agentus 0.2.0 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "agentus",
- "version": "0.2.0",
+ "version": "0.3.0",
  "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
  "license": "Apache-2.0",
  "repository": {

package/packages/server/src/acp/registry.ts

@@ -53,6 +53,18 @@ export interface BackendRow {
   profile: string | null;
   /** default working directory for new slots (null = the dialog asks) */
   cwd: string | null;
+  /**
+   * The permission mode a NEW session from this row starts in — an ACP mode id (`default` /
+   * `accept_edits` / `dont_ask` today), or null for "send nothing, the agent keeps its own default".
+   *
+   * Applied at CREATION only: a resumed session already carries the mode its operator picked for it
+   * (Hermes persists it in the session's own meta), so re-applying the row's default on load would
+   * silently undo a per-session choice — the row declares where a conversation STARTS, nothing more.
+   *
+   * A mode the agent did not advertise is not sent (see rowWarnings): the session then comes up in
+   * the agent's own mode, and the row says so instead of the pick quietly doing nothing.
+   */
+  defaultMode: string | null;
   notes: string;
   /** seeded row (the ones that used to be env-driven); editable, but flagged in the UI */
   builtin: boolean;
@@ -191,7 +203,7 @@ export interface BackendHandshake {
   loadSession: boolean | null;
   /** agentCapabilities.sessionCapabilities.fork */
   fork: boolean | null;
-  modes: { currentModeId: string | null; available: string[] } | null;
+  modes: { currentModeId: string | null; available: string[]; names?: Record<string, string> } | null;
   configOptions: { id: string; name: string | null; currentValue: string | null }[];
   models: { currentModelId: string | null; available: string[] } | null;
   /** slash commands the agent announced (session/update or newSession) */
@@ -223,6 +235,9 @@ export function seedRows(now = Date.now()): BackendRow[] {
       home: null,
       profile: null,
       cwd: null,
+      // Nothing is sent: a freshly seeded row behaves exactly as the pre-feature cockpit did, and
+      // the operator opts a row in from the settings page.
+      defaultMode: null,
       notes: notes[id] ?? "",
       builtin: true,
       health: emptyHealth(),
@@ -283,8 +298,30 @@ export function planFor(row: BackendRow): BackendPlan {
   }
 }
 
-const ID_RE = /^[a-z0-9][a-z0-9._-]{0,40}$/;
+/**
+ * Everything a row should wear as a warning in the settings list, resolved in ONE place: the spawn
+ * concerns (`planFor`) plus the declarations that are silently INERT when they disagree with what the
+ * agent advertised. The failure this exists to prevent is a pick the operator set, believes in, and
+ * never sees take effect.
+ *
+ * The default mode is only judgeable against a real handshake — before the row's first session the
+ * cockpit knows nothing about that agent's modes, and a "cannot check yet" line would sit on every
+ * fresh row.
+ */
+export function rowWarnings(row: BackendRow): string[] {
+  const out = [...planFor(row).warnings];
+  const wanted = (row.defaultMode ?? "").trim();
+  const advertised = row.handshake?.modes?.available ?? [];
+  if (wanted && advertised.length && !advertised.includes(wanted)) {
+    out.push(
+      `默认权限「${wanted}」不在这个后端上次握手报出的档位里（${advertised.join(" / ")}）` +
+        `—— 新建会话不会用它，会话会照 agent 自己的默认来。`,
+    );
+  }
+  return out;
+}
 
