@saadnvd1/agent-os 0.3.489 → 0.3.494

package/lib/orchestrator/shell-parse.ts

@@ -0,0 +1,289 @@
+import os from "os";
+
+/**
+ * A shell command line read into the simple commands it runs, for the
+ * orchestrator's deny list (shell-guard.ts). It reads what a zsh or bash
+ * would: quotes, escapes, `;` `&&` `||` `|` `&` and newlines between
+ * commands, subshells and groups, `$( )`, backticks and `<( )` (whose
+ * commands are read too), redirects and heredocs. It is a reader for honest
+ * mistakes, not a sandbox: a script or an interpreter's inline code runs
+ * what it likes, and nothing here sees that.
+ */
+
+export interface SimpleCommand {
+  words: string[];
+  // Files it writes through >, >>, &> and the like.
+  writes: string[];
+  // Files it reads through <.
+  reads: string[];
+  // What a heredoc or here-string feeds it.
+  stdin: string;
+}
+
+// Stands in for text only the running shell knows: a substitution's
+// output or a variable other than HOME.
+export const UNKNOWN = "\u0000";
+
+const MAX_DEPTH = 8;
+
+const blank = (): SimpleCommand => ({
+  words: [],
+  writes: [],
+  reads: [],
+  stdin: "",
+});
+
+// The index of the `)` closing the `(` at `open`, skipping quoted text.
+function closingParen(src: string, open: number): number {
+  let depth = 0;
+  for (let i = open; i < src.length; i++) {
+    const c = src[i];
+    if (c === "\\") i++;
+    else if (c === "'") {
+      const end = src.indexOf("'", i + 1);
+      if (end < 0) return -1;
+      i = end;
+    } else if (c === '"') {
+      for (i++; i < src.length && src[i] !== '"'; i++) if (src[i] === "\\") i++;
+    } else if (c === "(") depth++;
+    else if (c === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+function closingBacktick(src: string, open: number): number {
+  for (let i = open + 1; i < src.length; i++) {
+    if (src[i] === "\\") i++;
+    else if (src[i] === "`") return i;
+  }
+  return -1;
+}
+
+const ANSI: Record<string, string> = { n: "\n", t: "\t", r: "\r", e: "\x1b" };
+
+// `$NAME` or `${NAME}` at `at` (just past the $): HOME expands, anything
+// else is unknown. Returns the text and the last index read.
+function variable(src: string, at: number): [string, number] {
+  if (src[at] === "{") {
+    const end = src.indexOf("}", at);
+    if (end < 0) return [UNKNOWN, src.length - 1];
+    return [src.slice(at + 1, end) === "HOME" ? os.homedir() : UNKNOWN, end];
+  }
+  const m = /^([A-Za-z_][A-Za-z0-9_]*|[0-9?#@*$!-])/.exec(src.slice(at));
+  if (!m) return ["$", at - 1];
+  return [m[1] === "HOME" ? os.homedir() : UNKNOWN, at + m[1].length - 1];
+}
+
+// The simple commands in a command line, or why it can't be read.
+export function parseShell(src: string, depth = 0): SimpleCommand[] | string {
+  if (depth > MAX_DEPTH) return "commands nested too deeply to check";
+  const out: SimpleCommand[] = [];
+  let cmd = blank();
+  let word: string | null = null;
+  let pending: "write" | "read" | "here" | "heredoc" | null = null;
+  const heredocs: { delim: string; tabs: boolean; cmd: SimpleCommand }[] = [];
+  let tabs = false;
