@oar-sh/oar 0.9.9 → 0.9.11

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -112,6 +112,7 @@ import { STEER_FOLDED_TEXT, STEER_STOPPED_TEXT, STEER_TURN_FAILED_TEXT } from '.
 import { buildSteerSettleFailure } from '../../shared/steer-settle-failure.mjs';
 import { shouldEmitStreamUpdate } from '../../shared/stream-emit-gating.mjs';
 import { withSteerNote } from '../../shared/steer-note.mjs';
+import { isRelayEventDelivery } from '../../shared/relay-events.mjs';
 import { isTransientRelayError } from '../../shared/worker-runtime/relay-errors.mjs';
 import {
   createTurnLiveness,
@@ -460,6 +461,10 @@ export function createCopilotSdkSessionRunner({
   // heartbeat snapshot, and a 10 s wait would often outlast the window in
   // which the runtime still holds the message (live check 2026-09-25).
   onCancellableChange = () => {},
+  // The relay turned this worker's newest task set away (`stale`): the
+  // worker asks for a heartbeat, on which the relay learns which process
+  // holds the session and asks for the set again.
+  onBackgroundTaskSetStale = () => {},
   dbg = () => {},
 } = {}) {
   let client = null;
@@ -627,7 +632,15 @@ export function createCopilotSdkSessionRunner({
   let taskRefreshQueued = 0;
   let lastTaskRefreshAt = 0;
   let taskPublishTimer = null;
+  // The last set the relay took, as JSON, and the one on its way to it.
   let lastPublishedTasksSignature = '';
+  let inFlightTasksSignature = null;
+  let taskPublishSeq = 0;
+  // Every post of the set carries its place in this worker's order
+  // (`epoch` tells this process from one before it): posts can overtake
+  // each other on the way, and the relay applies the newer one only.
+  const taskSetEpoch = Date.now();
+  let taskSetStaleNotedAt = 0;
   // Cap expiry is bounded: a task whose cancel the runtime refuses (or that
   // keeps failing) this many times is abandoned — dropped from the live set so
   // it stops pinning the runtime — rather than held forever.
@@ -1569,27 +1582,77 @@ export function createCopilotSdkSessionRunner({
    * semantics, the same route the Claude worker publishes on). Set changes
    * publish at once; enrichment-only changes (a tool call, tokens) ride a
    * trailing throttle. Advisory: a failed post never disturbs events.
+   *
+   * A set equal to the last one the relay TOOK (or to the one on its way)
+   * is not sent again: the signature is recorded when the post succeeds, so
+   * a failed post is retried by the next publish instead of being
+   * remembered as sent.
+   * `resync`: the relay asked for the set again on a heartbeat (it
+   * restarted, or a post was lost); that goes out whatever the signature
+   * says, flagged. Returns the post.
    */
-  function publishBackgroundTasks({ immediate = false } = {}) {
+  function publishBackgroundTasks({ immediate = false, resync = false } = {}) {
     const run = () => {
       if (taskPublishTimer) {
         clearTimeout(taskPublishTimer);
         taskPublishTimer = null;
       }
-      const tasks = sessionRpc.tasks ? registryCards() : shellTrackerCards();
+      const tasks = currentTaskCards();
       const signature = JSON.stringify(tasks);
-      if (signature === lastPublishedTasksSignature) return;
-      lastPublishedTasksSignature = signature;
-      api('POST', '/api/background-tasks', { conversationId: sdkSessionId, tasks })
-        .catch((error) => dbg('background task publish failed', error?.message || String(error)));
+      const unchanged = inFlightTasksSignature === null
+        ? signature === lastPublishedTasksSignature
+        : signature === inFlightTasksSignature;
+      if (!resync && unchanged) return Promise.resolve();
+      const seq = ++taskPublishSeq;
+      inFlightTasksSignature = signature;
+      return api('POST', '/api/background-tasks', {
+        conversationId: sdkSessionId,
+        tasks,
+        order: { epoch: taskSetEpoch, seq },
+        ...(resync ? { resync: true } : {}),
+      })
+        .then((answer) => {
+          // Only the newest post says what the relay holds now.
+          if (seq !== taskPublishSeq) return;
+          inFlightTasksSignature = null;
+          if (answer?.stale === true) {
+            // Turned away, not taken: nothing is recorded as sent, and a
+            // heartbeat is asked for (at most one per ten seconds; the
+            // periodic beat repeats the relay's request anyway).
+            dbg('the relay dropped the newest background task set', answer.reason || '');
+            if (Date.now() - taskSetStaleNotedAt < 10_000) return;
+            taskSetStaleNotedAt = Date.now();
+            try { onBackgroundTaskSetStale(); } catch {}
+            return;
+          }
+          lastPublishedTasksSignature = signature;
+        })
+        .catch((error) => {
+          // Not taken: the signature stays at what the relay last took, so
+          // the next publish of this set is sent, not skipped.
+          if (seq === taskPublishSeq) inFlightTasksSignature = null;
+          dbg('background task publish failed', error?.message || String(error));
+        });
     };
-    if (immediate || !(taskPublishThrottleMs > 0)) {
-      run();
-      return;
-    }
-    if (taskPublishTimer) return;
+    if (resync || immediate || !(taskPublishThrottleMs > 0)) return run();
+    if (taskPublishTimer) return Promise.resolve();
     taskPublishTimer = setTimeout(run, taskPublishThrottleMs);
     taskPublishTimer.unref?.();
+    return Promise.resolve();
+  }
+
+  function currentTaskCards() {
+    return sessionRpc.tasks ? registryCards() : shellTrackerCards();
+  }
+
+  /** The ids of the live background tasks, for the heartbeat's digest. */
+  function backgroundTaskIds() {
+    return currentTaskCards().map((task) => task.taskId);
+  }
+
+  /** The relay asked for the task set again (heartbeat answer). */
+  function resyncBackgroundTasks() {
+    return publishBackgroundTasks({ resync: true });
   }
 