+const ID_RE = /^[a-z0-9][a-z0-9._-]{0,40}$/;
 /** Shape an arbitrary request body into a row. `base` = the row being edited (PATCH). */
 export function coerceRow(body: Record<string, unknown>, base?: BackendRow): { row?: BackendRow; error?: string } {
   const now = Date.now();
@@ -337,6 +374,10 @@ export function coerceRow(body: Record<string, unknown>, base?: BackendRow): { r
       home: body.home === undefined ? (base?.home ?? null) : (s(body.home) || null),
       profile: body.profile === undefined ? (base?.profile ?? null) : (s(body.profile) || null),
       cwd: body.cwd === undefined ? (base?.cwd ?? null) : (s(body.cwd) || null),
+      // Not spawn-relevant, so it is deliberately ABSENT from `edited` below: which mode a new
+      // session starts in says nothing about which command this row resolves to, and clearing the
+      // health/handshake evidence over it would forget what the agent can do.
+      defaultMode: body.defaultMode === undefined ? (base?.defaultMode ?? null) : (s(body.defaultMode) || null),
       notes: body.notes === undefined ? (base?.notes ?? "") : s(body.notes),
       builtin: base?.builtin ?? false,
       // Health is evidence about the CURRENT spawn definition, so changing that definition
@@ -554,6 +595,14 @@ export function handshakeFrom(
     ? {
         currentModeId: s.modes.currentModeId ?? null,
         available: (s.modes.availableModes ?? []).map((m) => m.id),
+        // The DISPLAY name travels with the id: the settings page offers these as the default-mode
+        // picker (「Accept Edits」, not `accept_edits`), and this cache is the only place a row that
+        // is not running can learn what its agent calls its modes.
+        names: Object.fromEntries(
+          (s.modes.availableModes ?? [])
+            .filter((m) => m.id)
+            .map((m) => [m.id, (m as { name?: string }).name || m.id]),
+        ),
       }
     : null;
   const models = s.models

package/packages/server/src/acp/session-manager.ts

@@ -209,10 +209,17 @@ export class SessionManager {
     // one you come back to, even when it is the oldest row in the list.
     const lastAt = this.#store.lastActivityAt();
     return [...this.#sessions.values()]
+      // An ARCHIVED session is not 工作空间 material, whatever its process is doing (resume leaves the
+      // flag alone, so a restored-then-archived slot can be live). It is listed by `archived()`
+      // instead — one row in one bucket, or the rail shows the same slot twice.
+      .filter((s) => this.#store.getSession(s.info.id)?.archivedAt == null)
       .map((s) => ({
         ...s.info,
         lastSeq: this.#store.maxSeq(s.info.id),
         lastAt: lastAt.get(s.info.id) ?? s.info.createdAt,
+        archivedAt: null,
+        // a row in the manager's map has a process, by definition
+        cold: false,
       }))
       .sort((a, b) => (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt);
   }
@@ -416,6 +423,11 @@ export class SessionManager {
       live.info.models = readModels(res);
       // the row just proved itself: remember that, plus what the agent said it can do
       this.#noteBackendCheck(String(backend), { ok: true, latencyMs: Date.now() - spawnStarted }, handshakeFrom(init, res));
+      // The row's DEFAULT permission mode, applied HERE: on a brand-new session, before the first
+      // prompt. Hermes reads its mode through a live getter (acp_adapter/server.py `policy_getter`),
+      // so the very first turn is already governed by it. A later `resume()` never passes through
+      // this method — that is exactly what keeps a per-session pick from being silently undone.
+      await this.#applyDefaultMode(live);
       this.#updateSession(live);
       return live.info;
     } catch (err) {
@@ -699,33 +711,74 @@ export class SessionManager {
     });
   }
 
