@yeaft/webchat-agent 1.0.445 → 1.0.447

package/Dockerfile

@@ -4,7 +4,8 @@ ARG BUILD_VERSION=dev
 ENV NODE_ENV=production \
     HOME=/home/yeaft \
     YEAFT_DIR=/home/yeaft/.yeaft \
-    WORK_DIR=/workspace
+    WORK_DIR=/workspace \
+    YEAFT_AGENT_RUNTIME=container_agent
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ca-certificates git openssh-client tini \
@@ -16,7 +17,9 @@ RUN apt-get update \
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY agent/package.json ./agent/
-RUN npm ci --workspace=agent --omit=dev
+RUN npm_config_cache=/tmp/yeaft-npm-cache npm ci --workspace=agent --omit=dev \
+  && rm -rf /tmp/yeaft-npm-cache \
+  && install -d -m 0700 -o yeaft -g yeaft /home/yeaft/.npm
 COPY --chown=yeaft:yeaft agent ./agent
 RUN node -e "const fs=require('fs'); const p='agent/package.json'; const j=JSON.parse(fs.readFileSync(p)); j.version=process.argv[1].replace(/^v/, ''); fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\\n')" "$BUILD_VERSION" \
   && chmod 0755 agent/container-entrypoint.sh

package/cli.js

@@ -38,9 +38,12 @@ import {
   warnDeprecatedInstanceArg,
 } from './service/config.js';
 import {
+  buildContainerImageUpgradeMessage,
   buildUpgradeInstallCommand,
   buildUpgradeMetadataUrl,
   buildUpgradeVersionCommand,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -545,6 +548,7 @@ function parseAndStart(args) {
 }
 
 async function checkForUpdates() {
+  if (isContainerAgentRuntime()) return;
   try {
     const res = await fetch(buildUpgradeMetadataUrl(pkg.name));
     if (!res.ok) return;
@@ -562,6 +566,11 @@ async function checkForUpdates() {
 async function upgrade(args = []) {
   warnDeprecatedInstanceArg(args);
   const instanceId = resolveServiceInstanceId(args, process.env, { management: true });
+  if (isContainerAgentRuntime()) {
+    console.error(`${CONTAINER_IMAGE_UPGRADE_REASON}: ${buildContainerImageUpgradeMessage(pkg.version)}`);
+    process.exitCode = 1;
+    return;
+  }
   console.log(`Current version: ${pkg.version}`);
   console.log('Checking for updates...');
 

package/connection/upgrade.js

@@ -8,6 +8,10 @@ import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAU
 import {
   buildUpgradeInstallCommand,
   buildUpgradeMetadataArgs,
+  buildContainerImageUpgradeMessage,
+  CONTAINER_AGENT_CAPABILITY,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -175,6 +179,20 @@ function compareCmp(cur, cmp) {
 }
 
 export async function handleUpgradeAgent() {
+  if (isContainerAgentRuntime() || ctx.agentCapabilities?.includes(CONTAINER_AGENT_CAPABILITY)) {
+    const version = ctx.agentVersion || null;
+    const error = buildContainerImageUpgradeMessage(version);
+    console.warn(`[Agent] Upgrade rejected (${CONTAINER_IMAGE_UPGRADE_REASON}): ${error}`);
+    await sendToServer({
+      type: 'upgrade_agent_ack',
+      success: false,
+      reason: CONTAINER_IMAGE_UPGRADE_REASON,
+      error,
+      version,
+    });
+    return;
+  }
+
   console.log('[Agent] Upgrade requested, checking for updates...');
   try {
     const pkgName = ctx.pkgName || '@yeaft/webchat-agent';

package/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/index.js

@@ -20,7 +20,9 @@ import {
 import { loadNodePty } from './terminal.js';
 import { connect } from './connection.js';
 import { loadMcpServers } from './mcp.js';
-import { SAFE_REMOTE_UPGRADE_CAPABILITY } from './upgrade-command.js';
+import {
+  getAgentUpgradeCapability,
+} from './upgrade-command.js';
 import { loadConfig as loadYeaftConfig } from './yeaft/config.js';
 import { initYeaftDir } from './yeaft/init.js';
 import { updateBrowserRuntimeSettings } from './yeaft/config-api.js';
@@ -173,7 +175,8 @@ async function detectCapabilities() {
   // agent build can speak plaintext WS frames. New servers see this and
   // flip `agent.encryptOutbound = false`, stopping outbound encryption
   // to this peer. Old servers ignore the unknown capability token.
-  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', SAFE_REMOTE_UPGRADE_CAPABILITY, 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins', 'yeaft_managed_skills'];
+  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins', 'yeaft_managed_skills'];
+  capabilities.push(getAgentUpgradeCapability());
   if (process.platform === 'linux') capabilities.push('work_item_attachments');
   const pty = await loadNodePty();
   if (pty) capabilities.push('terminal');

package/local-runtime/agent/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/local-runtime/server/context.js

