openclacky 1.5.20 → 1.5.22

data/lib/clacky/server/http_server.rb

@@ -75,26 +75,38 @@ module Clacky
         ev[:skill_command_display] = skill_command_display if skill_command_display
         ev[:editable] = false unless editable
         ev[:references] = references unless Array(references).empty?
-        rendered = Array(files).filter_map do |f|
+        rendered_images = []
+        rendered_attachments = []
+        Array(files).each do |f|
+          next if f[:reference] || f["reference"]
+
           url  = f[:data_url] || f["data_url"]
           name = f[:name]     || f["name"]
           path = f[:path]     || f["path"]
           type = f[:type]     || f["type"] || ""
+          mime = f[:mime_type] || f["mime_type"]
+          image = type.to_s == "image" || mime.to_s.start_with?("image/")
 
           if url
-            url
-          elsif type.to_s == "image" && path && File.exist?(path.to_s)
+            rendered_images << url
+          elsif image && path && File.exist?(path.to_s)
             # Serve via the /api/local-image proxy instead of inlining a base64
             # data URL. Inlining forced a synchronous disk-read + full base64
             # encode + downscale on every history replay (2-3s lag for sessions
             # with downgraded text-model images). The proxy lets the browser
             # lazy-load + cache the image, keeping the replay response tiny.
-            "/api/local-image?path=#{CGI.escape(path.to_s)}&v=#{File.mtime(path.to_s).to_i}"
+            rendered_images << "/api/local-image?path=#{CGI.escape(path.to_s)}&v=#{File.mtime(path.to_s).to_i}"
+          elsif image && name
+            rendered_images << "expired:#{name}"
           elsif name
-            type.to_s == "image" ? "expired:#{name}" : "pdf:#{name}"
+            attachment_type = type.to_s.empty? ? (mime || "file") : type
+            attachment = { name: name, type: attachment_type }
+            attachment[:path] = path if path && File.exist?(path.to_s)
+            rendered_attachments << attachment
           end
         end
-        ev[:images] = rendered unless rendered.empty?
+        ev[:images] = rendered_images unless rendered_images.empty?
+        ev[:attachments] = rendered_attachments unless rendered_attachments.empty?
         @events << ev
       end
 
