agentus 0.10.1 → 0.11.1

package/packages/server/src/acp/voice-mode.ts

@@ -0,0 +1,145 @@
+// 语音通话模式（issue #48）：通话里 agent 的输出是要被 TTS 念出来的。
+//
+// The cockpit already told the agent *what* to answer; it never told it that the answer would be
+// SPOKEN. So a question that naturally wants a table produced a table, and the operator heard
+// 「竖线 横线 竖线」. This file owns the two things that fix it, and nothing else:
+//
+//   · the three-state lifecycle (enter → constraint every turn → exit) as a pure decision, so the
+//     trickiest part — WHICH block is owed on THIS prompt — is testable without an agent;
+//   · the thinking-depth lookup, because a call is full-duplex and a 20-second first token is
+//     indistinguishable from a hang-up.
+//
+// The block rides the same channel as the plan reminder (`_meta`-tagged resource block), so the
+// transcript keeps the operator's own words and nothing else.
+
+/** The `_meta` key that marks a block as OURS — never the operator's words. */
+export const VOICE_META_KEY = "agentus/voice-mode";
+
+export type VoiceBoundary = "enter" | "exit";
+
+/** What the store remembers about one session's call state. */
+export interface VoiceState {
+  inCall: boolean;
+  /** A boundary that has not been delivered yet: it rides the NEXT prompt, then clears. */
+  boundary: VoiceBoundary | null;
+  /** How many prompts were spoken inside this call — the exit block quotes it. */
+  turns: number;
+}
+
+/** 进入通话：边界 + 约束合一（一次说完，别让模型只记住半句）。 */
+export const VOICE_ENTER_TEXT = [
+  "现在开始语音通话：你接下来的回复会被 TTS 朗读出来，用户是用耳朵听的。",
+  "请用口语化的短句回答（几句话以内），不要表格、代码块、列表符号、链接和 Markdown 标记；",
+  "需要列举时用「第一/第二」这样的口语说法。数字、专有名词、路径要念得出来。",
+].join("");
+
+/** 通话中每一轮都带：单轮指令会被后续对话冲淡，也会被压缩摘要吃掉。 */
+export const VOICE_STEADY_TEXT =
+  "（仍在语音通话中：继续用口语短句回答，不要表格、代码块、列表符号。）";
+
+/** 退出通话：不只说「结束了」，还要解释刚才那段的性质 —— 否则模型会接着用通话腔回文字提问。 */
+export function voiceExitText(turns: number): string {
+  const n = Math.max(0, Math.floor(turns));
+  return [
+    `语音通话已结束（上面${n > 0 ? ` ${n} 轮` : "的对话"}是通话内容：你的回复被朗读出来，用户的话经语音识别转写，`,
+    "可能有识别噪声、断句和口语碎片，不必逐字当真）。",
+    "现在恢复文字对话：正常输出格式（表格、代码块、列表都可以用），按文字场景回答。",
+  ].join("");
+}
+
+/**
+ * The block owed on THIS prompt, or null when nothing is owed.
+ *
+ * Three cases, exactly as the issue specifies:
+ *   enter boundary        → enter text + steady text (合一)
+ *   in call, no boundary   → steady text only (每轮)
+ *   exit boundary          → exit text (一次性)
+ */
+export function voiceModeBlock(sessionId: string, st: VoiceState): unknown | null {
+  const lines: string[] = [];
+  if (st.boundary === "enter") {
+    lines.push(VOICE_ENTER_TEXT);
+    if (st.inCall) lines.push(VOICE_STEADY_TEXT);
+  } else if (st.inCall) {
+    lines.push(VOICE_STEADY_TEXT);
+  } else if (st.boundary === "exit") {
+    lines.push(voiceExitText(st.turns));
+  }
+  if (!lines.length) return null;
+  return {
+    type: "resource",
+    resource: {
+      uri: `agentus://voice/${sessionId}`,
+      mimeType: "text/plain",
+      text: lines.join("\n"),
+    },
+    _meta: { [VOICE_META_KEY]: true },
+  };
+}
+
+/**
+ * Does this prompt get the call treatment at all?
+ *
