openclacky 1.5.20 → 1.5.21

data/lib/clacky/server/http_server.rb

@@ -110,6 +110,15 @@ module Clacky
 
       def show_tool_call(name, args)
         args_data = args.is_a?(String) ? (JSON.parse(args) rescue args) : args
+        if Clacky::Tools::AskUser.feedback_tool?(name)
+          questions = Clacky::Tools::AskUser.normalize_questions(args_data)
+          first = questions.first || {}
+          @events << { type: "request_feedback", session_id: @session_id,
+                       request_id: Clacky::Tools::AskUser.fetch_key(args_data, :request_id),
+                       context: Clacky::Tools::AskUser.fetch_key(args_data, :context).to_s,
+                       question: first[:question].to_s, options: first[:options] || [], questions: questions }
+          return
+        end
         summary   = tool_call_summary(name, args_data)
         @events << stamp({ type: "tool_call", session_id: @session_id, name: name, args: args_data, summary: summary })
       end
@@ -700,6 +709,7 @@ module Clacky
         when ["POST",   "/api/browser/configure"]  then api_browser_configure(req, res)
         when ["POST",   "/api/browser/reload"]    then api_browser_reload(res)
         when ["POST",   "/api/browser/toggle"]    then api_browser_toggle(res)
+        when ["POST",   "/api/browser/settings"]  then api_browser_settings(req, res)
         when ["GET",    "/api/backup/status"]     then api_backup_status(res)
         when ["POST",   "/api/backup/run"]        then api_backup_run(res)
         when ["GET",    "/api/backup/download"]   then api_backup_download(res)
@@ -732,8 +742,8 @@ module Clacky
         when ["DELETE", "/api/trash"]     then api_trash_delete(req, res)
         when ["GET",    "/api/trash/sessions"]     then api_trash_sessions(req, res)
         when ["POST",   "/api/trash/sessions/restore"] then api_trash_session_restore(req, res)
-        when ["DELETE", "/api/trash/sessions"]     then api_trash_sessions_delete(req, res)
-        when ["DELETE", "/api/archive/sessions"]   then api_archive_sessions_empty(res)
+        when ["POST",   "/api/trash/sessions/delete"]  then api_trash_sessions_delete(req, res)
+        when ["POST",   "/api/archive/sessions/delete"] then api_archive_sessions_delete(req, res)
         when ["GET",    "/api/profile"]   then api_profile_get(res)
         when ["PUT",    "/api/profile"]   then api_profile_put(req, res)
         when ["GET",    "/api/memories"]  then api_memories_list(res)
@@ -870,6 +880,9 @@ module Clacky
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/project$})
             session_id = path.sub("/api/sessions/", "").sub("/project", "")
             api_update_session_project(session_id, req, res)
+          elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/permission_mode$})
+            session_id = path.split("/")[3]
+            api_switch_session_permission_mode(session_id, req, res)
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/model$})
             session_id = path.sub("/api/sessions/", "").sub("/model", "")
             api_switch_session_model(session_id, req, res)
@@ -950,6 +963,9 @@ module Clacky
           elsif method == "PATCH" && path.match?(%r{^/api/projects/[^/]+$})
             project_id = path.sub("/api/projects/", "")
             api_update_project(project_id, req, res)
+          elsif method == "POST" && path.match?(%r{^/api/projects/[^/]+/sessions/archive$})
+            project_id = path.sub("/api/projects/", "").sub("/sessions/archive", "")
+            api_archive_project_sessions(project_id, res)
           elsif method == "DELETE" && path.match?(%r{^/api/projects/[^/]+/sessions$})
             project_id = path.sub("/api/projects/", "").sub("/sessions", "")
             api_delete_project_sessions(project_id, res)
@@ -968,6 +984,7 @@ module Clacky
         query        = URI.decode_www_form(req.query_string.to_s).to_h
         limit        = [query["limit"].to_i.then { |n| n > 0 ? n : 15 }, 50].min
         before       = query["before"].to_s.strip.then  { |v| v.empty? ? nil : v }
+        before_id    = query["before_id"].to_s.strip.then { |v| v.empty? ? nil : v }
         q            = query["q"].to_s.strip.then       { |v| v.empty? ? nil : v }
         q_scope      = query["q_scope"].to_s.strip.then { |v| %w[name content].include?(v) ? v : "name" }
         date         = query["date"].to_s.strip.then    { |v| v.empty? ? nil : v }
@@ -987,14 +1004,15 @@ module Clacky
         # The archive view is the exception: it groups archived sessions by
         # project by hand, so project membership must survive both filters.
         exclude_project = archived ? false : (before ? true : !!type)
-        sessions = @registry.list(limit: limit + 1, before: before, q: q, q_scope: q_scope, date: date, type: type, exclude_type: exclude_type, exclude_project: exclude_project, archived: archived)
+        sessions = @registry.list(limit: limit + 1, before: before, before_id: before_id, q: q, q_scope: q_scope, date: date, type: type, exclude_type: exclude_type, exclude_project: exclude_project, archived: archived)
 