@@ -122,14 +122,6 @@ export function clearYeaftDebugRequestsForClient(clientId) {
 // only; heartbeat/control frames are deliberately excluded.
 export const userStatsDeltas = new Map();
 
-const HEARTBEAT_MESSAGE_TYPES = new Set([
-  'ping',
-  'pong',
-  'ping_session',
-  'pong_session',
-  'client_hello'
-]);
-
 const OUTBOUND_MESSAGE_TRAFFIC_TYPES = new Set([
   'claude_output',
   'yeaft_output',
@@ -158,24 +150,10 @@ function getOrCreateDelta(userId) {
   return delta;
 }
 
-export function isHeartbeatMessageType(type) {
-  return HEARTBEAT_MESSAGE_TYPES.has(type);
-}
-
 export function isOutboundMessageTraffic(type) {
   return OUTBOUND_MESSAGE_TRAFFIC_TYPES.has(type);
 }
 
-/**
- * Record a non-heartbeat WS request received from a user. This is kept for
- * operator diagnostics; dashboard traffic comes from user-turn/message bytes.
- */
-export function trackRequest(userId, bytesReceived, messageType = '') {
-  if (!userId || isHeartbeatMessageType(messageType)) return;
-  const delta = getOrCreateDelta(userId);
-  delta.requests++;
-}
-
 /**
  * Record outbound message bytes sent to a user via WS.
  */
@@ -198,7 +176,10 @@ export function trackBytesSent(userId, bytesSent, messageType = '') {
 export function trackUserTurn(userId, bytesReceived = 0) {
   if (!userId) return;
   const delta = getOrCreateDelta(userId);
+  // Both counters are recorded at the validated user-turn boundary. The old
+  // WS ingress counter saw history/control frames and is intentionally gone.
   delta.messages++;
+  delta.requests++;
   delta.bytesReceived += Math.max(0, Number(bytesReceived) || 0);
 }
 

package/local-runtime/server/database.js

@@ -8,6 +8,7 @@ export { yeaftProjectDb, YeaftProjectDbError } from './db/yeaft-project-db.js';
 export { sessionUiMetadataDb } from './db/session-ui-metadata-db.js';
 export { messageDb } from './db/message-db.js';
 export { userStatsDb } from './db/user-stats-db.js';
+export { agentInventoryDb } from './db/agent-inventory-db.js';
 export { expertDb } from './db/expert-db.js';
 export { identityDb } from './db/identity-db.js';
 export { closeDb } from './db/connection.js';

