@co0ontty/wand 4.83.1 → 4.84.0

package/dist/server.js

@@ -1,3 +1,4 @@
+import { OpenRouterFreeModelsService } from "./openrouter-free-models.js";
 import crypto from "node:crypto";
 import compression from "compression";
 import express from "express";
@@ -13,12 +14,15 @@ import { AuthService, BROWSER_ADMIN_PRINCIPAL, CONNECTED_APP_PRINCIPAL, principa
 import { ensureCertificates } from "./cert.js";
 import { getDefaultModelForProvider, getProviderDefaultModels, isExecutionMode, resolveConfigDir, } from "./config.js";
 import { ModelCatalogService } from "./models.js";
+import { defaultModelGroupSelector } from "./model-groups.js";
 import { ProcessManager } from "./process-manager.js";
 import { SessionLogger } from "./session-logger.js";
+import { coreHarnessAgentDir, warmCoreHarness } from "./harness-engine.js";
 import { SessionRegistry } from "./session-registry.js";
 import { SessionCompletionTracker } from "./session-completion.js";
 import { resolveSystemAiContext } from "./session-ai-context.js";
 import { StructuredSessionManager } from "./structured-session-manager.js";
+import { SettingsWebAccess, registerSettingsWebAccessRoute } from "./settings-web-access.js";
 import { DecisionService } from "./decision-service.js";
 import { registerDecisionRoutes } from "./server-decision-routes.js";
 import { recordRecentPath, registerFileRoutes } from "./server-file-routes.js";
@@ -33,8 +37,12 @@ import { registerTaskRoutes } from "./server-task-routes.js";
 import { getGithubConnectorStatus } from "./github-connector.js";
 import { registerMissionRoutes } from "./server-mission-routes.js";
 import { Missions } from "./missions.js";
-import { createAiTeamRunner } from "./ai-team-runner.js";
+import { AI_TEAM_CHAT_PREFIX, createAiTeamRunner } from "./ai-team-runner.js";
+import { ConversationService } from "./conversation-service.js";
+import { CONVERSATION_RELAY_PREFIX } from "./conversation-types.js";
+import { forwardConversationRelay, registerConversationRoutes } from "./server-conversation-routes.js";
 import { registerAiTeamRoutes } from "./server-ai-team-routes.js";
+import { registerTeamDispatchRoutes } from "./server-team-dispatch-routes.js";
 import { registerSiliconEmployeeRoutes } from "./server-employee-routes.js";
 import { defaultRoleForCli } from "./default-employee.js";
 import { UserMemoryService } from "./user-memory.js";
@@ -50,7 +58,7 @@ import { asyncRoute, jsonErrorHandler } from "./express-async.js";
 import { checkPackageUpdateAsync, installPackageGloballyAsync, normalizeUpdateChannel, resolveGlobalWandCli, } from "./npm-update-utils.js";
 import { repairServiceUnitAfterUpdate } from "./service-self-repair.js";
 import { computeRelaunch } from "./relaunch.js";
-import { startRetentionTimer } from "./retention.js";
+import { createRetentionSweep, startRetentionTimer } from "./retention.js";
 import { RuntimeConfigState } from "./runtime-config.js";
 import { safeServiceInstalled } from "./tui/runtime-utils.js";
 import { checkManagedServiceUpdatePreflight, } from "./update-helper.js";
@@ -73,6 +81,7 @@ import { createUpgradeAwareTerminalHost } from "./render-host.js";
 import { createUpgradeAwareStructuredHost } from "./render-structured-host.js";
 import { checkPasswordRateLimit, recordFailedPassword, resetPasswordRateLimit } from "./middleware/rate-limit.js";
 import { updateProviderClis, verifyProviderCliUpdateResults, } from "./provider-cli-updater.js";
+import { userAuthor } from "./user-profile.js";
 const SERVER_MODULE_DIR = path.dirname(new URL(import.meta.url).pathname);
 const RUNTIME_ROOT_DIR = path.resolve(SERVER_MODULE_DIR, "..");
 // ── Package info ──
@@ -133,9 +142,12 @@ const DISPLAY_VERSION = BUILD_INFO.version || PKG_VERSION;
 const SERVER_INSTANCE_ID = crypto.randomUUID();
 // ── Auth helpers ──
 const requestPrincipals = new WeakMap();
-function buildRequireAuth(useHttps, storage, config, authService) {
+function buildRequireAuth(useHttps, storage, config, authService, settingsAccess) {
     return function requireAuth(req, res, next) {
-        const principal = authService.authenticateSession(readSessionCookie(req, useHttps))
+        const sessionToken = readSessionCookie(req, useHttps);
+        const sessionPrincipal = authService.authenticateSession(sessionToken);
+        const principal = (sessionPrincipal && principalHasScope(sessionPrincipal, "session-preferences") &&
+            settingsAccess.accepts(sessionToken, req.headers.cookie) ? BROWSER_ADMIN_PRINCIPAL : sessionPrincipal)