@@ -110,6 +122,15 @@ module Clacky
 
       def show_tool_call(name, args)
         args_data = args.is_a?(String) ? (JSON.parse(args) rescue args) : args
+        if Clacky::Tools::AskUser.feedback_tool?(name)
+          questions = Clacky::Tools::AskUser.normalize_questions(args_data)
+          first = questions.first || {}
+          @events << { type: "request_feedback", session_id: @session_id,
+                       request_id: Clacky::Tools::AskUser.fetch_key(args_data, :request_id),
+                       context: Clacky::Tools::AskUser.fetch_key(args_data, :context).to_s,
+                       question: first[:question].to_s, options: first[:options] || [], questions: questions }
+          return
+        end
         summary   = tool_call_summary(name, args_data)
         @events << stamp({ type: "tool_call", session_id: @session_id, name: name, args: args_data, summary: summary })
       end
@@ -700,6 +721,7 @@ module Clacky
         when ["POST",   "/api/browser/configure"]  then api_browser_configure(req, res)
         when ["POST",   "/api/browser/reload"]    then api_browser_reload(res)
         when ["POST",   "/api/browser/toggle"]    then api_browser_toggle(res)
+        when ["POST",   "/api/browser/settings"]  then api_browser_settings(req, res)
         when ["GET",    "/api/backup/status"]     then api_backup_status(res)
         when ["POST",   "/api/backup/run"]        then api_backup_run(res)
         when ["GET",    "/api/backup/download"]   then api_backup_download(res)
@@ -732,8 +754,8 @@ module Clacky
         when ["DELETE", "/api/trash"]     then api_trash_delete(req, res)
         when ["GET",    "/api/trash/sessions"]     then api_trash_sessions(req, res)
         when ["POST",   "/api/trash/sessions/restore"] then api_trash_session_restore(req, res)
-        when ["DELETE", "/api/trash/sessions"]     then api_trash_sessions_delete(req, res)
-        when ["DELETE", "/api/archive/sessions"]   then api_archive_sessions_empty(res)
+        when ["POST",   "/api/trash/sessions/delete"]  then api_trash_sessions_delete(req, res)
+        when ["POST",   "/api/archive/sessions/delete"] then api_archive_sessions_delete(req, res)
         when ["GET",    "/api/profile"]   then api_profile_get(res)
         when ["PUT",    "/api/profile"]   then api_profile_put(req, res)
         when ["GET",    "/api/memories"]  then api_memories_list(res)
@@ -828,9 +850,6 @@ module Clacky
             session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
             action     = path[%r{/git/([a-z]+)$}, 1]
             api_session_git(session_id, action, req, res)
-          elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/git/commit$})
-            session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
-            api_session_git_commit(session_id, req, res)
           elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/git/restore$})
             session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
             api_session_git_restore(session_id, req, res)
@@ -870,6 +889,9 @@ module Clacky
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/project$})
             session_id = path.sub("/api/sessions/", "").sub("/project", "")
             api_update_session_project(session_id, req, res)
+          elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/permission_mode$})
+            session_id = path.split("/")[3]
+            api_switch_session_permission_mode(session_id, req, res)
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+/model$})
             session_id = path.sub("/api/sessions/", "").sub("/model", "")
             api_switch_session_model(session_id, req, res)
@@ -947,9 +969,18 @@ module Clacky
           elsif method == "DELETE" && path.match?(%r{^/api/memories/[^/]+$})
             filename = URI.decode_www_form_component(path.sub("/api/memories/", ""))
             api_memories_delete(filename, res)
+          elsif method == "GET" && path.match?(%r{^/api/projects/[^/]+/git$})
+            project_id = path.sub("/api/projects/", "").sub("/git", "")
+            api_project_git(project_id, req, res)
+          elsif method == "POST" && path.match?(%r{^/api/projects/[^/]+/git/checkout$})
+            project_id = path.sub("/api/projects/", "").sub("/git/checkout", "")
+            api_project_git_checkout(project_id, req, res)
           elsif method == "PATCH" && path.match?(%r{^/api/projects/[^/]+$})
             project_id = path.sub("/api/projects/", "")
             api_update_project(project_id, req, res)
+          elsif method == "POST" && path.match?(%r{^/api/projects/[^/]+/sessions/archive$})
+            project_id = path.sub("/api/projects/", "").sub("/sessions/archive", "")
+            api_archive_project_sessions(project_id, res)
           elsif method == "DELETE" && path.match?(%r{^/api/projects/[^/]+/sessions$})
             project_id = path.sub("/api/projects/", "").sub("/sessions", "")
             api_delete_project_sessions(project_id, res)
@@ -968,6 +999,7 @@ module Clacky
         query        = URI.decode_www_form(req.query_string.to_s).to_h
         limit        = [query["limit"].to_i.then { |n| n > 0 ? n : 15 }, 50].min
         before       = query["before"].to_s.strip.then  { |v| v.empty? ? nil : v }
+        before_id    = query["before_id"].to_s.strip.then { |v| v.empty? ? nil : v }
         q            = query["q"].to_s.strip.then       { |v| v.empty? ? nil : v }
         q_scope      = query["q_scope"].to_s.strip.then { |v| %w[name content].include?(v) ? v : "name" }
         date         = query["date"].to_s.strip.then    { |v| v.empty? ? nil : v }
@@ -987,14 +1019,15 @@ module Clacky
         # The archive view is the exception: it groups archived sessions by
         # project by hand, so project membership must survive both filters.
         exclude_project = archived ? false : (before ? true : !!type)
-        sessions = @registry.list(limit: limit + 1, before: before, q: q, q_scope: q_scope, date: date, type: type, exclude_type: exclude_type, exclude_project: exclude_project, archived: archived)
+        sessions = @registry.list(limit: limit + 1, before: before, before_id: before_id, q: q, q_scope: q_scope, date: date, type: type, exclude_type: exclude_type, exclude_project: exclude_project, archived: archived)
 
         pinned_part, non_pinned_part = sessions.partition { |s| s[:pinned] }
         has_more = non_pinned_part.size > limit
         non_pinned_part = non_pinned_part.first(limit)
         sessions = pinned_part + non_pinned_part
 
-        payload = { sessions: sessions, has_more: has_more, groups: @registry.group_stats_all }
+        payload = { sessions: sessions, has_more: has_more, next_cursor: non_pinned_part.last&.dig(:cursor),
+                    groups: @registry.group_stats_all }
         # The archive page offers "delete all", so it needs the size of the whole
         # archive — the paged `sessions` array only ever shows one page of it.
         payload[:archived_count] = @registry.archived_count if archived
@@ -1682,6 +1715,22 @@ module Clacky
         json_response(res, 500, { ok: false, error: e.message })
       end
 
