@openchambery/web 1.18.4 → 1.18.5

package/server/lib/session-index/service.js

@@ -140,6 +140,12 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
       ON session_summary(runtime_key, directory, activity_updated_at DESC, session_id DESC);
     CREATE INDEX IF NOT EXISTS session_child_parent
       ON session_child(runtime_key, directory, parent_id);
+    CREATE TABLE IF NOT EXISTS session_pin (
+      runtime_key TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      pinned_at INTEGER NOT NULL,
+      PRIMARY KEY (runtime_key, session_id)
+    );
   `);
   const sessionSummaryColumns = new Set(
     db.prepare("SELECT name FROM pragma_table_info('session_summary')").all().map((column) => column.name),
@@ -147,6 +153,12 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
   if (!sessionSummaryColumns.has('pinned_at')) {
     db.exec('ALTER TABLE session_summary ADD COLUMN pinned_at INTEGER');
   }
+  db.prepare(`
+    INSERT OR IGNORE INTO session_pin(runtime_key, session_id, pinned_at)
+    SELECT runtime_key, session_id, pinned_at
+    FROM session_summary
+    WHERE pinned_at IS NOT NULL
+  `).run();
   db.prepare('INSERT OR REPLACE INTO session_index_meta(key, value) VALUES (?, ?)')
     .run('schema_version', String(SCHEMA_VERSION));
 
@@ -240,6 +252,23 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     SELECT COUNT(*) AS count FROM session_child
     WHERE runtime_key = ? AND directory = ? AND parent_id = ?
   `);
+  const readPins = db.prepare(`
+    SELECT session_id AS id, pinned_at AS pinnedAt
+    FROM session_pin
+    WHERE runtime_key = ?
+    ORDER BY pinned_at DESC, session_id DESC
+  `);
+  const upsertPin = db.prepare(`
+    INSERT INTO session_pin(runtime_key, session_id, pinned_at)
+    VALUES (?, ?, ?)
+    ON CONFLICT(runtime_key, session_id) DO UPDATE SET pinned_at = excluded.pinned_at
+  `);
+  const deletePin = db.prepare('DELETE FROM session_pin WHERE runtime_key = ? AND session_id = ?');
+  const writeSummaryPinnedAt = db.prepare(`
+    UPDATE session_summary
+    SET pinned_at = ?
+    WHERE runtime_key = ? AND session_id = ?
+  `);
 
   const replaceDirectoryRows = ({ directory, sessions, cursor, hasMore, fullSync = true, now = Date.now() }) => {
     const normalizedDirectory = normalizeDirectory(directory);
@@ -363,6 +392,8 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
 
   const snapshot = () => {
     const key = runtimeKey();
+    const pinRows = readPins.all(key);
+    const pinById = new Map(pinRows.map((row) => [row.id, row.pinnedAt]));
     const directories = db.prepare(`
       SELECT directory, cursor, has_more AS hasMore, last_synced_at AS lastSyncedAt,
         last_full_synced_at AS lastFullSyncedAt, last_accessed_at AS lastAccessedAt
@@ -387,7 +418,9 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
             created: session.createdAt,
             updated: session.updatedAt,
             ...(session.archivedAt ? { archived: session.archivedAt } : {}),
-            ...(session.pinnedAt ? { pinned: session.pinnedAt } : {}),
+            ...((pinById.get(session.id) ?? session.pinnedAt)
+              ? { pinned: pinById.get(session.id) ?? session.pinnedAt }
+              : {}),
           },
           metadata: {
             openchamber: {
@@ -401,13 +434,17 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
         }))
         .filter(isVisibleSession),
     }));
-    return { directories };
+    return {
+      directories,
+      pinnedSessionIds: pinRows.map((row) => row.id),
+    };
   };
 
   function remove(sessionID) {
     if (typeof sessionID !== 'string' || !sessionID) return false;
     const key = runtimeKey();
     const parent = parentForChild.get(key, sessionID);
+    const pinResult = deletePin.run(key, sessionID);
     const result = db.prepare('DELETE FROM session_summary WHERE runtime_key = ? AND session_id = ?').run(key, sessionID);
     deleteChildrenWithParent.run(key, sessionID);
     deleteChild.run(key, sessionID);
@@ -419,7 +456,7 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
         parent.parentID,
       );
     }
-    return result.changes > 0;
+    return result.changes > 0 || pinResult.changes > 0;
   }
 