+
+  const endWord = () => {
+    if (word === null) return;
+    if (pending === "write") cmd.writes.push(word);
+    else if (pending === "read") cmd.reads.push(word);
+    else if (pending === "here") cmd.stdin += `${word}\n`;
+    else if (pending === "heredoc") heredocs.push({ delim: word, tabs, cmd });
+    else cmd.words.push(word);
+    pending = null;
+    word = null;
+  };
+  const endCmd = () => {
+    endWord();
+    if (cmd.words.length || cmd.writes.length || cmd.reads.length)
+      out.push(cmd);
+    cmd = blank();
+  };
+  const nest = (inner: string): string | null => {
+    const r = parseShell(inner, depth + 1);
+    if (typeof r === "string") return r;
+    out.push(...r);
+    return null;
+  };
+
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === " " || c === "\t") {
+      endWord();
+      continue;
+    }
+    if (c === "\n" || c === "\r") {
+      endCmd();
+      // Heredoc bodies start on the next line.
+      for (const h of heredocs.splice(0)) {
+        while (i + 1 < src.length) {
+          const end = src.indexOf("\n", i + 1);
+          const line = src.slice(i + 1, end < 0 ? src.length : end);
+          i = end < 0 ? src.length : end;
+          const text = h.tabs ? line.replace(/^\t+/, "") : line;
+          if (text === h.delim) break;
+          h.cmd.stdin += `${text}\n`;
+        }
+      }
+      continue;
+    }
+    if (c === "#" && word === null) {
+      const end = src.indexOf("\n", i);
+      i = (end < 0 ? src.length : end) - 1;
+      continue;
+    }
+    if (c === "\\") {
+      if (src[i + 1] !== "\n") word = (word ?? "") + (src[i + 1] ?? "");
+      i++;
+      continue;
+    }
+    if (c === "'") {
+      const end = src.indexOf("'", i + 1);
+      if (end < 0) return "an unclosed ' quote";
+      word = (word ?? "") + src.slice(i + 1, end);
+      i = end;
+      continue;
+    }
+    if (c === '"') {
+      let text = "";
+      let j = i + 1;
+      for (; j < src.length && src[j] !== '"'; j++) {
+        const d = src[j];
+        if (d === "\\" && j + 1 < src.length) {
+          const n = src[++j];
+          if (n !== "\n") text += /["\\$`]/.test(n) ? n : `\\${n}`;
+        } else if (d === "$" && src[j + 1] === "(") {
+          const end = closingParen(src, j + 1);
+          if (end < 0) return "an unclosed $(";
+          const err = nest(src.slice(j + 2, end));
+          if (err) return err;
+          text += UNKNOWN;
+          j = end;
+        } else if (d === "`") {
+          const end = closingBacktick(src, j);
+          if (end < 0) return "an unclosed backtick";
+          const err = nest(src.slice(j + 1, end));
+          if (err) return err;
+          text += UNKNOWN;
+          j = end;
+        } else if (d === "$") {
+          const [v, end] = variable(src, j + 1);
+          text += v;
+          j = end;
+        } else text += d;
+      }
+      if (j >= src.length) return 'an unclosed " quote';
+      word = (word ?? "") + text;
+      i = j;
+      continue;
+    }
+    if (c === "$" && src[i + 1] === "(") {
+      const end = closingParen(src, i + 1);
