agentus 0.3.2 → 0.3.4

package/packages/server/src/index.ts

@@ -1,7 +1,6 @@
 // Agentus server entry: HTTP (REST + static web build) + WebSocket relay.
 // The browser never talks to CLI subprocesses directly (design.md §1).
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { createServer as createHttpsServer } from "node:https";
 import type { Duplex } from "node:stream";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
@@ -31,7 +30,7 @@ const PORT = Number(process.env.AGENTUS_PORT ?? 8788);
 // cwd-relative path would silently open a second database (the operator's slots would
 // "disappear"). Both entry points must land on the same store.
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // …/packages/server/src
-// WHERE STATE LIVES — sqlite, credentials.json, auth.token, tls/, settings.json.
+// WHERE STATE LIVES — sqlite, credentials.json, auth.token, settings.json.
 //   1. `AGENTUS_DATA` when it is set. Every launcher and dev/QA instance pins it, so the
 //      rules below can never move a running install's data out from under it.
 //   2. `~/.agentus` once it holds something, or when there is no repo-side data yet.
@@ -41,7 +40,7 @@ const HERE = path.dirname(fileURLToPath(import.meta.url)); // …/packages/serve
 //      directory won and how to move).
 // NOTHING may write inside node_modules: for an installed package
 // `<pkg>/packages/server/.data` is deleted by the next `npm i -g agentus`, taking the
-// transcript, the login and the TLS key with it.
+// transcript and the login with it.
 const DEFAULT_DATA_DIR = path.join(homedir(), ".agentus");
 const REPO_DATA_DIR = path.resolve(HERE, "../.data");
 const hasData = (dir: string): boolean => {
@@ -69,19 +68,6 @@ const APK_FILE = process.env.AGENTUS_APK
     path.join(DATA_DIR, "agentus-companion.apk"),
   ].find((p) => fs.existsSync(p))
   ?? path.resolve(HERE, "../../../android/artifacts/agentus-companion.apk");
-// Optional second listener, TLS (see the block right before listen). Declared up here
-// because the request handler also serves the public cert — a phone that has to trust a
-// self-signed issuer needs to fetch the cert from somewhere, and that somewhere should
-// not require already trusting it.
-//   AGENTUS_TLS_PORT=0  -> off;  no cert on disk -> off (the LAN listener is unaffected).
-const TLS_PORT = Number(process.env.AGENTUS_TLS_PORT ?? 8443);
-const TLS_CERT = process.env.AGENTUS_TLS_CERT ?? path.join(DATA_DIR, "tls", "cert.pem");
-const TLS_KEY = process.env.AGENTUS_TLS_KEY ?? path.join(DATA_DIR, "tls", "key.pem");
-// The issuer a device installs once (make-cert.sh: long-lived root + short-lived leaf).
-// Falls back to the leaf itself for a single self-signed cert from an older setup.
-const TLS_CA = process.env.AGENTUS_TLS_CA ?? path.join(DATA_DIR, "tls", "ca.pem");
-const TLS_READY = TLS_PORT > 0 && fs.existsSync(TLS_CERT) && fs.existsSync(TLS_KEY);
-
 // `agentus --where` (bin/agentus.mjs) asks the ONE place that decides these paths to say
 // what it decided, then exits — before any listener, store or subprocess exists. Print and
 // exit here rather than re-deriving the same rules in the CLI: "where is my data" must not
@@ -92,12 +78,11 @@ if (process.env.AGENTUS_PRINT_PATHS) {
   console.log(`[agentus] data dir      ${DATA_DIR}  (${DATA_DIR_SOURCE})`);
   console.log(`[agentus] web bundle    ${WEB_DIST}  (${has(path.join(WEB_DIST, "index.html"))})`);
   console.log(`[agentus] companion apk ${APK_FILE}  (${has(APK_FILE)})`);
-  console.log(`[agentus] tls listener  ${TLS_READY ? `on :${TLS_PORT} (${TLS_CERT})` : `off (AGENTUS_TLS_PORT=${TLS_PORT}, cert ${has(TLS_CERT)})`}`);
   console.log(`[agentus] http port     ${PORT}`);
   process.exit(0);
 }
 
-fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 }); // 0700: credentials + TLS key live here
+fs.mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 }); // 0700: credentials live here
 const store = new Store(path.join(DATA_DIR, "agentus.sqlite"));
 // M6: an existing cockpit must behave exactly as before, so the registry starts as a copy of
 // the builtin (env-driven) rows and the operator edits from there. Seeding is one-shot: an
@@ -223,16 +208,25 @@ notify.onAction(({ ref, action, activity, device }) => {
   console.log(`[notify] action device=${device.name} activity=${activity.activityId} action=${action.actionId} type=${ref?.type ?? "none"}`);
   if (!ref) return; // the button existed but nobody claimed it: log and drop, never guess
   switch (ref.type) {
-    case "permission":
+    case "permission": {
       // The lock screen answering an agent's permission prompt — the whole point of the channel.
-      mgr.respondPermission(String(ref.sessionId), String(ref.requestId), {
+      const applied = mgr.respondPermission(String(ref.sessionId), String(ref.requestId), {
         outcome: "selected",
         optionId: String(ref.optionId),
       }, {
         optionKind: typeof ref.optionKind === "string" ? ref.optionKind : undefined,
         signature: typeof ref.signature === "string" ? ref.signature : undefined,
       });
+      // The request is gone (our timeout, the agent gave up, its process died). Take the card off
+      // the phone instead of leaving a 「待你确认」 that no longer has a request behind it — the
+      // browser gets `permission-expired` for the same click, and a phone that keeps a dead button
+      // is the same defect one device over.
+      if (!applied) {
+        console.log(`[notify] permission answer dropped for ${ref.requestId}: card dismissed`);
+        notify.dismiss(`perm:${ref.requestId}`);
+      }
       return;
+    }
     case "open":
       return; // the app already opened the deeplink; nothing to do server-side
     default:
@@ -240,6 +234,19 @@ notify.onAction(({ ref, action, activity, device }) => {
   }
 });
 
+// The page channel of the same decision: one `notify` frame to every cockpit websocket.
+//
+// No cursor, no replay, and no per-client state — deliberately unlike the device socket above. The
+// phone replays because it was PAIRED and may have been asleep in a pocket; a browser tab that missed
+// frames has a transcript to catch up in, and a wall of stale cards after a reload is worse than none.
+// Every gate that matters (which kinds, whether the channel is on) was applied in the notify centre.
+notify.onNotice((notice) => {
+  const wire = JSON.stringify({ t: "notify", notice });
+  for (const { ws } of clients.values()) {
+    if (ws.readyState === WebSocket.OPEN) ws.send(wire);
+  }
+});
+
 // Operator settings (voice, theme, call knobs, talk-to-agent prefs) live in the store's
 // `settings` table: the UI owns them and env only bootstraps them (settings.ts). Read
 // before anything asks.
@@ -270,6 +277,11 @@ setHotwordSource((sessionId) => hotwordsFor(store, sessionId).map((h) => h.word)
   };
   const envIdle = envNum(process.env.AGENTUS_IDLE_KILL_MIN);
   const envIdleMs = envIdle != null ? envIdle * 60_000 : null;
+  // 热备 (warm slots): same ABSENT≠0 discipline as above. The TTL takes a FRACTION of a minute so the
+  // warm-EXPIRY path can be exercised in seconds rather than by waiting out a day.
+  const envWarm = envNum(process.env.AGENTUS_WARM_SLOTS);
+  const envWarmTtlMin = envNum(process.env.AGENTUS_WARM_TTL_MIN);
+  const envWarmTtlMs = envWarmTtlMin != null ? envWarmTtlMin * 60_000 : null;
   const envSweep = envNum(process.env.AGENTUS_IDLE_SWEEP_MS);
   const sweepMs = envSweep != null && envSweep >= 1000 ? envSweep : 30_000;
   const source = envIdleMs != null ? "AGENTUS_IDLE_KILL_MIN" : "settings.agent.idleKillMin";
@@ -278,8 +290,18 @@ setHotwordSource((sessionId) => hotwordsFor(store, sessionId).map((h) => h.word)
       envIdleMs != null ? envIdle : agentSettings().idleKillMin
     } min (${source}), sweep ${Math.round(sweepMs / 1000)}s, 0 = off`,
   );
+  // The warm set is the other half of the same decision (which slots survive being quiet) and it is
+  // NEVER inferred from the idle value: 「最近 N 个即使空闲也保留」 and 「其余空闲多久收」 are two
+  // answers. Printing both with their sources is what turns 「为什么它被收了」 into one glance.
+  console.log(
+    `[agentus] warm slots: ${envWarm ?? agentSettings().warmSlots} kept up to ${
+      envWarmTtlMs != null ? envWarmTtlMs / 3_600_000 : agentSettings().warmTtlHours
+    } h untouched (${envWarm != null || envWarmTtlMs != null ? "AGENTUS_WARM_*" : "settings.agent"}), 0 = off / never`,
+  );
   mgr.startIdleReaper({
     idleMs: () => envIdleMs ?? agentSettings().idleKillMin * 60_000,
+    warmSlots: () => envWarm ?? agentSettings().warmSlots,
+    warmTtlMs: () => envWarmTtlMs ?? agentSettings().warmTtlHours * 3_600_000,
     watched: (id) => notify.operatorWatching(id),
     intervalMs: sweepMs,
   });
@@ -393,9 +415,10 @@ function serveStatic(req: IncomingMessage, res: ServerResponse): void {
   fs.createReadStream(file).pipe(res);
 }
 
