agentus 0.10.0 → 0.11.0

package/README.md

@@ -53,10 +53,11 @@ depth**, a permission mode that survives a restart, the **context-budget** field
 channel** (memory recall/save hints in the message stream), per-process skill roots, **project
 skills made visible and switchable** (a repo's `.agents/skills` shows up as a `project_skills`
 option instead of being skipped in silence), **background-job completion wake-ups** (a finished
-background process comes back as a turn of its own), and a **DeepSeek web backend** (search +
+background process comes back as a turn of its own), an **ACP session that writes its own log files** (`agent.log`/`errors.log`, so a
+cockpit-side failure is diagnosable afterwards), and a **DeepSeek web backend** (search +
 extract on the model key) — come from the fork's integration build instead. That is a five-line install:
 [§ Which Hermes to run](docs/installation.md#which-hermes-to-run) — currently the tag
-`agentus/v0.22.0/merge-20261021-1400`, on Hermes `v0.22.0`.
+`agentus/v0.22.0/merge-20261023-0522`, on Hermes `v0.22.0`.
 
 The first slot you start will use the Hermes home **your own agent already uses**
 (`~/.hermes`) unless the backend row names another one — see "HERMES_HOME" below.

package/README.zh-CN.md

@@ -47,10 +47,11 @@ web bundle、配套 APK —— 然后直接退出，不启动任何东西）。
 **上下文预算**输入框、把记忆召回 / 存记忆提示送进消息流的 **status 通道**、按进程指定的技能根、
 **项目 skill 可见可设**（仓库的 `.agents/skills` 会以 `project_skills` 选项出现，而不是被无声跳过）、
 **后台任务完成唤醒**（后台进程跑完会自己开一个回合回来），
+**ACP 会话自己写日志**（`agent.log`/`errors.log`，驾驶舱里出的问题事后可查），
 以及 **DeepSeek 的 web 后端**（搜索 + 正文抓取，共用模型 key）—— 来自 fork 的集成构建（tag）。
 装法就五行：
 [§ 该跑哪份 Hermes](docs/installation.zh-CN.md#该跑哪份-hermes) —— 当前是 tag
-`agentus/v0.22.0/merge-20261021-1400`，基座 Hermes `v0.22.0`。
+`agentus/v0.22.0/merge-20261023-0522`，基座 Hermes `v0.22.0`。
 
 你启动的第一个 slot 会使用**你自己的 agent 已经在用的**那个 Hermes home（`~/.hermes`），除非后端那一行
 指定了另一个 —— 见下面的「HERMES_HOME」。

package/docs/installation.md

@@ -60,7 +60,7 @@ ref and gets rebuilt, while a tag never moves — so pin the tag. The `agentus/`
 ours apart from upstream's own tags (`v0.22.0`, `v0.22.0+canary.*`), and the timestamp in the
 last segment sorts, so "newest" is a `sort -V`.
 
-**Current integration build: `agentus/v0.22.0/merge-20261021-1400`** — the newest tag on the fork,
+**Current integration build: `agentus/v0.22.0/merge-20261023-0522`** — the newest tag on the fork,
 built on Hermes `v0.22.0`. This line is for orientation only, not the source of truth: the
 `TAG=$(…)` step below resolves the newest one on every run, so read it there if this sentence
 ever looks stale.

package/docs/installation.zh-CN.md

@@ -52,7 +52,7 @@ agentus/<hermes 内部版本>/merge-<YYYYMMDD-HHMM>
 tag。`agentus/` 这个前缀也把它和上游自己的 tag（`v0.22.0`、`v0.22.0+canary.*`）分开；最后一段是时间戳，
 可排序，所以「最新」就是一次 `sort -V`。
 