   // ------------------------------------------------------- background tasks --
@@ -4216,7 +4279,8 @@ export function createCopilotSdkSessionRunner({
     // message and drop the request it was working on (burn-in 2026-09-25).
     // Not in a continuation: there the running work is the runtime's own
     // follow-up, not a request of the user's to keep going with.
-    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' ? body : withSteerNote(body));
+    // Nor in an event message the relay wrote: the note speaks as the user.
+    const prompt = withRelayContext(context?.prefix, turn.kind === 'continuation' || isRelayEventDelivery(message) ? body : withSteerNote(body));
     // Re-checked AFTER the awaits and before anything is sent or registered.
     // Nothing has been sent yet, so handing the row back to the normal path is
     // free.
@@ -4698,6 +4762,8 @@ export function createCopilotSdkSessionRunner({
     steeringState,
     getSettleFailed,
     acknowledgeSettleFailed,
+    backgroundTaskIds,
+    resyncBackgroundTasks,
     cancelPushedMessage,
     // The task panel's per-card Stop (`rpc.tasks.cancel`); also what a
     // subagent lane's Stop tries — the runtime tracks sync agents in the same
@@ -4724,6 +4790,7 @@ export function createCopilotSdkSessionRunner({
       ? new Promise((resolve) => { setTimeout(resolve, taskRefreshMs + 5); }).then(() => taskRefreshChain)
       : taskRefreshChain),
     // Test seams / observability.
+    _publishBackgroundTasks: publishBackgroundTasks,
     _getState: () => ({
       hasClient: !!client,
       hasSession: !!session,

package/server/copilot-worker/copilot-sdk-session-worker.mjs

@@ -121,6 +121,7 @@ async function main() {
     // A message became (or stopped being) cancellable: report it now rather
     // than on the next 10 s heartbeat (coalesced by the controller).
     onCancellableChange: () => heartbeat?.requestPulse(),
+    onBackgroundTaskSetStale: () => heartbeat?.requestPulse(),
     canHandBackHeldDelivery: () => linkBridge.canHandBackHeldDelivery(),
     dbg,
   });
@@ -144,6 +145,11 @@ async function main() {
     getSteeringState: () => turnRunner.steeringState(),
     getSettleFailed: () => turnRunner.getSettleFailed(),
     onSettleFailedHandled: (ids) => turnRunner.acknowledgeSettleFailed(ids),
+    // The relay holds the task set in memory only: the digest of the live
+    // task ids rides every beat, and a relay that is out of step (it
+    // restarted, a post was lost) asks for the set again.
+    getBackgroundTaskIds: () => turnRunner.backgroundTaskIds(),
+    onResyncBackgroundTasks: () => turnRunner.resyncBackgroundTasks(),
   });
 