-  /** Sessions we know about on disk but have no process for (rail's cold slots). */
-  archived(limit = 20): SessionInfo[] {
+  /** Rows the OPERATOR put away — 已归档. Chosen by the archive FLAG, not by liveness: a session
+   *  the operator archived belongs there whatever its process is doing, and a session that merely
+   *  lost its process (crashed, was closed, or was reaped for being idle) does NOT — that was the
+   *  old rule, and it turned 已归档 into a drawer where the operator's own intent was
+   *  indistinguishable from debris.
+   *
+   *  No cap: this list is curated by hand, so hiding its tail would hide the operator's own work.
+   *  Real removal is the ✕ purge button (DELETE on a cold row). */
+  archived(): SessionInfo[] {
+    const lastAtAll = this.#store.lastActivityAt();
     return this.#store
-      // include closed rows: "close" means "kill the process, keep the transcript as a cold
-      // slot" (that is what the UI's close prompt promises) — filtering status!='closed' made
-      // the slot vanish from the rail entirely, leaving the transcript unreachable even though
-      // it was still on disk. Real deletion is the separate ✕ purge button.
       .listSessions(true)
-      .filter((r) => !this.#sessions.has(r.id))
-      .map((r) => ({
-        id: r.id, backend: r.backend, acpSessionId: r.acpSessionId, cwd: r.cwd,
-        workspace: r.workspace ?? null,
-        models: (r.models ?? null) as SessionInfo["models"],
-        contextLimit: r.contextLimit ?? null,
-        title: r.title, autoTitle: r.autoTitle ?? null, status: r.status, pid: null, createdAt: r.createdAt,
-        modes: (r.modes ?? null) as SessionModeState | null,
-        configOptions: (r.configOptions ?? []) as ConfigOptionView[],
-        usage: (r.usage ?? null) as SessionInfo["usage"],
-        commands: normCommands(r.commands),
-        lastSeq: this.#store.maxSeq(r.id),
-        lastAt: this.#store.lastActivityAt().get(r.id) ?? r.createdAt,
-      }))
+      .filter((r) => r.archivedAt != null)
+      .map((r) => {
+        const live = this.#sessions.get(r.id);
+        // An archived row can still have a process — resume does not touch the flag — and then it is
+        // NOT cold: the rail must draw a live row (and clicking it hands over the floor rather than
+        // waking anything), or the operator is told a slot is asleep while it is running.
+        return live
+          ? {
+              ...live.info,
+              lastSeq: this.#store.maxSeq(r.id),
+              lastAt: lastAtAll.get(r.id) ?? r.createdAt,
+              archivedAt: r.archivedAt ?? null,
+              cold: false,
+            }
+          : this.#infoFromRow(r);
+      })
+      .sort((a, b) => (b.archivedAt ?? 0) - (a.archivedAt ?? 0) || (b.lastAt ?? 0) - (a.lastAt ?? 0));
+  }
+
+  /** Cold rows that are NOT archived: on disk, no process, still part of 工作空间. A crashed slot,
+   *  one the operator closed, or one THIS cockpit reaped for being idle — all of them must stay
+   *  reachable in the rail (the old rule showed them under 已归档; the older one dropped them out of
+   *  the list entirely, which is how a transcript became unreachable while still on disk).
+   *
+   *  Capped, unlike `archived()`: crash debris accumulates without anyone choosing it, and the rail
+   *  has its own recent-N rule anyway. */
+  cold(limit = 20): SessionInfo[] {
+    return this.#store
+      .listSessions(true)
+      .filter((r) => r.archivedAt == null && !this.#sessions.has(r.id))
+      .map((r) => this.#infoFromRow(r))
       // cold rows by the same rule as live ones (recent chat first), THEN take the page
       .sort((a, b) => (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt)
       .slice(0, limit);
   }
 
+  /** One row in the shape list()/cold()/archived() produce, from a stored row. */
+  #infoFromRow(r: SessionRow): SessionInfo {
+    return {
+      id: r.id, backend: r.backend, acpSessionId: r.acpSessionId, cwd: r.cwd,
+      workspace: r.workspace ?? null,
+      models: (r.models ?? null) as SessionInfo["models"],
+      contextLimit: r.contextLimit ?? null,
+      title: r.title, autoTitle: r.autoTitle ?? null, status: r.status, pid: null, createdAt: r.createdAt,
+      modes: (r.modes ?? null) as SessionModeState | null,
+      configOptions: (r.configOptions ?? []) as ConfigOptionView[],
+      usage: (r.usage ?? null) as SessionInfo["usage"],
+      commands: normCommands(r.commands),
+      lastSeq: this.#store.maxSeq(r.id),
+      lastAt: this.#store.lastActivityAt().get(r.id) ?? r.createdAt,
+      archivedAt: r.archivedAt ?? null,
+      // no process by construction: this path only ever runs for a row that is not in the map
+      cold: true,
+    };
+  }
+
   async prompt(
     sessionId: string,
     text: string,
@@ -827,6 +880,47 @@ export class SessionManager {
     await s.conn.cancel({ sessionId: s.info.acpSessionId }).catch(() => {});
   }
 