             ?? authenticateBearerAppToken(req, storage, config);
         if (!principal) {
             res.status(401).json({ error: "未授权，请先登录。" });
@@ -272,6 +284,8 @@ export function isPortInUseError(error) {
             && error.code === "EADDRINUSE");
 }
 export async function startServer(config, configPath, options = {}) {
+    if (config.shell?.trim())
+        process.env.SHELL = config.shell.trim();
     // 关键：在创建 ProcessManager / 任何 spawn 之前先修 PATH。
     // 服务被注册为 systemd / launchd 时，unit 文件里的 PATH 是安装那一刻烧死的，
     // 之后用户切 node 版本 / 重装 wand / 把 claude 装到新位置都不会更新 unit，
@@ -299,7 +313,9 @@ export async function startServer(config, configPath, options = {}) {
     app.set("trust proxy", "loopback, 172.16.0.0/12");
     const storage = new WandStorage(resolveDatabasePath(configPath));
     const runtimeConfig = new RuntimeConfigState(config);
+    const openRouter = new OpenRouterFreeModelsService(storage, options.openRouterFetch);
     const authService = new AuthService(storage);
+    const settingsAccess = new SettingsWebAccess();
     const decisions = new DecisionService(config.localDecision);
     // 默认模型优先读存储（UI 改设置后实时生效），未设置时由 getPreference 回落到 config。
     const getCurrentDefaultModels = () => ({
@@ -316,11 +332,14 @@ export async function startServer(config, configPath, options = {}) {
         const currentDefaults = getCurrentDefaultModels();
         return {
             storage,
+            managedPiModels: () => openRouter.catalog(),
+            managedPiModelMembers: () => openRouter.members(),
+            modelGroups: () => config.modelGroups ?? [],
             inheritEnv: config.inheritEnv !== false,
             apiKey: process.env.ANTHROPIC_API_KEY,
             baseUrl: process.env.ANTHROPIC_BASE_URL,
             ...injected,
-            piEndpointDiscovery: injected.piEndpointDiscovery ?? { enabled: !testMode },
+            piEndpointDiscovery: injected.piEndpointDiscovery ?? { enabled: !testMode, agentDir: coreHarnessAgentDir(config.harness) },
             configuredClaudeModels: [
                 currentDefaults.claude,
                 config.commitCli === "claude" ? (storage.getPreference("pref:commitModel", config.commitModel) ?? "") : undefined,
@@ -351,22 +370,36 @@ export async function startServer(config, configPath, options = {}) {
             knownSessionIds: knownPtySessionIds,
         });
     const terminalHost = ptyHosts.host;
-    const processes = new ProcessManager(config, storage, configDir, terminalHost);
+    let decisionRuntime = null;
+    let autoAssignEvaluate;
+    const processes = new ProcessManager(config, storage, configDir, terminalHost, { resolveDecisionEvaluate: () => autoAssignEvaluate });
     const structuredLogger = new SessionLogger(configDir, config.shortcutLogMaxBytes);
     // Production startup provides a daemon-backed host for structured CLI runs
     // even when Render owns every PTY. In-process hosts are for test injection.
     const legacyStructuredHost = ptyHosts.legacyHost
         ?? (terminalHost instanceof TerminalDaemonClient ? terminalHost : null);
     const structuredHosts = await createUpgradeAwareStructuredHost(configPath, legacyStructuredHost, config.structured?.processHost);
-    let decisionRuntime = null;
-    const structuredSessions = new StructuredSessionManager(storage, config, structuredLogger, {}, structuredHosts.host, () => decisionRuntime);
+    const structuredSessions = new StructuredSessionManager(storage, config, structuredLogger, {}, structuredHosts.host, () => decisionRuntime, openRouter, () => autoAssignEvaluate);
+    // core harness 预热：只读本机 Pi 认证与模型目录，不联网。失败不影响启动，
+    // 但要在开始接输入前得到确定结论，否则首轮引擎裁决会因缓存未就绪而退回 CLI。
+    const coreHarnessStatus = await warmCoreHarness(config.harness);
+    if (coreHarnessStatus) {
+        console.log(coreHarnessStatus.available
+            ? `[wand] core harness 可用（Pi provider ${coreHarnessStatus.providerCount} 个、模型 ${coreHarnessStatus.modelCount} 个，agentDir ${coreHarnessStatus.agentDir}）；pi 结构化会话将使用进程内引擎。`
+            : `[wand] core harness 不可用，pi 结构化会话回退 CLI：${coreHarnessStatus.reason}`);
+    }
     const sessionRegistry = new SessionRegistry(processes, structuredSessions, storage);
     const sessionCompletions = new SessionCompletionTracker(storage, (id) => sessionRegistry.get(id));
     const missions = new Missions(storage, structuredSessions, sessionRegistry);
+    // 任务保留的立即扫描也晚绑定：设置路由先注册，WebSocket 和会话表稍后才就绪。
+    let runTaskRetentionSweep = () => ({