   const wsLink = createWorkerWebSocketLink({

package/server/cursor-worker/cursor-sdk-adapter.mjs

@@ -209,12 +209,66 @@ export function startCursorRun({
   };
   // A tool call is reported on both surfaces (the delta hook and the message
   // stream) under the same id; either one opens and closes it.
+  //
+  // Not every tool call is reported. The SDK translates only the tools it has
+  // a type for and drops the rest on both surfaces: among them the wait on a
+  // background shell (`awaitToolCall`), web fetches and input to a running
+  // shell. All a dropped call leaves is the step's `tool-requests-listed`
+  // count, sent once the model has finished requesting tools; from there the
+  // run waits for them without a single event, for as long as the command it
+  // waits on takes. So the calls listed beyond those reported count as one
+  // open tool, which closes when the model writes again: the SDK tells
+  // nothing about such a call ending, and the next step is the first sign.
+  // A step without such calls keeps the model window once its reported
+  // tools have ended. Steps are told from the delta hook alone: it carries
+  // the count, the reported calls and the model's output in step order.
+  const stepCalls = new Set();
+  let stepListed = false;
+  let unreportedCalls = 0;
+  const UNREPORTED_TOOLS = 'unreported-tools';
+  const noteCallStarted = (callId) => {
+    const key = String(callId || '').trim();
+    if (!key || stepCalls.has(key)) return;
+    stepCalls.add(key);
+    // Reported after the count: it was one of the calls counted as unreported.
+    if (stepListed && unreportedCalls > 0 && --unreportedCalls === 0) liveness.end('tool', UNREPORTED_TOOLS);
+  };
+  const noteToolsListed = (callCount) => {
+    stepListed = true;
+    unreportedCalls = Math.max(0, (Number(callCount) || 0) - stepCalls.size);
+    if (unreportedCalls > 0) liveness.begin('tool', UNREPORTED_TOOLS, 'unreported tool');
+  };
+  const noteModelWriting = () => {
+    if (!stepListed) return;
+    stepListed = false;
+    unreportedCalls = 0;
+    stepCalls.clear();
+    liveness.end('tool', UNREPORTED_TOOLS);
+  };
   const observe = (event) => {
     if (event.source === 'delta') {
       const update = event.update || {};
       liveness.traffic(update.type);
-      if (update.type === 'tool-call-started') liveness.begin('tool', update.callId, update.toolCall?.type);
-      else if (update.type === 'tool-call-completed') liveness.end('tool', update.callId);
+      switch (update.type) {
+        case 'tool-call-started':
+          noteCallStarted(update.callId);
+          liveness.begin('tool', update.callId, update.toolCall?.type);
+          break;
+        case 'tool-call-completed':
+          liveness.end('tool', update.callId);
+          break;
+        case 'tool-requests-listed':
+          noteToolsListed(update.callCount);
+          break;
+        case 'text-delta':
+        case 'thinking-delta':
+        case 'thinking-completed':
+        case 'partial-tool-call':
+          noteModelWriting();
+          break;
+        default:
+          break;
+      }
       return;
     }
     const message = event.message || {};

package/server/db-schema.mjs

@@ -14,6 +14,14 @@ import { migrateRemoteRelays } from './migrations/0005-remote-relays.mjs';
 import { migrateWorkspaceRootSettings } from './migrations/0006-workspace-root-settings.mjs';
 import { migrateClaudeCloud } from './migrations/0007-claude-cloud.mjs';
 import { migrateMessagePins } from './migrations/0008-message-pins.mjs';
+import { migrateSubagentTimeline } from './migrations/0009-subagent-timeline.mjs';
+import { migrateSubagentTimelinePruning } from './migrations/0010-subagent-timeline-pruning.mjs';
+import { migrateRelayEventSubscriptions } from './migrations/0011-relay-event-subscriptions.mjs';
+import { migrateCrossRelayEventSubscriptions } from './migrations/0012-cross-relay-event-subscriptions.mjs';
+import { migratePreviews } from './migrations/0013-previews.mjs';
+import { migrateConversationGroups } from './migrations/0014-conversation-groups.mjs';
+import { migrateConversationGroupPosition } from './migrations/0015-conversation-group-position.mjs';
+import { migrateShareAccessLog } from './migrations/0016-share-access-log.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -422,8 +430,8 @@ export const SCHEMA_SQL = `
     ON workflow_runs(conversation_id);
 
