agentus 0.10.0 → 0.11.0

package/packages/server/src/index.ts

@@ -17,6 +17,7 @@ import { describeAcpError } from "./acp/errors.js";
 import { BACKENDS } from "./acp/backends.js";
 import { HERMES_DEFAULT_HOME, classifyError, checkedHealth, coerceRow, inspectRow, planFor, rowWarnings, seedRows, startupCheck } from "./acp/registry.js";
 import { ChangedOnDiskError, FsError, listDirs, readTextFile, statFile, writeTextFile } from "./fs.js";
+import { acquireInstanceLock, humanAge } from "./instance-lock.js";
 import { terms } from "./term.js";
 import { VoiceError, listVoiceModels, setHotwordSource, synthesize, transcribe, voiceCapabilities } from "./voice.js";
 import { dictationContext, hotwordsFor, vocabularyOf } from "./hotwords.js";
@@ -133,6 +134,33 @@ if (process.env.AGENTUS_PRINT_PATHS) {
 }
 
 fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 }); // 0700: credentials live here
+
+// ---- one data directory, ONE server (incident 2026-10-22, incident-20261022-orphan-reclaim.md §7) ----
+// Claimed BEFORE the store is opened and long before anything reclaims or listens. The reclaim below
+// kills the agent processes this database remembers, so a second instance on the same data dir is not
+// a "port conflict" — it is the destruction of a running cockpit. Refuse, and touch nothing.
+// A dead owner (crash, SIGKILL, reboot) is replaced, so a stale claim never bricks an install.
+const instanceLock = acquireInstanceLock(DATA_DIR, { port: PORT });
+if (!instanceLock.ok) {
+  const h = instanceLock.holder;
+  console.error(`[agentus] refusing to start: this data directory already has an owner`);
+  console.error(`[agentus]   data dir: ${DATA_DIR}  (${DATA_DIR_SOURCE})`);
+  if (h) {
+    console.error(`[agentus]   owner:    pid ${h.pid}${h.port ? ` on port ${h.port}` : ""}, up ${humanAge(Date.now() - h.startedAt)}`);
+  }
+  console.error(`[agentus]   reason:   ${instanceLock.why}`);
+  console.error(`[agentus]   two servers on one data dir reclaim each other's agents — stop that instance first,`);
+  console.error(`[agentus]   or give this one its own directory:  AGENTUS_DATA=/some/other/dir`);
+  process.exit(1);
+}
+if (instanceLock.tookOver) {
+  const prev = instanceLock.tookOver;
+  console.log(
+    `[agentus] instance lock: took over ${DATA_DIR} from pid ${prev.pid}`
+    + ` (gone or recycled; up ${humanAge(Date.now() - (prev.startedAt || Date.now()))})`,
+  );
+}
+
 const store = new Store(path.join(DATA_DIR, "agentus.sqlite"));
 // M6: an existing cockpit must behave exactly as before, so the registry starts as a copy of
 // the builtin (env-driven) rows and the operator edits from there. Seeding is one-shot: an
@@ -203,7 +231,12 @@ function emit(evt: ServerEvent): void {
   notify.observe(evt);
 }
 
-const mgr = new SessionManager(store, emit);
+// The data dir and this run's instance id travel into the manager: they are what lets a reclaim tell
+// "an agent of THIS directory from a previous run" from "some pid the database still remembers".
+const mgr = new SessionManager(store, emit, {
+  dataDir: DATA_DIR,
+  instanceId: instanceLock.holder.instanceId,
+});
 
 /** 工作播报 (issue #16). Constructed AFTER the manager so it can spawn observers through it, and
  *  wired into `emit` above through this mutable handle — the hub itself is not in the broadcast
@@ -431,6 +464,12 @@ setHotwordSource((sessionId) => hotwordsFor(store, sessionId).map((h) => h.word)
   // behaviour); the switch exists because a synthetic turn spends tokens the operator may not want
   // spent at 3am — and it is read live, so flipping it applies to the next completion.
   mgr.setCompletionWakeSource(() => agentSettings().completionWake);
+  // 语音通话（issue #48）: 「在打电话」 has exactly one authority in this process (the notify centre's
+  // presence, which the page already reports every 30 s), so the voice-mode block and the thinking
+  // dial derive from it instead of adding a second client→server state channel. The presence
+  // listener turns each report into the transitions the manager records.
+  mgr.setCallLiveSource(() => notify.callLiveSession());
+  notify.onPresenceChange(() => { void mgr.syncCallState(); });
   mgr.startIdleReaper({
     idleMs: () => envIdleMs ?? agentSettings().idleKillMin * 60_000,
     warmSlots: () => envWarm ?? agentSettings().warmSlots,
@@ -494,7 +533,9 @@ function installSafetyNet(): void {
   });
 }
 