+        archivedSessions: 0, purgedSessions: 0, archivedTasks: 0, purgedTasks: 0, purgedTeamRuns: 0,
+    });
     // wsManager 在后面才建：团队运行的变更通知经由这个转发口，接好之前静默丢弃。
     let notifyAiTeamRun = (_data) => { };
     // 运行中步骤的 live 文本推送（§4.9），同样走系统通知，接好之前静默丢弃。
     let notifyAiTeamRunLive = (_update) => { };
+    let notifyConversationSession = (_update) => { };
     // 团队降级的 model-unknown 事前比对只看这份已发现的清单；没刷新过就是空，判定方向是放行。
     const aiTeamModelIds = (provider) => {
         const cache = modelCatalog.snapshot();
@@ -381,14 +414,27 @@ export async function startServer(config, configPath, options = {}) {
         }[provider];
         return cache[key].map((entry) => entry.id);
     };
+    let conversations = null;
     const aiTeams = createAiTeamRunner({
         storage, config, structured: structuredSessions, processes, sessions: sessionRegistry,
-        notify: (run) => notifyAiTeamRun({ kind: "ai-team-run", runId: run.id, taskId: run.taskId }),
+        selfAuthor: () => userAuthor(config.userProfile),
+        notify: (run) => {
+            conversations?.importRun(run);
+            notifyAiTeamRun({ kind: "ai-team-run", runId: run.id, taskId: run.taskId });
+        },
         notifyLive: (update) => notifyAiTeamRunLive(update),
         models: aiTeamModelIds,
+        chatHistoryTurns: id => conversations?.history(id) ?? [],
         // 成员名单里的模型名：`default` 哨兵换成服务端为该 CLI 配置的默认模型。
         defaultModelOf: (provider) => getDefaultModelForProvider(config, provider),
     });
+    const conversationService = new ConversationService({ storage, config, structured: structuredSessions, runner: aiTeams,
+        notifySession: update => notifyConversationSession(update), deleteSession: id => { sessionRegistry.deleteWithProviderHistory(id); } });
+    conversations = conversationService;
+    conversationService.migrateExistingChats();
+    for (const prefix of [CONVERSATION_RELAY_PREFIX, AI_TEAM_CHAT_PREFIX]) {
+        structuredSessions.registerRelay(prefix, (sessionId, input) => forwardConversationRelay(conversationService, sessionId, input));
+    }
     const updateState = new ServerUpdateState();
     const getUpdateChannel = () => normalizeUpdateChannel(storage.getConfigValue("updateChannel"));
     let disconnectAuthenticatedSockets = () => { };
@@ -397,7 +443,7 @@ export async function startServer(config, configPath, options = {}) {
     };
     const useHttps = config.https === true;
     const protocol = useHttps ? "https" : "http";
-    const requireAuth = buildRequireAuth(useHttps, storage, config, authService);
+    const requireAuth = buildRequireAuth(useHttps, storage, config, authService, settingsAccess);
     const requireAdmin = buildRequireScope("admin");
     const requireSessions = buildRequireScope("sessions");
     const requireFiles = buildRequireScope("files");
@@ -468,9 +514,9 @@ export async function startServer(config, configPath, options = {}) {
         res.type("application/javascript").send(chunk.content);
     });
     // ── Web UI endpoints ──
-    app.get("/", (_req, res) => {
+    app.get(["/", "/settings"], (req, res) => {
         res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
-        res.type("html").send(renderApp(configPath));
+        res.type("html").send(renderApp(configPath, /^\/settings\/?$/.test(req.path) ? "settings" : "console", req.query.client === "app" ? "client" : "browser"));
     });
     app.get("/api/structured-chat-avatar/:role", requireAuth, asyncRoute(async (req, res) => {
         const role = req.params.role === "user" || req.params.role === "assistant"
@@ -597,11 +643,21 @@ export async function startServer(config, configPath, options = {}) {
         res.json({ ok: true, reauthenticationRequired: true });
     });
     // ── Android APK update & download (no auth required) ──
-    registerPublicUpdateRoutes(app, distributionManager);
+    registerPublicUpdateRoutes(app, distributionManager, config.publicOrigin);
     // Public probe so the unauthenticated browser does not log a 401 on /api/config
     app.get("/api/session-check", (req, res) => {
         res.json({ authed: authService.validateSession(readSessionCookie(req, useHttps)) });
     });
+    registerSettingsWebAccessRoute(app, {
+        requireAuth, useHttps, access: settingsAccess,
+        authenticateSession: (token) => authService.authenticateSession(token),
+    });
+    // Count-only compatibility probe. Local control (including session IDs and
+    // admission barriers) uses the owner-only Unix IPC socket.