+  /**
+   * Put a NEW session into its backend row's default permission mode (BackendRow.defaultMode).
+   * Called from `create()` only — see the call site for why a resume must never do this.
+   *
+   * Three refusals are deliberate:
+   *  · a row with no default sends NOTHING (the agent keeps its own default) — so a registry the
+   *    operator never touched behaves exactly as it did before this existed;
+   *  · a mode the agent did not advertise is not sent either: it would come back as a refusal nobody
+   *    sees, and the settings row already wears a warning saying the pick does not match this
+   *    agent's handshake (registry.rowWarnings);
+   *  · a failure NEVER fails the slot. The session is usable, just in the agent's own mode — and the
+   *    log line is the only evidence of which of those two happened, so it is not optional.
+   */
+  async #applyDefaultMode(live: LiveSession): Promise<void> {
+    const wanted = (this.#store.getBackend(String(live.info.backend))?.defaultMode ?? "").trim();
+    if (!wanted) return;
+    const modes = live.info.modes;
+    const acpSessionId = live.info.acpSessionId;
+    if (!modes || !live.conn || !acpSessionId) return;
+    const ids = (modes.availableModes ?? []).map((m) => m.id);
+    if (!ids.includes(wanted)) {
+      console.log(
+        `[agentus] session ${live.info.id}: default permission mode "${wanted}" is not advertised by ` +
+          `${String(live.info.backend)} (${ids.join(", ") || "no modes"}) — sending nothing`,
+      );
+      return;
+    }
+    if (modes.currentModeId === wanted) return;
+    try {
+      await live.conn.setSessionMode({ sessionId: acpSessionId, modeId: wanted });
+      live.info.modes = { ...modes, currentModeId: wanted };
+      console.log(`[agentus] session ${live.info.id}: default permission mode -> ${wanted}`);
+    } catch (e) {
+      // qodercli advertises modes but answered -32601 in the design probe, so "advertised but not
+      // implemented" is a real case — same tolerance as setMode(), and never a failed spawn.
+      console.log(
+        `[agentus] session ${live.info.id}: default permission mode "${wanted}" not applied: ${errMessage(e)}`,
+      );
+    }
+  }
+
   async setMode(sessionId: string, modeId: string): Promise<void> {
     const s = this.#need(sessionId);
     if (!s.conn || !s.info.acpSessionId) throw new Error("session not ready");
@@ -1107,17 +1201,87 @@ export class SessionManager {
 