   /**
@@ -480,36 +517,22 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     return result.changes > 0;
   };
 
-  const summaryExists = db.prepare(`
-    SELECT 1 AS present FROM session_summary
-    WHERE runtime_key = ? AND session_id = ?
-    LIMIT 1
-  `);
-
   const setPinned = (sessionID, pinnedAt = Date.now()) => {
     if (typeof sessionID !== 'string' || !sessionID) return false;
     const timestamp = toTimestamp(pinnedAt);
     if (!timestamp) return false;
     const key = runtimeKey();
-    if (!summaryExists.get(key, sessionID)) return false;
-    db.prepare(`
-      UPDATE session_summary
-      SET pinned_at = ?
-      WHERE runtime_key = ? AND session_id = ?
-    `).run(timestamp, key, sessionID);
+    upsertPin.run(key, sessionID, timestamp);
+    writeSummaryPinnedAt.run(timestamp, key, sessionID);
     return true;
   };
 
   const clearPinned = (sessionID) => {
     if (typeof sessionID !== 'string' || !sessionID) return false;
     const key = runtimeKey();
-    if (!summaryExists.get(key, sessionID)) return false;
-    db.prepare(`
-      UPDATE session_summary
-      SET pinned_at = NULL
-      WHERE runtime_key = ? AND session_id = ?
-    `).run(key, sessionID);
-    return true;
+    const pinResult = deletePin.run(key, sessionID);
+    const summaryResult = writeSummaryPinnedAt.run(null, key, sessionID);
+    return pinResult.changes > 0 || summaryResult.changes > 0;
   };
 
   const replaceChildSessions = db.transaction((directory, parentSessionID, children) => {

package/server/lib/session-index/service.test.js

@@ -385,7 +385,88 @@ describe('Electron session index', () => {
 
     expect(service.upsert({ ...session('ses_a', 11), time: { created: 9, updated: 11, archived: 12 } })).toBe(true);
     expect(service.snapshot().directories[0].sessions).toEqual([]);
+    expect(service.snapshot().pinnedSessionIds ?? []).not.toContain('ses_a');
     expect(service.clearPinned('ses_a')).toBe(false);
     service.close();
   });
+
+  it('keeps a pin after the session falls outside the newest-20 rebuild window', () => {
+    const runtimeRef = { value: 'http://runtime-a.test' };
+    const service = createService(runtimeRef);
+    service.replaceDirectory({
+      directory: '/repo',
+      sessions: [session('ses_pinned', 10)],
+      cursor: null,
+      hasMore: false,
+    });
+    expect(service.setPinned('ses_pinned', 42)).toBe(true);
+
+    const newer = Array.from({ length: 20 }, (_, index) => session(`ses_new_${index}`, 200 - index));
+    service.replaceDirectory({ directory: '/repo', sessions: newer, cursor: null, hasMore: true, now: 3000 });
+
+    const snapshot = service.snapshot();
+    expect(snapshot.directories[0].sessions).toHaveLength(20);
+    expect(snapshot.directories[0].sessions.some((item) => item.id === 'ses_pinned')).toBe(false);
+    expect(snapshot.pinnedSessionIds).toEqual(['ses_pinned']);
+    service.close();
+  });
+
+  it('keeps a pin after live upserts evict the pinned summary row', () => {
+    const runtimeRef = { value: 'http://runtime-a.test' };
+    const service = createService(runtimeRef);
+    service.replaceDirectory({
+      directory: '/repo',
+      sessions: [session('ses_pinned', 10)],
+      cursor: null,
+      hasMore: false,
+    });
+    expect(service.setPinned('ses_pinned', 43)).toBe(true);
+
+    for (let index = 0; index < 20; index += 1) {
+      service.upsert(session(`ses_new_${index}`, 200 - index));
+    }
+
+    const snapshot = service.snapshot();
+    expect(snapshot.directories[0].sessions).toHaveLength(20);
+    expect(snapshot.directories[0].sessions.some((item) => item.id === 'ses_pinned')).toBe(false);
+    expect(snapshot.pinnedSessionIds).toEqual(['ses_pinned']);
+    service.close();
+  });
+
+  it('backfills session_pin from existing summary pinned_at on open', () => {
+    const runtimeRef = { value: 'http://runtime-a.test' };
+    const service = createService(runtimeRef);
+    service.replaceDirectory({ directory: '/repo', sessions: [session('ses_a', 10)], cursor: null, hasMore: false });
+    expect(service.setPinned('ses_a', 66)).toBe(true);
+    service.close();
+
+    const dbPath = path.join(tempDirectories[tempDirectories.length - 1], 'session-index.sqlite');
+    const Database = createRequire(import.meta.url)('better-sqlite3');
+    const db = new Database(dbPath);
+    db.exec('DELETE FROM session_pin');
+    db.close();
+
+    const reopened = createSessionIndexService({
+      dbPath,
+      getRuntimeConfig: () => ({ apiBaseUrl: runtimeRef.value }),
+    });
+    expect(reopened.snapshot().pinnedSessionIds).toEqual(['ses_a']);
+    expect(reopened.snapshot().directories[0].sessions[0].time.pinned).toBe(66);
+    reopened.close();
+  });
+
+  it('pins a session that is not in the newest-20 index', () => {
+    const runtimeRef = { value: 'http://runtime-a.test' };
+    const service = createService(runtimeRef);
+    const newest = Array.from({ length: 20 }, (_, index) => session(`ses_${index}`, 100 - index));
+    service.replaceDirectory({ directory: '/repo', sessions: newest, cursor: 80, hasMore: true, now: 1000 });
+
+    expect(service.setPinned('ses_old', 55)).toBe(true);
+    expect(service.snapshot().pinnedSessionIds).toEqual(['ses_old']);
+    expect(service.snapshot().directories[0].sessions.some((item) => item.id === 'ses_old')).toBe(false);
+
+    expect(service.clearPinned('ses_old')).toBe(true);
+    expect(service.snapshot().pinnedSessionIds ?? []).toEqual([]);
+    service.close();
+  });
 });