-// AC5: reclaim orphans from previous run before serving anything.
+// AC5: reclaim orphans from a previous run — only reachable once the instance lock above proved this
+// process is the single owner of DATA_DIR, and only killing agents that receipt proves are ours
+// (incident 2026-10-22: a second instance used to execute the live cockpit's slots here, every 10 s).
 const killed = mgr.reclaimOrphans();
 if (killed) console.log(`[agentus] reclaimed ${killed} orphan agent process(es)`);
 

package/packages/server/src/instance-lock.ts

@@ -0,0 +1,235 @@
+// ONE data directory, ONE server.
+//
+// Why this file exists (incident 2026-10-22, `tasks/20261001-agentus/incident-20261022-orphan-reclaim.md` §7):
+// a hand-written promote script started a SECOND server on the live data dir (a different port, so
+// `listen` was happy). That instance then ran the startup orphan reclaim — which kills every agent
+// pid the database remembers — and executed the agents of the server that was already serving. Every
+// 10 s the launchd job retried, failed with EADDRINUSE, and killed the operator's freshly restored
+// sessions again: the failure looked like "my sessions die on resume".
+//
+// So identity is claimed BEFORE anything that can touch another instance's processes:
+//   · the claim is an O_EXCL `server.pid` in the data dir (atomic on every filesystem we ship to),
+//   · a claim is only honoured while its pid is alive AND still looks like an agentus server,
+//   · a dead or foreign holder is replaced (crash/SIGKILL must not brick the data dir),
+//   · nothing here kills anything — refusing to start is the whole remedy.
+
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+
+/** The claim lives beside the sqlite store: same dir, same 0700 guarantees. */
+export const LOCK_FILE = "server.pid";
+
+export interface LockHolder {
+  pid: number;
+  port: number | null;
+  dataDir: string;
+  /** Identifies THIS process run. Agents record it too, so a reclaim can tell "previous run" from
+   *  "mine" — see `acp/agent-owner.ts`. */
+  instanceId: string;
+  startedAt: number;
+  entry: string;
+}
+
+export interface LockHandle {
+  ok: true;
+  path: string;
+  holder: LockHolder;
+  /** Set when the previous holder was gone and we took the directory over. */
+  tookOver: LockHolder | null;
+  release(): void;
+}
+
+export interface LockRefused {
+  ok: false;
+  holder: LockHolder | null;
+  /** One line an operator can act on; `index.ts` prints it verbatim. */
+  why: string;
+}
+
+/** `ps -o command=` — the argv of a pid, or null when it is gone. */
+export function commandLineOf(pid: number): string | null {
+  try {
+    const out = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+    });
+    const s = out.trim();
+    return s || null;
+  } catch {
+    return null;
+  }
+}
+
+/** Kernel start time of a pid (ms), or null when it cannot be read. Used only to detect pid REUSE. */
+export function startedAtOf(pid: number): number | null {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    if (!out) return null;
+    const t = Date.parse(out); // "Thu Oct 22 23:42:48 2026" under the C locale ps uses
+    return Number.isFinite(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+
+export function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM = exists, just not ours to signal. Either way it is NOT free to take over silently.
+    return (err as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+/** Does this argv look like an agentus server? Deliberately narrow: a pid that is merely alive must
+ *  never block a restart because its number was recycled by an unrelated program. Covers the source
+ *  entry (`packages/server/src/index.ts`, tsx or node), the built one (`dist/server/index.js`) and a
+ *  globally installed package (`…/node_modules/agentus/…`). */
+export function looksLikeServer(cmd: string | null): boolean {
+  if (!cmd) return false;
+  if (!/\b(node|tsx|bun|deno)\b/.test(cmd)) return false;
+  return /packages[\\/]server[\\/](src[\\/]index|dist[\\/]index)\.(ts|js|mjs|cjs)\b/.test(cmd)
+    || /agentus[\\/](dist[\\/])?server[\\/]index\.(js|mjs|cjs)\b/.test(cmd);
+}
+
+/** Synchronous sleep: this runs during module init, before any event loop turn is meaningful. */
+function sleepSync(ms: number): void {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) { /* spin: only when Atomics is unavailable */ }
+  }
+}
+
+function readHolder(lockPath: string): LockHolder | null {
+  try {
+    const raw = fs.readFileSync(lockPath, "utf8");
+    const j = JSON.parse(raw) as Partial<LockHolder>;
+    if (typeof j.pid !== "number" || !Number.isInteger(j.pid)) return null;
+    return {
+      pid: j.pid,
+      port: typeof j.port === "number" ? j.port : null,
+      dataDir: typeof j.dataDir === "string" ? j.dataDir : "",
+      instanceId: typeof j.instanceId === "string" ? j.instanceId : "",
+      startedAt: typeof j.startedAt === "number" ? j.startedAt : 0,