   -- Previews published mid-turn, pinned to the transcript. Snapshot JSON, not a
-  -- registry reference: the registry is in-memory and the card must still
-  -- render after the preview closes or the relay restarts. Written with the
+  -- registry reference: the card must still render after the preview closes
+  -- (or after a restart dropped it as no longer valid). Written with the
   -- queue id (the response id does not exist yet mid-turn) and linked to the
   -- response at finalize, exactly like relay_activity.
   CREATE TABLE IF NOT EXISTS preview_cards (
@@ -441,6 +449,24 @@ export const SCHEMA_SQL = `
   CREATE INDEX IF NOT EXISTS idx_preview_cards_queue
     ON preview_cards(queue_message_id);
 
+  -- Published previews, restored at boot so their public links survive a
+  -- restart. Existing databases get the table from migration 0013 (same
+  -- columns; a test keeps the two declarations equal). Times are epoch ms.
+  -- Its index comes from the migration only, which skips a previews table of
+  -- other columns instead of failing the boot over it.
+  CREATE TABLE IF NOT EXISTS previews (
+    token           TEXT PRIMARY KEY,
+    mode            TEXT NOT NULL,
+    conversation_id TEXT,
+    label           TEXT NOT NULL,
+    target_host     TEXT,
+    target_port     INTEGER,
+    root_dir        TEXT,
+    created_at      INTEGER NOT NULL,
+    last_hit_at     INTEGER,
+    host_boot_id    TEXT
+  );
+
   CREATE TABLE IF NOT EXISTS uploaded_files (
     sha256        TEXT PRIMARY KEY,
     original_name TEXT,
@@ -742,6 +768,73 @@ try {
 } catch (error) {
   console.warn(`[message-pins] migration 0008 failed; retrying on next boot: ${error?.message || error}`);
 }
+// Sub-agent viewer: the timeline table and the run header columns. Readers
+// tolerate their absence (runs fall back to the activity, thought and stream
+// rows), so a failure is logged and retried next boot like 0008.
+try {
+  migrateSubagentTimeline(db);
+} catch (error) {
+  console.warn(`[subagent-timeline] migration 0009 failed; retrying on next boot: ${error?.message || error}`);
+}
+// Sub-agent record retention: the pruned marker and the sweep's index. The
+// sweep checks for the column and does nothing without it, so a failure is
+// logged and retried next boot like 0009.
+try {
+  migrateSubagentTimelinePruning(db);
+} catch (error) {
+  console.warn(`[subagent-timeline] migration 0010 failed; retrying on next boot: ${error?.message || error}`);
+}
+// Relay event subscriptions: two new tables. The event service checks for
+// them and stays off without them, so a failure is logged and retried next
+// boot like 0010.
+try {
+  migrateRelayEventSubscriptions(db);
+} catch (error) {
+  console.warn(`[relay-events] migration 0011 failed; retrying on next boot: ${error?.message || error}`);
+}
+// Relay event subscriptions across paired relays: columns on 0011's table and
+// the link table. Without them the event service keeps to this relay's own
+// sessions, so a failure is logged and retried next boot like 0011.
+try {
+  migrateCrossRelayEventSubscriptions(db);
+} catch (error) {
+  console.warn(`[relay-events] migration 0012 failed; retrying on next boot: ${error?.message || error}`);
+}
+// Persisted previews: one new table. The preview store checks for it and keeps
+// previews in memory only without it, so a failure is logged and retried next
+// boot like 0012.
+try {
+  migratePreviews(db);
+} catch (error) {
+  console.warn(`[previews] migration 0013 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// Session groups: the group table and the conversations' group column. The
+// group repository checks for them and sees no groups without them, so a
+// failure is logged and retried next boot like 0012.
+try {
+  migrateConversationGroups(db);
+} catch (error) {
+  console.warn(`[session-groups] migration 0014 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// A hand order inside a session group: one column. The group repository
+// checks for it and keeps the activity order without it, so a failure is
+// logged and retried next boot like 0014.
+try {
+  migrateConversationGroupPosition(db);
+} catch (error) {
+  console.warn(`[session-groups] migration 0015 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// Share lineages and the share access log: one column, one table. The share
+// repository checks for them; without them a renew starts a fresh lineage and
+// no open is logged, so a failure is logged and retried next boot like 0015.
+try {
+  migrateShareAccessLog(db);
+} catch (error) {
+  console.warn(`[shares] migration 0016 failed; retrying on next boot: ${error?.message || error}`);
+}
 
 const runtimeSessionColumns = db.prepare(`PRAGMA table_info(runtime_sessions)`).all().map((c) => c.name);
 if (runtimeSessionColumns.length) {