-**当前集成构建：`agentus/v0.22.0/merge-20261021-1400`** —— fork 上最新的那个 tag，基座 Hermes
+**当前集成构建：`agentus/v0.22.0/merge-20261023-0522`** —— fork 上最新的那个 tag，基座 Hermes
 `v0.22.0`。这行只为一眼看个大概，不是权威：下面的 `TAG=$(…)` 每次都会自己解析出最新，觉得这行过期就
 以它为准。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentus",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
   "license": "Apache-2.0",
   "repository": {
@@ -78,6 +78,7 @@
     "live-stream": "tsx scripts/qa/live-stream.mts",
     "open-target": "tsx scripts/qa/open-target.mts",
     "rail-recent": "tsx scripts/qa/rail-recent.mts",
+    "rail-breakpoints": "node scripts/qa/rail-breakpoints.mjs",
     "permission-echo": "node scripts/qa/permission-echo.mjs",
     "turn-pulse": "tsx scripts/qa/turn-pulse.mts",
     "resume-tail": "tsx scripts/qa/resume-tail.mts",

package/packages/server/src/acp/agent-owner.ts

@@ -0,0 +1,141 @@
+// WHICH agent processes belong to THIS data directory.
+//
+// `reclaimOrphans()` used to ask one question — `process.kill(pid, 0)`, "is this number alive?" — and
+// then SIGKILL it. Two ways that ends a session that was perfectly healthy:
+//   1. pid reuse: the agent died with the previous server, the number went to something else, and the
+//      next boot killed an unrelated process;
+//   2. two servers on one data dir (incident 2026-10-22 §7): the second one reclaimed the first one's
+//      agents — every minute, forever, because it kept failing to listen and retrying.
+//
+// A pid is a weak identity, so each spawn now leaves a receipt next to the store:
+//   <DATA_DIR>/agents/<pid>.json = { pid, sessionId, dataDir, serverInstance, startedAt, cmd }
+// and a reclaim only kills when the receipt proves the process is an agent of this data dir from a
+// PREVIOUS server run. No receipt (rows written by older builds) → the argv must still look like an
+// ACP agent; otherwise the pid is dropped with a warning instead of being killed.
+
+import fs from "node:fs";
+import path from "node:path";
+import { commandLineOf, pidAlive } from "../instance-lock.js";
+
+export interface AgentReceipt {
+  pid: number;
+  sessionId: string;
+  dataDir: string;
+  /** The server run that spawned it — the same value as the instance lock's `instanceId`. */
+  serverInstance: string;
+  startedAt: number;
+  cmd: string;
+}
+
+export interface Verdict {
+  /** Nothing to kill: the pid is already gone. Not an error, never worth a warning. */
+  gone: boolean;
+  /** Safe to SIGKILL: the receipt proves ownership. */
+  kill: boolean;
+  /** Human-readable reason, logged either way (the operator's next 5-minute diagnosis). */
+  why: string;
+}
+
+function agentsDir(dataDir: string): string {
+  return path.join(dataDir, "agents");
+}
+
+function receiptPath(dataDir: string, pid: number): string {
+  return path.join(agentsDir(dataDir), `${pid}.json`);
+}
+
+/** Best effort: bookkeeping must never fail a session. */
+export function recordAgentOwner(dataDir: string | null, receipt: Omit<AgentReceipt, "dataDir"> & { dataDir?: string }): void {
+  const dir = dataDir ?? receipt.dataDir;
+  if (!dir) return;
+  try {
+    fs.mkdirSync(agentsDir(dir), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(
+      receiptPath(dir, receipt.pid),
+      JSON.stringify({ ...receipt, dataDir: path.resolve(dir) }, null, 2),
+      { mode: 0o600 },
+    );
+  } catch { /* an unreadable receipt only makes reclaim more conservative */ }
+}
+
+export function forgetAgentOwner(dataDir: string | null, pid: number | null | undefined): void {
+  if (!dataDir || !pid) return;
+  try { fs.unlinkSync(receiptPath(dataDir, pid)); } catch { /* already gone */ }
+}
+