+      # POST /api/browser/settings
+      # Body: { screenshot_max_base64_bytes: 300000 }
+      # The field is optional — omitting it keeps the current value.
+      def api_browser_settings(req, res)
+        body = JSON.parse(req.body.to_s) rescue {}
+
+        settings = @browser_manager.update_screenshot_settings(
+          max_base64_bytes: body["screenshot_max_base64_bytes"]
+        )
+        json_response(res, 200, { ok: true }.merge(settings))
+      rescue ArgumentError => e
+        json_response(res, 422, { ok: false, error: e.message })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
       # GET /api/backup/status
       def api_backup_status(res)
         json_response(res, 200, BackupManager.status)
@@ -2287,45 +2336,77 @@ module Clacky
         json_response(res, 200, {
           ok: true,
           provider: config["provider"],
-          key_masked: config["key"].empty? ? nil : mask_api_key(config["key"]),
+          keys_masked: masked_search_keys(config),
           available: Clacky::Utils::SearcherManager.available
         })
       end
 
       # PATCH /api/config/search
-      # Body: { provider: "tavily"|"", key?: "..." }
+      # Body: { provider?: "tavily"|"deepseek_web"|"", key?: "..." }
+      # Omitted fields keep their current value.
       def api_update_search_config(req, res)
         body = parse_json_body(req)
         return json_response(res, 400, { error: "Invalid JSON" }) unless body
 
         provider = body["provider"].to_s.strip
-        unless provider.empty? || Clacky::Utils::SearcherManager.path_for(provider)
+        if body.key?("provider") && !search_provider_known?(provider)
           return json_response(res, 422, { error: "Unknown search provider: #{provider}" })
         end
 
+        current = Clacky::SearchConfig.load
+        final_provider = body.key?("provider") ? provider : current["provider"]
+        # A masked value only ever stands for the same provider's stored key.
         key = body["key"].to_s
-        key = Clacky::SearchConfig.key if key.include?("****")
+        key = Clacky::SearchConfig.key_for(final_provider) if key.include?("****")
+        final_key = body.key?("key") ? key : Clacky::SearchConfig.key_for(final_provider)
+
+        # deepseek_web falls back to the configured model key, so it may be
+        # saved without one. Every other searcher is a script that reads the
+        # key from CLACKY_SEARCH_KEY and cannot run without it.
+        if !final_provider.empty? &&
+           final_provider != Clacky::SearchConfig::DEEPSEEK_WEB &&
+           final_key.to_s.strip.empty?
+          return json_response(res, 422, {
+            error: "API key is required for search provider '#{final_provider}'"
+          })
+        end
 
-        Clacky::SearchConfig.save(provider: provider, key: key)
-        json_response(res, 200, { ok: true, provider: provider })
+        Clacky::SearchConfig.save(
+          provider: body.key?("provider") ? provider : nil,
+          key: body.key?("key") ? key : nil
+        )
+        config = Clacky::SearchConfig.load
+        json_response(res, 200, { ok: true, provider: config["provider"], keys_masked: masked_search_keys(config) })
       rescue => e
         json_response(res, 422, { error: e.message })
       end
 
+      private def masked_search_keys(config)
+        config["keys"].transform_values { |key| mask_api_key(key) }
+      end
+
+      private def search_provider_known?(provider)
+        return true if provider.empty?
+        return true if provider == Clacky::SearchConfig::DEEPSEEK_WEB
+
+        !Clacky::Utils::SearcherManager.path_for(provider).nil?
+      end
+
       # POST /api/config/search/test
-      # Runs the searcher with a fixed query so the user gets a definitive
-      # answer before saving, rather than discovering a bad key mid-task.
+      # Runs the configured engine with a fixed query so the user gets a
+      # definitive answer before saving, rather than discovering a bad key mid-task.
       def api_test_search_config(req, res)
         body = parse_json_body(req) || {}
         provider = body["provider"].to_s.strip
         return json_response(res, 200, { ok: false, message: "provider is required" }) if provider.empty?
 