   async closeSession(sessionId: string): Promise<void> {
     const s = this.#need(sessionId);
-    for (const { resolve, timer } of s.pendingPermissions.values()) {
+    this.#stop(s, "closed");
+    this.#emitSessions();
+  }
+
+  /** 归档 / 取消归档 — the operator's own STORAGE decision, taken independently of the process.
+   *
+   *  Archiving a LIVE session stops its process too: 「我把它收起来了」 and 「它还在后台吃内存」
+   *  contradict each other, and demanding a close first would make the archive a two-step ritual that
+   *  says nothing about intent. Un-archiving only moves the flag — the row lands back in 工作空间 as
+   *  a cold slot, and the rail's 「取消归档并恢复」 wakes it with a separate resume (so a restore that
+   *  fails to load leaves a visible cold slot rather than an error nobody asked for). */
+  async setArchived(id: string, on: boolean): Promise<SessionInfo> {
+    const live = this.#sessions.get(id);
+    const row = this.#store.getSession(id);
+    if (!row) throw new Error(`no such session: ${id}`);
+    if (on && live) this.#stop(live, "archived");
+    this.#store.setArchived(id, on ? Date.now() : null);
+    this.#emitSessions();
+    return this.#sessions.get(id)?.info ?? this.#coldInfo(id);
+  }
+
+  /** Stop a slot's agent process and record WHY it went away. The row always survives with its
+   *  transcript: the transcript is the operator's, the process is ours to reclaim.
+   *
+   *  `reaped` is its own status on purpose — 「它怎么变冷了」 has three different answers (I closed
+   *  it / it crashed / the cockpit reclaimed it for being idle) and a rail that shows one word for
+   *  all three teaches the operator to distrust the column. */
+  #stop(live: LiveSession, why: "closed" | "archived" | "reaped"): void {
+    for (const { resolve, timer } of live.pendingPermissions.values()) {
       clearTimeout(timer);
       resolve({ outcome: { outcome: "cancelled" } });
     }
-    s.pendingPermissions.clear();
-    s.child?.kill("SIGTERM");
-    s.info.status = "closed";
-    const row = this.#store.getSession(sessionId);
-    if (row) this.#store.upsertSession({ ...row, status: "closed", closedAt: Date.now(), pid: null });
-    this.#sessions.delete(sessionId);
-    this.#emitSessions();
+    live.pendingPermissions.clear();
+    live.child?.kill("SIGTERM");
+    live.info.status = why === "reaped" ? "reaped" : "closed";
+    live.info.pid = null;
+    const row = this.#store.getSession(live.info.id);
+    if (row) {
+      this.#store.upsertSession({
+        ...row, status: live.info.status, closedAt: Date.now(), pid: null,
+      });
+    }
+    this.#sessions.delete(live.info.id);
+  }
+
+  /** Reclaim idle slots: stop the agent process of a session nobody has touched for the operator's
+   *  threshold. Deliberately NOT an archive — the row stays in 工作空间 wearing `reaped` and a click
+   *  brings it back. AionUi ships exactly this switch (设置 → 系统 → 「Agent 空闲超时（分钟）」,
+   *  default 5, 1–60) and the guards below are what its changelog had to add after the first version
+   *  killed agents that were still working: never touch a slot mid-turn, one waiting on a human, or
+   *  one the operator is WATCHING right now (a reply that lands while he reads it must not be killed
+   *  under him).
+   *
+   *  `idleMs()` is read on every tick, so a settings change applies with no restart; 0 = off. */
+  startIdleReaper(opts: { idleMs: () => number; watched?: (id: string) => boolean; intervalMs?: number }): () => void {
+    const interval = opts.intervalMs ?? 30_000;
+    const tick = (): void => {
+      const idleMs = opts.idleMs();
+      if (!(idleMs > 0)) return;
+      const now = Date.now();
+      let reaped = 0;
+      for (const s of [...this.#sessions.values()]) {
+        if (s.busy || s.pendingPermissions.size) continue;
+        if (s.info.status === "starting" || s.info.status === "running") continue;
+        if (opts.watched?.(s.info.id)) continue;
+        const lastAt = s.info.lastAt ?? s.info.createdAt;
+        if (now - lastAt < idleMs) continue;
+        console.log(
+          `[agentus] idle reap: ${s.info.id} (${Math.round((now - lastAt) / 60_000)} min idle, limit ${Math.round(idleMs / 60_000)} min)`,
+        );
+        this.#stop(s, "reaped");
+        reaped += 1;
+      }
+      // Only speak when something changed: a frame every tick would be noise on the socket (and on
+      // the phone's notification path, which observes this same stream).
+      if (reaped) this.#emitSessions();
+    };
+    const timer = setInterval(tick, interval);
+    // A server that will not exit because of the reclaim timer is a worse bug than the memory it saves.
+    timer.unref?.();
+    return () => clearInterval(timer);
   }
 
   /** The list every client needs to be current: the rows PLUS what is already waiting for an
@@ -1689,22 +1853,14 @@ export class SessionManager {
     this.#store.touchActivity(live.info.id, at);
   }
 
-  /** One cold row, in the same shape list()/archived() produce. */
+  /** One cold row, in the same shape list()/cold()/archived() produce. */
   #coldInfo(id: string): SessionInfo {
     const r = this.#store.getSession(id);
     if (!r) throw new Error(`no such session: ${id}`);
     return {
-      id: r.id, backend: r.backend, acpSessionId: r.acpSessionId, cwd: r.cwd,
-      workspace: r.workspace ?? null, contextLimit: r.contextLimit ?? null,
+      ...this.#infoFromRow(r),
+      // the one difference from the list path: the model's own window, which the resume card prints
       modelContextLimit: this.#store.getModelLimit(((r.models ?? null) as SessionInfo["models"])?.currentModelId ?? null),
-      models: (r.models ?? null) as SessionInfo["models"],
-      title: r.title, autoTitle: r.autoTitle ?? null, status: r.status, pid: null, createdAt: r.createdAt,
-      modes: (r.modes ?? null) as SessionModeState | null,
-      configOptions: (r.configOptions ?? []) as ConfigOptionView[],
-      usage: (r.usage ?? null) as SessionInfo["usage"],
-      commands: normCommands(r.commands),
-      lastSeq: this.#store.maxSeq(id),
-      lastAt: this.#store.lastActivityAt().get(id) ?? r.createdAt,
     };
   }
 