         pinned_part, non_pinned_part = sessions.partition { |s| s[:pinned] }
         has_more = non_pinned_part.size > limit
         non_pinned_part = non_pinned_part.first(limit)
         sessions = pinned_part + non_pinned_part
 
-        payload = { sessions: sessions, has_more: has_more, groups: @registry.group_stats_all }
+        payload = { sessions: sessions, has_more: has_more, next_cursor: non_pinned_part.last&.dig(:cursor),
+                    groups: @registry.group_stats_all }
         # The archive page offers "delete all", so it needs the size of the whole
         # archive — the paged `sessions` array only ever shows one page of it.
         payload[:archived_count] = @registry.archived_count if archived
@@ -1682,6 +1700,22 @@ module Clacky
         json_response(res, 500, { ok: false, error: e.message })
       end
 
+      # POST /api/browser/settings
+      # Body: { screenshot_max_base64_bytes: 300000 }
+      # The field is optional — omitting it keeps the current value.
+      def api_browser_settings(req, res)
+        body = JSON.parse(req.body.to_s) rescue {}
+
+        settings = @browser_manager.update_screenshot_settings(
+          max_base64_bytes: body["screenshot_max_base64_bytes"]
+        )
+        json_response(res, 200, { ok: true }.merge(settings))
+      rescue ArgumentError => e
+        json_response(res, 422, { ok: false, error: e.message })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
       # GET /api/backup/status
       def api_backup_status(res)
         json_response(res, 200, BackupManager.status)
@@ -2293,38 +2327,66 @@ module Clacky
       end
 
       # PATCH /api/config/search
-      # Body: { provider: "tavily"|"", key?: "..." }
+      # Body: { provider?: "tavily"|"deepseek_web"|"", key?: "..." }
+      # Omitted fields keep their current value.
       def api_update_search_config(req, res)
         body = parse_json_body(req)
         return json_response(res, 400, { error: "Invalid JSON" }) unless body
 
         provider = body["provider"].to_s.strip
-        unless provider.empty? || Clacky::Utils::SearcherManager.path_for(provider)
+        if body.key?("provider") && !search_provider_known?(provider)
           return json_response(res, 422, { error: "Unknown search provider: #{provider}" })
         end
 
         key = body["key"].to_s
         key = Clacky::SearchConfig.key if key.include?("****")
 
-        Clacky::SearchConfig.save(provider: provider, key: key)
-        json_response(res, 200, { ok: true, provider: provider })
+        current = Clacky::SearchConfig.load
+        final_provider = body.key?("provider") ? provider : current["provider"]
+        final_key      = body.key?("key") ? key : current["key"]
+
+        # deepseek_web falls back to the configured model key, so it may be
+        # saved without one. Every other searcher is a script that reads the
+        # key from CLACKY_SEARCH_KEY and cannot run without it.
+        if !final_provider.empty? &&
+           final_provider != Clacky::SearchConfig::DEEPSEEK_WEB &&
+           final_key.to_s.strip.empty?
+          return json_response(res, 422, {
+            error: "API key is required for search provider '#{final_provider}'"
+          })
+        end
+
+        Clacky::SearchConfig.save(
+          provider: body.key?("provider") ? provider : nil,
+          key: body.key?("key") ? key : nil
+        )
+        config = Clacky::SearchConfig.load
+        json_response(res, 200, { ok: true, provider: config["provider"] })
       rescue => e
         json_response(res, 422, { error: e.message })
       end
 
+      private def search_provider_known?(provider)
+        return true if provider.empty?
+        return true if provider == Clacky::SearchConfig::DEEPSEEK_WEB
+
+        !Clacky::Utils::SearcherManager.path_for(provider).nil?
+      end
+
       # POST /api/config/search/test
-      # Runs the searcher with a fixed query so the user gets a definitive
-      # answer before saving, rather than discovering a bad key mid-task.
+      # Runs the configured engine with a fixed query so the user gets a
+      # definitive answer before saving, rather than discovering a bad key mid-task.
       def api_test_search_config(req, res)
         body = parse_json_body(req) || {}
         provider = body["provider"].to_s.strip
         return json_response(res, 200, { ok: false, message: "provider is required" }) if provider.empty?
 