+      if (end < 0) return "an unclosed $(";
+      // $(( )) is arithmetic, not a command.
+      if (src[i + 2] !== "(") {
+        const err = nest(src.slice(i + 2, end));
+        if (err) return err;
+      }
+      word = (word ?? "") + UNKNOWN;
+      i = end;
+      continue;
+    }
+    if (c === "$" && src[i + 1] === "'") {
+      let text = "";
+      let j = i + 2;
+      for (; j < src.length && src[j] !== "'"; j++) {
+        if (src[j] === "\\" && j + 1 < src.length) {
+          const n = src[++j];
+          text += ANSI[n] ?? n;
+        } else text += src[j];
+      }
+      if (j >= src.length) return "an unclosed $' quote";
+      word = (word ?? "") + text;
+      i = j;
+      continue;
+    }
+    if (c === "$") {
+      const [v, end] = variable(src, i + 1);
+      word = (word ?? "") + v;
+      i = end;
+      continue;
+    }
+    if (c === "`") {
+      const end = closingBacktick(src, i);
+      if (end < 0) return "an unclosed backtick";
+      const err = nest(src.slice(i + 1, end));
+      if (err) return err;
+      word = (word ?? "") + UNKNOWN;
+      i = end;
+      continue;
+    }
+    if ((c === "<" || c === ">") && src[i + 1] === "(") {
+      const end = closingParen(src, i + 1);
+      if (end < 0) return "an unclosed process substitution";
+      const err = nest(src.slice(i + 2, end));
+      if (err) return err;
+      word = (word ?? "") + UNKNOWN;
+      i = end;
+      continue;
+    }
+    if (c === ">" || c === "<" || (c === "&" && src[i + 1] === ">")) {
+      // A file descriptor's number (2>) belongs to the redirect.
+      if (word !== null && /^\d+$/.test(word)) word = null;
+      else endWord();
+      if (c === "&") {
+        i++;
+        if (src[i + 1] === ">") i++;
+        pending = "write";
+      } else if (c === ">") {
+        if (src[i + 1] === ">" || src[i + 1] === "|") i++;
+        if (src[i + 1] === "&") {
+          i++;
+          // >&2 and >&- duplicate a descriptor; >&file writes the file.
+          if (/[\d-]/.test(src[i + 1] ?? "")) {
+            i++;
+            continue;
+          }
+        }
+        pending = "write";
+      } else if (src[i + 1] === "<") {
+        i++;
+        if (src[i + 1] === "<") {
+          i++;
+          pending = "here";
+        } else {
+          tabs = src[i + 1] === "-";
+          if (tabs) i++;
+          pending = "heredoc";
+        }
+      } else if (src[i + 1] === "&") {
+        i += 2;
+      } else if (src[i + 1] === ">") {
+        i++;
+        pending = "write";
+      } else pending = "read";
+      continue;
+    }
+    if (/[;&|()]/.test(c)) {
+      endCmd();
+      continue;
+    }
+    if (
+      (c === "{" || c === "}") &&
+      word === null &&
+      /^[\s;]?$/.test(src[i + 1] ?? "")
+    ) {
+      endCmd();
+      continue;
+    }
+    // ~ and ~/ at a word's start are the home folder.
+    if (c === "~" && word === null && /^[/\s]?$/.test(src[i + 1] ?? "")) {
+      word = os.homedir();
+      continue;
+    }
+    word = (word ?? "") + c;
+  }
+  endCmd();
+  return out;
+}