package/local-runtime/server/db/agent-inventory-db.js

@@ -0,0 +1,122 @@
+import { stmts } from './connection.js';
+
+function jsonArray(value) {
+  return JSON.stringify(Array.isArray(value) ? value : []);
+}
+
+function jsonObject(value) {
+  return JSON.stringify(value && typeof value === 'object' && !Array.isArray(value) ? value : {});
+}
+
+function parseJson(value, fallback) {
+  if (typeof value !== 'string' || !value) return fallback;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+function parseCapabilities(value) {
+  const parsed = parseJson(value, []);
+  return Array.isArray(parsed) ? parsed : [];
+}
+
+function parseMetrics(value) {
+  const parsed = parseJson(value, {});
+  return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+}
+
+function mapRow(row) {
+  if (!row) return null;
+  return {
+    id: row.id,
+    instanceId: row.instance_id || null,
+    ownerId: row.owner_id || null,
+    name: row.name,
+    workDir: row.work_dir || '',
+    version: row.version || null,
+    platform: row.platform || null,
+    capabilities: parseCapabilities(row.capabilities_json),
+    capabilityMetadataProvided: row.capability_metadata_provided === 1,
+    metrics: parseMetrics(row.metrics_json),
+    metricsUpdatedAt: row.metrics_updated_at || null,
+    lastSeenAt: row.last_seen_at || null,
+    lastConnectedAt: row.last_connected_at || null,
+    updatedAt: row.updated_at || null,
+  };
+}
+
+function validTimestamp(value, fallback = Date.now()) {
+  const timestamp = Number(value);
+  return Number.isFinite(timestamp) && timestamp > 0 ? timestamp : fallback;
+}
+
+/**
+ * Durable, admin-only last-known Agent inventory.
+ *
+ * The inventory never decides whether an Agent is online. That remains a
+ * property of the current owner-scoped WebSocket in `context.agents`; these
+ * rows only preserve identity and last-seen metadata across disconnects and
+ * Server restarts.
+ */
+export const agentInventoryDb = {
+  /**
+   * Insert or replace the durable metadata for one Agent connection.
+   * @param {{id:string, instanceId?:string|null, ownerId?:string|null, name:string,
+   *   workDir?:string, version?:string|null, platform?:string|null,
+   *   capabilities?:string[], capabilityMetadataProvided?:boolean,
+   *   metrics?:object, metricsUpdatedAt?:number|null, lastSeenAt?:number,
+   *   lastConnectedAt?:number, updatedAt?:number}} agent
+   */
+  upsert(agent) {
+    if (!agent?.id || !agent?.name) return false;
+    const now = validTimestamp(agent.updatedAt);
+    const lastSeenAt = validTimestamp(agent.lastSeenAt, now);
+    const lastConnectedAt = validTimestamp(agent.lastConnectedAt, now);
+    stmts.upsertAgentInventory.run(
+      agent.id,
+      agent.instanceId || null,
+      agent.ownerId || null,
+      agent.name,
+      agent.workDir || '',
+      agent.version || null,
+      agent.platform || null,
+      jsonArray(agent.capabilities),
+      agent.capabilityMetadataProvided ? 1 : 0,
+      agent.metrics == null ? null : jsonObject(agent.metrics),
+      agent.metricsUpdatedAt ? validTimestamp(agent.metricsUpdatedAt, now) : null,
+      lastSeenAt,
+      lastConnectedAt,
+      now,
+    );
+    return true;
+  },
+
+  /** Persist only a new last-seen timestamp for a live inventory row. */
+  touch(id, lastSeenAt = Date.now()) {
+    if (!id) return false;
+    const timestamp = validTimestamp(lastSeenAt);
+    const result = stmts.touchAgentInventory.run(timestamp, timestamp, id);
+    return result.changes > 0;
+  },
+
+  /** Persist a cumulative metrics snapshot without changing connection metadata. */
+  updateMetrics(id, metrics = {}, metricsUpdatedAt = Date.now()) {
+    if (!id) return false;
+    const timestamp = validTimestamp(metricsUpdatedAt);
+    const result = stmts.updateAgentInventoryMetrics.run(
+      jsonObject(metrics),
+      timestamp,
+      timestamp,
+      id,
+    );
+    return result.changes > 0;
+  },
+
+  /** Return all historical Agent records, newest last-seen first. */
+  getAll() {
+    return stmts.getAllAgentInventory.all().map(mapRow);
+  },
+};

package/local-runtime/server/db/connection.js

@@ -134,6 +134,27 @@ db.exec(`
     PRIMARY KEY (user_id, agent_instance_id, metric_epoch)
   );
 
+  -- Durable last-known Agent inventory for admin operations. online is not
+  -- stored here: it is derived from the current owner-scoped WebSocket map.
+  -- Keeping the inventory separate from sessions preserves historical Agents
+  -- after their socket disconnects and across Server restarts.
+  CREATE TABLE IF NOT EXISTS agent_inventory (
+    id TEXT PRIMARY KEY,
+    instance_id TEXT,
+    owner_id TEXT REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    work_dir TEXT,
+    version TEXT,
+    platform TEXT,
+    capabilities_json TEXT NOT NULL DEFAULT '[]',
+    capability_metadata_provided INTEGER NOT NULL DEFAULT 0,
+    metrics_json TEXT NOT NULL DEFAULT '{}',
+    metrics_updated_at INTEGER,
+    last_seen_at INTEGER NOT NULL,
+    last_connected_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
   -- 基本索引（不依赖迁移列）
   CREATE INDEX IF NOT EXISTS idx_sessions_agent ON sessions(agent_id);
   CREATE INDEX IF NOT EXISTS idx_sessions_updated ON sessions(updated_at DESC);
@@ -152,6 +173,7 @@ db.exec(`
   -- concurrent reads continue during the build; writers will block briefly.
   CREATE INDEX IF NOT EXISTS idx_messages_session_role_id ON messages(session_id, role, id DESC);
   CREATE INDEX IF NOT EXISTS idx_daily_stats_date ON daily_stats(date);
+  CREATE INDEX IF NOT EXISTS idx_agent_inventory_owner_seen ON agent_inventory(owner_id, last_seen_at DESC);
 