package/server/lib/session-title/DOCUMENTATION.md

@@ -18,16 +18,21 @@ throttle (`TITLE_THROTTLE_MS`) when a refresh is armed.
    pattern as session-assist. Purely event-driven — dormant sessions never
    generate anything.
   2. Auto title refresh is intentionally sparse (title stability first). A newly
-    observed root `session.created` generates its first title immediately on the
-    first `session.status: idle`. A fork title (`(fork #n)`) waits for its first
-    newly-created user message; the matching assistant completion triggers an
-    immediate title refresh that bypasses inherited title metadata and throttle.
-    Ordinary later idle transitions do **not** arm another refresh. Any
-    `busy`/`retry` status or a fresh user `message.updated` still clears an
-    already-armed timer (so initial/fork timers cancel if the user keeps going).
-    A sidebar smart-title request sets `titleRefresh.requestedAt`; its
-    `session.updated` event arms the same flow immediately (forced / manual
-    refresh is unaffected by the background gate).
+     observed root `session.created` generates its first title immediately on the
+     first `session.status: idle`. A fork title (`(fork #n)`) waits for its first
+     newly-created user message; the matching assistant completion triggers an
+     immediate title refresh that bypasses inherited title metadata and throttle.
+     If the fork's `session.created` was lost (SSE reconnect gap, server or
+     OpenCode restart), the first newly-created user message lazily re-registers
+     the pending fork from the session read inside `recordUserActivity` (fork
+     title + message created after the fork + activity timestamp not yet past
+     the fork time), so the first-reply refresh still fires.
+     Ordinary later idle transitions do **not** arm another refresh. Any
+     `busy`/`retry` status or a fresh user `message.updated` still clears an
+     already-armed timer (so initial/fork timers cancel if the user keeps going).
+     A sidebar smart-title request sets `titleRefresh.requestedAt`; its
+     `session.updated` event arms the same flow immediately (forced / manual
+     refresh is unaffected by the background gate).
   3. On fire:
     - Skip when Settings → Chat → session title refresh is off.
     - Skip system-owned sessions whose metadata carries a non-empty

package/server/lib/session-title/runtime.js

@@ -484,6 +484,30 @@ export const createSessionTitleRuntime = ({
     if (!session || typeof session !== 'object') return;
 