package/lib/orchestrator/tool-names.ts

@@ -38,17 +38,17 @@ export const TOOL_NAMES = {
   ask_saad: name("ask_saad"),
 } as const;
 
-// What it may do, fixed by its role: it reads other sessions' text, so it
-// never gets a general shell. Anything not listed is refused without asking.
-// It acts through its own tools, which are scoped to its workspace and
-// braked; the shell keeps only `aos` commands that read, and notify, which
-// reaches only Saad, so `aos send`, `task`, `spawn` and `stack` can't go
-// around them. It writes files, but never in a project repository, a task
-// worktree, AgentOS's own state or a secret file, except inside its own
-// quick changes' worktrees (quick.ts), where it may also run git that
-// looks, stages or undoes, never commits with hooks or pushes: its worker
-// checks each write and each shell command first (write-guard.ts,
-// git-guard.ts).
+// What it may do, fixed by its role. It acts through its own tools, which
+// are scoped to its workspace and braked. Its shell runs anything, without
+// asking: Saad chose that on 2026-10-11, knowing an orchestrator reads other
+// sessions' text and a misled one could get around the gates with
+// `python -c` or a script, which no parser sees. Its worker still refuses a
+// deny list of shell commands before they run (shell-guard.ts): merging,
+// closing or retargeting a PR, pushing, writing in a project repository or
+// task worktree other than its own quick changes, writing AgentOS's state,
+// stopping AgentOS or its tmux, and reading secrets. That catches honest
+// mistakes, not a determined bypass. Its file writes are checked the same
+// way, against a longer list (write-guard.ts).
 export const ORCHESTRATOR_PERMISSIONS: {
   permissionMode: PermissionMode;
   allowedTools: string[];
@@ -66,17 +66,8 @@ export const ORCHESTRATOR_PERMISSIONS: {
     "NotebookEdit",
     "ToolSearch",
     "TodoWrite",
-    "Bash(aos peers:*)",
-    "Bash(aos inbox:*)",
-    "Bash(aos history:*)",
-    "Bash(aos stacks:*)",
-    "Bash(aos schedules:*)",
-    // Reaches only Saad's phone, at most once a minute.
-    "Bash(aos notify:*)",
-    "Bash(aos docs:*)",
-    "Bash(aos doc:*)",
-    // Only `git -C <its own quick worktree>`, refused anywhere else.
-    "Bash(git:*)",
+    // Anything; its worker refuses the deny list (shell-guard.ts).
+    "Bash",
   ],
   disallowedTools: [],
 };

package/lib/orchestrator/write-guard.ts

@@ -12,6 +12,7 @@
  * `..` resolved the way the system will resolve it.
  */
 
+import { execFile } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -21,8 +22,8 @@ import { isSecretPath } from "../secret-paths";
 import { WORKTREES_DIR } from "../worktrees";
 import { orchestratorDir } from "./home";
 import { LIMITS_FILE } from "./usage";
-import { GIT_LAYOUT_FILE, readCommand } from "./git-guard";
 import { quickWorktrees } from "./quick-store";
+import { shellRefusal } from "./shell-guard";
 
 // The tools that write a file, and the argument naming it.
 export const WRITE_TOOLS: Record<string, string> = {
@@ -60,6 +61,11 @@ const RUNS_CODE =
 // judges.
 const AGENTOS_TEMP = /(^|\/)aos-(review|rebase|body)-[^/]+(\/|$)/;
 
+// A git repository's layout. Git config can run programs (core.fsmonitor,
+// diff.external, filter and textconv drivers), so even in its own quick
+// worktrees an orchestrator never writes these.
+const GIT_LAYOUT_FILE = /(^|\/)(HEAD|\.gitattributes)$|(^|\/)\.git(\/|$)/i;
+
 const MAX_LINKS = 40;
 
 // The path as the system resolves it: component by component from the root,
@@ -120,10 +126,14 @@ const within = (p: string, root: string) => {
 
 const expandHome = (p: string) => p.replace(/^~(?=$|\/)/, os.homedir());
 
-// Why a write to this path is refused, or null when it may go ahead.
+// Why a write to this path is refused, or null when it may go ahead. For a
+// shell command (`shell`), only the deny list's places count: a project
+// repository or task worktree that isn't its own quick change, a review's
+// checkout, and AgentOS's state outside its folder.
 export async function writeRefusal(
   filePath: string,
-  bounds: WriteBounds
+  bounds: WriteBounds,
+  { shell = false }: { shell?: boolean } = {}
 ): Promise<string | null> {
   if (!filePath) return "No file path to check.";
   const given = expandHome(filePath);
@@ -171,7 +181,7 @@ export async function writeRefusal(
     const repo = repos.find((r) => within(target, r) && !holdsQuick(r));
     if (repo)
       return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), or for a small edit, in a quick change's worktree (quick_change), so its PR goes through the merge gates.`;
-    if (ownQuick && GIT_LAYOUT_FILE.test(target))
+    if (ownQuick && !shell && GIT_LAYOUT_FILE.test(target))
       return `${filePath} is part of a git repository's layout (HEAD, .git/, .gitattributes); git config can run programs, so orchestrators never write those.`;
     if (AGENTOS_TEMP.test(target))
       return `${filePath} is in a checkout AgentOS is reviewing or rebasing; orchestrators never write there.`;
@@ -180,6 +190,7 @@ export async function writeRefusal(
     const own = ownDir.some((d) => within(target, d)) || !!ownQuick;
     if (state.some((d) => within(target, d)) && !own)
       return `${filePath} is in AgentOS's own state (${bounds.state}); you may write only in your folder, ${bounds.ownDir}.`;
+    if (shell) continue;
     if (isSecretPath(target) || isSecretPath(filePath))
       return `${filePath} holds or guards secrets; orchestrators never write those.`;
     const runsIn = runs.find((r) => within(target, r));
@@ -201,6 +212,9 @@ export async function writeRefusal(
   return null;
 }
 