+ * Only an OPERATOR prompt does. A background-completion wake rides the same `prompt()` with an
+ * `origin`, and it is a synthetic turn nobody reads: letting it carry the block burned the pending
+ * exit boundary into it (so the operator's next real message never learned the call had ended) and
+ * inflated the turn count that the exit block quotes.
+ */
+export function voiceAppliesToPrompt(opts: { origin?: unknown }): boolean {
+  return !opts.origin;
+}
+
+export interface ThinkingChoice {
+  id: string;
+  /** The operator's (or the session's) current value. */
+  current: string;
+  /** The cheapest/fastest value the backend offers — what a call switches to. */
+  lowest: string;
+}
+
+/**
+ * Find the session's thinking-depth knob in the options the AGENT advertised.
+ *
+ * There is no schema for this: ACP options are free-form, and every backend names its own. The two
+ * signals that survive across backends (Hermes, the mock, and the adapters we have seen) are the
+ * semantic `category: "thought_level"` and an id/name containing think/reason/effort. If neither is
+ * present the session simply has no such knob and call mode must not invent one.
+ *
+ * The LOWEST level must also be recognised. ACP puts no ordering on the value list, so falling back
+ * to `options[0]` is a coin flip that can pick "3 档" or `true` — i.e. a call could make the agent
+ * SLOWER, which is the exact failure mode call mode exists to remove (review M3). If no value looks
+ * cheapest, report no knob: worse to press an unknown dial than to leave it alone.
+ */
+export function thinkingOptionOf(options: unknown): ThinkingChoice | null {
+  if (!Array.isArray(options)) return null;
+  const list = options as { id?: unknown; name?: unknown; category?: unknown; currentValue?: unknown; options?: unknown }[];
+  const found = list.find((o) => {
+    if (!o || typeof o.id !== "string") return false;
+    if (o.category === "thought_level") return true;
+    const hay = `${o.id} ${typeof o.name === "string" ? o.name : ""}`;
+    return /think|reason|effort/i.test(hay) && Array.isArray(o.options) && o.options.length > 1;
+  });
+  if (!found) return null;
+  const values = (Array.isArray(found.options) ? found.options : [])
+    .map((o) => {
+      const v = o as { value?: unknown; name?: unknown };
+      return {
+        value: typeof v.value === "string" ? v.value : typeof v.value === "number" ? String(v.value) : "",
+        name: typeof v.name === "string" ? v.name : "",
+      };
+    })
+    .filter((o) => o.value);
+  if (values.length < 2) return null;
+  const lowValue = /^(off|none|disabled|min|minimal|low|lowest|quick|fast|1)$/i;
+  const lowName = /^(off|none|disabled|low|lowest|quick|fast|最低|低|关闭|关|快速|最快|1\s*档?)$/i;
+  const pick = values.find((v) => lowValue.test(v.value.trim()) || lowName.test(v.name.trim()));
+  if (!pick) return null;
+  const currentRaw = found.currentValue;
+  return {
+    id: found.id as string,
+    current: typeof currentRaw === "string"
+      ? currentRaw
+      : typeof currentRaw === "number" || typeof currentRaw === "boolean" ? String(currentRaw) : "",
+    lowest: pick.value,
+  };
+}