+      entry: typeof j.entry === "string" ? j.entry : "",
+    };
+  } catch {
+    return null; // unreadable or truncated: a crashed writer, treat as no claim
+  }
+}
+
+/** Is the recorded holder still a live agentus server on THIS data dir? */
+function judgeHolder(holder: LockHolder, dataDir: string): { alive: boolean; why: string } {
+  if (holder.pid === process.pid) return { alive: false, why: `claim names this very pid (${holder.pid})` };
+  if (!pidAlive(holder.pid)) return { alive: false, why: `pid ${holder.pid} is gone` };
+  const cmd = commandLineOf(holder.pid);
+  if (!cmd) return { alive: false, why: `pid ${holder.pid} disappeared while checking` };
+  if (!looksLikeServer(cmd)) {
+    return { alive: false, why: `pid ${holder.pid} was recycled by another program (${cmd.slice(0, 120)})` };
+  }
+  if (holder.dataDir && path.resolve(holder.dataDir) !== path.resolve(dataDir)) {
+    // The file lives in OUR dir but names another one: copied/hand-edited file. Its pid may well be
+    // a healthy server for the OTHER directory — replacing the claim is right, killing is not.
+    return { alive: false, why: `claim names data dir ${holder.dataDir}, not ${dataDir}` };
+  }
+  if (holder.startedAt) {
+    const actual = startedAtOf(holder.pid);
+    // 1 s of slack: `ps` prints whole seconds. Anything larger means pid reuse, not our process.
+    if (actual !== null && Math.abs(actual - holder.startedAt) > 2000) {
+      return { alive: false, why: `pid ${holder.pid} start time does not match the claim (reused pid)` };
+    }
+  }
+  return { alive: true, why: `pid ${holder.pid} (port ${holder.port ?? "?"}) is serving this data dir` };
+}
+
+export interface AcquireOptions {
+  /** Port this instance intends to listen on; recorded for the operator, not used for judging. */
+  port?: number | null;
+  /** How long to wait for a dying holder to release (a restart hands over within a second; a live
+   *  second instance must be refused quickly enough to be useful). */
+  waitMs?: number;
+}
+
+/**
+ * Claim `dataDir`. Returns a handle (already released on process exit) or a refusal with the reason.
+ *
+ * Callers MUST `process.exit(1)` on a refusal and MUST NOT touch the store, the agents or the port:
+ * the whole point is that a second instance leaves the first one's world untouched.
+ */
+export function acquireInstanceLock(dataDir: string, opts: AcquireOptions = {}): LockHandle | LockRefused {
+  const lockPath = path.join(dataDir, LOCK_FILE);
+  const me: LockHolder = {
+    pid: process.pid,
+    port: opts.port ?? null,
+    dataDir: path.resolve(dataDir),
+    instanceId: randomUUID(),
+    startedAt: Date.now(),
+    entry: process.argv[1] ?? "",
+  };
+  const deadline = Date.now() + (opts.waitMs ?? 4000);
+  let tookOver: LockHolder | null = null;
+
+  for (;;) {
+    try {
+      // O_EXCL: the kernel decides who wins, even with two servers starting in the same tick.
+      const fd = fs.openSync(lockPath, "wx", 0o600);
+      try {
+        fs.writeFileSync(fd, JSON.stringify(me, null, 2));
+      } finally {
+        fs.closeSync(fd);
+      }
+      const handle: LockHandle = {
+        ok: true, path: lockPath, holder: me, tookOver,
+        release: () => {
+          // Only ever remove OUR claim: a slow instance must not delete the claim of the one that
+          // replaced it (that is how two servers end up owning one directory).
+          const onDisk = readHolder(lockPath);
+          if (!onDisk || onDisk.pid !== me.pid || onDisk.instanceId !== me.instanceId) return;
+          try { fs.unlinkSync(lockPath); } catch { /* already gone */ }
+        },
+      };
+      process.once("exit", handle.release);
+      return handle;
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") {
+        return { ok: false, holder: null, why: `cannot create ${lockPath}: ${(err as Error).message}` };
+      }
+    }
+
+    const holder = readHolder(lockPath);
+    if (!holder) {
+      // A crashed writer left junk (or a zero-byte file). Remove and retry.
+      try { fs.unlinkSync(lockPath); } catch { /* raced with another starter: loop decides */ }
+      continue;
+    }
+    const verdict = judgeHolder(holder, dataDir);
+    if (verdict.alive) {
+      if (Date.now() < deadline) {
+        // A restart tears the old process down first; give it a moment instead of failing a
+        // `tsx watch` reload or a promote on a scheduling hiccup.
+        sleepSync(250);
+        continue;
+      }
+      return { ok: false, holder, why: verdict.why };
+    }
+    tookOver = holder;
+    console.log(`[agentus] instance lock: taking over ${lockPath} — ${verdict.why}`);
+    try { fs.unlinkSync(lockPath); } catch { /* someone else cleaned it: the next open decides */ }
+  }
+}
+
+/** For a diagnostic line: "1m 12s". */
+export function humanAge(ms: number): string {
+  const s = Math.max(0, Math.round(ms / 1000));
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  return `${m}m ${s % 60}s`;
+}