-// One request handler, two listeners: plain HTTP on PORT (LAN, loopback, curl/scripts)
-// and TLS on TLS_PORT (the port a public tunnel points at). Shared on purpose — auth,
-// routes and static serving must not drift between the two.
+// One request handler, plain HTTP on PORT (LAN, loopback, curl/scripts).
+// TLS is NOT terminated in-process: put a TLS-terminating reverse proxy (or a tunnel that
+// does its own `public_tls`) in FRONT of this port. That keeps the LAN path warning-free
+// and `curl`/scripts byte-identical, and keeps cert lifecycle out of the app.
 const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
   const url = new URL(req.url ?? "/", "http://x");
   try {
@@ -437,24 +460,6 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
       return res.end("Agentus: authentication required\n");
     }
 
-    // GET /cert.crt — the ISSUER to install into a phone's trust store (the "proceed
-    // anyway" click, once per device, is the whole cost of TOFU; this makes it a download).
-    // With make-cert.sh's root+leaf setup this is the root, so the leaf can be rotated
-    // yearly without every device having to re-install.
-    // PUBLIC material only: the key never leaves <DATA>/tls/.
-    if (url.pathname === "/cert.crt") {
-      if (!TLS_READY) return send(res, 404, { error: "tls is off on this server" });
-      const der = fs.readFileSync(fs.existsSync(TLS_CA) ? TLS_CA : TLS_CERT);
-      res.writeHead(200, {
-        // Apple's installer claims this type and opens the profile flow directly;
-        // Android/Chrome just downloads the file.
-        "content-type": "application/x-x509-ca-cert",
-        "content-disposition": 'attachment; filename="agentus.crt"',
-        "content-length": String(der.length),
-      });
-      return res.end(der);
-    }
-
     // ---- the phone's onboarding page + the APK, both behind the operator login ----------
     // The pairing code lives on this page, so it is NOT public: an unauthenticated visitor is
     // sent to the login screen (the SPA at /) and comes back with a session cookie.
@@ -1235,7 +1240,14 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
         const html = fs.readFileSync(path.join(WEB_DIST, "index.html"), "utf8");
         asset = html.match(/\/assets\/index-([A-Za-z0-9_-]+)\.js/)?.[1] ?? null;
       } catch { /* no build on disk (dev server without dist) */ }
-      return send(res, 200, { asset });
+      // …and `dev`: WHICH INSTANCE this is. Only two things in the UI care, and both are about
+      // keeping a QA backend out of the operator's way — the mock agent shows up in the new-session
+      // form on a dev instance only. The marker is the dev runner's own environment (`DEV_TREE`,
+      // written by scripts/dev.sh; also AGENTUS_DEV=1 for a launcher of one's own); the live
+      // launcher sets neither, so live answers false. An instance-level fact, so it rides the
+      // endpoint that already describes the instance rather than every backend row.
+      const dev = Boolean(process.env.DEV_TREE) || process.env.AGENTUS_DEV === "1";
+      return send(res, 200, { asset, dev });
     }
     if (url.pathname.startsWith("/api/")) return send(res, 404, { error: "not_found" });
