@oar-sh/oar 0.9.8 → 0.9.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",
@@ -50,9 +50,9 @@
     "test:e2e:raw": "node ./node_modules/@playwright/test/cli.js test --config tests/playwright.config.mjs"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.283",
-    "@cursor/sdk": "^1.0.32",
-    "@github/copilot-sdk": "^1.0.14",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.292",
+    "@cursor/sdk": "^1.0.36",
+    "@github/copilot-sdk": "^1.0.17",
     "better-sqlite3": "^12.10.0",
     "express": "^4.18.2",
     "qrcode-terminal": "^0.12.0",
@@ -63,7 +63,6 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "cloudflared": "^0.7.1",
     "tty-console": "^1.0.4"
   },
   "devDependencies": {

package/server/README.md

@@ -658,6 +658,24 @@ images, calling the OpenAI Images API directly rather than going through a CLI w
   is never silently lost.
 - `POST /api/shared/:token/presence` tracks shared-viewer presence, surfaced as a watcher count.
 
+## Pinned messages
+
+- `PATCH /api/conversation/:id/message/:messageId/pin` with `{ pinned: boolean }` sets or clears
+  `messages.pinned_at`. A conversation holds at most 100 pins; the next one is refused with `409`
+  and `code: "pin-limit"`. The answer is
+  `{ ok, conversationId, messageId, pinned, pins, pinsRevision }`.
+- `GET /api/conversation/:id` carries `pins`: every pinned message of the conversation in
+  conversation order, also those outside the requested history page, each as
+  `{ messageId, role, preview, timestamp, pinnedAt, attachmentCount, hiddenFromShares }`.
+  `preview` is plain text of at most 160 characters. Each message also carries `pinned`.
+- Every change is broadcast as the socket event `conversation_pins_updated` with
+  `{ conversationId, pins, revision }`. `revision` (`pinsRevision` in the HTTP answers) grows with
+  every change. A conversation load that left the relay before a change can reach the browser
+  after the change's own event; the browser keeps the list with the higher revision.
+- Shared views carry neither `pins` nor `pinned`: pins are the owner's bookmarks.
+- Pins belong to message rows. `/compact` starts a new conversation without them (they stay with
+  the archived one); re-importing an imported session keeps them, matched like hidden marks.
+
 ## Relay Mode Selection
 
 The composer also includes a per-message mode picker:
@@ -973,6 +991,7 @@ Queue metrics include `parkedCount` for turns deferred behind restart/rebind gat
 | POST | `/api/subagent-run` | (Worker) Register/update a subagent run for the active turn |
 | POST | `/api/conversation/:conversationId/subagent/:subagentRunId/cancel` | Request cancellation of one subagent run (unsupported by the Claude runtime) |
 | PATCH | `/api/conversation/:id/message/:messageId/share-visibility` | Hide or unhide a single message from shared views |
+| PATCH | `/api/conversation/:id/message/:messageId/pin` | `{ pinned }` → pin or unpin a single message; answers with the conversation's pin list and broadcasts `conversation_pins_updated` |
 | POST | `/api/conversation/:id/share` | Create or update the conversation's read-only share token |
 | GET | `/api/shared/:token` | Read-only shared conversation view (hidden messages filtered out) |
 | POST | `/api/shared/:token/presence` | Report shared-viewer presence for the watcher count |
@@ -1381,7 +1400,7 @@ service).
 | `cloudflaredTunnel.enabled` | `false` | Legacy alias for mode (`true` => `managed`) |
 | `cloudflaredTunnel.required` | `false` | Pause dequeue when the Cloudflare tunnel is disconnected in managed mode |
 | `cloudflaredTunnel.token` | — | Tunnel token from the router panel (never logged) |
-| `cloudflaredTunnel.binary` | *(auto)* | `cloudflared` path; falls back to the optional npm package, then `PATH` |
+| `cloudflaredTunnel.binary` | `cloudflared` | Path or command name of the `cloudflared` you installed (OAR ships none); defaults to `cloudflared` on `PATH`. Without one the tunnel stays off and the status says how to install it |
 | `cloudflaredTunnel.extraArgs` | `[]` | Extra arguments appended to `cloudflared tunnel run` |
 | `tunnelMarkerHeaders` | `[]` | Extra edge-injected header names that mark tunnel traffic for the session-worker path guard |
 