+        key = body["key"].to_s
+        key = Clacky::SearchConfig.key_for(provider) if key.empty? || key.include?("****")
+        return test_deepseek_web_search(res, key) if provider == Clacky::SearchConfig::DEEPSEEK_WEB
+
         script = Clacky::Utils::SearcherManager.path_for(provider)
         return json_response(res, 200, { ok: false, message: "searcher not found: #{provider}" }) unless script
 
-        key = body["key"].to_s
-        key = Clacky::SearchConfig.key if key.empty? || key.include?("****")
-
         stdout, stderr, status = Clacky::Utils::ParserManager.capture3_with_timeout(
           { "CLACKY_SEARCH_KEY" => key },
           Clacky::Utils::SearcherManager.interpreter_for(script),
@@ -2353,6 +2434,23 @@ module Clacky
         json_response(res, 200, { ok: false, message: e.message })
       end
 
+      private def test_deepseek_web_search(res, key)
+        key = @agent_config.deepseek_web_key.to_s if key.empty?
+        if key.empty?
+          return json_response(res, 200, {
+            ok: false, message: "No DeepSeek key: fill one in or configure a DeepSeek / OpenClacky model"
+          })
+        end
+
+        results = Clacky::DeepSeekWebTools.search(
+          query: "openclacky", count: 1, api_key: key,
+          base_url: @agent_config.deepseek_web_base_url(key)
+        )
+        json_response(res, 200, { ok: true, message: "Returned #{results.size} result(s)" })
+      rescue => e
+        json_response(res, 200, { ok: false, message: e.message })
+      end
+
       # POST /api/internal/ocr-image
       # Internal endpoint used by parser scripts (e.g. pdf_parser_vlm.py) to
       # transcribe a single image via the configured OCR sidecar. Localhost-
@@ -4511,10 +4609,12 @@ module Clacky
 
         path = Utils::EnvironmentDetector.resolve_local_path(raw_path)
         ext = File.extname(path).downcase.sub(/\A\./, "")
+        # Extension-less files (Dockerfile, Makefile, Gemfile) declare no
+        # document type, so no app lists them. Plain text is the closest
+        # approximation and keeps the picker useful.
+        ext = "txt" if ext.empty?
 
-        apps = if ext.empty?
-          []
-        elsif Utils::EnvironmentDetector.os_type == :wsl
+        apps = if Utils::EnvironmentDetector.os_type == :wsl
           Utils::WindowsAppDetector.apps_for_ext(ext)
         else
           Utils::MacAppDetector.apps_for_ext(ext)
@@ -4531,9 +4631,7 @@ module Clacky
         return json_response(res, 400, { error: "path is required" }) if raw_path.empty?
 
         path = Utils::EnvironmentDetector.resolve_local_path(raw_path)
-        app = if File.extname(path).empty?
-          nil
-        elsif Utils::EnvironmentDetector.os_type == :wsl
+        app = if Utils::EnvironmentDetector.os_type == :wsl
           Utils::WindowsAppDetector.default_app_for(path)
         else
           Utils::MacAppDetector.default_app_for(path)
@@ -4603,6 +4701,9 @@ module Clacky
         when "open"
           result = Utils::EnvironmentDetector.open_file(linux_path)
           return json_response(res, 501, { error: "unsupported OS" }) if result.nil?
+          # system() returns false when the launcher exits non-zero (broken app
+          # association, no handler). Surface it instead of a silent 200.
+          return json_response(res, 500, { error: "failed to open file" }) unless result
           json_response(res, 200, { ok: true })
         when "open_with"
           result = if Utils::EnvironmentDetector.os_type == :wsl
@@ -5335,9 +5436,22 @@ module Clacky
         when "status"
           json_response(res, 200, { repo: true }.merge(Clacky::Server::GitPanel.status(dir)))
         when "diff"
-          json_response(res, 200, { repo: true, diff: Clacky::Server::GitPanel.diff(dir, file: query["file"]) })
+          json_response(res, 200, { repo: true, diff: Clacky::Server::GitPanel.diff(
+            dir, file: query["file"], context: query["context"],
+            scope: query["scope"], base: query["base"]
+          ) })
+        when "review"
+          if query["scope"].to_s == "lastTurn"
+            json_response(res, 200, Clacky::Server::GitPanel.last_turn_review(git_session_agent(session_id)))
+          else
+            json_response(res, 200, Clacky::Server::GitPanel.review(
+              dir, scope: query["scope"], base: query["base"]
+            ))
+          end
         when "log"
-          json_response(res, 200, { repo: true, commits: Clacky::Server::GitPanel.log(dir, limit: query["limit"] || 50) })
+          json_response(res, 200, { repo: true, commits: Clacky::Server::GitPanel.log(
+            dir, limit: query["limit"] || 50, unpushed: query["unpushed"].to_s == "1"
+          ) })
         when "branches"
           json_response(res, 200, { repo: true, branches: Clacky::Server::GitPanel.branches(dir) })
         else
@@ -5345,24 +5459,6 @@ module Clacky
         end
       end
 