     return serveStatic(req, res);
@@ -1254,8 +1266,7 @@ const httpServer = createServer(handleRequest);
 // it becomes a socket. A browser cannot set headers on a WS handshake, so auth
 // rides on the cookie (sent automatically, same-origin) — or ?token= for scripts.
 const wss = new WebSocketServer({ noServer: true });
-// Bound to BOTH listeners (see the TLS block before listen): a browser on the TLS port
-// needs its wss sockets too, and this handler reads the cookie / ?token=, never the scheme.
+// Bound to the single HTTP listener; this handler reads the cookie / ?token=, never the scheme.
 const handleUpgrade = (req: IncomingMessage, socket: Duplex, head: Buffer) => {
   const url = new URL(req.url ?? "/", "http://x");
   // The companion's socket carries its own device token in the query — a phone cannot set
@@ -1581,25 +1592,6 @@ httpServer.listen(PORT, "0.0.0.0", () => {
     );
   }
 });
-// ---- optional TLS listener (self-signed) ----
-// A tunnel that terminates on the public internet must NOT be plain HTTP: the login
-// password and the session cookie would cross it in the clear. SEPARATE from PORT on
-// purpose, so the LAN path stays plain HTTP — no cert warning in the house, curl
-// unchanged. (Config constants live at the top, next to the other paths.)
-if (TLS_READY) {
-  const httpsServer = createHttpsServer({ cert: fs.readFileSync(TLS_CERT), key: fs.readFileSync(TLS_KEY) }, handleRequest);
-  httpsServer.on("upgrade", handleUpgrade);
-  httpsServer.listen(TLS_PORT, "0.0.0.0", () => {
-    console.log(`[agentus-server] https://0.0.0.0:${TLS_PORT} (self-signed, SAN ${TLS_CERT} — point a public tunnel at THIS port; ${PORT} stays for the LAN)`);
-  });
-  // A busy TLS port must not take the LAN listener down with it: log, keep serving.
-  httpsServer.on("error", (err) => {
-    console.error(`[agentus-server] tls listener failed on ${TLS_PORT}: ${(err as Error).message}`);
-  });
-} else if (TLS_PORT > 0) {
-  console.log(`[agentus-server] tls off: no cert at ${TLS_CERT} (create it with scripts/make-cert.sh, or set AGENTUS_TLS_PORT=0)`);
-}
-
 httpServer.on("error", (err) => {
   console.error(`[agentus] cannot listen on ${PORT}: ${(err as Error).message}`);
   process.exit(1); // fail fast: never linger as a listener-less zombie

package/packages/server/src/notify/center.ts

@@ -26,8 +26,10 @@ import type {
   NotifyFrame,
   NotifyRef,
   NotifyRules,
+  NotifyWebRules,
   Presence,
   OpenTarget,
+  WebNotice,
 } from "./types.js";
 
 export interface NotifyCenterOptions {
@@ -152,6 +154,8 @@ export class NotifyCenter {
   /** actionKey -> when it was consumed, so a button can only fire once. */
   private readonly consumed = new Map<string, number>();
   private onActionCb: ((e: ActionEvent) => void) | null = null;
+  /** The page channel's sink: index.ts fans this out to every cockpit websocket. */
+  private onNoticeCb: ((n: WebNotice) => void) | null = null;
   private timers: NodeJS.Timeout[] = [];
   private wss: WebSocketServer | null = null;
   /** Which session the cockpit is showing, and whether its tab is visible. Deliberately in
@@ -163,14 +167,34 @@ export class NotifyCenter {
 