package/packages/server/src/notify/center.ts

@@ -238,6 +238,13 @@ export class NotifyCenter {
     return next;
   }
 
+  /** Called after EVERY presence report (issue #48 wires it to the voice-mode transitions). Kept as
+   *  a listener rather than a direct call so the notify centre stays free of session knowledge. */
+  #onPresence?: (p: Presence) => void;
+  onPresenceChange(fn: (p: Presence) => void): void {
+    this.#onPresence = fn;
+  }
+
   /** The cockpit says which session it is looking at; null/visible=false means "nobody is". */
   setPresence(sessionId: string | null, visible: boolean, call = false): Presence {
     this.presence = {
@@ -254,6 +261,9 @@ export class NotifyCenter {
     if (this.presence.sessionId && (this.presence.visible || this.presence.call)) {
       this.onFocus?.(this.presence.sessionId);
     }
+    // Announce AFTER the fields are settled: a listener asking `callLiveSession()` must see the
+    // report it was just told about, not the previous one.
+    try { this.#onPresence?.(this.presence); } catch { /* presence is a hint, never a requirement */ }
     return this.presence;
   }
 
@@ -273,6 +283,15 @@ export class NotifyCenter {
     return Boolean(this.presence.call) && Date.now() - this.presence.at < NotifyCenter.WATCH_TTL_MS;
   }
 
+  /** WHICH session is on a call right now, or null. The public form of `onCall()` for issue #48:
+   *  the voice-mode block and the thinking-dial switch need the session id, not just a boolean, and
+   *  they must agree with the notification rules about what "on a call" means (one presence, one TTL,
+   *  one answer). */
+  callLiveSession(): string | null {
+    if (!this.onCall()) return null;
+    return this.presence.sessionId;
+  }
+
   /** True when a notification for this session would interrupt the operator looking at it. */
   private watching(sessionId: string): boolean {
     return this.rules().quietWhenWatching && this.operatorWatching(sessionId);