+function readReceipt(dataDir: string, pid: number): AgentReceipt | null {
+  try {
+    const j = JSON.parse(fs.readFileSync(receiptPath(dataDir, pid), "utf8")) as Partial<AgentReceipt>;
+    if (typeof j.pid !== "number") return null;
+    return {
+      pid: j.pid,
+      sessionId: typeof j.sessionId === "string" ? j.sessionId : "",
+      dataDir: typeof j.dataDir === "string" ? j.dataDir : "",
+      serverInstance: typeof j.serverInstance === "string" ? j.serverInstance : "",
+      startedAt: typeof j.startedAt === "number" ? j.startedAt : 0,
+      cmd: typeof j.cmd === "string" ? j.cmd : "",
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Does this argv look like a CLI coding agent run over ACP? Fallback for rows without a receipt. */
+export function looksLikeAcpAgent(cmd: string | null): boolean {
+  if (!cmd) return false;
+  if (/mock[\\/]agent\.mjs\b/.test(cmd)) return true;          // the bundled mock backend
+  if (/\bqodercli\b/.test(cmd)) return true;
+  if (/\bhermes\b/.test(cmd) && /\bacp\b/.test(cmd)) return true;
+  if (/\b(claude-code|claude|opencode|codex)\b/.test(cmd) && /\bacp\b/.test(cmd)) return true;
+  return false;
+}
+
+/**
+ * Decide whether `pid` (recorded on session `sessionId`) may be killed by the startup reclaim.
+ *
+ * `serverInstance` is OUR instance id: a receipt naming it means the process is ours, so it is not an
+ * orphan at all (this also makes the call safe to use while running).
+ */
+export function verifyAgentOwner(
+  dataDir: string | null,
+  pid: number,
+  sessionId: string,
+  serverInstance: string,
+): Verdict {
+  if (!pidAlive(pid)) return { gone: true, kill: false, why: `pid ${pid} already gone` };
+
+  const cmd = commandLineOf(pid);
+  if (!cmd) return { gone: true, kill: false, why: `pid ${pid} vanished while checking` };
+
+  if (!dataDir) {
+    // No data dir wired in (unit tests, odd embedders): fall back to the argv shape, and say so.
+    return looksLikeAcpAgent(cmd)
+      ? { gone: false, kill: true, why: `pid ${pid} matches an ACP agent (no data dir to compare)` }
+      : { gone: false, kill: false, why: `pid ${pid} is not an ACP agent (${cmd.slice(0, 120)})` };
+  }
+
+  const receipt = readReceipt(dataDir, pid);
+  if (receipt) {
+    if (receipt.dataDir && path.resolve(receipt.dataDir) !== path.resolve(dataDir)) {
+      return { gone: false, kill: false, why: `pid ${pid} was spawned by the server of ${receipt.dataDir}` };
+    }
+    if (receipt.sessionId && receipt.sessionId !== sessionId) {
+      return { gone: false, kill: false, why: `pid ${pid} belongs to session ${receipt.sessionId}, not ${sessionId}` };
+    }
+    if (receipt.serverInstance && receipt.serverInstance === serverInstance) {
+      return { gone: false, kill: false, why: `pid ${pid} was spawned by THIS server run` };
+    }
+    if (!looksLikeAcpAgent(cmd)) {
+      // Receipt says ours, argv says something else: the pid was recycled after all. Trust the argv.
+      return { gone: false, kill: false, why: `pid ${pid} no longer runs an ACP agent (${cmd.slice(0, 120)})` };
+    }
+    return { gone: false, kill: true, why: `pid ${pid} = agent of session ${sessionId} from a previous run (receipt)` };
+  }
+
+  // Receipt-less row (written before this file existed, or the file was lost). Judge by argv only:
+  // a non-agent process must NEVER be killed for a stale database row.
+  if (!looksLikeAcpAgent(cmd)) {
+    return { gone: false, kill: false, why: `pid ${pid} is not an ACP agent (${cmd.slice(0, 120)})` };
+  }
+  return { gone: false, kill: true, why: `pid ${pid} matches an ACP agent (no receipt: legacy row)` };
+}