-      # POST /api/sessions/:id/git/commit — body: { message:, files: [..] }.
-      def api_session_git_commit(session_id, req, res)
-        dir = git_session_dir(session_id, res)
-        return unless dir
-
-        unless Clacky::Server::GitPanel.repo?(dir)
-          return json_response(res, 400, { error: "Not a git repository" })
-        end
-
-        body = parse_json_body(req)
-        result = Clacky::Server::GitPanel.commit(dir, message: body["message"], files: body["files"])
-        if result[:ok]
-          json_response(res, 200, result)
-        else
-          json_response(res, 422, { error: result[:error] })
-        end
-      end
-
       # POST /api/sessions/:id/git/restore - body: { file: }.
       # Discards uncommitted changes to one file, back to its HEAD state.
       def api_session_git_restore(session_id, req, res)
@@ -5466,8 +5562,7 @@ module Clacky
           json_response(res, 404, { error: "Session not found" })
           return nil
         end
-        session = @registry.get(session_id)
-        agent   = session && session[:agent]
+        agent = git_session_agent(session_id)
         unless agent
           json_response(res, 404, { error: "Session not found" })
           return nil
@@ -5479,6 +5574,11 @@ module Clacky
         end
         dir
       end
+
+      private def git_session_agent(session_id)
+        session = @registry.get(session_id)
+        session && session[:agent]
+      end
       # Lists one directory level inside the session's working_dir (lazy, per-layer).
       # Path traversal outside working_dir is rejected. Noisy dirs are hidden.
       IGNORED_FILE_ENTRIES = %w[.git .svn .hg node_modules .DS_Store .bundle vendor/bundle tmp .sass-cache].freeze
@@ -5492,7 +5592,11 @@ module Clacky
         return json_response(res, 404, { error: "Session not found" }) unless agent
 
         root = File.expand_path(agent.working_dir.to_s)
-        return json_response(res, 404, { error: "Working directory not found" }) unless Dir.exist?(root)
+        unless Dir.exist?(root)
+          # `code` lets the client tell "the folder was deleted" apart from any
+          # other failure and explain it, instead of showing a generic error.
+          return json_response(res, 404, { error: "Working directory not found", code: "working_dir_missing", path: root })
+        end
 
         query = URI.decode_www_form(req.query_string.to_s).to_h
         rel = query["path"].to_s
@@ -5517,7 +5621,9 @@ module Clacky
           end
         end
 
-        return json_response(res, 404, { error: "Directory not found" }) unless Dir.exist?(target)
+        unless Dir.exist?(target)
+          return json_response(res, 404, { error: "Directory not found", code: "directory_missing" })
+        end
         entries = Dir.children(target).reject do |name|
           IGNORED_FILE_ENTRIES.include?(name) || (!show_hidden && name.start_with?("."))
         end
@@ -6034,20 +6140,23 @@ module Clacky
         json_response(res, 200, { ok: true, session_id: session_id })
       end
 
-      # DELETE /api/trash/sessions?days_old=N
-      # Bulk: permanently delete sessions older than N days (default: 7).
+      # POST /api/trash/sessions/delete
+      # Body: { session_ids: ["...", ...] }
+      # Bulk: permanently delete exactly these sessions. The caller decides the
+      # scope (the page's filters live in the browser), so an empty list is
+      # rejected rather than read as "everything".
       private def api_trash_sessions_delete(req, res)
-        query    = URI.decode_www_form(req.query_string.to_s).to_h
-        days_old = query["days_old"].to_s.strip
-        days_i   = days_old.empty? ? 7 : days_old.to_i
+        raw = parse_json_body(req)["session_ids"]
+        ids = raw.is_a?(Array) ? raw.map { |id| id.to_s.strip }.reject(&:empty?) : []
 
-        deleted = @session_manager.cleanup_trash(days: days_i)
+        if ids.empty?
+          json_response(res, 400, { ok: false, error: "session_ids is required" })
+          return
+        end
 
-        json_response(res, 200, {
-          ok:            true,
-          deleted_count: deleted,
-          days_old:      days_i
-        })
+        deleted = @session_manager.permanent_delete_trash_sessions(ids)
+
+        json_response(res, 200, { ok: true, deleted_count: deleted })
       end
 
       # ── Trash helpers (private) ─────────────────────────────────────
@@ -7198,6 +7307,71 @@ module Clacky
         json_response(res, 500, { error: e.message })
       end
 
