound switch.
     // Absent in older wiring and most tests, where both are no-ops.
     remoteRelayInbound = null,
+    // Relay events: what each session is doing (state, tasks) and the
+    // subscriptions that end with an archived or deleted conversation.
+    relayEventService = null,
+    sessionActivityTracker = null,
   } = deps;
   const sdkSessionSyncService = createSdkSessionSyncService(db);
+  let listRunningRunConversations = null;
+  try {
+    listRunningRunConversations = db.prepare(`SELECT DISTINCT conversation_id FROM subagent_runs WHERE status = 'running'`);
+  } catch {}
+
+  /**
+   * `{ sessionState, sessionTasks, lastActivityAt }` of one conversation:
+   * running_turn, background_only or idle, with its tasks. Only conversations
+   * that may be doing something are asked (`candidates`); the rest are idle.
+   */
+  function describeSessionActivity(conversationId, candidates = null) {
+    const id = String(conversationId || '').trim();
+    if (!sessionActivityTracker || !id) return null;
+    if (candidates && !candidates.has(id)) return { sessionState: 'idle' };
+    try {
+      const view = sessionActivityTracker.describe(id);
+      return {
+        sessionState: view.state,
+        ...(view.tasks.length ? { sessionTasks: view.tasks } : {}),
+        ...(view.state !== 'idle' && view.lastActivityAt ? { lastActivityAt: view.lastActivityAt } : {}),
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  /** The conversations that may be busy: a turn queued, a run or task known. */
+  function activityCandidates(activeTurnConversationIds) {
+    const ids = new Set(activeTurnConversationIds);
+    for (const id of sessionActivityTracker?.knownConversationIds?.() || []) ids.add(String(id));
+    try {
+      for (const row of listRunningRunConversations?.all?.() || []) ids.add(String(row.conversation_id || ''));
+    } catch {}
+    return ids;
+  }
   // Generic synchronous transaction runner for the session-sync route: binding
   // validation, workspace learning and the binding writes must commit or roll
   // back as one unit (audit #21).
@@ -2218,6 +2269,23 @@ export function registerSessionsRoutes(app, deps) {
       AND (id = ? OR response_message_id = ?)
     LIMIT 1
   `);
+  function listConversationPins(conversationId) {
+    return buildPinList(stmts.listPinnedMessages?.all?.(conversationId) || []);
+  }
+  // Orders the pin lists a browser receives. A conversation load that left
+  // before a pin change can arrive after the change's own socket event; with
+  // the revision the browser can tell the older list from the newer one. In
+  // memory only: a restart starts above every revision handed out before.
+  const pinRevisionFloor = Date.now();
+  const pinRevisionByConversation = new Map();
+  function conversationPinRevision(conversationId) {
+    return pinRevisionByConversation.get(conversationId) || pinRevisionFloor;
+  }
+  function bumpConversationPinRevision(conversationId) {
+    const next = Math.max(Date.now(), conversationPinRevision(conversationId) + 1);
+    pinRevisionByConversation.set(conversationId, next);
+    return next;
+  }
   const listSessionWorkerQueueRows = db.prepare(`
     SELECT id, conversation_id, runtime_session_id, owner_sdk_session_id, status
     FROM queue
@@ -2533,6 +2601,7 @@ export function registerSessionsRoutes(app, deps) {
       hardDeleteConversationRows(conversationId);
       deleteOrphanedUploads(orphanedUploads);
       io.emit('conversation_deleted', { conversationId });
+      try { relayEventService?.noteConversationGone?.(conversationId, { deleted: true }); } catch {}
       finalized.push(conversationId);
     }
     return finalized;
@@ -2712,7 +2781,9 @@ export function registerSessionsRoutes(app, deps) {
     });
     messages = messages.map((message) => {
       const sourceMessageId = responseMessageToSourceId.get(String(message.id || '').trim()) || message.sourceMessageId || undefined;
-      const withSource = sourceMessageId ? { ...message, sourceMessageId } : message;
+      // Pins are the owner's bookmarks: a public share never learns of them.