   /** The operator's switches, always complete (a state file may predate them). */
   rules(): NotifyRules {
-    return { ...DEFAULT_NOTIFY_RULES, ...(this.state.rules ?? {}) };
+    // A state file written before the web channel existed has no `web` key at all, so the stored
+    // value is really partial — the cast says that out loud instead of pretending otherwise.
+    const stored = this.state.rules as Partial<NotifyRules> | undefined;
+    // `web` is merged one level deeper than the rest: a partial patch (one switch from the page) must
+    // not drop the other two — a nested object replaced wholesale is how a channel silently forgets
+    // its settings.
+    return {
+      ...DEFAULT_NOTIFY_RULES,
+      ...(stored ?? {}),
+      web: { ...DEFAULT_NOTIFY_RULES.web, ...(stored?.web ?? {}) },
+    };
   }
 
   setRules(patch: Partial<NotifyRules>): NotifyRules {
-    const next: NotifyRules = { ...this.rules(), ...patch };
+    const current = this.rules();
+    const next: NotifyRules = {
+      ...current,
+      ...patch,
+      web: { ...current.web, ...(patch.web ?? {}) },
+    };
     this.state.rules = next;
     this.save();
-    this.log(`[notify] rules turnStart=${next.turnStart} approval=${next.approval} completion=${next.completion} quietWhenWatching=${next.quietWhenWatching}`);
+    const w = next.web;
+    this.log(
+      `[notify] rules turnStart=${next.turnStart} approval=${next.approval} completion=${next.completion} ` +
+      `quietWhenWatching=${next.quietWhenWatching} | web enabled=${w.enabled} turnStart=${w.turnStart} ` +
+      `approval=${w.approval} completion=${w.completion}`,
+    );
     return next;
   }
 
@@ -473,6 +497,27 @@ export class NotifyCenter {
     return this.events.filter((e) => e.seq > cursor && e.activity.op !== "clear_all");
   }
 
+  // ---- the page channel (browser notifications) -----------------------------
+  //
+  // The same decision, a second renderer. Kept here (not in the page) so that strings, dedup and the
+  // card lifecycle have ONE owner: the page cannot re-derive "what happened" from the transcript, and
+  // a rule change must apply to both channels without shipping a bundle.
+  //
+  // What this channel deliberately does NOT do: consult presence. The page knows whether it is the
+  // tab in front (`document.hidden`) and stays quiet by itself, which is the same judgement made where
+  // the fact lives — and it must stay that way, because one browser tab cannot see the other machine.
+
+  onNotice(cb: (n: WebNotice) => void): void {
+    this.onNoticeCb = cb;
+  }
+
+  /** Emit one page notice, gated on the web channel's own switches. */
+  private notice(n: Omit<WebNotice, "at">, rule: keyof Omit<NotifyWebRules, "enabled">): void {
+    const web = this.rules().web;
+    if (!web.enabled || !web[rule]) return;
+    this.onNoticeCb?.({ ...n, at: Date.now() });
+  }
+
   // ---- actions -------------------------------------------------------------
 