+      # GET /api/projects/:id/git?dir= — branch state of a work tree, used by
+      # the new-session branch picker. `dir` overrides the project's own
+      # working dir, since a session may run in a different repo. `repo: false`
+      # covers a missing working dir, a missing directory, and plain non-git
+      # folders, so the picker can simply hide itself.
+      def api_project_git(project_id, req, res)
+        project = @project_manager.find(project_id)
+        return json_response(res, 404, { error: "Project not found" }) unless project
+
+        dir = git_work_tree(project, git_dir_param(req))
+        return json_response(res, 200, { repo: false }) unless dir
+
+        json_response(res, 200, {
+          repo:     true,
+          branch:   Clacky::Server::GitPanel.branch_name(dir),
+          branches: Clacky::Server::GitPanel.branches(dir),
+        })
+      end
+
+      # POST /api/projects/:id/git/checkout — body: { branch:, create:?, from:?, dir:? }
+      # Switches a work tree. `create: true` branches off `from`, which may be
+      # a remote ref (origin/feature) to get a tracking branch.
+      def api_project_git_checkout(project_id, req, res)
+        project = @project_manager.find(project_id)
+        return json_response(res, 404, { error: "Project not found" }) unless project
+
+        body = parse_json_body(req)
+        dir  = git_work_tree(project, body["dir"])
+        return json_response(res, 400, { error: "Not a git repository" }) unless dir
+
+        result = Clacky::Server::GitPanel.checkout(
+          dir,
+          branch: body["branch"],
+          create: body["create"] == true,
+          from:   body["from"]
+        )
+
+        unless result[:ok]
+          return json_response(res, 422, { error: result[:error] })
+        end
+
+        json_response(res, 200, {
+          ok:       true,
+          branch:   Clacky::Server::GitPanel.branch_name(dir),
+          branches: Clacky::Server::GitPanel.branches(dir),
+        })
+      end
+
+      def git_dir_param(req)
+        URI.decode_www_form(req.query_string.to_s).to_h["dir"]
+      rescue ArgumentError
+        nil
+      end
+
+      # Resolves the work tree a git request targets: the explicit `dir` when
+      # given, otherwise the project's own working dir. Nil when the path is
+      # not an existing git repository.
+      def git_work_tree(project, dir_param)
+        raw = dir_param.to_s.strip
+        dir = raw.empty? ? project[:working_dir].to_s : File.expand_path(raw)
+        return nil if dir.empty? || !Dir.exist?(dir)
+        return nil unless Clacky::Server::GitPanel.repo?(dir)
+        dir
+      end
+
       # PATCH /api/projects/:id - update a project
       # Body: { name:?, description:?, color:?, working_dir:?, pinned:? } - only provided fields are changed
       def api_update_project(project_id, req, res)
@@ -7250,6 +7424,45 @@ module Clacky
         json_response(res, 500, { error: e.message })
       end
 
+      # POST /api/projects/:id/sessions/archive - archive every live session in a project
+      def api_archive_project_sessions(project_id, res)
+        return json_response(res, 404, { error: "Project not found" }) unless @project_manager.find(project_id)
+
+        archived = _archive_project_sessions(project_id)
+        json_response(res, 200, { ok: true, archived: archived })
+      rescue => e
+        json_response(res, 500, { error: e.message })
+      end
+
+      # Sessions already in the archive keep their original archived_at, so the
+      # archive page stays ordered by when the user actually put them away.
+      private def _archive_project_sessions(project_id)
+        archived = 0
+        now      = Time.now.iso8601
+
+        @session_manager.all_sessions.each do |session_data|
+          next unless session_data[:project_id].to_s == project_id
+          next if session_data[:archived_at]
+
+          sid  = session_data[:session_id]
+          live = nil
+          @registry.with_session(sid) { |s| live = s[:agent] }
+
+          if live
+            live.archived_at = now
+            @session_manager.save(live.to_session_data(updated_at: Time.now))
+          else
+            # Untouched on disk: patch the loaded row rather than restoring an
+            # agent for every session in the project just to stamp one field.
+            @session_manager.save(session_data.merge(archived_at: now, updated_at: now))
+          end
+
+          broadcast(sid, { type: "session_updated", session_id: sid, archived_at: now })
+          archived += 1
+        end
+        archived
+      end
+
       private def _delete_project_sessions(project_id)
         deleted = 0
         @session_manager.all_sessions.each do |session_data|
@@ -7346,6 +7559,24 @@ module Clacky
         json_response(res, 500, { error: e.message })
       end
 