+const agentOsDbPath = () =>
+  path.resolve(process.env.DB_PATH || path.join(process.cwd(), "agent-os.db"));
+
 // What an orchestrator's writes are held to, read fresh for each one so a
 // project added since counts: every local project's repositories (not just
 // its workspace's, since a write to another workspace's repo skips its gates
@@ -219,9 +233,7 @@ export async function orchestratorWriteBounds(
         WHERE worktree_path IS NOT NULL AND worktree_path != ''`
     )
     .all() as { dir: string }[];
-  const dbPath = path.resolve(
-    process.env.DB_PATH || path.join(process.cwd(), "agent-os.db")
-  );
+  const dbPath = agentOsDbPath();
   const repos = projects.map((p) => expandHome(p.dir)).filter((d) => d !== "");
   return {
     cwd: expandHome(session.working_directory),
@@ -313,60 +325,45 @@ export async function orchestratorToolRefusal(
   return writeRefusal(filePath, await orchestratorWriteBounds(session));
 }
 
-// A shell command: one plain command, and git only in its own quick
-// worktrees (git-guard.ts), the folder it names resolved like a write's.
+// A shell command, against the deny list (shell-guard.ts), its writes held
+// to the shell's share of the write bounds.
 async function commandRefusal(
   session: Session,
   command: unknown
 ): Promise<string | null> {
-  const read = readCommand(command);
-  if (read.refusal !== null || read.dir === null) return read.refusal;
-  const quick = quickWorktrees(session.id);
-  const dir = read.dir;
-  if (!dir.startsWith("/") || !quick.length)
-    return `Refused: git runs only in one of your quick changes' worktrees, named by its full path (${quick.length ? quick.join(", ") : "you have none open; start one with quick_change"}).`;
-  return (await isQuickRoot(dir, quick))
-    ? null
-    : `Refused: ${read.dir} isn't the root of one of your quick changes' worktrees (${quick.join(", ")}). Git runs at the root only, never in a subfolder, a project checkout or another session's worktree.`;
+  const bounds = await orchestratorWriteBounds(session);
+  const dbFile = agentOsDbPath();
+  return shellRefusal(command, {
+    cwd: bounds.cwd,
+    writeRefusal: (p) => writeRefusal(p, bounds, { shell: true }),
+    isAgentOsState: async (p) => {
+      const real = await physicalPath(p);
+      const dbReal = await physicalPath(dbFile);
+      if ([p, real].some((f) => f === dbFile || f === dbReal)) return true;
+      const own = await physicalPath(bounds.ownDir);
+      const state = await physicalPath(bounds.state);
+      return within(real, state) && !within(real, own);
+    },
+    protectedPids,
+  });
 }
 