package/packages/server/src/acp/session-manager.ts

@@ -15,6 +15,8 @@ import type {
   RequestPermissionResponse,
 } from "@agentclientprotocol/sdk";
 import { BACKENDS, buildSpawnEnv, nativePlanSourceOf, type BackendSpec } from "./backends.js";
+import { forgetAgentOwner, recordAgentOwner, verifyAgentOwner } from "./agent-owner.js";
+import { thinkingOptionOf, voiceModeBlock } from "./voice-mode.js";
 import {
   byActivity,
   coldPage as pageCold,
@@ -287,10 +289,17 @@ export class SessionManager {
    *  to hibernate. Default ON — this is the CLI/gateway behaviour, and the whole point is that the
    *  agent takes its own result instead of the operator noticing a stale screen. */
   #completionWake: () => boolean = () => true;
+  /** The data directory this server owns, and the id of THIS run. Both come from the instance lock
+   *  in index.ts; together they are the only evidence that a recorded pid is an agent OF THIS STORE
+   *  from a PREVIOUS run — see `agent-owner.ts` and the 2026-10-22 incident. */
+  #dataDir: string | null = null;
+  #instanceId = "";
 
-  constructor(store: Store, emit: Emitter) {
+  constructor(store: Store, emit: Emitter, opts: { dataDir?: string | null; instanceId?: string } = {}) {
     this.#store = store;
     this.#emit = emit;
+    this.#dataDir = opts.dataDir ?? null;
+    this.#instanceId = opts.instanceId ?? "";
   }
 
   /** Wire the operator's 「后台任务完成唤醒」 switch in (index.ts → settings.agent.completionWake). */
@@ -304,6 +313,15 @@ export class SessionManager {
     this.#planHint = read;
   }
 
+  /** 语音通话（issue #48）：which session is on a call RIGHT NOW, or null when nobody is.
+   *  Wired from index.ts to the notify centre's presence — 「在打电话」 already has exactly one
+   *  answer in this process, and a second source would drift. Optional: with nothing wired the
+   *  manager never injects anything, which is the pre-#48 behaviour. */
+  #callLive: () => string | null = () => null;
+  setCallLiveSource(read: () => string | null): void {
+    this.#callLive = read;
+  }
+
   list(): SessionInfo[] {
     // Most recently CHATTED first — the cockpit's left rail is a launch pad, not a log file, and
     // creation order is the wrong key for that: the session you talked to a minute ago is the
@@ -361,17 +379,44 @@ export class SessionManager {
     return this.#sessions.get(id)?.busy ?? false;
   }
 
-  /** Reclaim orphans from a previous server run (AC5): kill recorded pids. */
+  /** Reclaim orphans from a previous server run (AC5): kill recorded pids — but only the ones that are
+   *  provably agents of THIS data dir (see `agent-owner.ts`).
+   *
+   *  A pid in the database is a claim, not proof. Three things it can be:
+   *    · an agent of this store that outlived the previous server → kill it, it holds the browser's
+   *      session id and nothing will ever answer through it again;
+   *    · a pid that died with the previous server and got recycled by something else → leave it alone,
+   *      say so in the log, and drop it from the row;
+   *    · an agent of ANOTHER server on the same data dir (the 2026-10-22 accident: a second instance
+   *      that could not even listen reclaimed the live cockpit's slots on every retry) → leave it
+   *      alone. The instance lock in index.ts refuses that second server outright; this is the second
+   *      line of defence, for the case where the claim was lost or hand-edited.
+   *
+   *  Never throws: the boot must not fail because one row is odd. */
   reclaimOrphans(): number {
     let killed = 0;
+    let skipped = 0;
     for (const row of this.#store.listSessions(true)) {
       if (row.pid == null) continue;
-      try {
-        process.kill(row.pid, 0); // alive?
-        process.kill(row.pid, "SIGKILL");
-        killed++;
-      } catch {
-        /* already gone */
+      const pid = row.pid;
+      const verdict = verifyAgentOwner(this.#dataDir, pid, row.id, this.#instanceId);
+      if (verdict.kill) {
+        try {
+          process.kill(pid, "SIGKILL");
+          killed++;
+          forgetAgentOwner(this.#dataDir, pid);
+          console.log(`[agentus] reclaim: killed pid ${pid} (session ${row.id}) — ${verdict.why}`);
+        } catch (err) {
+          console.log(`[agentus] reclaim: pid ${pid} (session ${row.id}) was gone before the kill — ${(err as Error).message}`);
+        }
+      } else if (verdict.gone) {
+        console.log(`[agentus] reclaim: nothing to kill for session ${row.id} — ${verdict.why}`);
+        forgetAgentOwner(this.#dataDir, pid);
+      } else {
+        // Alive but not provably ours. Do NOT kill; do drop the pid so the next boot does not
+        // re-examine (and re-endanger) the same number.
+        skipped++;
+        console.warn(`[agentus] reclaim: SKIPPED pid ${pid} (session ${row.id}) — ${verdict.why}`);
       }
       if (row.status !== "closed") {
         // Only a turn that was ACTUALLY in flight can be reported as interrupted. A `ready` session
@@ -385,9 +430,86 @@ export class SessionManager {
         if (wasRunning) this.#finalizePlan(row.id, "interrupted");
       }
     }
+    if (skipped) {
+      console.warn(
+        `[agentus] reclaim: ${skipped} recorded pid(s) left running — they are not this data dir's agents`
+        + ` (${this.#dataDir ?? "no data dir"})`,
+      );
+    }
     return killed;
   }
 