package/packages/server/src/index.ts

@@ -17,6 +17,7 @@ import { describeAcpError } from "./acp/errors.js";
 import { BACKENDS } from "./acp/backends.js";
 import { HERMES_DEFAULT_HOME, classifyError, checkedHealth, coerceRow, inspectRow, planFor, rowWarnings, seedRows, startupCheck } from "./acp/registry.js";
 import { ChangedOnDiskError, FsError, listDirs, readTextFile, statFile, writeTextFile } from "./fs.js";
+import { acquireInstanceLock, humanAge } from "./instance-lock.js";
 import { terms } from "./term.js";
 import { VoiceError, listVoiceModels, setHotwordSource, synthesize, transcribe, voiceCapabilities } from "./voice.js";
 import { dictationContext, hotwordsFor, vocabularyOf } from "./hotwords.js";
@@ -133,6 +134,33 @@ if (process.env.AGENTUS_PRINT_PATHS) {
 }
 
 fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 }); // 0700: credentials live here
+
+// ---- one data directory, ONE server (incident 2026-10-22, incident-20261022-orphan-reclaim.md §7) ----
+// Claimed BEFORE the store is opened and long before anything reclaims or listens. The reclaim below
+// kills the agent processes this database remembers, so a second instance on the same data dir is not
+// a "port conflict" — it is the destruction of a running cockpit. Refuse, and touch nothing.
+// A dead owner (crash, SIGKILL, reboot) is replaced, so a stale claim never bricks an install.
+const instanceLock = acquireInstanceLock(DATA_DIR, { port: PORT });
+if (!instanceLock.ok) {
+  const h = instanceLock.holder;
+  console.error(`[agentus] refusing to start: this data directory already has an owner`);
+  console.error(`[agentus]   data dir: ${DATA_DIR}  (${DATA_DIR_SOURCE})`);
+  if (h) {
+    console.error(`[agentus]   owner:    pid ${h.pid}${h.port ? ` on port ${h.port}` : ""}, up ${humanAge(Date.now() - h.startedAt)}`);
+  }
+  console.error(`[agentus]   reason:   ${instanceLock.why}`);
+  console.error(`[agentus]   two servers on one data dir reclaim each other's agents — stop that instance first,`);
+  console.error(`[agentus]   or give this one its own directory:  AGENTUS_DATA=/some/other/dir`);
+  process.exit(1);
+}
+if (instanceLock.tookOver) {
+  const prev = instanceLock.tookOver;
+  console.log(
+    `[agentus] instance lock: took over ${DATA_DIR} from pid ${prev.pid}`
+    + ` (gone or recycled; up ${humanAge(Date.now() - (prev.startedAt || Date.now()))})`,
+  );
+}
+
 const store = new Store(path.join(DATA_DIR, "agentus.sqlite"));
 // M6: an existing cockpit must behave exactly as before, so the registry starts as a copy of
 // the builtin (env-driven) rows and the operator edits from there. Seeding is one-shot: an
@@ -203,7 +231,12 @@ function emit(evt: ServerEvent): void {
   notify.observe(evt);
 }
 
-const mgr = new SessionManager(store, emit);
+// The data dir and this run's instance id travel into the manager: they are what lets a reclaim tell
+// "an agent of THIS directory from a previous run" from "some pid the database still remembers".
+const mgr = new SessionManager(store, emit, {
+  dataDir: DATA_DIR,
+  instanceId: instanceLock.holder.instanceId,
+});
 
 /** 工作播报 (issue #16). Constructed AFTER the manager so it can spawn observers through it, and
  *  wired into `emit` above through this mutable handle — the hub itself is not in the broadcast
@@ -431,6 +464,12 @@ setHotwordSource((sessionId) => hotwordsFor(store, sessionId).map((h) => h.word)
   // behaviour); the switch exists because a synthetic turn spends tokens the operator may not want
   // spent at 3am — and it is read live, so flipping it applies to the next completion.
   mgr.setCompletionWakeSource(() => agentSettings().completionWake);
+  // 语音通话（issue #48）: 「在打电话」 has exactly one authority in this process (the notify centre's
+  // presence, which the page already reports every 30 s), so the voice-mode block and the thinking
+  // dial derive from it instead of adding a second client→server state channel. The presence
+  // listener turns each report into the transitions the manager records.
+  mgr.setCallLiveSource(() => notify.callLiveSession());
+  notify.onPresenceChange(() => { void mgr.syncCallState(); });
   mgr.startIdleReaper({
     idleMs: () => envIdleMs ?? agentSettings().idleKillMin * 60_000,
     warmSlots: () => envWarm ?? agentSettings().warmSlots,
@@ -494,7 +533,9 @@ function installSafetyNet(): void {
   });
 }
 