+    app.get("/api/core-status", (_req, res) => {
+        const { hasActiveTurns, activeTurnCount } = structuredSessions.getCoreTurnStatus();
+        res.set("Cache-Control", "no-store").json({ hasActiveTurns, activeTurnCount });
+    });
     registerDecisionRoutes(app, { storage, decisions, requireAuth, requireSessions });
     app.use("/api", requireAuth);
     // Connected apps receive only the route families used by native clients and
@@ -613,6 +669,7 @@ export async function startServer(config, configPath, options = {}) {
         "/api/session-list",
         "/api/session-directories",
         "/api/structured-sessions",
+        "/api/conversations",
         "/api/commands",
         "/api/user-memory",
         "/api/claude-history",
@@ -691,6 +748,8 @@ export async function startServer(config, configPath, options = {}) {
             ],
             structuredChatPersona,
             cardDefaults: config.cardDefaults,
+            // 会话署名与头像：客户端只做展示投影，不解释成任何执行身份。
+            userProfile: config.userProfile ?? {},
             // 把语言偏好暴露给前端做 UI 文案 i18n。后端原本只用它给 Claude 拼 system prompt，
             // 前端没收到 → "SUBAGENT" / "Read" 这些 UI label 一直是英文，跟用户设的中文不匹配。
             language: config.language ?? "",
@@ -722,7 +781,9 @@ export async function startServer(config, configPath, options = {}) {
         getDistributionSettings,
         getGithubConnector: () => getGithubConnectorStatus(storage),
         modelCatalog,
+        openRouter,
         resolveAppConnectCode: (req) => resolveAppConnectCode(req, config, useHttps, getEffectivePassword(storage, config)),
+        sweepTaskRetention: () => runTaskRetentionSweep(),
     });
     registerGithubRoutes(app, { storage, requireAdmin, sessions: sessionRegistry });
     // 任务管理与 Missions 一样只需登录：原生 connected-app 也要能列/建/派发。
@@ -732,12 +793,15 @@ export async function startServer(config, configPath, options = {}) {
         runner: aiTeams,
         notifyTeamChanged: (teamId) => notifyAiTeamRun({ kind: "ai-team-definition", teamId }),
     });
+    // 无指派派工：本地决策模型建议名单 → 确认开工（不自动派工，见 AGENTS）。
+    registerTeamDispatchRoutes(app, { storage, runner: aiTeams, decisions });
     registerSiliconEmployeeRoutes(app, {
         storage,
         config,
         notifyEmployeeChanged: (employeeId) => notifyAiTeamRun({ kind: "silicon-employee-definition", employeeId }),
     });
     registerAttentionRoutes(app, { sessions: sessionRegistry, runner: aiTeams });
+    registerConversationRoutes(app, conversationService);
     registerAdminUpdateRoutes(app, {
         storage,
         config,
@@ -764,7 +828,7 @@ export async function startServer(config, configPath, options = {}) {
     }
     registerSessionRoutes(app, processes, structuredSessions, storage, config.defaultMode, config, sessionRegistry, (cwd) => {
         recordRecentPath(storage, cwd);
-    }, (event) => wsManager.emitEvent(event));
+    }, (event) => wsManager.emitEvent(event), decisions);
     registerClaudeHistoryRoutes(app, processes, storage);
     registerWorkspaceRoutes(app, storage, sessionRegistry, { config });
     registerMissionRoutes(app, missions);
@@ -837,7 +901,7 @@ export async function startServer(config, configPath, options = {}) {
                 ? "qodercli"
                 : rawCommand;
             const effectiveModel = provider
-                ? rawModel || getDefaultModelForProvider(config, provider) || undefined
+                ? rawModel || defaultModelGroupSelector(config.modelGroups, provider, getDefaultModelForProvider(config, provider)) || getDefaultModelForProvider(config, provider) || undefined
                 : undefined;
             const reqCols = typeof body.cols === "number" && Number.isFinite(body.cols) ? body.cols : undefined;
             const reqRows = typeof body.rows === "number" && Number.isFinite(body.rows) ? body.rows : undefined;
@@ -957,6 +1021,7 @@ export async function startServer(config, configPath, options = {}) {
         wsManager.emitEvent(event);
     });
     structuredSessions.setEventEmitter((event) => {
+        conversationService.ingestSessionEvent(event);
         sessionCompletions.ingest(event);
         missions.ingest(event);
         aiTeams.ingest(event);
@@ -970,10 +1035,14 @@ export async function startServer(config, configPath, options = {}) {
             type: "notification", sessionId: "__system__", data: { kind: "ai-team-step-live", ...update },
         });
     };
+    notifyConversationSession = update => {
+        wsManager.emitEvent({ type: "notification", sessionId: "__system__", data: { kind: "conversation-session-preview", ...update } });
+    };
     // Re-attach structured CLI runs that kept going inside terminald while the
     // previous web process was down; fire-and-forget, failures are logged inside.