   onAction(cb: (e: ActionEvent) => void): void {
@@ -927,11 +972,11 @@ export class NotifyCenter {
     const title = (sessionId: string): string => this.sessionTitle?.(sessionId) ?? sessionId.slice(0, 8);
     const link = (sessionId: string): string => `/?session=${encodeURIComponent(sessionId)}`;
     switch (evt.t) {
-      case "turn-start":
-        // The rules gate BEFORE anything else: an event that is switched off must not even be
-        // evaluated against presence (and a suppressed event must not be mistaken for a bug).
-        if (!this.rules().turnStart || this.watching(evt.sessionId)) return;
-        this.publish({
+      case "turn-start": {
+        // Rules gate the PHONE first, and that is why the page's copy is emitted before the gate: the
+        // two channels have independent switches, and an early return for one must not starve the
+        // other. Both render the SAME object, so the words can never drift apart.
+        const running: ActivityObject = {
           schema: 1, op: "upsert", activityId: `turn:${evt.sessionId}`, revision: this.nextRevision(`turn:${evt.sessionId}`),
           kind: "agent_running", priority: "low", ongoing: true, promotable: true,
           title: "Agentus · 运行中",
@@ -939,29 +984,55 @@ export class NotifyCenter {
           progress: { indeterminate: true },
           channel: { id: "agent_running", name: "任务运行中", importance: "low", sound: false },
           smallIcon: "agentus", ...tapTarget(link(evt.sessionId)), visibility: "public",
-        });
+        };
+        this.notice({
+          op: "upsert", noticeId: `turn:${evt.sessionId}`, kind: "agent_running",
+          // The browser card drops the `Agentus ·` prefix the phone title carries: a browser already
+          // shows the origin and the icon, so the product's own name would spend the visible line.
+          title: "运行中", body: running.body ?? "", open: link(evt.sessionId),
+        }, "turnStart");
+        if (!this.rules().turnStart || this.watching(evt.sessionId)) return;
+        this.publish(running);
         return;
-      case "permission":
+      }
+      case "permission": {
         // Never suppressed by presence: this is a decision waiting on a human, and the whole
         // point of the phone being in the loop is answering it while away from the desk.
+        const { activity, actionRefs } = this.approvalActivity(evt.request, title(evt.request.sessionId), link(evt.request.sessionId));
+        this.notice({
+          op: "upsert", noticeId: `perm:${evt.request.requestId}`, kind: "approval",
+          title: activity.title, body: activity.body ?? "", open: link(evt.request.sessionId),
+          // Sticky: a browser card that fades away while the agent is still blocked is the same
+          // failure as a dead button on a lock screen.
+          sticky: true,
+        }, "approval");
         if (!this.rules().approval) return;
-        this.publishApproval(evt.request, title(evt.request.sessionId), link(evt.request.sessionId));
+        this.publish(activity, { actionRefs });
         return;
+      }
       case "permission-resolved":
         // Always clear the card, even if the request itself was never published — a stale
-        // "waiting for you" on the phone is worse than no notification at all.
+        // "waiting for you" on the phone is worse than no notification at all. The page's card goes
+        // away for the same reason and with the same unconditionality — and it is NOT switch-gated:
+        // taking a dead card off the screen is not an interruption, and gating it on a preference
+        // would leave a card nobody can answer.
         this.dismiss(`perm:${evt.requestId}`);
+        this.onNoticeCb?.({
+          op: "dismiss", noticeId: `perm:${evt.requestId}`, kind: "approval", title: "", body: "", at: Date.now(),
+        });
         return;
       case "turn-end": {
         // The running card goes away unconditionally — a zombie "still running" on the phone is worse
         // than no card at all, even when the frame that started it was suppressed.
         this.dismiss(`turn:${evt.sessionId}`);
+        this.onNoticeCb?.({
+          op: "dismiss", noticeId: `turn:${evt.sessionId}`, kind: "agent_running", title: "", body: "", at: Date.now(),
+        });
         // Both gates belong here and both were missing: `completion` was stored but never read, and
         // presence was only consulted for turn-start — so the completion card fired while the operator was watching
         // the very session (and, mid-call, with a sound: the reported bug).
-        if (!this.rules().completion || this.watching(evt.sessionId)) return;
         const failed = Boolean(evt.error);
-        this.publish({
+        const done: ActivityObject = {
           schema: 1, op: "upsert", activityId: `done:${evt.sessionId}:${Date.now()}`, revision: 1,
           kind: failed ? "error" : "agent_done", priority: "high", ongoing: false, promotable: false,
           title: failed ? "执行失败" : "已完成",
@@ -974,10 +1045,23 @@ export class NotifyCenter {
           },
           actions: [{ id: "open", label: "查看", style: "primary" }],
           smallIcon: "agentus", ...tapTarget(link(evt.sessionId)), visibility: "private",
-        }, { actionRefs: { open: { type: "open", sessionId: evt.sessionId } } });
+        };
+        // The page's card is keyed per SESSION (`done:<id>`), unlike the phone's per-occurrence id:
+        // a browser card carries a `tag`, so one per session is what makes the newest replace the
+        // previous one instead of stacking a wall of 「已完成」. Nothing is lost — the transcript is
+        // the history; the card only has to say what just happened.
+        this.notice({
+          op: "upsert", noticeId: `done:${evt.sessionId}`, kind: failed ? "error" : "agent_done",
+          title: done.title, body: done.body ?? "", open: link(evt.sessionId),
+        }, "completion");
+        if (!this.rules().completion || this.watching(evt.sessionId)) return;
+        this.publish(done, { actionRefs: { open: { type: "open", sessionId: evt.sessionId } } });
         return;
       }
       case "error":
+        // Phone-only, on purpose. This is the cockpit's own error with no session in scope, and on a
+        // desktop it is already ON SCREEN — the page is drawing that error right now. A browser card
+        // repeating something the operator is looking at is the one thing this channel must not do.
         this.publish({
           schema: 1, op: "upsert", activityId: `error:${Date.now()}`, revision: 1, kind: "error",
           priority: "high", ongoing: false, promotable: false, title: "Agentus 报错",
@@ -991,7 +1075,12 @@ export class NotifyCenter {
     }
   }
 