package/server/db-schema.mjs

@@ -13,6 +13,7 @@ import { migrateSteerSettleMarkers } from './migrations/0004-steer-settle-marker
 import { migrateRemoteRelays } from './migrations/0005-remote-relays.mjs';
 import { migrateWorkspaceRootSettings } from './migrations/0006-workspace-root-settings.mjs';
 import { migrateClaudeCloud } from './migrations/0007-claude-cloud.mjs';
+import { migrateMessagePins } from './migrations/0008-message-pins.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -734,6 +735,13 @@ try {
 } catch (error) {
   console.warn(`[claude-cloud] migration 0007 failed; retrying on next boot: ${error?.message || error}`);
 }
+// Pinned messages: one additive column and its partial index. Readers tolerate
+// their absence (no pins), so a failure is logged and retried next boot like 0007.
+try {
+  migrateMessagePins(db);
+} catch (error) {
+  console.warn(`[message-pins] migration 0008 failed; retrying on next boot: ${error?.message || error}`);
+}
 
 const runtimeSessionColumns = db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((c) => c.name);
 if (runtimeSessionColumns.length) {

package/server/migrations/0008-message-pins.mjs

@@ -0,0 +1,85 @@
+'use strict';
+
+/**
+ * Migration: pinned messages.
+ *
+ * 1. `messages.pinned_at` — when the user pinned the message (ISO time); NULL
+ *    means not pinned. A pin is a property of the message row, like
+ *    `hidden_from_shares`, so it goes away with the row.
+ * 2. `idx_messages_pinned` — a partial index over the pinned rows only: the
+ *    pin list travels with every conversation load.
+ *
+ * Additive and idempotent. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0008-message-pins.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function indexExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`)
+    .get(name);
+}
+
+function columnNames(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((column) => String(column.name)));
+}
+
+export function migrateMessagePins(db) {
+  if (!tableExists(db, 'messages')) return { applied: false, columnsAdded: 0, indexesAdded: 0 };
+  let columnsAdded = 0;
+  let indexesAdded = 0;
+  if (!columnNames(db, 'messages').has('pinned_at')) {
+    db.exec(`ALTER TABLE messages ADD COLUMN pinned_at TEXT`);
+    columnsAdded += 1;
+  }
+  if (!indexExists(db, 'idx_messages_pinned')) {
+    db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_messages_pinned
+      ON messages(conversation_id, timestamp)
+      WHERE pinned_at IS NOT NULL
+    `);
+    indexesAdded += 1;
+  }
+  return { applied: columnsAdded + indexesAdded > 0, columnsAdded, indexesAdded };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateMessagePins(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0008 on ${dbPath}`);
+    console.log(result.applied
+      ? `  message pins: columns added ${result.columnsAdded}, indexes added ${result.indexesAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0008 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}

package/server/public/app/api-client.js

@@ -900,6 +900,36 @@ export async function updateMessageShareVisibility(conversationId, messageId, hi
   });
 }
 
+// Pin or unpin one message. Unlike apiFetch this keeps the relay's `error`
+// text on a refusal (the pin limit), so the notice can say why.
+export async function updateMessagePin(conversationId, messageId, pinned) {
+  const convId = String(conversationId || '').trim();
+  const msgId = String(messageId || '').trim();
+  if (!convId || !msgId || !networkRequestsEnabled) return null;
+  const url = `/api/conversation/${encodeURIComponent(convId)}/message/${encodeURIComponent(msgId)}/pin`;
+  try {
+    const response = await fetch(`${BASE}${url}`, {
+      signal: requestTimeoutSignal(),
+      method: 'PATCH',
+      headers: {
+        'Content-Type': 'application/json',
+        ...authHeaders(),
+      },
+      body: JSON.stringify({ pinned: pinned === true }),
+    });
+    const result = await response.json().catch(() => null);
+    if (!response.ok) {
+      console.error('API error', response.status, url);
+      return { ok: false, status: response.status, error: String(result?.error || '').trim() };
+    }
+    noteFetchSuccess();
+    return result;
+  } catch (error) {
+    noteFetchFailure(url, error);
+    return null;
+  }
+}
+
 export async function updateConversationTitle(id, title) {
   const convId = String(id || '').trim();
   if (!convId) return null;