-// Whether a folder is inside one of these worktrees by every way the
-// system could read it: as named, with `..` taken by name, and with links
-// followed.
-export async function insideQuick(
-  dir: string,
-  quick: string[]
-): Promise<boolean> {
-  try {
-    const forms = [
-      path.resolve(dir),
-      await physicalPath(dir),
-      await physicalPath(path.resolve(dir)),
-    ];
-    const roots = (
-      await Promise.all(
-        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
-      )
-    ).flat();
-    return forms.every((f) => roots.some((r) => within(f, r)));
-  } catch {
-    return false;
-  }
-}
-
-// Whether a folder is exactly the root of one of these worktrees (as named,
-// and with links followed), where git finds the real git dir.
-async function isQuickRoot(dir: string, quick: string[]): Promise<boolean> {
-  if (!(await insideQuick(dir, quick))) return false;
-  try {
-    const forms = [path.resolve(dir), await physicalPath(dir)];
-    const roots = (
-      await Promise.all(
-        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
-      )
-    ).flat();
-    return forms.every((f) => roots.includes(f));
-  } catch {
-    return false;
-  }
+// AgentOS's server (whatever listens on its port), the tmux servers its
+// sessions run in, and this worker. A lookup that fails refuses the kill.
+async function protectedPids(): Promise<Set<number>> {
+  const port = process.env.AGENTOS_PORT || process.env.PORT || "3011";
+  const pids = (cmd: string, args: string[]) =>
+    new Promise<number[]>((resolve, reject) =>
+      execFile(cmd, args, { timeout: 5000 }, (e, out) => {
+        // Exit 1 is "nothing matched".
+        if (e && (e as { code?: unknown }).code !== 1)
+          return reject(new Error(`couldn't list processes with ${cmd}`));
+        resolve(out.split(/\s+/).filter(Boolean).map(Number));
+      })
+    );
+  const [server, tmux] = await Promise.all([
+    pids("lsof", ["-ti", `tcp:${port}`, "-sTCP:LISTEN"]),
+    pids("pgrep", ["-x", "tmux"]),
+  ]);
+  return new Set([...server, ...tmux, process.pid, process.ppid]);
 }

package/lib/sidebar/queued.ts

@@ -19,6 +19,8 @@ export function queuedRows(input: {
   workspaceId: string | null;
   projectId?: string | null;
   query?: string;
+  // Only what this orchestrator session queued.
+  startedBy?: string | null;
 }): QueuedRow[] {
   const q = (input.query ?? "").trim().toLowerCase();
   // Each line's waiting tasks, in order, for what a move can swap with.
@@ -34,6 +36,7 @@ export function queuedRows(input: {
         !input.sessionIds.has(item.id) &&
         (!input.workspaceId || item.workspaceId === input.workspaceId) &&
         (!input.projectId || item.projectId === input.projectId) &&
+        (!input.startedBy || item.startedBy === input.startedBy) &&
         (!q ||
           item.name.toLowerCase().includes(q) ||
           (item.projectName ?? "").toLowerCase().includes(q))

package/lib/sidebar/rollup.ts

@@ -0,0 +1,58 @@
+// What an orchestrator started, counted from the same rows the shelves show:
+// blocked is a row on Needs you, in review a task state, running a working
+// row, queued an item in the Queued shelf. Client-safe.
+import type { QueuedRow } from "./queued";
+import type { Shelves, SidebarRow } from "./shelves";
+
+export interface Rollup {
+  running: number;
+  inReview: number;
+  blocked: number;
+  queued: number;
+}
+
+const flatten = (rows: SidebarRow[]): SidebarRow[] =>
+  rows.flatMap((r) => [r, ...flatten(r.workers), ...flatten(r.quick ?? [])]);
+
+export function rollups(
+  shelves: Shelves,
+  queued: readonly Pick<QueuedRow, "item">[]
+): Map<string, Rollup> {
+  const out = new Map<string, Rollup>();
+  const of = (id: string) => {
+    let r = out.get(id);
+    if (!r)
+      out.set(id, (r = { running: 0, inReview: 0, blocked: 0, queued: 0 }));
+    return r;
+  };
+  const rows = flatten([
+    ...shelves.orchestrators,
+    ...shelves.pinned,
+    ...shelves.needsYou,
+    ...shelves.working,
+    ...shelves.done,
+  ]);
+  for (const row of rows) {
+    const by = row.session.started_by;
+    if (!by) continue;
+    const r = of(by);
+    if (row.need) r.blocked++;
+    else if (row.task === "review") r.inReview++;
+    else if (row.working) r.running++;
+  }
+  for (const { item } of queued)
+    if (item.startedBy && item.status !== "failed") of(item.startedBy).queued++;
+  return out;
+}
+
+export const rollupChips = [
+  { key: "running", label: "running", dot: "bg-green-500" },
+  { key: "inReview", label: "in review", dot: "bg-primary" },
+  { key: "blocked", label: "blocked", dot: "bg-amber-500" },
+  { key: "queued", label: "queued", dot: "bg-muted-foreground/35" },
+] as const;
+
+// The chips to draw: zero counts are left out.
+export function visibleChips(r: Rollup | undefined) {
+  return r ? rollupChips.filter((c) => r[c.key] > 0) : [];
+}