-        script = Clacky::Utils::SearcherManager.path_for(provider)
-        return json_response(res, 200, { ok: false, message: "searcher not found: #{provider}" }) unless script
-
         key = body["key"].to_s
         key = Clacky::SearchConfig.key if key.empty? || key.include?("****")
+        return test_deepseek_web_search(res, key) if provider == Clacky::SearchConfig::DEEPSEEK_WEB
+
+        script = Clacky::Utils::SearcherManager.path_for(provider)
+        return json_response(res, 200, { ok: false, message: "searcher not found: #{provider}" }) unless script
 
         stdout, stderr, status = Clacky::Utils::ParserManager.capture3_with_timeout(
           { "CLACKY_SEARCH_KEY" => key },
@@ -2353,6 +2415,23 @@ module Clacky
         json_response(res, 200, { ok: false, message: e.message })
       end
 
+      private def test_deepseek_web_search(res, key)
+        key = @agent_config.deepseek_web_key.to_s if key.empty?
+        if key.empty?
+          return json_response(res, 200, {
+            ok: false, message: "No DeepSeek key: fill one in or configure a DeepSeek / OpenClacky model"
+          })
+        end
+
+        results = Clacky::DeepSeekWebTools.search(
+          query: "openclacky", count: 1, api_key: key,
+          base_url: @agent_config.deepseek_web_base_url(key)
+        )
+        json_response(res, 200, { ok: true, message: "Returned #{results.size} result(s)" })
+      rescue => e
+        json_response(res, 200, { ok: false, message: e.message })
+      end
+
       # POST /api/internal/ocr-image
       # Internal endpoint used by parser scripts (e.g. pdf_parser_vlm.py) to
       # transcribe a single image via the configured OCR sidecar. Localhost-
@@ -6034,20 +6113,23 @@ module Clacky
         json_response(res, 200, { ok: true, session_id: session_id })
       end
 
-      # DELETE /api/trash/sessions?days_old=N
-      # Bulk: permanently delete sessions older than N days (default: 7).
+      # POST /api/trash/sessions/delete
+      # Body: { session_ids: ["...", ...] }
+      # Bulk: permanently delete exactly these sessions. The caller decides the
+      # scope (the page's filters live in the browser), so an empty list is
+      # rejected rather than read as "everything".
       private def api_trash_sessions_delete(req, res)
-        query    = URI.decode_www_form(req.query_string.to_s).to_h
-        days_old = query["days_old"].to_s.strip
-        days_i   = days_old.empty? ? 7 : days_old.to_i
+        raw = parse_json_body(req)["session_ids"]
+        ids = raw.is_a?(Array) ? raw.map { |id| id.to_s.strip }.reject(&:empty?) : []
 
-        deleted = @session_manager.cleanup_trash(days: days_i)
+        if ids.empty?
+          json_response(res, 400, { ok: false, error: "session_ids is required" })
+          return
+        end
 
-        json_response(res, 200, {
-          ok:            true,
-          deleted_count: deleted,
-          days_old:      days_i
-        })
+        deleted = @session_manager.permanent_delete_trash_sessions(ids)
+
+        json_response(res, 200, { ok: true, deleted_count: deleted })
       end
 
       # ── Trash helpers (private) ─────────────────────────────────────
@@ -7250,6 +7332,45 @@ module Clacky
         json_response(res, 500, { error: e.message })
       end
 