@@ -1748,6 +1904,8 @@ export class SessionManager {
       pid: null,
       createdAt: now,
       closedAt: null,
+      // a fork is a NEW conversation: it is nobody's archive (the parent's flag is not inherited)
+      archivedAt: null,
       // the agent just told us the fork's modes/options — keep them so the new slot shows
       // the right permission mode and thinking depth before it is even resumed
       modes: res?.modes ?? source.info.modes ?? null,
@@ -1798,6 +1956,9 @@ function sessionRow(i: SessionInfo, home: string | null = null) {
   return {
     id: i.id, backend: i.backend, acpSessionId: i.acpSessionId, cwd: i.cwd,
     title: i.title, status: i.status, pid: i.pid, createdAt: i.createdAt, closedAt: null,
+    // never written by this upsert (the archive flag has its own statement — see setArchived):
+    // carried here only so the row type stays honest.
+    archivedAt: i.archivedAt ?? null,
     modes: i.modes ?? null, configOptions: i.configOptions ?? [],
     usage: i.usage ?? null, commands: i.commands ?? [],
     models: i.models ?? null,

package/packages/server/src/index.ts

@@ -14,13 +14,13 @@ import { exportFilename, renderJson, renderMarkdown, type ExportSessionHeader }
 import { SessionManager, SessionUnavailable } from "./acp/session-manager.js";
 import { describeAcpError } from "./acp/errors.js";
 import { BACKENDS } from "./acp/backends.js";
-import { classifyError, checkedHealth, coerceRow, inspectRow, planFor, seedRows, startupCheck } from "./acp/registry.js";
+import { classifyError, checkedHealth, coerceRow, inspectRow, planFor, rowWarnings, seedRows, startupCheck } from "./acp/registry.js";
 import { ChangedOnDiskError, FsError, listDirs, readTextFile, statFile, writeTextFile } from "./fs.js";
 import { terms } from "./term.js";
 import { VoiceError, listVoiceModels, setHotwordSource, synthesize, transcribe, voiceCapabilities } from "./voice.js";
 import { hotwordsFor, vocabularyOf } from "./hotwords.js";
 import { openDashscopeStream } from "./dashscope.js";
-import { initSettings, publicSettings, saveCall, savePrefs, saveSettings, saveTheme } from "./settings.js";
+import { agentSettings, initSettings, publicSettings, saveAgent, saveCall, savePrefs, saveSettings, saveTheme } from "./settings.js";
 import * as auth from "./auth.js";
 import { NotifyCenter } from "./notify/center.js";
 import type { BackendId, ClientCommand, PermissionDecision, PromptAttachment, ServerEvent } from "../../shared/src/index.js";
@@ -169,9 +169,19 @@ const mgr = new SessionManager(store, emit);
 
 /** The session list every client stays current with: the rows PLUS what is already waiting for
  *  an answer. Pending approvals are STATE, not just an event — a page that connects or refreshes
- *  after the request was raised still has to be able to show it. */
+ *  after the request was raised still has to be able to show it.
+ *
+ *  Three buckets, because the rail has three answers to 「这个会话在哪」 and one field cannot carry
+ *  them: `sessions` = live (a process is attached), `cold` = on disk with no process and NOT
+ *  archived (they belong in 工作空间 too — a crashed slot must not look archived), `archived` = the
+ *  operator put it away. Each row also carries `cold`/`archivedAt`, so a client never has to infer
+ *  state from which list a row arrived in (that inference is exactly what merged 已归档 with 死了). */
 const sessionsEvent = (): ServerEvent => ({
-  t: "sessions", sessions: mgr.list(), pending: mgr.pendingPermissions(),
+  t: "sessions",
+  sessions: mgr.list(),
+  cold: mgr.cold(),
+  archived: mgr.archived(),
+  pending: mgr.pendingPermissions(),
 });
 
 // ---- notify channel (docs/android-notify-contract.md) ----------------------------
@@ -234,6 +244,43 @@ initSettings(DATA_DIR, store);
 // so the lookup is injected rather than imported.
 setHotwordSource((sessionId) => hotwordsFor(store, sessionId).map((h) => h.word));
 