-// AC5: reclaim orphans from previous run before serving anything.
+// AC5: reclaim orphans from a previous run — only reachable once the instance lock above proved this
+// process is the single owner of DATA_DIR, and only killing agents that receipt proves are ours
+// (incident 2026-10-22: a second instance used to execute the live cockpit's slots here, every 10 s).
 const killed = mgr.reclaimOrphans();
 if (killed) console.log(`[agentus] reclaimed ${killed} orphan agent process(es)`);
 

package/packages/server/src/instance-lock.ts

@@ -0,0 +1,235 @@
+// ONE data directory, ONE server.
+//
+// Why this file exists (incident 2026-10-22, `tasks/20261001-agentus/incident-20261022-orphan-reclaim.md` §7):
+// a hand-written promote script started a SECOND server on the live data dir (a different port, so
+// `listen` was happy). That instance then ran the startup orphan reclaim — which kills every agent
+// pid the database remembers — and executed the agents of the server that was already serving. Every
+// 10 s the launchd job retried, failed with EADDRINUSE, and killed the operator's freshly restored
+// sessions again: the failure looked like "my sessions die on resume".
+//
+// So identity is claimed BEFORE anything that can touch another instance's processes:
+//   · the claim is an O_EXCL `server.pid` in the data dir (atomic on every filesystem we ship to),
+//   · a claim is only honoured while its pid is alive AND still looks like an agentus server,
+//   · a dead or foreign holder is replaced (crash/SIGKILL must not brick the data dir),
+//   · nothing here kills anything — refusing to start is the whole remedy.
+
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+
+/** The claim lives beside the sqlite store: same dir, same 0700 guarantees. */
+export const LOCK_FILE = "server.pid";
+
+export interface LockHolder {
+  pid: number;
+  port: number | null;
+  dataDir: string;
+  /** Identifies THIS process run. Agents record it too, so a reclaim can tell "previous run" from
+   *  "mine" — see `acp/agent-owner.ts`. */
+  instanceId: string;
+  startedAt: number;
+  entry: string;
+}
+
+export interface LockHandle {
+  ok: true;
+  path: string;
+  holder: LockHolder;
+  /** Set when the previous holder was gone and we took the directory over. */
+  tookOver: LockHolder | null;
+  release(): void;
+}
+
+export interface LockRefused {
+  ok: false;
+  holder: LockHolder | null;
+  /** One line an operator can act on; `index.ts` prints it verbatim. */
+  why: string;
+}
+
+/** `ps -o command=` — the argv of a pid, or null when it is gone. */
+export function commandLineOf(pid: number): string | null {
+  try {
+    const out = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+    });
+    const s = out.trim();
+    return s || null;
+  } catch {
+    return null;
+  }
+}
+
+/** Kernel start time of a pid (ms), or null when it cannot be read. Used only to detect pid REUSE. */
+export function startedAtOf(pid: number): number | null {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    if (!out) return null;
+    const t = Date.parse(out); // "Thu Oct 22 23:42:48 2026" under the C locale ps uses
+    return Number.isFinite(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+
+export function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM = exists, just not ours to signal. Either way it is NOT free to take over silently.
+    return (err as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+/** Does this argv look like an agentus server? Deliberately narrow: a pid that is merely alive must
+ *  never block a restart because its number was recycled by an unrelated program. Covers the source
+ *  entry (`packages/server/src/index.ts`, tsx or node), the built one (`dist/server/index.js`) and a
+ *  globally installed package (`…/node_modules/agentus/…`). */
+export function looksLikeServer(cmd: string | null): boolean {
+  if (!cmd) return false;
+  if (!/\b(node|tsx|bun|deno)\b/.test(cmd)) return false;
+  return /packages[\\/]server[\\/](src[\\/]index|dist[\\/]index)\.(ts|js|mjs|cjs)\b/.test(cmd)
+    || /agentus[\\/](dist[\\/])?server[\\/]index\.(js|mjs|cjs)\b/.test(cmd);
+}
+
+/** Synchronous sleep: this runs during module init, before any event loop turn is meaningful. */
+function sleepSync(ms: number): void {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) { /* spin: only when Atomics is unavailable */ }
+  }
+}
+
+function readHolder(lockPath: string): LockHolder | null {
+  try {
+    const raw = fs.readFileSync(lockPath, "utf8");
+    const j = JSON.parse(raw) as Partial<LockHolder>;
+    if (typeof j.pid !== "number" || !Number.isInteger(j.pid)) return null;
+    return {
+      pid: j.pid,
+      port: typeof j.port === "number" ? j.port : null,
+      dataDir: typeof j.dataDir === "string" ? j.dataDir : "",
+      instanceId: typeof j.instanceId === "string" ? j.instanceId : "",
+      startedAt: typeof j.startedAt === "number" ? j.startedAt : 0,