     const meta = readTitleRefreshMeta(session);
+
+    // Lazy fork registration: when the fork's `session.created` event was lost
+    // (SSE reconnect gap, server/OpenCode restart), the in-memory pending map
+    // never learned about the fork. The first newly-created user message on a
+    // fork-titled session (message created after the fork, before any activity
+    // timestamp advanced past the fork) rebuilds that pending entry so the
+    // matching idle still triggers the first-refresh. Idempotent: the normal
+    // session.created path already holds a pending entry, and once activity
+    // advances past the fork time later messages never re-register.
+    const forkCreated = Number(session?.time?.created);
+    if (
+      !forkFirstSendPending.has(sessionId)
+      && isForkedSessionTitle(typeof session.title === 'string' ? session.title : '')
+      && Number.isFinite(forkCreated)
+      && createdAt > forkCreated
+      && !(Number(meta.titleRefresh.activityUpdatedAt) > forkCreated)
+    ) {
+      forkFirstSendPending.set(sessionId, {
+        createdAt: forkCreated,
+        directory: directory || '',
+        hasNewUserMessage: true,
+      });
+    }
+
     const previous = Number(meta.titleRefresh.activityUpdatedAt);
     const activityUpdatedAt = Number.isFinite(previous) ? Math.max(previous, createdAt) : createdAt;
     if (activityUpdatedAt === previous) return;

package/server/lib/session-title/runtime.test.js

@@ -410,6 +410,149 @@ describe('session-title helpers', () => {
     }
   });
 
+  it('recovers the fork first-refresh when the fork session.created event was lost', async () => {
+    const originalFetch = globalThis.fetch;
+    const forkCreated = 100;
+    const session = {
+      id: 'ses-fork-lost',
+      title: 'Original work (fork #1)',
+      time: { created: forkCreated },
+      metadata: {
+        openchamber: {
+          titleRefresh: {
+            // Inherited from the parent: activity predates the fork.
+            activityUpdatedAt: 50,
+            lastAutoTitle: 'Original work',
+            generatedAt: 40,
+            forMessageID: 'assistant-original',
+          },
+        },
+      },
+    };
+    const messages = [
+      { info: { id: 'user-fork', role: 'user' }, parts: [{ type: 'text', text: 'Try a different approach' }] },
+      { info: { id: 'assistant-fork', role: 'assistant' }, parts: [{ type: 'text', text: 'Different approach ready' }] },
+    ];
+    let generationCalls = 0;
+
+    globalThis.fetch = async (input, init = {}) => {
+      const url = String(input);
+      if (url.includes('/message')) {
+        return new Response(JSON.stringify(messages), { status: 200 });
+      }
+      if (init.method === 'PATCH') {
+        const body = typeof init.body === 'string' ? JSON.parse(init.body) : init.body;
+        if (typeof body?.title === 'string') session.title = body.title;
+        if (body?.metadata) session.metadata = body.metadata;
+        return new Response(JSON.stringify(session), { status: 200 });
+      }
+      return new Response(JSON.stringify(session), { status: 200 });
+    };
+
+    try {
+      const runtime = createSessionTitleRuntime({
+        buildOpenCodeUrl: (pathname) => `http://opencode${pathname}`,
+        getOpenCodeAuthHeaders: () => ({}),
+        getSmallModelService: async () => ({
+          generateSmallModelText: async () => {
+            generationCalls += 1;
+            return { text: 'Different approach', providerID: 'test', modelID: 'test' };
+          },
+        }),
+        now: () => 1_000,
+        isTitleRefreshEnabled: () => true,
+      });
+
+      // No session.created — it was lost across an SSE reconnect gap. The first
+      // newly-sent fork message lazily re-registers the pending fork entry.
+      runtime.processPayload({
+        type: 'message.updated',
+        properties: { directory: '/repo', info: { sessionID: 'ses-fork-lost', role: 'user', id: 'user-fork', time: { created: 200 } } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 25));
+
+      runtime.processPayload({
+        type: 'session.status',
+        properties: { sessionID: 'ses-fork-lost', directory: '/repo', status: { type: 'idle' } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 25));
+
+      expect(generationCalls).toBe(1);
+      expect(session.title).toBe('Different approach');
+      runtime.stop();
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it('does not lazily re-register a fork after its activity already moved past the fork', async () => {
+    const originalFetch = globalThis.fetch;
+    const forkCreated = 100;
+    const session = {
+      id: 'ses-fork-advanced',
+      title: 'Original work (fork #1)',
+      time: { created: forkCreated },
+      metadata: {
+        openchamber: {
+          titleRefresh: {
+            // A fork message already advanced activity past the fork time.
+            activityUpdatedAt: 300,
+            lastAutoTitle: 'Original work',
+            generatedAt: 40,
+            forMessageID: 'assistant-original',
+          },
+        },
+      },
+    };
+    let generationCalls = 0;
+
+    globalThis.fetch = async (input, init = {}) => {
+      if (String(input).includes('/message')) {
+        return new Response(JSON.stringify([
+          { info: { id: 'user-x', role: 'user' }, parts: [{ type: 'text', text: 'later message' }] },
+          { info: { id: 'assistant-x', role: 'assistant' }, parts: [{ type: 'text', text: 'later reply' }] },
+        ]), { status: 200 });
+      }
+      if (init.method === 'PATCH') {
+        const body = typeof init.body === 'string' ? JSON.parse(init.body) : init.body;
+        if (body?.metadata) session.metadata = body.metadata;
+        return new Response(JSON.stringify(session), { status: 200 });
+      }
+      return new Response(JSON.stringify(session), { status: 200 });
+    };
+
+    try {
+      const runtime = createSessionTitleRuntime({
+        buildOpenCodeUrl: (pathname) => `http://opencode${pathname}`,
+        getOpenCodeAuthHeaders: () => ({}),
+        getSmallModelService: async () => ({
+          generateSmallModelText: async () => {
+            generationCalls += 1;
+            return { text: 'Should not run', providerID: 'test', modelID: 'test' };
+          },
+        }),
+        now: () => 1_000,
+        isTitleRefreshEnabled: () => true,
+      });
+
+      runtime.processPayload({
+        type: 'message.updated',
+        properties: { directory: '/repo', info: { sessionID: 'ses-fork-advanced', role: 'user', id: 'user-x', time: { created: 400 } } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      runtime.processPayload({
+        type: 'session.status',
+        properties: { sessionID: 'ses-fork-advanced', directory: '/repo', status: { type: 'idle' } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 25));
+
+      expect(generationCalls).toBe(0);
+      runtime.stop();
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   it('refreshes a new session on first idle, then ignores later idle transitions', async () => {
     const originalFetch = globalThis.fetch;
     const session = {