+      # POST /api/projects/:id/sessions/archive - archive every live session in a project
+      def api_archive_project_sessions(project_id, res)
+        return json_response(res, 404, { error: "Project not found" }) unless @project_manager.find(project_id)
+
+        archived = _archive_project_sessions(project_id)
+        json_response(res, 200, { ok: true, archived: archived })
+      rescue => e
+        json_response(res, 500, { error: e.message })
+      end
+
+      # Sessions already in the archive keep their original archived_at, so the
+      # archive page stays ordered by when the user actually put them away.
+      private def _archive_project_sessions(project_id)
+        archived = 0
+        now      = Time.now.iso8601
+
+        @session_manager.all_sessions.each do |session_data|
+          next unless session_data[:project_id].to_s == project_id
+          next if session_data[:archived_at]
+
+          sid  = session_data[:session_id]
+          live = nil
+          @registry.with_session(sid) { |s| live = s[:agent] }
+
+          if live
+            live.archived_at = now
+            @session_manager.save(live.to_session_data(updated_at: Time.now))
+          else
+            # Untouched on disk: patch the loaded row rather than restoring an
+            # agent for every session in the project just to stamp one field.
+            @session_manager.save(session_data.merge(archived_at: now, updated_at: now))
+          end
+
+          broadcast(sid, { type: "session_updated", session_id: sid, archived_at: now })
+          archived += 1
+        end
+        archived
+      end
+
       private def _delete_project_sessions(project_id)
         deleted = 0
         @session_manager.all_sessions.each do |session_data|
@@ -7346,6 +7467,24 @@ module Clacky
         json_response(res, 500, { error: e.message })
       end
 
+      # PATCH /api/sessions/:id/permission_mode — session-only, never global.
+      def api_switch_session_permission_mode(session_id, req, res)
+        mode = parse_json_body(req)["permission_mode"].to_s
+        unless %w[confirm_all auto_approve].include?(mode)
+          return json_response(res, 400, { error: "Invalid permission mode" })
+        end
+        return json_response(res, 404, { error: "Session not found" }) unless @registry.ensure(session_id)
+
+        @registry.with_session(session_id) do |session|
+          agent = session[:agent]
+          return json_response(res, 404, { error: "Session not found" }) unless agent
+          agent.permission_mode = mode
+          @session_manager.save(agent.to_session_data(updated_at: Time.now))
+        end
+        broadcast_session_update(session_id)
+        json_response(res, 200, { ok: true, permission_mode: mode })
+      end
+
       def api_switch_session_model(session_id, req, res)
         body = parse_json_body(req)
         model_id = body["model_id"].to_s.strip
@@ -7589,15 +7728,21 @@ module Clacky
         json_response(res, 201, { session: @registry.snapshot(fork_id) })
       end
 
-      # DELETE /api/archive/sessions
-      # Empties the archive: every archived chat is soft-deleted and lands in
-      # the recycle bin, never destroyed for good. Archiving keeps a chat out of
-      # the sidebar, so clearing the archive means the user is done with all of
-      # them. The toolbar's search and filters deliberately do not narrow this —
-      # the button says "delete all", and the confirmation counts what this
-      # call is about to take out.
-      def api_archive_sessions_empty(res)
-        ids = @registry.list(archived: true).map { |s| s[:id] }
+      # POST /api/archive/sessions/delete — soft-deletes into the recycle bin.
+      # With `session_ids`, only those still-archived chats go; without a body,
+      # the whole archive (the page is paged, so only the server can list it).
+      # An explicit empty list is rejected so "matches nothing" never means "all".
+      def api_archive_sessions_delete(req, res)
+        body = parse_json_body(req)
+        ids  = @registry.list(archived: true).map { |s| s[:id] }
+
+        if !body.is_a?(Hash) || body.key?("session_ids")
+          raw       = body.is_a?(Hash) ? body["session_ids"] : nil
+          requested = raw.is_a?(Array) ? raw.map { |id| id.to_s.strip }.reject(&:empty?) : []
+          return json_response(res, 400, { ok: false, error: "session_ids must not be empty" }) if requested.empty?
+
+          ids &= requested
+        end
 
         # `list` just read these ids off disk, so skip the per-id existence
         # probe — `load` re-parses every session file for each call.
@@ -7841,14 +7986,16 @@ module Clacky
           raw_images = (msg["images"] || []).map do |data_url|
             { "data_url" => data_url, "name" => "image.jpg", "mime_type" => "image/jpeg" }
           end
-          handle_user_message(session_id, msg["content"].to_s, (msg["files"] || []) + raw_images, references: msg["references"] || [], feedback: msg["feedback"]&.transform_keys(&:to_sym))
+          handle_user_message(session_id, msg["content"].to_s, (msg["files"] || []) + raw_images, references: msg["references"] || [])
 