+      entry: typeof j.entry === "string" ? j.entry : "",
+    };
+  } catch {
+    return null; // unreadable or truncated: a crashed writer, treat as no claim
+  }
+}
+
+/** Is the recorded holder still a live agentus server on THIS data dir? */
+function judgeHolder(holder: LockHolder, dataDir: string): { alive: boolean; why: string } {
+  if (holder.pid === process.pid) return { alive: false, why: `claim names this very pid (${holder.pid})` };
+  if (!pidAlive(holder.pid)) return { alive: false, why: `pid ${holder.pid} is gone` };
+  const cmd = commandLineOf(holder.pid);
+  if (!cmd) return { alive: false, why: `pid ${holder.pid} disappeared while checking` };
+  if (!looksLikeServer(cmd)) {
+    return { alive: false, why: `pid ${holder.pid} was recycled by another program (${cmd.slice(0, 120)})` };
+  }
+  if (holder.dataDir && path.resolve(holder.dataDir) !== path.resolve(dataDir)) {
+    // The file lives in OUR dir but names another one: copied/hand-edited file. Its pid may well be
+    // a healthy server for the OTHER directory — replacing the claim is right, killing is not.
+    return { alive: false, why: `claim names data dir ${holder.dataDir}, not ${dataDir}` };
+  }
+  if (holder.startedAt) {
+    const actual = startedAtOf(holder.pid);
+    // 1 s of slack: `ps` prints whole seconds. Anything larger means pid reuse, not our process.
+    if (actual !== null && Math.abs(actual - holder.startedAt) > 2000) {
+      return { alive: false, why: `pid ${holder.pid} start time does not match the claim (reused pid)` };
+    }
+  }
+  return { alive: true, why: `pid ${holder.pid} (port ${holder.port ?? "?"}) is serving this data dir` };
+}
+
+export interface AcquireOptions {
+  /** Port this instance intends to listen on; recorded for the operator, not used for judging. */
+  port?: number | null;
+  /** How long to wait for a dying holder to release (a restart hands over within a second; a live
+   *  second instance must be refused quickly enough to be useful). */
+  waitMs?: number;
+}
+
+/**
+ * Claim `dataDir`. Returns a handle (already released on process exit) or a refusal with the reason.
+ *
+ * Callers MUST `process.exit(1)` on a refusal and MUST NOT touch the store, the agents or the port:
+ * the whole point is that a second instance leaves the first one's world untouched.
+ */
+export function acquireInstanceLock(dataDir: string, opts: AcquireOptions = {}): LockHandle | LockRefused {
+  const lockPath = path.join(dataDir, LOCK_FILE);
+  const me: LockHolder = {
+    pid: process.pid,
+    port: opts.port ?? null,
+    dataDir: path.resolve(dataDir),
+    instanceId: randomUUID(),
+    startedAt: Date.now(),
+    entry: process.argv[1] ?? "",
+  };
+  const deadline = Date.now() + (opts.waitMs ?? 4000);
+  let tookOver: LockHolder | null = null;
+
+  for (;;) {
+    try {
+      // O_EXCL: the kernel decides who wins, even with two servers starting in the same tick.
+      const fd = fs.openSync(lockPath, "wx", 0o600);
+      try {
+        fs.writeFileSync(fd, JSON.stringify(me, null, 2));
+      } finally {
+        fs.closeSync(fd);
+      }
+      const handle: LockHandle = {
+        ok: true, path: lockPath, holder: me, tookOver,
+        release: () => {
+          // Only ever remove OUR claim: a slow instance must not delete the claim of the one that
+          // replaced it (that is how two servers end up owning one directory).
+          const onDisk = readHolder(lockPath);
+          if (!onDisk || onDisk.pid !== me.pid || onDisk.instanceId !== me.instanceId) return;
+          try { fs.unlinkSync(lockPath); } catch { /* already gone */ }
+        },
+      };
+      process.once("exit", handle.release);
+      return handle;
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") {
+        return { ok: false, holder: null, why: `cannot create ${lockPath}: ${(err as Error).message}` };
+      }
+    }
+
+    const holder = readHolder(lockPath);
+    if (!holder) {
+      // A crashed writer left junk (or a zero-byte file). Remove and retry.
+      try { fs.unlinkSync(lockPath); } catch { /* raced with another starter: loop decides */ }
+      continue;
+    }
+    const verdict = judgeHolder(holder, dataDir);
+    if (verdict.alive) {
+      if (Date.now() < deadline) {
+        // A restart tears the old process down first; give it a moment instead of failing a
+        // `tsx watch` reload or a promote on a scheduling hiccup.
+        sleepSync(250);
+        continue;
+      }
+      return { ok: false, holder, why: verdict.why };
+    }
+    tookOver = holder;
+    console.log(`[agentus] instance lock: taking over ${lockPath} — ${verdict.why}`);
+    try { fs.unlinkSync(lockPath); } catch { /* someone else cleaned it: the next open decides */ }
+  }
+}
+
+/** For a diagnostic line: "1m 12s". */
+export function humanAge(ms: number): string {
+  const s = Math.max(0, Math.round(ms / 1000));
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  return `${m}m ${s % 60}s`;
+}