package/server/lib/session-turn-pages/DOCUMENTATION.md

@@ -68,7 +68,7 @@ Success `200`:
 - `records`: chronological oldest → newest, including intermediate non-boundary rows (synthetic, tools, subtask, compaction) inside the window.
 - `turnCount`: count of authored user boundaries in `records`.
 - `cursor`: host-owned opaque token for the next `before=` request; `null` when `complete` is true. The token represents the position **just before** the earliest returned authored user (so the client can load older history without overlap).
-- `complete`: `upstreamComplete && selected.length === accumulated.length`. True when upstream history is exhausted **and** `selectTurnRecords` did not trim any older scanned rows (nothing left for the client). When the scan window held more than N turns and older rows were trimmed, `complete` stays `false` with a `cursor` so the client can fetch the trimmed history.
+- `complete`: `upstreamComplete && selected.length === accumulated.length`. True when upstream history is exhausted **and** `selectTurnRecords` did not trim any older scanned rows (nothing left for the client). When the scan window held more than N turns and older rows were trimmed, or when upstream stopped on a full page with a missing `nextCursor` (suspicious truncation), `complete` stays `false` with a `cursor` so the client can fetch / retry.
 - `partsProjection`: `"slim-v1"` on every turn-page response (first packet and prepend). Names the projection applied to `records`; see below. Reconcile responses omit this field and keep full parts.
 