package/server/grok-worker/acp-client.mjs

@@ -12,6 +12,7 @@ import {
   createTurnStalledError,
   resolveTurnStallWindows,
 } from '../../shared/worker-runtime/turn-liveness.mjs';
+import { windowsSystemToolPath } from '../../shared/windows-system-tools.mjs';
 
 function whichCommand(command = 'grok') {
   const value = String(command || 'grok').trim() || 'grok';
@@ -522,7 +523,7 @@ export class AcpClient extends EventEmitter {
       this.proc.kill();
       if (process.platform === 'win32' && this.proc.pid) {
         try {
-          this.spawnImpl('taskkill', ['/pid', String(this.proc.pid), '/t', '/f'], {
+          this.spawnImpl(windowsSystemToolPath('taskkill'), ['/pid', String(this.proc.pid), '/t', '/f'], {
             stdio: 'ignore',
             windowsHide: true,
           });

package/server/grok-worker/acp-host-services.mjs

@@ -12,6 +12,7 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import fs from 'node:fs/promises';
+import { windowsSystemToolPath } from '../../shared/windows-system-tools.mjs';
 
 const DEFAULT_OUTPUT_BYTE_LIMIT = 1024 * 1024;
 const MAX_OUTPUT_BYTE_LIMIT = 8 * 1024 * 1024;
@@ -55,9 +56,9 @@ export function createAcpHostServices({
         timeout: 10_000,
         stdio: 'ignore',
       });
-      cachedWindowsShell = probe && probe.status === 0 ? 'pwsh' : 'powershell';
+      cachedWindowsShell = probe && probe.status === 0 ? 'pwsh' : windowsSystemToolPath('powershell');
     } catch {
-      cachedWindowsShell = 'powershell';
+      cachedWindowsShell = windowsSystemToolPath('powershell');
     }
     return cachedWindowsShell;
   }
@@ -178,7 +179,7 @@ export function createAcpHostServices({
     if (platform === 'win32' && entry.proc.pid) {
       // proc.kill() only reaches the shell; shells leave grandchildren behind.
       try {
-        spawnImpl('taskkill', ['/pid', String(entry.proc.pid), '/t', '/f'], {
+        spawnImpl(windowsSystemToolPath('taskkill'), ['/pid', String(entry.proc.pid), '/t', '/f'], {
           stdio: 'ignore',
           windowsHide: true,
         });

package/server/migrations/0009-subagent-timeline.mjs

@@ -0,0 +1,135 @@
+'use strict';
+
+/**
+ * Migration: sub-agent timeline.
+ *
+ * 1. `subagent_timeline` — one row per entry of a sub-agent's record (a
+ *    thought, a tool call, a tool result, reply text, a child agent, a note),
+ *    in the order the relay first saw it (`seq`, per run). A writer names each
+ *    entry with its own `entry_key`; a second write under the same key updates
+ *    the entry in place (live text, a thought that is still streaming) and
+ *    keeps its place in the order.
+ * 2. Header columns on `subagent_runs`: what the task panel shows (model,
+ *    type, tokens) and what the viewer needs to know about the run (task id,
+ *    background, whether the record was cut, who writes the timeline). The
+ *    panel's own copy lives in memory only and is gone when the task settles.
+ *
+ * Additive and idempotent. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0009-subagent-timeline.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function indexExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`)
+    .get(name);
+}
+
+function columnNames(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((column) => String(column.name)));
+}
+
+export const SUBAGENT_RUN_HEADER_COLUMNS = Object.freeze([
+  ['model', 'TEXT'],
+  ['model_inherited', 'INTEGER'],
+  ['subagent_type', 'TEXT'],
+  ['task_id', 'TEXT'],
+  ['total_tokens', 'INTEGER'],
+  ['background', 'INTEGER NOT NULL DEFAULT 0'],
+  ['truncated', 'INTEGER NOT NULL DEFAULT 0'],
+  ['timeline_owner', 'TEXT'],
+]);
+
+export function migrateSubagentTimeline(db) {
+  if (!tableExists(db, 'subagent_runs')) return { applied: false, tablesAdded: 0, columnsAdded: 0, indexesAdded: 0 };
+  let tablesAdded = 0;
+  let columnsAdded = 0;
+  let indexesAdded = 0;
+
+  const runColumns = columnNames(db, 'subagent_runs');
+  for (const [name, type] of SUBAGENT_RUN_HEADER_COLUMNS) {
+    if (runColumns.has(name)) continue;
+    db.exec(`ALTER TABLE subagent_runs ADD COLUMN ${name} ${type}`);
+    columnsAdded += 1;
+  }
+  if (!indexExists(db, 'idx_subagent_runs_parent')) {
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_subagent_runs_parent ON subagent_runs(parent_subagent_id)`);
+    indexesAdded += 1;
+  }
+
+  if (!tableExists(db, 'subagent_timeline')) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS subagent_timeline (
+        id               INTEGER PRIMARY KEY AUTOINCREMENT,
+        run_id           TEXT NOT NULL,
+        conversation_id  TEXT NOT NULL,
+        queue_message_id TEXT,
+        entry_key        TEXT NOT NULL,
+        seq              INTEGER NOT NULL,
+        kind             TEXT NOT NULL,
+        text             TEXT,
+        tool_name        TEXT,
+        tool_use_id      TEXT,
+        metadata_json    TEXT,
+        done             INTEGER NOT NULL DEFAULT 1,
+        created_at       TEXT NOT NULL,
+        updated_at       TEXT NOT NULL,
+        UNIQUE (run_id, entry_key),
+        UNIQUE (run_id, seq),
+        FOREIGN KEY (conversation_id) REFERENCES conversations(id) ON DELETE CASCADE
+      )
+    `);
+    tablesAdded += 1;
+  }
+  if (!indexExists(db, 'idx_subagent_timeline_conversation')) {
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_subagent_timeline_conversation ON subagent_timeline(conversation_id)`);
+    indexesAdded += 1;
+  }
+  return {
+    applied: tablesAdded + columnsAdded + indexesAdded > 0,
+    tablesAdded,
+    columnsAdded,
+    indexesAdded,
+  };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateSubagentTimeline(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0009 on ${dbPath}`);
+    console.log(result.applied
+      ? `  sub-agent timeline: tables added ${result.tablesAdded}, columns added ${result.columnsAdded}, indexes added ${result.indexesAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0009 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}