package/packages/server/src/notify/center.ts

@@ -238,6 +238,13 @@ export class NotifyCenter {
     return next;
   }
 
+  /** Called after EVERY presence report (issue #48 wires it to the voice-mode transitions). Kept as
+   *  a listener rather than a direct call so the notify centre stays free of session knowledge. */
+  #onPresence?: (p: Presence) => void;
+  onPresenceChange(fn: (p: Presence) => void): void {
+    this.#onPresence = fn;
+  }
+
   /** The cockpit says which session it is looking at; null/visible=false means "nobody is". */
   setPresence(sessionId: string | null, visible: boolean, call = false): Presence {
     this.presence = {
@@ -254,6 +261,9 @@ export class NotifyCenter {
     if (this.presence.sessionId && (this.presence.visible || this.presence.call)) {
       this.onFocus?.(this.presence.sessionId);
     }
+    // Announce AFTER the fields are settled: a listener asking `callLiveSession()` must see the
+    // report it was just told about, not the previous one.
+    try { this.#onPresence?.(this.presence); } catch { /* presence is a hint, never a requirement */ }
     return this.presence;
   }
 
@@ -273,6 +283,15 @@ export class NotifyCenter {
     return Boolean(this.presence.call) && Date.now() - this.presence.at < NotifyCenter.WATCH_TTL_MS;
   }
 
+  /** WHICH session is on a call right now, or null. The public form of `onCall()` for issue #48:
+   *  the voice-mode block and the thinking-dial switch need the session id, not just a boolean, and
+   *  they must agree with the notification rules about what "on a call" means (one presence, one TTL,
+   *  one answer). */
+  callLiveSession(): string | null {
+    if (!this.onCall()) return null;
+    return this.presence.sessionId;
+  }
+
   /** True when a notification for this session would interrupt the operator looking at it. */
   private watching(sessionId: string): boolean {
     return this.rules().quietWhenWatching && this.operatorWatching(sessionId);