 ### Turn-page payload projection
@@ -147,6 +147,7 @@ A message is an authored user turn boundary when:
 
 - Upstream pages are chronological **old→new** within each page; **do not reverse**. Older pages are **prepended** while deduping by `info.id` (global order remains old→new).
 - Continues paging with raw upstream `before` until `turns` authored boundaries are collected or upstream reports no next cursor.
+- **Suspicious truncation:** an upstream page whose `records.length >= scanLimit` (full page) but `nextCursor == null` is treated as a non-authoritative cut (observed OpenCode `x-next-cursor` race), not as end-of-history. The host stops scanning that round with `upstreamComplete=false`, so the response stays `complete=false` and still emits a boundary host cursor the client can retry. A short page (`records.length < scanLimit`) with no cursor, an empty page with no cursor, or an explicit `page.complete === true` remain authoritative exhaustion. Client no-growth handling still bounds retries if the upstream view stays truncated.
 - Every upstream record must have a non-empty `info.id`; otherwise structured error, no partial `records`, HTTP 502.
 - Hard scan caps (no partial success): **50 pages** / **5000 messages** → structured error, HTTP 413.
 - Repeated / stalled cursor, or empty page that still carries a next cursor → structured error, no partial `records`, HTTP 502.

package/server/lib/session-turn-pages/service.js

@@ -719,7 +719,14 @@ export const createSessionTurnPageService = ({
 
         const rawNext = page.nextCursor;
         const nextCursor = typeof rawNext === 'string' && rawNext.length > 0 ? rawNext : null;
-        const pageComplete = page.complete === true || nextCursor == null;
+        // Explicit page.complete wins. Otherwise: no nextCursor on a short page
+        // is authoritative exhaustion; a *full* page with no nextCursor is a
+        // suspicious upstream truncation (x-next-cursor race) — stop scanning
+        // but do not mark upstreamComplete so the host still emits a retryable
+        // boundary cursor instead of permanently exhausting the client.
+        const fullPageNoCursor = nextCursor == null && records.length >= pageLimit;
+        const pageComplete = page.complete === true
+          || (nextCursor == null && !fullPageNoCursor);
 
         if (records.length === 0) {
           if (nextCursor) {
@@ -795,6 +802,12 @@ export const createSessionTurnPageService = ({
           break;
         }
 
+        if (fullPageNoCursor) {
+          // Suspicious truncation: keep upstreamComplete=false so the response
+          // stays complete=false with a host cursor the client can retry.
+          break;
+        }
+
         // Enough authored boundaries collected — stop without requiring exhaustion.
         if (countAuthoredBoundaries(accumulated) >= turnBudget) {
           break;