+      # PATCH /api/sessions/:id/permission_mode — session-only, never global.
+      def api_switch_session_permission_mode(session_id, req, res)
+        mode = parse_json_body(req)["permission_mode"].to_s
+        unless %w[confirm_all auto_approve].include?(mode)
+          return json_response(res, 400, { error: "Invalid permission mode" })
+        end
+        return json_response(res, 404, { error: "Session not found" }) unless @registry.ensure(session_id)
+
+        @registry.with_session(session_id) do |session|
+          agent = session[:agent]
+          return json_response(res, 404, { error: "Session not found" }) unless agent
+          agent.permission_mode = mode
+          @session_manager.save(agent.to_session_data(updated_at: Time.now))
+        end
+        broadcast_session_update(session_id)
+        json_response(res, 200, { ok: true, permission_mode: mode })
+      end
+
       def api_switch_session_model(session_id, req, res)
         body = parse_json_body(req)
         model_id = body["model_id"].to_s.strip
@@ -7589,15 +7820,21 @@ module Clacky
         json_response(res, 201, { session: @registry.snapshot(fork_id) })
       end
 
-      # DELETE /api/archive/sessions
-      # Empties the archive: every archived chat is soft-deleted and lands in
-      # the recycle bin, never destroyed for good. Archiving keeps a chat out of
-      # the sidebar, so clearing the archive means the user is done with all of
-      # them. The toolbar's search and filters deliberately do not narrow this —
-      # the button says "delete all", and the confirmation counts what this
-      # call is about to take out.
-      def api_archive_sessions_empty(res)
-        ids = @registry.list(archived: true).map { |s| s[:id] }
+      # POST /api/archive/sessions/delete — soft-deletes into the recycle bin.
+      # With `session_ids`, only those still-archived chats go; without a body,
+      # the whole archive (the page is paged, so only the server can list it).
+      # An explicit empty list is rejected so "matches nothing" never means "all".
+      def api_archive_sessions_delete(req, res)
+        body = parse_json_body(req)
+        ids  = @registry.list(archived: true).map { |s| s[:id] }
+
+        if !body.is_a?(Hash) || body.key?("session_ids")
+          raw       = body.is_a?(Hash) ? body["session_ids"] : nil
+          requested = raw.is_a?(Array) ? raw.map { |id| id.to_s.strip }.reject(&:empty?) : []
+          return json_response(res, 400, { ok: false, error: "session_ids must not be empty" }) if requested.empty?
+
+          ids &= requested
+        end
 
         # `list` just read these ids off disk, so skip the per-id existence
         # probe — `load` re-parses every session file for each call.
@@ -7841,14 +8078,16 @@ module Clacky
           raw_images = (msg["images"] || []).map do |data_url|
             { "data_url" => data_url, "name" => "image.jpg", "mime_type" => "image/jpeg" }
           end
-          handle_user_message(session_id, msg["content"].to_s, (msg["files"] || []) + raw_images, references: msg["references"] || [], feedback: msg["feedback"]&.transform_keys(&:to_sym))
+          handle_user_message(session_id, msg["content"].to_s, (msg["files"] || []) + raw_images, references: msg["references"] || [])
 
-        when "feedback_response"
+        when "feedback_intervene"
           session_id = msg["session_id"] || conn.session_id
-          @registry.get(session_id)&.dig(:ui)&.deliver_feedback(
-            msg["content"].to_s, files: msg["files"] || [], display_text: msg["display_text"],
-            references_display: msg["references"] || [],
-            reference_contexts: build_reference_contexts(msg["references"] || []))
+          session = @registry.get(session_id)
+          if session&.dig(:ui)&.intervene_feedback(msg["request_id"])
+            # Finish the handoff before processing the next message on this connection.
+            # An immediate submission then uses the ordinary awaiting-feedback path.
+            session[:thread]&.join
+          end
 