   -- Managed Sandbox control-plane state. Runtime resources are deliberately
   -- not created on this mixed-use Server Host; qualified Controllers report
@@ -1266,6 +1288,43 @@ export const stmts = {
       updated_at = excluded.updated_at
   `),
 
+  // Durable Admin Agent inventory. `online` is derived from context.agents.
+  upsertAgentInventory: db.prepare(`
+    INSERT INTO agent_inventory (
+      id, instance_id, owner_id, name, work_dir, version, platform,
+      capabilities_json, capability_metadata_provided, metrics_json,
+      metrics_updated_at, last_seen_at, last_connected_at, updated_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE(?, '{}'), ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      instance_id = excluded.instance_id,
+      owner_id = excluded.owner_id,
+      name = excluded.name,
+      work_dir = excluded.work_dir,
+      version = excluded.version,
+      platform = excluded.platform,
+      capabilities_json = excluded.capabilities_json,
+      capability_metadata_provided = excluded.capability_metadata_provided,
+      metrics_json = CASE WHEN excluded.metrics_updated_at IS NULL THEN agent_inventory.metrics_json ELSE excluded.metrics_json END,
+      metrics_updated_at = COALESCE(excluded.metrics_updated_at, agent_inventory.metrics_updated_at),
+      last_seen_at = excluded.last_seen_at,
+      last_connected_at = excluded.last_connected_at,
+      updated_at = excluded.updated_at
+  `),
+
+  touchAgentInventory: db.prepare(`
+    UPDATE agent_inventory SET last_seen_at = ?, updated_at = ? WHERE id = ?
+  `),
+
+  updateAgentInventoryMetrics: db.prepare(`
+    UPDATE agent_inventory
+    SET metrics_json = ?, metrics_updated_at = ?, updated_at = ?
+    WHERE id = ?
+  `),
+
+  getAllAgentInventory: db.prepare(`
+    SELECT * FROM agent_inventory ORDER BY last_seen_at DESC, name ASC, id ASC
+  `),
+
   // Identity 操作 (multi-provider SSO)
   insertIdentity: db.prepare(`
     INSERT INTO user_identities (id, user_id, provider, subject, email, display_name, created_at, last_login_at)

package/local-runtime/server/handlers/agent-sync.js

@@ -1,5 +1,5 @@
 import { CONFIG } from '../config.js';
-import { sessionDb, userStatsDb } from '../database.js';
+import { agentInventoryDb, sessionDb, userStatsDb } from '../database.js';
 import { agents, webClients } from '../context.js';
 import { sendToWebClient, broadcastAgentList } from '../ws-utils.js';
 import {
@@ -82,6 +82,11 @@ export async function handleAgentSync(agentId, agent, msg) {
         : null;
       if (!capabilities || capabilities.length === 0) break;
       agent.capabilities = capabilities;
+      try {
+        agentInventoryDb.upsert({ ...agent, id: agentId });
+      } catch (error) {
+        console.error(`[AgentInventory] Failed to persist capabilities for ${agentId}:`, error.message);
+      }
       // Transport encryption negotiation is connection-scoped and immutable.
       // A runtime capability refresh must never flip framing mid-connection.
       await broadcastAgentList();
@@ -91,6 +96,12 @@ export async function handleAgentSync(agentId, agent, msg) {
     case 'agent_metrics': {
       agent.metrics = normalizeAgentMetrics(msg.metrics || {});
       agent.metricsUpdatedAt = Date.now();
+      try {
+        const persisted = agentInventoryDb.updateMetrics(agentId, agent.metrics, agent.metricsUpdatedAt);
+        if (persisted === false) agentInventoryDb.upsert({ ...agent, id: agentId });
+      } catch (error) {
+        console.error(`[AgentInventory] Failed to persist metrics for ${agentId}:`, error.message);
+      }
       if (agent.ownerId && agent.metrics.metricEpoch) {
         try {
           userStatsDb.recordAgentTokenSnapshot(