-        when "feedback_response"
+        when "feedback_intervene"
           session_id = msg["session_id"] || conn.session_id
-          @registry.get(session_id)&.dig(:ui)&.deliver_feedback(
-            msg["content"].to_s, files: msg["files"] || [], display_text: msg["display_text"],
-            references_display: msg["references"] || [],
-            reference_contexts: build_reference_contexts(msg["references"] || []))
+          session = @registry.get(session_id)
+          if session&.dig(:ui)&.intervene_feedback(msg["request_id"])
+            # Finish the handoff before processing the next message on this connection.
+            # An immediate submission then uses the ordinary awaiting-feedback path.
+            session[:thread]&.join
+          end
 
         when "confirmation"
           session_id = msg["session_id"] || conn.session_id
@@ -7868,7 +8015,9 @@ module Clacky
           pinned_part, non_pinned_part = page.partition { |s| s[:pinned] }
           non_pinned_limit = [10 - pinned_part.size, 0].max
           has_more = non_pinned_part.size > non_pinned_limit
-          all_sessions = pinned_part + non_pinned_part.first(non_pinned_limit)
+          non_pinned_part = non_pinned_part.first(non_pinned_limit)
+          next_cursor = non_pinned_part.last&.dig(:cursor)
+          all_sessions = pinned_part + non_pinned_part
           projects = @project_manager.all
           if projects.any?
             project_ids = projects.map { |p| p[:id] }
@@ -7880,7 +8029,7 @@ module Clacky
             paged_ids = all_sessions.map { |s| s[:id] }.to_set
             all_sessions += project_sessions.reject { |s| paged_ids.include?(s[:id]) }
           end
-          conn.send_json(type: "session_list", sessions: all_sessions, has_more: has_more,
+          conn.send_json(type: "session_list", sessions: all_sessions, has_more: has_more, next_cursor: next_cursor,
                          groups: groups, projects: projects)
 
         when "run_task"
@@ -7948,12 +8097,10 @@ module Clacky
         end
       end
 
-      def handle_user_message(session_id, content, files = [], references: [], feedback: nil)
+      def handle_user_message(session_id, content, files = [], references: [])
         return unless @registry.exist?(session_id)
 
         session = @registry.get(session_id)
-        feedback_options = feedback ? { feedback: feedback } : {}
-
         mode = @agent_config.input_behavior
         queued = false
         queued_created_at = nil
@@ -7961,7 +8108,7 @@ module Clacky
           if s[:status] == :running && %w[queue steer].include?(mode)
             queued_created_at = Time.now.to_f
             s[:agent].enqueue_input(content, delivery: mode.to_sym, files: files, references_display: references,
-                                    reference_contexts: build_reference_contexts(references), created_at: queued_created_at, **feedback_options)
+                                    reference_contexts: build_reference_contexts(references), created_at: queued_created_at)
             queued = true
           end
         end
@@ -7984,7 +8131,7 @@ module Clacky
           if old_thread && !old_thread.join(2)
             retained_created_at = Time.now.to_f
             session[:agent].enqueue_input(content, files: files, references_display: references,
-                                          reference_contexts: build_reference_contexts(references), created_at: retained_created_at, **feedback_options)
+                                          reference_contexts: build_reference_contexts(references), created_at: retained_created_at)
             broadcast(session_id, { type: "input_enqueued", session_id: session_id, created_at: retained_created_at })
             broadcast(session_id, { type: "input_queue_notice", session_id: session_id, key: "chat.input.stoppingDelayed" })
             return
@@ -8042,7 +8189,7 @@ module Clacky
           # "Thinking..." forever. A web-originated turn bound to an IM channel gets a
           # card too, so tools/narration render like a native IM turn (#603).
           @channel_manager.channel_ui_for_session(session_id)&.start_task(reply_to: nil)
-          agent.run(content, files: files, reference_contexts: reference_contexts, created_at: msg_created_at, references_display: references, **feedback_options)
+          agent.run(content, files: files, reference_contexts: reference_contexts, created_at: msg_created_at, references_display: references)
         end
       end
 