+// ---- idle reclaim (AionUi parity: 设置 → 系统 → 「Agent 空闲超时（分钟）」) ---------------------
+// The operator's standing answer to 「一个 ready 了好几个小时的槽位还挂着 agent 进程」. It STOPS the
+// process and nothing else: the row stays in 工作空间 wearing `reaped`, one click brings it back, and
+// its transcript is untouched — reaping is not archiving (that is the operator's own decision now).
+//
+// The threshold is read on every tick, so changing it in 设置 applies immediately (no restart — a
+// restart would kill exactly the slots this feature exists to keep alive cheaply). Two env knobs for
+// QA: AGENTUS_IDLE_KILL_MIN accepts a FRACTION of a minute, which is how the reclaim path is
+// exercised in seconds instead of in five minutes (AionUi made its own timeouts env-configurable for
+// the same reason), and AGENTUS_IDLE_SWEEP_MS moves the tick.
+{
+  // ABSENT must mean "follow 设置", not 0 — `Number("")` is 0, which would silently disable the
+  // reaper on every instance that never sets the env (measured: the startup line said 「0 min」 on an
+  // instance whose setting was 5). Only a real, non-empty value is an override.
+  const envNum = (raw: string | undefined): number | null => {
+    const s = String(raw ?? "").trim();
+    if (!s) return null;
+    const n = Number(s);
+    return Number.isFinite(n) && n >= 0 ? n : null;
+  };
+  const envIdle = envNum(process.env.AGENTUS_IDLE_KILL_MIN);
+  const envIdleMs = envIdle != null ? envIdle * 60_000 : null;
+  const envSweep = envNum(process.env.AGENTUS_IDLE_SWEEP_MS);
+  const sweepMs = envSweep != null && envSweep >= 1000 ? envSweep : 30_000;
+  const source = envIdleMs != null ? "AGENTUS_IDLE_KILL_MIN" : "settings.agent.idleKillMin";
+  console.log(
+    `[agentus] idle reclaim: ${
+      envIdleMs != null ? envIdle : agentSettings().idleKillMin
+    } min (${source}), sweep ${Math.round(sweepMs / 1000)}s, 0 = off`,
+  );
+  mgr.startIdleReaper({
+    idleMs: () => envIdleMs ?? agentSettings().idleKillMin * 60_000,
+    watched: (id) => notify.operatorWatching(id),
+    intervalMs: sweepMs,
+  });
+}
+
 /** The tail of the session being dictated into, for DashScope's context enhancement
  *  ("根据上下文"): user/assistant turns only, capped at 5 by the API. */
 function dictationContext(sessionId?: string): { role: "user" | "assistant"; text: string }[] {
@@ -620,7 +667,10 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
             // settings page shows it next to the row: it is the one declaration an operator may
             // want to flip when an agent gains (or loses) native plan support.
             nativePlanSource: row.nativePlanSource,
-            warnings: plan.warnings,
+            // Which permission mode a NEW session from this row starts in (null = the agent's own
+            // default); the settings page edits it next to the other row declarations.
+            defaultMode: row.defaultMode,
+            warnings: rowWarnings(row),
             health: row.health, handshake: row.handshake,
           };
         }),
@@ -633,7 +683,7 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
       if (store.getBackend(row.id)) return send(res, 409, { error: `backend ${row.id} already exists` });
       store.upsertBackend(row);
       const plan = planFor(row);
-      return send(res, 201, { ok: true, id: row.id, warnings: plan.warnings });
+      return send(res, 201, { ok: true, id: row.id, warnings: rowWarnings(row) });
     }
     const beMatch = url.pathname.match(/^\/api\/backends\/([\w.-]+)(\/.*)?$/);
     if (beMatch) {
@@ -643,7 +693,7 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
       if (!existing) return send(res, 404, { error: `unknown backend: ${beId}` });
       if (req.method === "GET" && beSub === "") {
         const plan = planFor(existing);
-        return send(res, 200, { ...existing, home: plan.home, warnings: plan.warnings });
+        return send(res, 200, { ...existing, home: plan.home, warnings: rowWarnings(existing) });
       }
       if ((req.method === "PATCH" || req.method === "PUT") && beSub === "") {
         const body = (await readJson(req)) as Record<string, unknown>;
@@ -651,7 +701,7 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
         if (!row) return send(res, 400, { error });
         store.upsertBackend(row);
         const plan = planFor(row);
-        return send(res, 200, { ok: true, id: row.id, warnings: plan.warnings });
+        return send(res, 200, { ok: true, id: row.id, warnings: rowWarnings(row) });
       }
       if (req.method === "DELETE" && beSub === "") {