package/server/lib/session-turn-pages/service.test.js

@@ -1107,4 +1107,137 @@ describe('createSessionTurnPageService', () => {
       signal: controller.signal,
     }));
   });
+
+  describe('full-page missing nextCursor (suspicious upstream truncation)', () => {
+    it('short page without cursor remains authoritative exhaustion', async () => {
+      // records < scanLimit + no cursor → real end of history.
+      const fetchPage = vi.fn(async () => pageResult([
+        user('msg_u1'),
+        assistant('msg_a1'),
+        user('msg_u2'),
+        assistant('msg_a2'),
+      ], null));
+      const service = createSessionTurnPageService({ fetchPage });
+
+      const result = await service.loadPage({
+        sessionID: 'ses_1',
+        turns: 3,
+        scanLimit: 100,
+      });
+
+      expect(result).toMatchObject({
+        ok: true,
+        complete: true,
+        cursor: null,
+        turnCount: 2,
+      });
+    });
+
+    it('full page without cursor stays incomplete and emits a host cursor', async () => {
+      // Upstream race: page is full (records >= scanLimit) but x-next-cursor is
+      // missing. Must not permanently exhaust — client needs a retryable cursor.
+      const records = [];
+      for (let i = 1; i <= 10; i += 1) {
+        records.push(user(`msg_u${i}`), assistant(`msg_a${i}`));
+      }
+      expect(records.length).toBe(20);
+      const fetchPage = vi.fn(async () => pageResult(records, null));
+      const service = createSessionTurnPageService({ fetchPage });
+
+      const result = await service.loadPage({
+        sessionID: 'ses_1',
+        turns: 3,
+        scanLimit: 20,
+      });
+
+      expect(result.ok).toBe(true);
+      expect(result.complete).toBe(false);
+      expect(typeof result.cursor).toBe('string');
+      expect(result.cursor.startsWith('oc1.')).toBe(true);
+      expect(result.turnCount).toBe(3);
+      expect(decodeHostCursor(result.cursor)).toEqual({
+        ok: true,
+        value: { before: null, boundaryID: 'msg_u8' },
+      });
+    });
+
+    it('page with nextCursor keeps paging (unchanged)', async () => {
+      const pages = new Map([
+        [undefined, pageResult([
+          user('msg_u2'),
+          assistant('msg_a2'),
+          user('msg_u3'),
+          assistant('msg_a3'),
+        ], 'opaque_older')],
+        ['opaque_older', pageResult([
+          user('msg_u1'),
+          assistant('msg_a1'),
+        ], null)],
+      ]);
+      const fetchPage = vi.fn(async ({ before }) => pages.get(before) ?? pageResult([], null));
+      const service = createSessionTurnPageService({ fetchPage });
+
+      const result = await service.loadPage({
+        sessionID: 'ses_1',
+        turns: 3,
+        scanLimit: 100,
+      });
+
+      expect(result).toMatchObject({
+        ok: true,
+        complete: true,
+        cursor: null,
+        turnCount: 3,
+      });
+      expect(fetchPage.mock.calls.length).toBe(2);
+    });
+
+    it('empty page without cursor remains authoritative exhaustion', async () => {
+      const fetchPage = vi.fn(async () => pageResult([], null));
+      const service = createSessionTurnPageService({ fetchPage });
+
+      const result = await service.loadPage({
+        sessionID: 'ses_1',
+        turns: 3,
+        scanLimit: 100,
+      });
+
+      expect(result).toMatchObject({
+        ok: true,
+        complete: true,
+        cursor: null,
+        turnCount: 0,
+      });
+      expect(result.records).toEqual([]);
+    });
+
+    it('explicit page.complete=true on a full page without cursor still exhausts', async () => {
+      // Explicit complete declaration outranks the full-page heuristic.
+      // Exactly turns=budget so selectTurnRecords does not trim — complete
+      // stays true solely because upstreamComplete was set by page.complete.
+      const records = [];
+      for (let i = 1; i <= 10; i += 1) {
+        records.push(user(`msg_u${i}`), assistant(`msg_a${i}`));
+      }
+      const fetchPage = vi.fn(async () => ({
+        records,
+        nextCursor: null,
+        complete: true,
+      }));
+      const service = createSessionTurnPageService({ fetchPage });
+
+      const result = await service.loadPage({
+        sessionID: 'ses_1',
+        turns: 10,
+        scanLimit: 20,
+      });
+
+      expect(result).toMatchObject({
+        ok: true,
+        complete: true,
+        cursor: null,
+        turnCount: 10,
+      });
+    });
+  });
 });

package/server/lib/ui-auth/ui-auth.js

@@ -714,7 +714,9 @@ export const createUiAuth = ({
   const respondUnauthorized = (req, res) => {
     res.status(401);
     const acceptsJson = req.headers.accept?.includes('application/json');
-    if (acceptsJson || req.path?.startsWith('/api')) {
+    // Express strips the mount prefix from req.path (e.g. app.use('/api') turns
+    // /api/mcp into /mcp), so resolve the original pathname instead.
+    if (acceptsJson || getRequestPathname(req).startsWith('/api')) {
       res.json({ error: 'UI authentication required', locked: true });
     } else {
       res.type('text/plain').send('Authentication required');

package/server/lib/ui-auth/ui-auth.test.js

@@ -259,6 +259,31 @@ describe('ui auth client credential seam', () => {
     }
   });
 
+  it('returns JSON 401 for unauthenticated API requests mounted under a sub-app', async () => {
+    const createUiAuth = await loadCreateUiAuth();
+    const auth = createUiAuth({ password: 'secret' });
+
+    // Express strips the mount prefix: app.use('/api') turns /api/mcp into
+    // req.path '/mcp'. The unauthorized response must still be identified as an
+    // API request (JSON + locked) so clients can react to the auth gate.
+    const req = {
+      method: 'GET',
+      baseUrl: '/api',
+      path: '/mcp',
+      originalUrl: '/api/mcp',
+      url: '/api/mcp',
+      headers: {},
+    };
+    const res = createResponse();
+    let called = false;
+    await auth.requireAuth(req, res, () => {
+      called = true;
+    });
+    expect(called).toBe(false);
+    expect(res.statusCode).toBe(401);
+    expect(res.body).toEqual({ error: 'UI authentication required', locked: true });
+  });
+
   it('issues desktop client tokens with the UI session expiry', async () => {
     const createUiAuth = await loadCreateUiAuth();
     let createClientInput = null;