package/packages/server/src/store/store.ts

@@ -267,6 +267,29 @@ interface RawPlanRow {
   updated_at: number;
 }
 
+/** 语音通话状态的一行（issue #48）—— 见 `voice_mode` 表。 */
+export interface VoiceRow {
+  sessionId: string;
+  inCall: boolean;
+  boundary: "enter" | "exit" | null;
+  turns: number;
+  thoughtBefore: string | null;
+  thoughtTouched: boolean;
+  updatedAt: number;
+}
+
+export type VoiceModePatch = Partial<Omit<VoiceRow, "sessionId" | "updatedAt">>;
+
+interface RawVoiceRow {
+  session_id: string;
+  in_call: number;
+  boundary: string | null;
+  turns: number;
+  thought_before: string | null;
+  thought_touched: number;
+  updated_at: number;
+}
+
 /** What a plan write carries. `explanation: undefined` means "keep the remark that is there"
  *  (only an agent writes one, and most plan updates carry none) — see `upsertPlan`. */
 export interface PlanPatch {
@@ -351,6 +374,19 @@ export class Store {
         items text not null, title text, explanation text, source text not null,
         terminal text, updated_at integer not null
       );
+      -- 语音通话模式（issue #48）. The two boundaries must SURVIVE a reload, an idle-reap and a
+      -- cold start: if the exit boundary were only in memory, a page refresh after hanging up would
+      -- leave the model believing it is still on a call (the transcript's last turns all sound like
+      -- one). Same待遇 as the plan row: state the cockpit owns, not something the transcript records.
+      create table if not exists voice_mode (
+        session_id text primary key,
+        in_call integer not null default 0,
+        boundary text,                    -- 'enter' | 'exit' | null (owed, rides the next prompt)
+        turns integer not null default 0, -- prompts spoken inside this call (the exit block quotes it)
+        thought_before text,              -- thinking depth to restore on hang-up (null = none taken)
+        thought_touched integer not null default 0, -- operator changed depth during the call
+        updated_at integer not null
+      );
     `);
     // The DB now holds the speech endpoint's key, so it is the operator's secret material:
     // 0600 like the file it replaced (a default 0644 sqlite file would be a downgrade).
@@ -913,6 +949,65 @@ export class Store {
     return this.getPlan(sessionId) as PlanSnapshot;
   }
 
+  /** 语音通话状态（issue #48）—— 读一行，缺省即「没在通话、没有欠着的边界」。 */
+  getVoiceMode(sessionId: string): VoiceRow {
+    const row = this.#db
+      .prepare("select session_id, in_call, boundary, turns, thought_before, thought_touched, updated_at from voice_mode where session_id = ?")
+      .get(sessionId) as RawVoiceRow | undefined;
+    return row
+      ? {
+          sessionId: row.session_id,
+          inCall: Boolean(row.in_call),
+          boundary: row.boundary === "enter" || row.boundary === "exit" ? row.boundary : null,
+          turns: row.turns ?? 0,
+          thoughtBefore: row.thought_before ?? null,
+          thoughtTouched: Boolean(row.thought_touched),
+          updatedAt: row.updated_at,
+        }
+      : { sessionId, inCall: false, boundary: null, turns: 0, thoughtBefore: null, thoughtTouched: false, updatedAt: 0 };
+  }
+
+  /** Write the parts that changed; undefined keeps the stored value (the plan patch's rule). */
+  upsertVoiceMode(sessionId: string, patch: VoiceModePatch): VoiceRow {
+    const prev = this.getVoiceMode(sessionId);
+    const next: VoiceRow = {
+      sessionId,
+      inCall: patch.inCall ?? prev.inCall,
+      boundary: patch.boundary === undefined ? prev.boundary : patch.boundary,
+      turns: patch.turns ?? prev.turns,
+      thoughtBefore: patch.thoughtBefore === undefined ? prev.thoughtBefore : patch.thoughtBefore,
+      thoughtTouched: patch.thoughtTouched ?? prev.thoughtTouched,
+      updatedAt: Date.now(),
+    };
+    this.#db
+      .prepare(
+        `insert into voice_mode (session_id, in_call, boundary, turns, thought_before, thought_touched, updated_at)
+         values (?, ?, ?, ?, ?, ?, ?)
+         on conflict(session_id) do update set
+           in_call = excluded.in_call, boundary = excluded.boundary, turns = excluded.turns,
+           thought_before = excluded.thought_before, thought_touched = excluded.thought_touched,
+           updated_at = excluded.updated_at`,
+      )
+      .run(
+        sessionId,
+        next.inCall ? 1 : 0,
+        next.boundary,
+        next.turns,
+        next.thoughtBefore,
+        next.thoughtTouched ? 1 : 0,
+        next.updatedAt,
+      );
+    return next;
+  }
+
+  /** Every session the store still believes is on a call — the list a hang-up has to sweep. */
+  listInCall(): VoiceRow[] {
+    const rows = this.#db
+      .prepare("select session_id from voice_mode where in_call = 1")
+      .all() as { session_id: string }[];
+    return rows.map((r) => this.getVoiceMode(r.session_id));
+  }
+
   appendMessage(m: Omit<StoredMessage, "seq">): StoredMessage {
     const seq = this.nextSeq(m.sessionId);
     this.#db