package/local-runtime/server/handlers/client-conversation.js

@@ -1246,6 +1246,7 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
         await sendToWebClient(client, { type: 'btw_error', conversationId: btwConvId, error: 'Permission denied' });
         return;
       }
+      trackUserTurn(client.userId, Buffer.byteLength(JSON.stringify(msg)));
       await forwardToAgent(client.currentAgent, {
         type: 'btw_question',
         conversationId: btwConvId,

package/local-runtime/server/handlers/client-misc.js

@@ -13,6 +13,8 @@ import {
 // may receive remote upgrade commands. Version thresholds are insufficient:
 // builds without this capability may still inherit the installed package cwd.
 export const SAFE_REMOTE_UPGRADE_CAPABILITY = 'remote_upgrade_safe';
+export const CONTAINER_AGENT_CAPABILITY = 'container_agent';
+export const CONTAINER_IMAGE_UPGRADE_REASON = 'container_image_upgrade_required';
 export { YEAFT_PLUGINS_CAPABILITY, YEAFT_PLUGINS_UNSUPPORTED_ERROR };
 
 async function rejectUnsupportedYeaftPlugins(client, msg, agentId) {
@@ -59,6 +61,19 @@ export async function handleClientMisc(clientId, client, msg, checkAgentAccess)
       if (!upgradeAgentId) break;
       if (!await checkAgentAccess(upgradeAgentId)) break;
       const upgradeAgent = agents.get(upgradeAgentId);
+      if (Array.isArray(upgradeAgent?.capabilities)
+          && upgradeAgent.capabilities.includes(CONTAINER_AGENT_CAPABILITY)) {
+        await sendToWebClient(client, {
+          type: 'upgrade_agent_ack',
+          agentId: upgradeAgentId,
+          success: false,
+          reason: CONTAINER_IMAGE_UPGRADE_REASON,
+          version: upgradeAgent?.version || null,
+          requiredCapability: CONTAINER_AGENT_CAPABILITY,
+          error: 'Container Agent is managed as a Docker image. Pull the configured image and recreate the same container through the Server/Sandbox lifecycle while keeping its persistent volumes and host-side agent-secret file.',
+        });
+        break;
+      }
       if (requiresManualUpgradeBridge(upgradeAgent?.capabilities, upgradeAgent?.platform)) {
         await sendToWebClient(client, {
           type: 'upgrade_agent_ack',

package/local-runtime/server/routes/admin-routes.js

@@ -1,9 +1,19 @@
 import { WebSocket } from 'ws';
-import { userStatsDb } from '../database.js';
+import { agentInventoryDb, userDb, userStatsDb } from '../database.js';
 import { agents, webClients, userStatsDeltas } from '../context.js';
 
 const toNumber = (value) => Number(value) || 0;
 