package/server/migrations/0010-subagent-timeline-pruning.mjs

@@ -0,0 +1,89 @@
+'use strict';
+
+/**
+ * Migration: pruning old sub-agent records.
+ *
+ * After the retention period the relay strips a finished run's tool inputs
+ * and tool results (services/subagent-record-retention.mjs). `pruned_at`
+ * marks an entry it already stripped, and a partial index over the tool
+ * entries not stripped yet, by age, lets the daily sweep go straight to its
+ * candidates instead of reading the whole table every day.
+ *
+ * Additive and idempotent. Safe to run on every boot.
+ *
+ * Usage: node server/migrations/0010-subagent-timeline-pruning.mjs [path/to/copilot.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+
+export const PRUNABLE_INDEX_NAME = 'idx_subagent_timeline_prunable';
+
+function tableExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`)
+    .get(name);
+}
+
+function indexExists(db, name) {
+  return !!db
+    .prepare(`SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`)
+    .get(name);
+}
+
+function columnNames(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((column) => String(column.name)));
+}
+
+export function migrateSubagentTimelinePruning(db) {
+  if (!tableExists(db, 'subagent_timeline')) return { applied: false, columnsAdded: 0, indexesAdded: 0 };
+  let columnsAdded = 0;
+  let indexesAdded = 0;
+  if (!columnNames(db, 'subagent_timeline').has('pruned_at')) {
+    db.exec(`ALTER TABLE subagent_timeline ADD COLUMN pruned_at TEXT`);
+    columnsAdded += 1;
+  }
+  if (!indexExists(db, PRUNABLE_INDEX_NAME)) {
+    // The sweep's WHERE repeats this condition word for word, so SQLite can
+    // use the partial index.
+    db.exec(`
+      CREATE INDEX IF NOT EXISTS ${PRUNABLE_INDEX_NAME}
+      ON subagent_timeline(updated_at)
+      WHERE pruned_at IS NULL AND kind IN ('tool_call', 'tool_result')
+    `);
+    indexesAdded += 1;
+  }
+  return { applied: columnsAdded + indexesAdded > 0, columnsAdded, indexesAdded };
+}
+
+function defaultDbPath() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', 'data', 'copilot.db');
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateSubagentTimelinePruning(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const dbPath = process.argv[2] ? path.resolve(process.argv[2]) : defaultDbPath();
+  try {
+    const result = migrate(dbPath);
+    console.log(`Migration 0010 on ${dbPath}`);
+    console.log(result.applied
+      ? `  sub-agent timeline pruning: columns added ${result.columnsAdded}, indexes added ${result.indexesAdded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0010 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}