+      const { pinned: _pinned, ...unpinnedMessage } = message;
+      const withSource = sourceMessageId ? { ...unpinnedMessage, sourceMessageId } : unpinnedMessage;
       // A public share never shows another relay's address or ids.
       const nextMessage = withSource.origin
         ? { ...withSource, origin: publicRemoteRelayOrigin(withSource.origin) }
@@ -2823,6 +2894,7 @@ export function registerSessionsRoutes(app, deps) {
         .map((row) => String(row?.conversation_id || '').trim())
         .filter(Boolean),
     );
+    const busyCandidates = sessionActivityTracker ? activityCandidates(activeTurnConversationIds) : null;
     const conversations = page.rows.map((r) => {
       const sid = String(r.sdk_session_id || '').trim();
       const workspaceState = typeof resolveConversationWorkspaceState === 'function'
@@ -2841,6 +2913,7 @@ export function registerSessionsRoutes(app, deps) {
         sdkSessionId: sid || null,
         title:        resolveConversationTitle({ title: r.title, titleSource: r.title_source }),
         activeTurn:   activeTurnConversationIds.has(String(r.id || '').trim()),
+        ...(describeSessionActivity(r.id, busyCandidates) || {}),
         archived:     Number(r.archived || 0) === 1,
         compactedInto: r.compacted_into || null,
         compactedFrom: r.compacted_from || null,
@@ -3600,6 +3673,9 @@ export function registerSessionsRoutes(app, deps) {
       cloud: conversationCloudPayload(conv, runtimeSession),
       messages: history.messages,
       pageInfo: history.pageInfo,
+      // A re-import can move a pin onto a new message id.
+      pins: listConversationPins(conversationId),
+      pinsRevision: conversationPinRevision(conversationId),
       refreshed: true,
     });
   });
@@ -3777,20 +3853,14 @@ export function registerSessionsRoutes(app, deps) {
     if (!file) return res.status(404).json({ error: 'Shared attachment not found' });
     const filePath = uploadPathForSha(sha256);
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Missing file on disk' });
-    // Unauthenticated share viewers: neutralize executable types (HTML/SVG),
-    // force nosniff + sandbox so an attachment can't run as script on this origin.
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
+    // Unauthenticated share viewers: the serving helper neutralizes executable
+    // types (HTML/SVG) and forces nosniff + sandbox so an attachment can't run
+    // as script on this origin; ranges let a shared video seek.
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, file.mime_type, { fileName: file.name || file.file_name || '' });
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: file.mime_type }, {
+      safeName: String(file.name || file.file_name || '').replace(/"/g, ''),
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   app.get('/api/shared/:token/generated-image/:messageId/:imageId/content', (req, res) => {
@@ -3832,18 +3902,10 @@ export function registerSessionsRoutes(app, deps) {
       return res.status(404).json({ error: 'Shared attachment not found' });
     }
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Shared attachment not found' });
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, attachment.type);
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: attachment.type }, {
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   // GET /api/conversation/:id — get paginated conversation history
@@ -3997,9 +4059,13 @@ export function registerSessionsRoutes(app, deps) {
       // processing one. Another relay's agent tells "still queued" from
       // "cancelled" with it.
       activeTurn: Number(stmts.getConversationActiveQueueCount?.get?.(resolvedConversationId)?.count || 0) > 0,
+      ...(describeSessionActivity(resolvedConversationId) || {}),
       backgroundTasks: backgroundTaskStore?.get?.(resolvedConversationId) || [],
       usageLimitPause: usageLimitPauseService?.getPause?.(resolvedConversationId) || null,
       previews: listConversationPreviews?.(resolvedConversationId) || [],
+      // Every pin of the conversation, also those outside this history page.
+      pins: listConversationPins(resolvedConversationId),
+      pinsRevision: conversationPinRevision(resolvedConversationId),
       preferredRelayMode: preferences.preferredRelayMode,
       preferredModel: preferences.preferredModel,
       preferredReasoningEffort: preferences.preferredReasoningEffort,
@@ -4059,6 +4125,57 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // Pin or unpin one message. Unlike share visibility this may change while
+  // the message's turn runs (nothing public depends on it), and every open
+  // client learns of it through the socket instead of reloading.