package/lib/sidebar/shelves.ts

@@ -1,6 +1,7 @@
 // The sidebar's one flat list, sorted onto shelves: the workspace's pinned
 // orchestrator, Pinned, Needs you, Working, then Done. Client-safe: no database.
 import type { Session } from "@/lib/db/types";
+import { fromSqliteTime } from "@/lib/session-meta";
 import type { TaskState } from "@/lib/tasks/state";
 
 // Why a session is blocked on you.
@@ -102,6 +103,8 @@ export interface ShelfInput {
   // Each workspace's current orchestrator (its overview's sessionId). Any
   // other orchestrator session is an ordinary row, pinned or not.
   currentOrchestrators?: ReadonlySet<string>;
+  // Only the sessions this orchestrator session started.
+  startedBy?: string | null;
 }
 
 const newestFirst = (a: SidebarRow, b: SidebarRow) =>
@@ -129,6 +132,7 @@ export function buildShelves(input: ShelfInput): Shelves {
       (s) =>
         !s.archived_at &&
         (!input.projectId || s.project_id === input.projectId) &&
+        (!input.startedBy || s.started_by === input.startedBy) &&
         matchesQuery(s, input.projectName(s), input.query ?? "")
     )
     .map((s) => toRow(input, s));
@@ -181,6 +185,26 @@ export function buildShelves(input: ShelfInput): Shelves {
 export const doneLimit = (pages: number) =>
   DONE_FIRST_PAGE + Math.max(0, pages) * DONE_PAGE;
 
+// What a folded Done shelf says: how many finished today (local time), and
+// how many before.
+export function doneSummary(
+  done: readonly SidebarRow[],
+  now: Date = new Date()
+): { today: number; earlier: number; text: string } {
+  const day = now.toDateString();
+  const today = done.filter(
+    (r) => fromSqliteTime(r.session.updated_at).toDateString() === day
+  ).length;
+  const earlier = done.length - today;
+  const text = [
+    today > 0 && `${today} done today`,
+    earlier > 0 && `${earlier} earlier`,
+  ]
+    .filter(Boolean)
+    .join(" · ");
+  return { today, earlier, text };
+}
+
 // A workspace holds its projects' sessions and its own orchestrator; no
 // workspace selected means every session.
 export function inWorkspace(

package/lib/tasks/queue.ts

@@ -87,6 +87,8 @@ export interface QueuedTaskView {
   afterId: string | null;
   note: string | null;
   error: string | null;
+  // The orchestrator session that queued it, when one did.
+  startedBy: string | null;
   createdAt: string;
 }
 
@@ -380,6 +382,7 @@ export function listQueue(): QueuedTaskView[] {
       afterId: r.after_task,
       note: r.note,
       error: r.error,
+      startedBy: r.started_by,
       createdAt: r.created_at,
     };
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.489",
+  "version": "0.3.494",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"