     void structuredSessions.recoverDetachedRuns();
     aiTeams.reconcile();
+    structuredSessions.resumeQueuedPiMessages();
     // ── Restart endpoint (needs server + wss in scope) ──
     /**
      * 统一的关服 + 重启。重启方式由 computeRelaunch 决定：
@@ -981,12 +1050,28 @@ export async function startServer(config, configPath, options = {}) {
      *     重写的）ExecStart 拉起，避免再 spawn detached 子进程与 systemd 抢单实例 pidfile；
      *   - 否则 → spawn 一个 detached 子进程（bin 优先全局安装，确保更新后跑到新版）再退出。
      */
+    let restartPending = false;
     function relaunchAfterShutdown() {
-        const plan = computeRelaunch({
-            serviceInstalled: safeServiceInstalled(),
-            globalCli: resolveGlobalWandCli(),
-        });
-        void close().finally(() => {
+        if (restartPending)
+            return;
+        restartPending = true;
+        const releaseDrain = structuredSessions.beginCoreRestartDrain();
+        void (async () => {
+            if (structuredSessions.getCoreTurnStatus().hasActiveTurns) {
+                process.stdout.write("[wand] 等待原生 Core 回合完成后再重启…\n");
+            }
+            while (structuredSessions.getCoreTurnStatus().hasActiveTurns) {
+                await new Promise((resolve) => setTimeout(resolve, 1000));
+            }
+            // Do not dispose tools/services or arm the force-exit timer while a native
+            // turn is still running. The same barrier covers manual and auto restart.
+            const plan = computeRelaunch({
+                serviceInstalled: safeServiceInstalled(),
+                globalCli: resolveGlobalWandCli(),
+            });
+            const forceExitTimer = setTimeout(() => process.exit(0), 5000);
+            forceExitTimer.unref?.();
+            await close();
             if (plan.mode === "spawn") {
                 spawn(process.execPath, [plan.bin ?? "", ...(plan.args ?? [])], {
                     detached: true,
@@ -996,10 +1081,11 @@ export async function startServer(config, configPath, options = {}) {
                 }).unref();
             }
             process.exit(0);
+        })().catch((error) => {
+            restartPending = false;
+            releaseDrain();
+            wandError("等待 Core 回合后重启失败", getErrorMessage(error));
         });
-        // Force exit after 5s if graceful shutdown stalls
-        const forceExitTimer = setTimeout(() => process.exit(0), 5000);
-        forceExitTimer.unref?.();
     }
     app.post("/api/restart", requireAdmin, asyncRoute(async (_req, res) => {
         res.json({ ok: true, message: "服务正在重启..." });
@@ -1019,10 +1105,12 @@ export async function startServer(config, configPath, options = {}) {
         const cleanupFailedListen = () => {
             shuttingDown = true;
             decisions.dispose();
+            openRouter.dispose();
             try {
                 processes.dispose();
             }
             catch { /* noop */ }
+            conversationService.dispose();
             try {
                 structuredSessions.dispose();
             }
@@ -1069,10 +1157,18 @@ export async function startServer(config, configPath, options = {}) {
             const address = server.address();
             const actualPort = typeof address === "object" && address ? address.port : config.port;
             bindAddr = `${config.host}:${actualPort}`;
+            const decisionStatus = decisions.status();
             if (config.localDecision?.enabled) {
                 const localHost = config.host === "::1" ? "[::1]" : config.host === "0.0.0.0" || config.host === "::" ? "127.0.0.1" : config.host;
                 decisionRuntime = { url: `${protocol}://${localHost}:${actualPort}`,
-                    ...(activeSslCertPath ? { caPath: activeSslCertPath } : {}) };
+                    ...(activeSslCertPath ? { caPath: activeSslCertPath } : {}),
+                    // core 会话直接调进程内决策服务，不再绕出 HTTP + env token。
+                    evaluate: (value, caller, signal) => decisions.evaluate(value, caller, signal) };
+            }
+            // 「智能分配」只要真正能跑（启用 + 平台/运行环境就绪）才由本地决策负责；
+            // 否则转给系统员工的一次性文本回退，而不是每次白等一个必然失败的调用。
+            if (config.localDecision?.enabled && decisionStatus.supported && decisionStatus.configured) {
+                autoAssignEvaluate = (value, caller, signal) => decisions.evaluate(value, caller, signal);
             }
             const scheme = useHttps ? "HTTPS" : "HTTP";
             // 主 URL：本机回环；若绑定 0.0.0.0 再补一个对外提示。
@@ -1108,6 +1204,9 @@ export async function startServer(config, configPath, options = {}) {
             data: { kind: "models", revision: result.revision, refreshedAt: result.refreshedAt },
         });
     });
+    openRouter.onChanged(() => modelCatalog.publishManagedPiModels());
+    if (!testMode)
+        openRouter.start();
     let modelCatalogRefreshTimer = null;
     if (!testMode) {
         void modelCatalog.refresh().catch(() => { });
@@ -1117,10 +1216,29 @@ export async function startServer(config, configPath, options = {}) {
         }, MODEL_CATALOG_AUTO_REFRESH_INTERVAL_MS);
         modelCatalogRefreshTimer.unref();
     }
-    // 保留期扫描：7 天没活动的会话/任务自动归档，归档 7 天后自动清理。
+    // 会话仍按固定 7 天归档再清理；任务窗口每次扫描读取当前设置。
+    // 保存任务保留设置后走同一条扫描，不等下一小时。
+    const retentionDeps = {
+        storage,
+        sessions: sessionRegistry,
+        taskRetention: () => config.taskRetention,
+    };
+    const sweepRetention = createRetentionSweep(retentionDeps);
+    runTaskRetentionSweep = () => {
+        const result = sweepRetention();
+        try {
+            wsManager.emitEvent({
+                type: "notification",
+                sessionId: "__system__",
+                data: { kind: "task-retention", ...result },
+            });
+        }
+        catch { /* 扫描结果已经返回给保存请求，通知失败不回滚 */ }
+        return result;
+    };
     let retentionTimer = null;
     if (!testMode) {
-        retentionTimer = startRetentionTimer({ storage, sessions: sessionRegistry });
+        retentionTimer = startRetentionTimer(retentionDeps, 60 * 60 * 1000, sweepRetention);
     }
     // Express 4 does not forward rejected route promises automatically. Every
     // async route above is wrapped with asyncRoute, and this final middleware
@@ -1194,10 +1312,8 @@ export async function startServer(config, configPath, options = {}) {
                     previousInstanceId: SERVER_INSTANCE_ID,
                 },
             });
-            // Restart after a brief delay
-            const restartTimer = setTimeout(() => {
-                relaunchAfterShutdown();
-            }, 1000);
+            // Manual and automatic restarts share the same live admission barrier.