         // A row that OPEN sessions still name must stay: deleting it would leave them pointing
@@ -700,7 +750,7 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
     if (url.pathname === "/api/sessions" && req.method === "GET") {
       // `pending` rides along because it is STATE, not an event: a page that loads or refreshes
       // after the request was raised never saw the event, and would otherwise show nothing.
-      return send(res, 200, { live: mgr.list(), archived: mgr.archived(), pending: mgr.pendingPermissions() });
+      return send(res, 200, { live: mgr.list(), cold: mgr.cold(), archived: mgr.archived(), pending: mgr.pendingPermissions() });
     }
     // The session's plan object — what the cockpit's card renders. STATE too, and the one piece of
     // it that cannot be replayed: after the agent process died there are no frames left to read,
@@ -829,7 +879,8 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
         if (body.theme && typeof body.theme === "object") saveTheme(body.theme as Record<string, unknown>);
         if (body.call && typeof body.call === "object") saveCall(body.call as Record<string, unknown>);
         if (body.prefs && typeof body.prefs === "object") savePrefs(body.prefs as Record<string, unknown>);
-        if (!body.voice && !body.theme && !body.call && !body.prefs) saveSettings(body);
+        if (body.agent && typeof body.agent === "object") saveAgent(body.agent as Record<string, unknown>);
+        if (!body.voice && !body.theme && !body.call && !body.prefs && !body.agent) saveSettings(body);
         return send(res, 200, publicSettings());
       } catch (e) {
         return send(res, 400, { error: String((e as Error)?.message ?? e) });
@@ -945,6 +996,30 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
         }
         return send(res, 404, { error: `no such session: ${id}` });
       }
+      if (req.method === "POST" && sub === "/archive") {
+        // 归档: the operator's own storage decision (and it stops a live process — see
+        // SessionManager.setArchived). Distinct from DELETE, which on a LIVE slot only closes it and
+        // on a COLD one purges the record: 归档 is the middle statement, and before this route the UI
+        // had no way to make it.
+        try {
+          const info = await mgr.setArchived(id, true);
+          emit(sessionsEvent());
+          return send(res, 200, info);
+        } catch (e) {
+          return send(res, 404, { error: String((e as Error)?.message ?? e) });
+        }
+      }
+      if (req.method === "POST" && sub === "/unarchive") {
+        // 取消归档: moves the flag only. Waking the slot is a SEPARATE /resume, so a restore that
+        // cannot load leaves a visible cold slot in 工作空间 instead of an error nobody asked for.
+        try {
+          const info = await mgr.setArchived(id, false);
+          emit(sessionsEvent());
+          return send(res, 200, info);
+        } catch (e) {
+          return send(res, 404, { error: String((e as Error)?.message ?? e) });
+        }
+      }
       if (req.method === "POST" && sub === "/resume") {
         // AC5's other half: bring a cold slot back to life (respawn + loadSession)
         try {

package/packages/server/src/notify/center.ts

@@ -197,7 +197,18 @@ export class NotifyCenter {
 
   /** True when a notification for this session would interrupt the operator looking at it. */
   private watching(sessionId: string): boolean {
-    if (!this.rules().quietWhenWatching) return false;
+    return this.rules().quietWhenWatching && this.operatorWatching(sessionId);
+  }
+
+  /** Is the operator looking at this session RIGHT NOW? A fresh presence report (the SPA re-reports
+   *  every few seconds) from a visible page or a live call.
+   *
+   *  Public and rule-free on purpose — the ONE question two features share with different gates.
+   *  `watching()` above answers "should notification be quiet?" and therefore consults the operator's
+   *  quietWhenWatching preference; the idle reaper asks "would killing this slot's process pull the
+   *  rug out from under a reply he is reading?", and routing THAT through a notification preference
+   *  would let a checkbox decide whether agent processes get killed. */
+  operatorWatching(sessionId: string): boolean {
     if (this.presence.sessionId !== sessionId) return false;
     if (Date.now() - this.presence.at >= NotifyCenter.WATCH_TTL_MS) return false;
     // A call counts even when nobody has touched the screen for minutes: on a call the hands are free