+  /** 语音通话的三种时刻（issue #48）。Called from the presence path (index.ts) whenever the
+   *  cockpit reports who is on a call.
+   *
+   *  A call has no "start"/"end" message of its own — the page only says, every 30 s, "I am on a
+   *  call with X". So transitions are DERIVED from that one fact, and each transition owes the agent
+   *  a block (entering: the style constraint; leaving: an explanation of what the last N turns were).
+   *  Nothing is sent at the moment of the transition itself: a bare prompt would make the agent
+   *  answer 「好的，我了解了」 into the microphone. The block rides the next real prompt.
+   */
+  async syncCallState(): Promise<void> {
+    const live = this.#callLive();
+    for (const v of this.#store.listInCall()) {
+      if (v.sessionId !== live) await this.#endCall(v.sessionId);
+    }
+    if (live && !this.#store.getVoiceMode(live).inCall) await this.#beginCall(live);
+  }
+
+  async #beginCall(id: string): Promise<void> {
+    if (!this.#store.getSession(id)) return; // a call with a session this store has never seen
+    const s = this.#sessions.get(id);
+    const choice = s ? thinkingOptionOf(s.info.configOptions) : null;
+    this.#store.upsertVoiceMode(id, {
+      inCall: true, boundary: "enter", turns: 0,
+      thoughtBefore: choice?.current ?? null, thoughtTouched: false,
+    });
+    // A call is full-duplex: waiting 20 s for a first token reads as a dead line to the operator.
+    // Lower the dial for the call and put the operator's own choice back on hang-up (see #endCall).
+    if (s && choice && choice.lowest && choice.current !== choice.lowest) {
+      await this.setConfig(id, choice.id, choice.lowest, { internal: true }).catch(() => { /* the block still goes out */ });
+    }
+  }
+
+  async #endCall(id: string): Promise<void> {
+    const v = this.#store.getVoiceMode(id);
+    this.#store.upsertVoiceMode(id, { inCall: false, boundary: "exit" });
+    const s = this.#sessions.get(id);
+    // The operator's explicit pick wins: if they changed the dial DURING the call, do not undo it.
+    if (s && v.thoughtBefore && !v.thoughtTouched) {
+      const choice = thinkingOptionOf(s.info.configOptions);
+      if (choice) await this.setConfig(id, choice.id, v.thoughtBefore, { internal: true }).catch(() => { /* keep going */ });
+    }
+    this.#store.upsertVoiceMode(id, { thoughtBefore: null, thoughtTouched: false });
+  }
+
+  /** Attach this prompt's voice block, and settle what it settles. Synchronous on purpose: it runs
+   *  inside the send path, and a slow store write must not delay the operator's words. */
+  #applyVoiceMode(s: LiveSession, blocks: unknown[]): void {
+    const live = this.#callLive();
+    let v = this.#store.getVoiceMode(s.info.id);
+    // Converge on the ONE authority (presence) in both directions: a page that closed mid-call never
+    // reports a hang-up, so the exit boundary must be derived here or the model stays on a call for
+    // ever; and a call that started while this slot was cold has no enter boundary recorded.
+    if (v.inCall && live !== s.info.id) {
+      v = this.#store.upsertVoiceMode(s.info.id, { inCall: false, boundary: "exit" });
+    } else if (!v.inCall && live === s.info.id) {
+      v = this.#store.upsertVoiceMode(s.info.id, { inCall: true, boundary: v.boundary ?? "enter", turns: 0 });
+    }
+    const block = voiceModeBlock(s.info.id, { inCall: v.inCall, boundary: v.boundary, turns: v.turns });
+    if (block) blocks.push(block);
+    if (v.boundary) this.#store.upsertVoiceMode(s.info.id, { boundary: null });
+    if (v.inCall) this.#store.upsertVoiceMode(s.info.id, { turns: v.turns + 1 });
+  }
+
+  /** Bind a freshly spawned agent to (this data dir, this session, this server run). Bookkeeping only:
+   *  a failure here makes a later reclaim more conservative, never a session fail. */
+  #stampAgentReceipt(pid: number, sessionId: string, cmd: string): void {
+    recordAgentOwner(this.#dataDir, {
+      pid, sessionId, startedAt: Date.now(), serverInstance: this.#instanceId, cmd,
+    });
+  }
+
   /** Last stderr lines from a session's agent (for diagnosing failed turns). */
   stderrTail(id: string, lines = 12): string {
     const s = this.#sessions.get(id);
@@ -529,6 +651,12 @@ export class SessionManager {
       throw new Error(why);
     }
 