+            const restartTimer = setTimeout(() => relaunchAfterShutdown(), 1000);
             restartTimer.unref?.();
         }
         catch (error) {
@@ -1269,6 +1385,7 @@ export async function startServer(config, configPath, options = {}) {
         closePromise = (async () => {
             shuttingDown = true;
             decisions.dispose();
+            openRouter.dispose();
             await userMemory.dispose();
             if (updateCheckTimer) {
                 clearInterval(updateCheckTimer);
@@ -1318,6 +1435,7 @@ export async function startServer(config, configPath, options = {}) {
                 processes.dispose();
             }
             catch { /* best-effort shutdown */ }
+            conversationService.dispose();
             try {
                 structuredSessions.dispose();
             }

package/dist/session-ai-context.d.ts

@@ -1,3 +1,4 @@
+import { type ModelGroup } from "./model-groups.js";
 import type { SiliconEmployee } from "./ai-team-types.js";
 import type { AiCliCandidate, SessionProvider, SessionSnapshot, WandConfig } from "./types.js";
 export interface SessionAiContext {
@@ -9,6 +10,9 @@ export interface SessionAiContext {
     opsPersona?: string;
     /** CLI 降级链（按顺序）。为空时只用 provider/model 这一次调用。 */
     cliCandidates?: AiCliCandidate[];
+    /** 系统应用必须经员工 CLI 渠道；候选为空时禁止退回当前会话/默认 provider。 */
+    employeeChannelOnly?: boolean;
+    modelGroups?: ModelGroup[];
 }
 /**
  * Resolve the provider from every representation used by current and legacy
@@ -17,6 +21,6 @@ export interface SessionAiContext {
  */
 export declare function resolveSessionProvider(snapshot: Pick<SessionSnapshot, "provider" | "structuredState" | "runner" | "command">): SessionProvider;
 /** Build the provider-specific settings used by session-adjacent AI actions. */
-export declare function resolveSessionAiContext(snapshot: Pick<SessionSnapshot, "provider" | "structuredState" | "runner" | "command" | "selectedModel" | "thinkingEffort">, config: Pick<WandConfig, "defaultModel" | "defaultCodexModel" | "defaultOpenCodeModel" | "defaultGrokModel" | "defaultQoderModel" | "defaultPiModel" | "defaultThinkingEffort" | "inheritEnv">): SessionAiContext;
+export declare function resolveSessionAiContext(snapshot: Pick<SessionSnapshot, "provider" | "structuredState" | "runner" | "command" | "selectedModel" | "thinkingEffort">, config: Pick<WandConfig, "defaultModel" | "defaultCodexModel" | "defaultOpenCodeModel" | "defaultGrokModel" | "defaultQoderModel" | "defaultPiModel" | "defaultThinkingEffort" | "inheritEnv" | "modelGroups">): SessionAiContext;
 /** Build the source order for Wand-owned AI features such as titles. */
 export declare function resolveSystemAiContext(snapshot: Parameters<typeof resolveSessionAiContext>[0], config: Parameters<typeof resolveSessionAiContext>[1] & Pick<WandConfig, "systemAiCli" | "systemAiModel">, systemEmployee?: SiliconEmployee | null): SessionAiContext;

package/dist/session-ai-context.js

@@ -1,4 +1,5 @@
 import { getDefaultModelForProvider } from "./config.js";
+import { resolveModelGroupModels } from "./model-groups.js";
 import { providerCliInstalled, isSessionProvider } from "./session-provider.js";
 import { isSystemSiliconEmployee, systemEmployeeCliCandidates } from "./system-employee.js";
 import { inferProviderFromCommand, inferProviderFromRunner } from "./session-provider.js";
@@ -30,6 +31,7 @@ export function resolveSessionAiContext(snapshot, config) {
         model: sessionModel ?? defaultModel,
         thinkingEffort: snapshot.thinkingEffort ?? config.defaultThinkingEffort,
         inheritEnv: config.inheritEnv,
+        ...(config.modelGroups?.length ? { modelGroups: config.modelGroups } : {}),
     };
 }
 /** Build the source order for Wand-owned AI features such as titles. */
@@ -37,13 +39,14 @@ export function resolveSystemAiContext(snapshot, config, systemEmployee) {
     const sessionContext = resolveSessionAiContext(snapshot, config);
     // 候选里的「跟随默认模型」在这里就换成具体的 Wand 默认模型：降级到下一个 provider