+  app.patch('/api/conversation/:id/message/:messageId/pin', auth, (req, res) => {
+    const conversationId = String(req.params.id || '').trim();
+    const messageId = String(req.params.messageId || '').trim();
+    if (!conversationId || !messageId) {
+      return res.status(400).json({ error: 'Missing conversation or message id' });
+    }
+    if (typeof req.body?.pinned !== 'boolean') {
+      return res.status(400).json({ error: 'pinned must be a boolean' });
+    }
+
+    const conv = stmts.getConvAnyStatus.get(conversationId);
+    if (!conv || String(conv.status || '').trim().toLowerCase() === 'deleted') {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+    const message = stmts.getMessageByConversation?.get(messageId, conversationId) || null;
+    if (!message) return res.status(404).json({ error: 'Message not found' });
+    if (!stmts.setMessagePinnedAt || !stmts.countPinnedMessages) {
+      return res.status(503).json({ error: 'Pinning messages is unavailable until the relay restarts' });
+    }
+
+    const pinned = req.body.pinned === true;
+    const currentlyPinned = !!message.pinned_at;
+    if (currentlyPinned !== pinned) {
+      if (pinned && Number(stmts.countPinnedMessages.get(conversationId)?.cnt || 0) >= MESSAGE_PIN_LIMIT) {
+        return res.status(409).json({
+          error: `This conversation already has ${MESSAGE_PIN_LIMIT} pinned messages. Unpin one first.`,
+          code: 'pin-limit',
+          limit: MESSAGE_PIN_LIMIT,
+        });
+      }
+      stmts.setMessagePinnedAt.run(pinned ? new Date().toISOString() : null, messageId, conversationId);
+    }
+
+    const pins = listConversationPins(conversationId);
+    if (currentlyPinned !== pinned) {
+      const revision = bumpConversationPinRevision(conversationId);
+      io?.emit?.('conversation_pins_updated', { conversationId, pins, revision });
+    }
+    return res.json({
+      ok: true,
+      conversationId,
+      messageId,
+      pinned,
+      pins,
+      pinsRevision: conversationPinRevision(conversationId),
+    });
+  });
+
   app.patch('/api/conversation/:id', auth, (req, res) => {
     const conversationId = String(req.params.id || '').trim();
     const result = persistConversationTitle({
@@ -4753,6 +4870,7 @@ export function registerSessionsRoutes(app, deps) {
     deleteOrphanedUploads(orphanedUploads);
     if (sdkSessionId && !cliSession.queued) stmts.deleteSdkDeleteRequest?.run?.(sdkSessionId);
     io.emit('conversation_deleted', { conversationId: id });
+    try { relayEventService?.noteConversationGone?.(id, { deleted: true }); } catch {}
     return { statusCode: 200, body: { ok: true, workerStopped, cliSessionDeleted: cliSession.deleted } };
   }
 
@@ -4831,6 +4949,8 @@ export function registerSessionsRoutes(app, deps) {
         }
         db.prepare(`UPDATE conversations SET archived = 1, updated_at = ? WHERE id = ?`).run(new Date().toISOString(), id);
         io.emit('conversation_archived', { conversationId: id, archived: true });
+        // Its subscriptions end, and so does its place in others'.
+        try { relayEventService?.noteConversationGone?.(id); } catch {}
         // The cloud session of a Claude Cloud conversation is archived with it;
         // best effort and not waited for.
         if (!sharedWithConversationId) {
@@ -5461,6 +5581,7 @@ export function registerSessionsRoutes(app, deps) {
         reconnectAttempts: runtimeState.cloudflaredTunnelState?.reconnectAttempts ?? 0,
         connectedSince: runtimeState.cloudflaredTunnelState?.connectedSince ?? null,
         lastError: runtimeState.cloudflaredTunnelState?.lastError ?? null,
+        binaryMissing: runtimeState.cloudflaredTunnelState?.binaryMissing ?? false,
         valid: runtimeState.cloudflaredTunnelState?.valid ?? true,
       },
       workerWebSocket: runtimeState.workerWebSocketStatus || null,
@@ -6349,6 +6470,25 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // How long sub-agent records keep their tool inputs and output (0 = always).
+  const subagentRecordRetentionPayload = (retentionDays) => ({
+    retentionDays,
+    choices: [...SUBAGENT_RECORD_RETENTION_CHOICES],
+    defaultDays: DEFAULT_SUBAGENT_RECORD_RETENTION_DAYS,
+  });
+
+  app.get('/api/settings/subagent-record-retention', auth, (_req, res) => {
+    res.json(subagentRecordRetentionPayload(getSubagentRecordRetentionDays()));
+  });
+
+  app.post('/api/settings/subagent-record-retention', auth, (req, res) => {
+    const parsed = parseSubagentRecordRetentionUpdate(req.body?.retentionDays);
+    if (!parsed.ok) return res.status(400).json({ error: parsed.error });
+    const result = setSubagentRecordRetentionDays(parsed.days);
+    if (!result.ok) return res.status(500).json({ error: result.error });
+    return res.json(subagentRecordRetentionPayload(result.retentionDays));
+  });
+
   app.get('/api/settings/background-task-timeout', auth, (_req, res) => {
     res.json({
       timeoutMinutes: getBackgroundTaskTimeoutMinutes(),