+    const pid: number = child.pid;
+
+    // The receipt that makes a later reclaim provable (agent-owner.ts). Written BEFORE the handshake,
+    // because the handshake can fail and leave a running process behind.
+    this.#stampAgentReceipt(pid, id, `${spec.cmd} ${args.join(" ")}`);
+
     const live: LiveSession = {
       info: {
         id, backend, acpSessionId: null, cwd,
@@ -709,6 +837,8 @@ export class SessionManager {
       throw new Error(why);
     }
 
+    this.#stampAgentReceipt(child.pid, id, `${spec.cmd} ${args.join(" ")}`);
+
     const live: LiveSession = {
       info: {
         id, backend: row.backend, acpSessionId: row.acpSessionId, cwd: row.cwd,
@@ -847,6 +977,17 @@ export class SessionManager {
             .catch(() => {});
         }
       }
+      // 通话中 resume（页面刷新、空闲回收后再唤起）：把通话档位重新压下去，否则「恢复的会话」会带着
+      // 用户平时的高思考档沉默十几秒 —— 正是 issue #48 要消除的那种卡死手感。
+      {
+        const vm = this.#store.getVoiceMode(id);
+        if (vm.inCall) {
+          const knob = thinkingOptionOf(live.info.configOptions);
+          if (knob && knob.current !== knob.lowest) {
+            await this.setConfig(id, knob.id, knob.lowest, { internal: true }).catch(() => { /* keep going */ });
+          }
+        }
+      }
       live.info.status = "ready";
       this.#updateSession(live);
       // a resumed slot is the same evidence as a fresh one: the row does work
@@ -1084,6 +1225,11 @@ export class SessionManager {
         if (reminder) blocks.push(reminder);
       }
     }
+    // 语音通话模式（issue #48）: entering, staying in, and leaving a call each owe the agent one
+    // sentence it cannot infer — that its output is being SPOKEN, or that the speaking is over.
+    // Rides the same `_meta`-tagged resource channel as the plan reminder; the operator's own words
+    // are untouched (the transcript stores `text`, never the blocks).
+    this.#applyVoiceMode(s, blocks);
     s.turnSeq += 1;
     s.busy = true;
     // The operator has spoken: from here anything the agent says is an ANSWER, not its own history
@@ -1254,10 +1400,19 @@ export class SessionManager {
     this.#updateSession(s);
   }
 