         when "confirmation"
           session_id = msg["session_id"] || conn.session_id
@@ -7868,7 +8107,9 @@ module Clacky
           pinned_part, non_pinned_part = page.partition { |s| s[:pinned] }
           non_pinned_limit = [10 - pinned_part.size, 0].max
           has_more = non_pinned_part.size > non_pinned_limit
-          all_sessions = pinned_part + non_pinned_part.first(non_pinned_limit)
+          non_pinned_part = non_pinned_part.first(non_pinned_limit)
+          next_cursor = non_pinned_part.last&.dig(:cursor)
+          all_sessions = pinned_part + non_pinned_part
           projects = @project_manager.all
           if projects.any?
             project_ids = projects.map { |p| p[:id] }
@@ -7880,7 +8121,7 @@ module Clacky
             paged_ids = all_sessions.map { |s| s[:id] }.to_set
             all_sessions += project_sessions.reject { |s| paged_ids.include?(s[:id]) }
           end
-          conn.send_json(type: "session_list", sessions: all_sessions, has_more: has_more,
+          conn.send_json(type: "session_list", sessions: all_sessions, has_more: has_more, next_cursor: next_cursor,
                          groups: groups, projects: projects)
 
         when "run_task"
@@ -7948,12 +8189,10 @@ module Clacky
         end
       end
 
-      def handle_user_message(session_id, content, files = [], references: [], feedback: nil)
+      def handle_user_message(session_id, content, files = [], references: [])
         return unless @registry.exist?(session_id)
 
         session = @registry.get(session_id)
-        feedback_options = feedback ? { feedback: feedback } : {}
-
         mode = @agent_config.input_behavior
         queued = false
         queued_created_at = nil
@@ -7961,7 +8200,7 @@ module Clacky
           if s[:status] == :running && %w[queue steer].include?(mode)
             queued_created_at = Time.now.to_f
             s[:agent].enqueue_input(content, delivery: mode.to_sym, files: files, references_display: references,
-                                    reference_contexts: build_reference_contexts(references), created_at: queued_created_at, **feedback_options)
+                                    reference_contexts: build_reference_contexts(references), created_at: queued_created_at)
             queued = true
           end
         end
@@ -7984,7 +8223,7 @@ module Clacky
           if old_thread && !old_thread.join(2)
             retained_created_at = Time.now.to_f
             session[:agent].enqueue_input(content, files: files, references_display: references,
-                                          reference_contexts: build_reference_contexts(references), created_at: retained_created_at, **feedback_options)
+                                          reference_contexts: build_reference_contexts(references), created_at: retained_created_at)
             broadcast(session_id, { type: "input_enqueued", session_id: session_id, created_at: retained_created_at })
             broadcast(session_id, { type: "input_queue_notice", session_id: session_id, key: "chat.input.stoppingDelayed" })
             return
@@ -8042,7 +8281,7 @@ module Clacky
           # "Thinking..." forever. A web-originated turn bound to an IM channel gets a
           # card too, so tools/narration render like a native IM turn (#603).
           @channel_manager.channel_ui_for_session(session_id)&.start_task(reply_to: nil)
-          agent.run(content, files: files, reference_contexts: reference_contexts, created_at: msg_created_at, references_display: references, **feedback_options)
+          agent.run(content, files: files, reference_contexts: reference_contexts, created_at: msg_created_at, references_display: references)
         end
       end
 
@@ -8256,6 +8495,7 @@ module Clacky
           Thread.current[:task_epoch] = epoch
           run_result = task.call
           awaiting = false
+          web_ui = nil
           owns_epoch = true
           loop do
             owns_epoch = @registry.current_epoch(session_id).to_i == epoch.to_i
@@ -8265,6 +8505,7 @@ module Clacky
             @registry.with_session(session_id) do |s|
               owns_epoch = s[:epoch].to_i == epoch.to_i
               next unless owns_epoch
+              web_ui = s[:ui]
               awaiting = run_result.is_a?(Hash) && run_result[:awaiting_user_feedback]
               pending = agent.take_pending_input if Agent.task_completed?(run_result)
               unless pending
@@ -8283,7 +8524,11 @@ module Clacky
           # session history: a chime is a live cue, never replayed on refresh.
           # Also fires when awaiting feedback — that is precisely when the user
           # most needs pulling back; the flag lets the client word it differently.
-          broadcast_all(type: "task_finished", session_id: session_id, awaiting_feedback: !!awaiting)
+          finished = { type: "task_finished", session_id: session_id, awaiting_feedback: !!awaiting }
+          # Lets clients not viewing this session keep the summary until it is first opened.
+          complete = web_ui&.last_complete
+          finished[:complete] = complete if complete&.dig(:task_id) && run_result.is_a?(Hash) && complete[:task_id] == run_result[:task_id]
+          broadcast_all(finished)
           @session_manager.save(agent.to_session_data(status: :success, updated_at: Time.now))
           # Start idle compression timer now that the agent is idle
           idle_timer&.start