data/lib/clacky/server/model_prices.rb

@@ -6,7 +6,8 @@ module Clacky
     # Resolves each model's input/output price (USD per 1M tokens) from
     # Clacky::ModelPricing plus a cost ratio vs the baseline model, so the
     # web UI never hardcodes prices - updating PRICING_TABLE is enough.
-    # Prices are post-promotion; `discount` is present when a rule applied,
+    # Prices are what the platform actually bills: post-promotion rates plus
+    # any lane markup. `discount` is present when a promotion applied,
     # carrying both the rate and its reason ("channel" or "promo") so the UI
     # can pick the right explanation.
     module ModelPrices
@@ -25,12 +26,13 @@ module Clacky
           next unless pricing
           info = Clacky::ModelPricing.discount_info(name)
           rate = info ? info[:rate] : 1.0
+          markup = Clacky::ModelPricing.markup_rate(name)
           # Rates are not powers of two, so the discounted product carries float
           # noise (3.0 * 0.95 == 2.8499999999999996) that would surface verbatim
           # in the picker tooltips. Four decimals is already finer than any
           # listed price.
-          pin  = (pricing[:input][:default] * rate).round(4)
-          pout = (pricing[:output][:default] * rate).round(4)
+          pin  = (pricing[:input][:default] * rate * markup).round(4)
+          pout = (pricing[:output][:default] * rate * markup).round(4)
           entry = { in: pin, out: pout, ratio: (pin + pout) / base_total }
           entry[:discount] = { rate: rate, reason: info[:reason] } if rate < 1.0
           prices[name] = entry

data/lib/clacky/server/pid_files.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require_relative "../agent_config"
+
+module Clacky
+  module Server
+    # Shared directory policy for master lifecycle and CLI discovery.
+    module PidFiles
+      module_function
+
+      def directory
+        override = ENV["CLACKY_PID_DIR"]
+        configured = if override && !override.strip.empty?
+                       override
+                     else
+                       AgentConfig.load.pid_dir
+                     end
+        return Dir.tmpdir if configured.nil? || configured.strip.empty?
+
+        File.expand_path(configured)
+      end
+    end
+  end
+end

data/lib/clacky/server/server_master.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "socket"
-require "tmpdir"
+require_relative "pid_files"
 require_relative "../banner"
 require_relative "../version"
 require_relative "../agent_config"
@@ -248,13 +248,19 @@ module Clacky
       end
 
       def pid_file_path
-        File.join(Dir.tmpdir, "clacky-master-#{@port}.pid")
+        File.join(pid_directory, "clacky-master-#{@port}.pid")
       end
 
       def write_pid_file
+        FileUtils.mkdir_p(pid_directory)
         File.write(pid_file_path, Process.pid.to_s)
       end
 
+      # Keep cleanup tied to the directory used at startup, even if config changes.
+      private def pid_directory
+        @pid_directory ||= PidFiles.directory
+      end
+
       def remove_pid_file
         # A replacement may already own the port after this master was stopped.
         if File.exist?(pid_file_path) && File.read(pid_file_path).strip == Process.pid.to_s
@@ -318,7 +324,7 @@ module Clacky
       end
 
       private def kill_master_on_port(port)
-        path = File.join(Dir.tmpdir, "clacky-master-#{port}.pid")
+        path = File.join(pid_directory, "clacky-master-#{port}.pid")
         return unless File.exist?(path)
 
         pid = File.read(path).strip.to_i

data/lib/clacky/server/session_registry.rb

@@ -194,7 +194,8 @@ module Clacky
       #   profile: "general"|"coding"|nil
       #            nil = no agent_profile filter
       #   limit:   max sessions to return (applies to NON-PINNED only; see below)
-      #   before:  ISO8601 cursor — only sessions with created_at < before
+      #   before, before_id: cursor — only sessions sorting after (before, before_id)
+      #             in the newest-first order; take it from a row's `cursor`
       #             (also applies to NON-PINNED only; pinned items are a separate
       #             logical section, they should never be paginated away)
       #   include_pinned: when true (default), all matching pinned sessions are
@@ -207,13 +208,13 @@ module Clacky
       #   archived:  false (default) → archived sessions are excluded from the
       #             result; true → ONLY archived sessions are returned. The two
       #             sets are disjoint, so every other caller keeps seeing exactly
-      #             the sessions it saw before archiving existed.
+      #             the sessions it saw before archiving existed. nil → no filter.
       #
       # Ordering of the returned array:
       #   [ ...all_pinned_matching (newest-first), ...non_pinned (newest-first, limited) ]
       #
       # source and profile are orthogonal — either can be nil independently.
-      def list(limit: nil, before: nil, q: nil, q_scope: "name", date: nil, type: nil, exclude_type: nil, include_pinned: true, project_id: nil, exclude_project: false, archived: false)
+      def list(limit: nil, before: nil, before_id: nil, q: nil, q_scope: "name", date: nil, type: nil, exclude_type: nil, include_pinned: true, project_id: nil, exclude_project: false, archived: false)
         return [] unless @session_manager
 