-  async setConfig(sessionId: string, configId: string, value: string | number | boolean): Promise<void> {
+  async setConfig(sessionId: string, configId: string, value: string | number | boolean, opts: { internal?: boolean } = {}): Promise<void> {
     const s = this.#need(sessionId);
     if (!s.conn || !s.info.acpSessionId) throw new Error("session not ready");
     const requested = String(value);
+    // 通话中操作者自己调了思考档位 → 以他为准，挂断时不再还原（issue #48）。`internal` marks the
+    // cockpit's own lowering/restoring, which must NOT count as the operator's choice.
+    if (!opts.internal) {
+      const vm = this.#store.getVoiceMode(sessionId);
+      if (vm.inCall) {
+        const knob = thinkingOptionOf(s.info.configOptions);
+        if (knob && knob.id === configId) this.#store.upsertVoiceMode(sessionId, { thoughtTouched: true });
+      }
+    }
     let actual = requested;
     let rejected = false;
     try {
@@ -2202,6 +2357,8 @@ export class SessionManager {
   }
 
   #onChildExit(live: LiveSession, code: number | null, sig: string | null): void {
+    // The process is gone, so is its claim: leave no receipt that a later boot would try to honour.
+    forgetAgentOwner(this.#dataDir, live.child?.pid ?? live.info.pid);
     // If we initiated close, session was already removed — ignore.
     if (!this.#sessions.has(live.info.id)) return;
     // …and if we are REPLACING this slot's process (restart), the exit is the one we asked for: the