     // 时不能拿上一个 provider 的模型，也不能把决定权交给 CLI 自己的默认值。
-    const chain = systemEmployeeCliCandidates(systemEmployee).map((candidate) => ({
-        ...candidate,
-        model: candidate.model ?? normalizeModel(getDefaultModelForProvider(config, candidate.provider)),
-    }));
+    const chain = systemEmployeeCliCandidates(systemEmployee).flatMap((candidate) => resolveModelGroupModels(config.modelGroups, candidate.provider, candidate.model ?? normalizeModel(getDefaultModelForProvider(config, candidate.provider)), {
+        preferDefault: !candidate.model || candidate.model === "default",
+    })
+        .map((model) => ({ ...candidate, model: normalizeModel(model) })));
     const owned = {
         ...sessionContext,
         ...(chain.length ? { cliCandidates: chain } : {}),
+        ...(systemEmployee ? { employeeChannelOnly: true } : {}),
         ...(isSystemSiliconEmployee(systemEmployee) ? { opsPersona: systemEmployee.prompt } : {}),
     };
     // 内置员工可用时，Wand 自有调用一律按它的候选链：provider/model 取首个已安装的
@@ -56,6 +59,8 @@ export function resolveSystemAiContext(snapshot, config, systemEmployee) {
     }
     if (chain.length)
         return owned;
+    if (systemEmployee)
+        return owned;
     // Older installations without a system AI CLI preference still follow the
     // current session. A chosen CLI must never inherit another provider's model.
     if (!isSessionProvider(config.systemAiCli))

package/dist/session-registry.d.ts

@@ -3,6 +3,8 @@ import type { StructuredSessionManager } from "./structured-session-manager.js";
 import type { WandStorage } from "./storage.js";
 import type { ExecutionMode, SessionSnapshot } from "./types.js";
 export type SessionOwner = "structured" | "pty" | "storage";
+export type ProviderHistoryDeleter = Pick<ProcessManager, "deleteClaudeHistoryFiles" | "deleteCodexHistoryFiles" | "deleteOpenCodeHistorySessions" | "deleteQoderHistoryFiles" | "deletePiHistoryFiles" | "deleteGrokHistoryFiles" | "deleteGeminiHistoryFiles">;
+export declare function deleteProviderNativeHistory(deleter: ProviderHistoryDeleter, provider: string, providerSessionId: string, cwd: string): void;
 type HiddenSessionStore = Pick<WandStorage, "getConfigValue" | "setConfigValue">;
 /** 读取 `hidden_claude_session_ids`；坏数据 / 空值按空集合处理，不抛错。 */
 export declare function readHiddenSessionIds(storage: Pick<HiddenSessionStore, "getConfigValue">): Set<string>;
@@ -35,6 +37,8 @@ export declare class SessionRegistry {
      * 归档 / 取消归档一个会话：只写标记，不杀进程、不删历史；真正的清理留给保留期扫描。
      * 会话可能只存在于 storage（重启后未加载），因此 storage-only 也要能改。
      */
+    /** 停掉空闲 PTY 壳。保留期只对「进程还在、但没有正在处理的回合」调用。 */
+    stop(id: string): SessionSnapshot | null;
     setArchived(id: string, archived: boolean): SessionSnapshot | null;
     updateWorktreeState(id: string, status: SessionSnapshot["worktreeMergeStatus"], info: SessionSnapshot["worktreeMergeInfo"]): SessionSnapshot | null;
     delete(id: string): SessionSnapshot | null;

package/dist/session-registry.js

@@ -1,5 +1,35 @@
 import { cleanupWorktreeSync } from "./git-worktree.js";
 import { inferProviderFromCommand } from "./session-provider.js";
+export function deleteProviderNativeHistory(deleter, provider, providerSessionId, cwd) {
+    const id = providerSessionId.trim();
+    if (!id)
+        return;
+    switch (provider) {
+        case "claude":
+            deleter.deleteClaudeHistoryFiles([{ claudeSessionId: id, cwd }]);
+            break;
+        case "codex":
+            deleter.deleteCodexHistoryFiles([id]);
+            break;
+        case "opencode":
+            deleter.deleteOpenCodeHistorySessions([id]);
+            break;
+        case "qoder":
+            deleter.deleteQoderHistoryFiles([id]);
+            break;
+        case "pi":
+            deleter.deletePiHistoryFiles([id]);
+            break;
+        case "grok":
+            deleter.deleteGrokHistoryFiles([id]);
+            break;
+        case "gemini":
+            deleter.deleteGeminiHistoryFiles([id]);
+            break;
+        default:
+            break;
+    }
+}