         live = @mutex.synchronize do
@@ -227,6 +228,7 @@ module Clacky
             model: model_info&.dig(:model), model_id: model_info&.dig(:id), name: live_name,
             total_tasks: s[:agent]&.total_tasks, total_cost: s[:agent]&.total_cost,
             cost_source: live_cost_source,
+            permission_mode: s[:agent]&.permission_mode,
             reasoning_effort: s[:agent]&.reasoning_effort,
             latest_latency: s[:agent]&.latest_latency,
             card_model: model_info&.dig(:card_model),
@@ -238,7 +240,7 @@ module Clacky
 
         all = @session_manager.all_sessions  # already sorted newest-first
 
-        all = all.select { |s| archived ? s[:archived_at].to_s != "" : s[:archived_at].to_s == "" }
+        all = all.select { |s| archived ? s[:archived_at].to_s != "" : s[:archived_at].to_s == "" } unless archived.nil?
 
         # ── type filter (replaces old source/profile split) ──────────────────
         # type=coding  → agent_profile == "coding"
@@ -297,9 +299,11 @@ module Clacky
         pinned, non_pinned = all.partition { |s| s[:pinned] }
 
         # `before` cursor ONLY applies to non-pinned (paginated) sessions.
-        # Cursor field must match the sort key in all_sessions (updated_at,
-        # falling back to created_at for legacy rows).
-        non_pinned = non_pinned.select { |s| (s[:updated_at] || s[:created_at] || "") < before } if before
+        # Cursor must match the sort key in all_sessions; the id breaks same-second ties.
+        if before
+          boundary = [before, before_id.to_s]
+          non_pinned = non_pinned.select { |s| (sort_key(s) <=> boundary) < 0 }
+        end
         non_pinned = non_pinned.first(limit) if limit
 
         # Pinned section: only included on the first page (before == nil) so
@@ -343,6 +347,7 @@ module Clacky
             model: model_info&.dig(:model), model_id: model_info&.dig(:id),
             name: live_name, total_tasks: s[:agent]&.total_tasks,
             total_cost: s[:agent]&.total_cost, cost_source: s[:agent]&.cost_source,
+            permission_mode: s[:agent]&.permission_mode,
             reasoning_effort: s[:agent]&.reasoning_effort,
             latest_latency: s[:agent]&.latest_latency,
             card_model: model_info&.dig(:card_model),
@@ -361,6 +366,10 @@ module Clacky
       # Merge a single disk-side session hash with the corresponding live
       # in-memory agent fields (may be nil) into the row shape the frontend
       # consumes.
+      private def sort_key(s)
+        [s[:updated_at] || s[:created_at] || "", s[:session_id].to_s]
+      end
+
       private def build_enriched_row(s, ls)
         id = s[:session_id]
         {
@@ -373,6 +382,7 @@ module Clacky
           raw_message:   ls&.dig(:raw_message),
           model:         ls&.dig(:model),
           model_id:      ls&.dig(:model_id),
+          permission_mode: ls&.dig(:permission_mode) || s.dig(:config, :permission_mode_override) || "confirm_all",
           card_model:    ls&.dig(:card_model),
           sub_model:     ls&.dig(:sub_model),
           sub_model_options: ls&.dig(:sub_model_options) || [],
@@ -395,6 +405,8 @@ module Clacky
           channel_info:  s[:channel_info],
           project_id:    s[:project_id],
           todos:         ls&.dig(:todos) || s[:todos] || [],
+          # Rows report live activity in updated_at; paging needs the on-disk sort key.
+          cursor:        sort_key(s).then { |at, sid| { before: at, before_id: sid } },
         }
       end