package/packages/server/src/acp/voice-mode.ts

@@ -0,0 +1,126 @@
+// 语音通话模式（issue #48）：通话里 agent 的输出是要被 TTS 念出来的。
+//
+// The cockpit already told the agent *what* to answer; it never told it that the answer would be
+// SPOKEN. So a question that naturally wants a table produced a table, and the operator heard
+// 「竖线 横线 竖线」. This file owns the two things that fix it, and nothing else:
+//
+//   · the three-state lifecycle (enter → constraint every turn → exit) as a pure decision, so the
+//     trickiest part — WHICH block is owed on THIS prompt — is testable without an agent;
+//   · the thinking-depth lookup, because a call is full-duplex and a 20-second first token is
+//     indistinguishable from a hang-up.
+//
+// The block rides the same channel as the plan reminder (`_meta`-tagged resource block), so the
+// transcript keeps the operator's own words and nothing else.
+
+/** The `_meta` key that marks a block as OURS — never the operator's words. */
+export const VOICE_META_KEY = "agentus/voice-mode";
+
+export type VoiceBoundary = "enter" | "exit";
+
+/** What the store remembers about one session's call state. */
+export interface VoiceState {
+  inCall: boolean;
+  /** A boundary that has not been delivered yet: it rides the NEXT prompt, then clears. */
+  boundary: VoiceBoundary | null;
+  /** How many prompts were spoken inside this call — the exit block quotes it. */
+  turns: number;
+}
+
+/** 进入通话：边界 + 约束合一（一次说完，别让模型只记住半句）。 */
+export const VOICE_ENTER_TEXT = [
+  "现在开始语音通话：你接下来的回复会被 TTS 朗读出来，用户是用耳朵听的。",
+  "请用口语化的短句回答（几句话以内），不要表格、代码块、列表符号、链接和 Markdown 标记；",
+  "需要列举时用「第一/第二」这样的口语说法。数字、专有名词、路径要念得出来。",
+].join("");
+
+/** 通话中每一轮都带：单轮指令会被后续对话冲淡，也会被压缩摘要吃掉。 */
+export const VOICE_STEADY_TEXT =
+  "（仍在语音通话中：继续用口语短句回答，不要表格、代码块、列表符号。）";
+
+/** 退出通话：不只说「结束了」，还要解释刚才那段的性质 —— 否则模型会接着用通话腔回文字提问。 */
+export function voiceExitText(turns: number): string {
+  const n = Math.max(0, Math.floor(turns));
+  return [
+    `语音通话已结束（上面${n > 0 ? ` ${n} 轮` : "的对话"}是通话内容：你的回复被朗读出来，用户的话经语音识别转写，`,
+    "可能有识别噪声、断句和口语碎片，不必逐字当真）。",
+    "现在恢复文字对话：正常输出格式（表格、代码块、列表都可以用），按文字场景回答。",
+  ].join("");
+}
+
+/**
+ * The block owed on THIS prompt, or null when nothing is owed.
+ *
+ * Three cases, exactly as the issue specifies:
+ *   enter boundary        → enter text + steady text (合一)
+ *   in call, no boundary   → steady text only (每轮)
+ *   exit boundary          → exit text (一次性)
+ */
+export function voiceModeBlock(sessionId: string, st: VoiceState): unknown | null {
+  const lines: string[] = [];
+  if (st.boundary === "enter") {
+    lines.push(VOICE_ENTER_TEXT);
+    if (st.inCall) lines.push(VOICE_STEADY_TEXT);
+  } else if (st.inCall) {
+    lines.push(VOICE_STEADY_TEXT);
+  } else if (st.boundary === "exit") {
+    lines.push(voiceExitText(st.turns));
+  }
+  if (!lines.length) return null;
+  return {
+    type: "resource",
+    resource: {
+      uri: `agentus://voice/${sessionId}`,
+      mimeType: "text/plain",
+      text: lines.join("\n"),
+    },
+    _meta: { [VOICE_META_KEY]: true },
+  };
+}
+
+/** Is this a block we injected (as opposed to something the operator typed)? */
+export function isVoiceBlock(block: unknown): boolean {
+  const meta = (block as { _meta?: Record<string, unknown> } | null)?._meta;
+  return Boolean(meta && meta[VOICE_META_KEY] === true);
+}
+
+export interface ThinkingChoice {
+  id: string;
+  /** The operator's (or the session's) current value. */
+  current: string;
+  /** The cheapest/fastest value the backend offers — what a call switches to. */
+  lowest: string;
+}
+
+/**
+ * Find the session's thinking-depth knob in the options the AGENT advertised.
+ *
+ * There is no schema for this: ACP options are free-form, and every backend names its own. The two
+ * signals that survive across backends (Hermes, the mock, and the adapters we have seen) are the
+ * semantic `category: "thought_level"` and an id/name containing think/reason/effort. If neither is
+ * present the session simply has no such knob and call mode must not invent one.
+ */
+export function thinkingOptionOf(options: unknown): ThinkingChoice | null {
+  if (!Array.isArray(options)) return null;
+  const list = options as { id?: unknown; name?: unknown; category?: unknown; currentValue?: unknown; options?: unknown }[];
+  const found = list.find((o) => {
+    if (!o || typeof o.id !== "string") return false;
+    if (o.category === "thought_level") return true;
+    const hay = `${o.id} ${typeof o.name === "string" ? o.name : ""}`;
+    return /think|reason|effort/i.test(hay) && Array.isArray(o.options) && o.options.length > 1;
+  });
+  if (!found) return null;
+  const values = (Array.isArray(found.options) ? found.options : [])
+    .map((o) => {
+      const v = o as { value?: unknown; name?: unknown };
+      return { value: typeof v.value === "string" ? v.value : "", name: typeof v.name === "string" ? v.name : "" };
+    })
+    .filter((o) => o.value);
+  if (values.length < 2) return null;
+  const lowest = values.find((v) => /^(off|none|disabled|min|minimal|low)$/i.test(v.value)
+    || /^(off|none|disabled|low|最低|关闭)$/i.test(v.name))?.value ?? values[0].value;
+  return {
+    id: found.id as string,
+    current: typeof found.currentValue === "string" ? found.currentValue : "",
+    lowest,
+  };
+}