package/packages/server/src/store/store.ts

@@ -267,6 +267,29 @@ interface RawPlanRow {
   updated_at: number;
 }
 
+/** 语音通话状态的一行（issue #48）—— 见 `voice_mode` 表。 */
+export interface VoiceRow {
+  sessionId: string;
+  inCall: boolean;
+  boundary: "enter" | "exit" | null;
+  turns: number;
+  thoughtBefore: string | null;
+  thoughtTouched: boolean;
+  updatedAt: number;
+}
+
+export type VoiceModePatch = Partial<Omit<VoiceRow, "sessionId" | "updatedAt">>;
+
+interface RawVoiceRow {
+  session_id: string;
+  in_call: number;
+  boundary: string | null;
+  turns: number;
+  thought_before: string | null;
+  thought_touched: number;
+  updated_at: number;
+}
+
 /** What a plan write carries. `explanation: undefined` means "keep the remark that is there"
  *  (only an agent writes one, and most plan updates carry none) — see `upsertPlan`. */
 export interface PlanPatch {
@@ -351,6 +374,19 @@ export class Store {
         items text not null, title text, explanation text, source text not null,
         terminal text, updated_at integer not null
       );
+      -- 语音通话模式（issue #48）. The two boundaries must SURVIVE a reload, an idle-reap and a
+      -- cold start: if the exit boundary were only in memory, a page refresh after hanging up would
+      -- leave the model believing it is still on a call (the transcript's last turns all sound like
+      -- one). Same待遇 as the plan row: state the cockpit owns, not something the transcript records.
+      create table if not exists voice_mode (
+        session_id text primary key,
+        in_call integer not null default 0,
+        boundary text,                    -- 'enter' | 'exit' | null (owed, rides the next prompt)
+        turns integer not null default 0, -- prompts spoken inside this call (the exit block quotes it)
+        thought_before text,              -- thinking depth to restore on hang-up (null = none taken)
+        thought_touched integer not null default 0, -- operator changed depth during the call
+        updated_at integer not null
+      );
     `);
     // The DB now holds the speech endpoint's key, so it is the operator's secret material:
     // 0600 like the file it replaced (a default 0644 sqlite file would be a downgrade).
@@ -913,6 +949,65 @@ export class Store {
     return this.getPlan(sessionId) as PlanSnapshot;
   }
 
+  /** 语音通话状态（issue #48）—— 读一行，缺省即「没在通话、没有欠着的边界」。 */
+  getVoiceMode(sessionId: string): VoiceRow {
+    const row = this.#db
+      .prepare("select session_id, in_call, boundary, turns, thought_before, thought_touched, updated_at from voice_mode where session_id = ?")
+      .get(sessionId) as RawVoiceRow | undefined;
+    return row
+      ? {
+          sessionId: row.session_id,
+          inCall: Boolean(row.in_call),
+          boundary: row.boundary === "enter" || row.boundary === "exit" ? row.boundary : null,
+          turns: row.turns ?? 0,
+          thoughtBefore: row.thought_before ?? null,
+          thoughtTouched: Boolean(row.thought_touched),
+          updatedAt: row.updated_at,
+        }
+      : { sessionId, inCall: false, boundary: null, turns: 0, thoughtBefore: null, thoughtTouched: false, updatedAt: 0 };
+  }
+
+  /** Write the parts that changed; undefined keeps the stored value (the plan patch's rule). */
+  upsertVoiceMode(sessionId: string, patch: VoiceModePatch): VoiceRow {
+    const prev = this.getVoiceMode(sessionId);
+    const next: VoiceRow = {
+      sessionId,
+      inCall: patch.inCall ?? prev.inCall,
+      boundary: patch.boundary === undefined ? prev.boundary : patch.boundary,
+      turns: patch.turns ?? prev.turns,
+      thoughtBefore: patch.thoughtBefore === undefined ? prev.thoughtBefore : patch.thoughtBefore,
+      thoughtTouched: patch.thoughtTouched ?? prev.thoughtTouched,
+      updatedAt: Date.now(),
+    };
+    this.#db
+      .prepare(
+        `insert into voice_mode (session_id, in_call, boundary, turns, thought_before, thought_touched, updated_at)
+         values (?, ?, ?, ?, ?, ?, ?)
+         on conflict(session_id) do update set
+           in_call = excluded.in_call, boundary = excluded.boundary, turns = excluded.turns,
+           thought_before = excluded.thought_before, thought_touched = excluded.thought_touched,
+           updated_at = excluded.updated_at`,
+      )
+      .run(
+        sessionId,
+        next.inCall ? 1 : 0,
+        next.boundary,
+        next.turns,
+        next.thoughtBefore,
+        next.thoughtTouched ? 1 : 0,
+        next.updatedAt,
+      );
+    return next;
+  }
+
+  /** Every session the store still believes is on a call — the list a hang-up has to sweep. */
+  listInCall(): VoiceRow[] {
+    const rows = this.#db
+      .prepare("select session_id from voice_mode where in_call = 1")
+      .all() as { session_id: string }[];
+    return rows.map((r) => this.getVoiceMode(r.session_id));
+  }
+
   appendMessage(m: Omit<StoredMessage, "seq">): StoredMessage {
     const seq = this.nextSeq(m.sessionId);
     this.#db