 /** 读取 `hidden_claude_session_ids`；坏数据 / 空值按空集合处理，不抛错。 */
 export function readHiddenSessionIds(storage) {
     const raw = storage.getConfigValue("hidden_claude_session_ids");
@@ -143,6 +173,12 @@ export class SessionRegistry {
      * 归档 / 取消归档一个会话：只写标记，不杀进程、不删历史；真正的清理留给保留期扫描。
      * 会话可能只存在于 storage（重启后未加载），因此 storage-only 也要能改。
      */
+    /** 停掉空闲 PTY 壳。保留期只对「进程还在、但没有正在处理的回合」调用。 */
+    stop(id) {
+        if (this.ownerOf(id) !== "pty")
+            return this.get(id);
+        return this.processes.stop(id);
+    }
     setArchived(id, archived) {
         const owner = this.ownerOf(id);
         if (owner === "structured")
@@ -184,12 +220,18 @@ export class SessionRegistry {
             catch { /* never block deletion */ }
         }
         const owner = this.ownerOf(id);
-        if (owner === "structured")
+        if (owner === "structured") {
             this.structured.delete(id);
-        else if (owner === "pty")
+        }
+        else if (owner === "pty") {
+            this.processes.delete(id);
+        }
+        else if (snapshot.sessionKind === "structured") {
+            this.structured.delete(id);
+        }
+        else {
             this.processes.delete(id);
-        else
-            this.storage.deleteSession(id);
+        }
         return snapshot;
     }
     deleteWithProviderHistory(id) {
@@ -201,15 +243,7 @@ export class SessionRegistry {
             ?? snapshot.structuredState?.provider
             ?? inferProviderFromCommand(snapshot.command)
             ?? "claude";
-        if (provider === "claude") {
-            this.processes.deleteClaudeHistoryFiles([{ claudeSessionId: providerSessionId, cwd: snapshot.cwd }]);
-        }
-        else if (provider === "codex") {
-            this.processes.deleteCodexHistoryFiles([providerSessionId]);
-        }
-        else {
-            return snapshot;
-        }
+        deleteProviderNativeHistory(this.processes, provider, providerSessionId, snapshot.cwd);
         addHiddenSessionIds(this.storage, [providerSessionId]);
         return snapshot;
     }

package/dist/session-transport.js

@@ -1,4 +1,5 @@
 import { enrichStructuredMessages, WAND_PROTOCOL_VERSION } from "./structured-client-protocol.js";
+import { normalizeTurnAnchors } from "./structured-provider-common.js";
 import { collectSessionTopicBlocklist, shouldAcceptGeneratedSessionTitle, summarizeSessionTitleFromInput, } from "./session-topic.js";
 export const SESSION_TRANSPORT_OUTPUT_LIMIT = 200_000;
 function cleanDisplayTitle(value) {
@@ -35,6 +36,10 @@ function sessionBase(snapshot) {
         providerCliActive: snapshot.providerCliActive,
         providerCliExitCode: snapshot.providerCliExitCode,
         ptyBusy: snapshot.ptyBusy === true,
+        // 与 ptyBusy 同生命周期的本轮锚点（运行时事实，存储里没有对应列）。和 ptyBusy 一起
+        // 读成 null，客户端才不会在一条已经 idle 的会话上算出「已运行 N 分钟」。
+        ptyTurnStartedAt: snapshot.ptyBusy === true ? snapshot.ptyTurnStartedAt ?? null : null,
+        ptyLastActivityAt: snapshot.ptyBusy === true ? snapshot.ptyLastActivityAt ?? null : null,
         runner: snapshot.runner,
         command: snapshot.command,
         cwd: snapshot.cwd,
@@ -60,7 +65,8 @@ function sessionBase(snapshot) {
         claudeSessionId: snapshot.claudeSessionId,
         providerSessionId: snapshot.claudeSessionId,
         queuedMessages: snapshot.queuedMessages,
-        structuredState: snapshot.structuredState,
+        // inFlight 之外的回合锚点一律读成 null（兜底历史库残值与重启降级窗口）。
+        structuredState: normalizeTurnAnchors(snapshot.structuredState),
         resumedFromSessionId: snapshot.resumedFromSessionId,
         autoRecovered: snapshot.autoRecovered,
         autoApprovePermissions: snapshot.autoApprovePermissions,
@@ -74,6 +80,7 @@ function sessionBase(snapshot) {
         workspaceTaskId: snapshot.workspaceTaskId,
         selectedModel: snapshot.selectedModel,
         thinkingEffort: snapshot.thinkingEffort,
+        piSettings: snapshot.piSettings,
         ptyCols: snapshot.ptyCols,
         ptyRows: snapshot.ptyRows,
     };