+function onlineUserIds() {
+  const ids = new Set();
+  for (const [, client] of webClients) {
+    if (client.authenticated && client.userId && client.ws?.readyState === WebSocket.OPEN) {
+      ids.add(client.userId);
+    }
+  }
+  return ids;
+}
+
 function emptyAgentMetrics() {
   return {
     totalTurns: 0,
@@ -73,7 +83,9 @@ function mergePendingUserStats(stats) {
     }
     row.message_count = toNumber(row.message_count) + toNumber(delta.messages);
     row.session_count = toNumber(row.session_count) + toNumber(delta.sessions);
-    row.request_count = toNumber(row.request_count) + toNumber(delta.requests);
+    // request_count is a legacy field and may contain old control-frame
+    // traffic. The current dashboard request metric is the user-turn count.
+    row.request_count = toNumber(row.message_count);
     row.bytes_sent = toNumber(row.bytes_sent) + toNumber(delta.bytesSent);
     row.bytes_received = toNumber(row.bytes_received) + toNumber(delta.bytesReceived);
   }
@@ -94,12 +106,7 @@ export function registerAdminRoutes(app, { requireAuth, requireAdmin }) {
   app.get('/api/admin/dashboard', requireAuth, requireAdmin, (req, res) => {
     try {
       const totals = userStatsDb.getDashboardTotals();
-      const onlineUsers = new Set();
-      for (const [, client] of webClients) {
-        if (client.authenticated && client.userId) {
-          onlineUsers.add(client.userId);
-        }
-      }
+      const onlineUsers = onlineUserIds();
       let onlineAgents = 0;
       for (const [, agent] of agents) {
         if (agent.ws.readyState === WebSocket.OPEN) onlineAgents++;
@@ -130,15 +137,43 @@ export function registerAdminRoutes(app, { requireAuth, requireAdmin }) {
     try {
       const period = req.query.period || 'all';
       const validPeriods = ['today', 'week', 'month', 'all'];
+      const activeUserIds = onlineUserIds();
       const stats = mergePendingUserStats(userStatsDb.getByPeriod(validPeriods.includes(period) ? period : 'all'));
+      const statsByUserId = new Map(stats.map(row => [row.user_id, row]));
+      // Include users with no usage rows yet so the Active filter reflects all
+      // currently connected users, not only users who have sent a prompt.
+      for (const user of userDb.getAll()) {
+        if (!statsByUserId.has(user.id)) {
+          stats.push({
+            user_id: user.id,
+            username: user.username,
+            display_name: user.display_name,
+            role: user.role,
+            message_count: 0,
+            session_count: 0,
+            request_count: 0,
+            bytes_sent: 0,
+            bytes_received: 0,
+            input_tokens: 0,
+            output_tokens: 0,
+            cache_read_tokens: 0,
+            cache_write_tokens: 0,
+            total_tokens: 0,
+            last_login_at: user.last_login_at,
+            updated_at: user.created_at,
+          });
+        }
+      }
       res.json(stats.map(s => ({
         userId: s.user_id,
         username: s.username,
         displayName: s.display_name,
         role: s.role,
         messageCount: s.message_count,
-        sessionCount: s.session_count,
-        requestCount: s.request_count,
+        // request_count predates the user-turn boundary and includes old
+        // control/echo traffic. Use the canonical user-turn count for the UI.
+        requestCount: toNumber(s.message_count),
+        active: activeUserIds.has(s.user_id),
         bytesSent: s.bytes_sent,
         bytesReceived: s.bytes_received,
         inputTokens: s.input_tokens,
@@ -155,24 +190,52 @@ export function registerAdminRoutes(app, { requireAuth, requireAdmin }) {
     }
   });
 
-  // GET /api/admin/agents — full agent list (no owner filtering)
+  // GET /api/admin/agents — durable inventory with live connection overlay.
+  // The route is admin-only; `online` still comes exclusively from the current
+  // owner-scoped WebSocket in `agents`, never from persisted inventory state.
   app.get('/api/admin/agents', requireAuth, requireAdmin, (req, res) => {
     try {
-      const agentList = Array.from(agents.entries()).map(([id, agent]) => ({
+      const liveAgents = new Map(Array.from(agents.entries()).map(([id, agent]) => [id, {
         id,
+        instanceId: agent.instanceId || null,
         name: agent.name,
         workDir: agent.workDir,
-        online: agent.ws.readyState === WebSocket.OPEN,
+        online: agent.ws?.readyState === WebSocket.OPEN,
         status: agent.status || 'ready',
         latency: agent.latency || null,
         version: agent.version || null,
+        platform: agent.platform || null,
         ownerId: agent.ownerId || null,
         ownerUsername: agent.ownerUsername || null,
         capabilities: agent.capabilities || [],
+        capabilityMetadataProvided: agent.capabilityMetadataProvided === true,
         conversationCount: agent.conversations?.size || 0,
+        lastSeenAt: agent.lastSeenAt || null,
+        lastConnectedAt: agent.lastConnectedAt || null,
         metrics: safeAgentMetrics(agent.metrics || {}),
-        metricsUpdatedAt: agent.metricsUpdatedAt || null
-      }));
+        metricsUpdatedAt: agent.metricsUpdatedAt || null,
+      }]));
+      const ownerUsernames = new Map(userDb.getAll().map(user => [user.id, user.username]));
+      const inventory = agentInventoryDb.getAll();
+      const agentList = inventory.map(record => {
+        const live = liveAgents.get(record.id);
+        if (!live) {
+          return {
+            ...record,
+            ownerUsername: record.ownerId ? (ownerUsernames.get(record.ownerId) || null) : null,
+            online: false,
+            status: 'offline',
+            latency: null,
+            conversationCount: 0,
+            metrics: safeAgentMetrics(record.metrics || {}),
+          };
+        }
+        liveAgents.delete(record.id);
+        return live;
+      });
+      // Keep a best-effort fallback for a live record whose initial inventory
+      // write failed; the next heartbeat/connection write repairs the row.
+      agentList.push(...liveAgents.values());
       res.json(agentList);
     } catch (e) {
       console.error('[Admin] Agents error:', e.message);