-  private publishApproval(request: PermissionRequestView, sessionTitle: string, link: string): void {
+  /** The approval card, built but not published: the phone's activity and the page's notice are two
+   *  renderings of ONE object, so the wording lives here and nowhere else. */
+  private approvalActivity(request: PermissionRequestView, sessionTitle: string, link: string): {
+    activity: ActivityObject;
+    actionRefs: Record<string, NotifyRef>;
+  } {
     const actions = request.options.slice(0, 3).map((o) => ({
       id: o.optionId,
       label: o.name.slice(0, 24),
@@ -1006,15 +1095,18 @@ export class NotifyCenter {
       };
     }
     const tool = splitToolTitle(request.toolCallTitle);
-    this.publish({
-      schema: 1, op: "upsert", activityId: `perm:${request.requestId}`, revision: 1, kind: "approval",
-      priority: "high", ongoing: true, promotable: true,
-      title: tool.head ? `待你确认：${tool.head.slice(0, 60)}` : "待你确认",
-      body: nameAndDetail(sessionTitle, tool.target || request.kind),
-      channel: { id: "agent_approval", name: "权限请求", importance: "high", sound: true, vibration: true },
-      actions: actions.length ? actions : [{ id: "open", label: "查看", style: "primary" }],
-      input: { enabled: true, placeholder: "或直接回一句" },
-      smallIcon: "agentus", ...tapTarget(link), visibility: "private",
-    }, { actionRefs });
+    return {
+      activity: {
+        schema: 1, op: "upsert", activityId: `perm:${request.requestId}`, revision: 1, kind: "approval",
+        priority: "high", ongoing: true, promotable: true,
+        title: tool.head ? `待你确认：${tool.head.slice(0, 60)}` : "待你确认",
+        body: nameAndDetail(sessionTitle, tool.target || request.kind),
+        channel: { id: "agent_approval", name: "权限请求", importance: "high", sound: true, vibration: true },
+        actions: actions.length ? actions : [{ id: "open", label: "查看", style: "primary" }],
+        input: { enabled: true, placeholder: "或直接回一句" },
+        smallIcon: "agentus", ...tapTarget(link), visibility: "private",
+      },
+      actionRefs,
+    };
   }
 }

package/packages/server/src/notify/types.ts

@@ -200,6 +200,21 @@ export interface NotifyRules {
   completion: boolean;
   /** Do not push while the operator is looking at that very session in the cockpit. */
   quietWhenWatching: boolean;
+  /** The OTHER channel: browser notifications on a machine that has the cockpit open. Same events,
+   *  rendered by the page (see WebNotice). Its own switches because the two channels are used in
+   *  different places: a "running" card belongs on a lock screen and is noise on a desktop that is
+   *  already showing the transcript, and a desktop has no `quietWhenWatching` need — the page knows
+   *  its own tab is in front and stays silent by itself. */
+  web: NotifyWebRules;
+}
+
+/** The web channel's own view of the same three events. */
+export interface NotifyWebRules {
+  /** The whole channel: off means the server sends pages nothing, whatever the per-kind switches say. */
+  enabled: boolean;
+  turnStart: boolean;
+  approval: boolean;
+  completion: boolean;
 }
 
 export const DEFAULT_NOTIFY_RULES: NotifyRules = {
@@ -207,8 +222,18 @@ export const DEFAULT_NOTIFY_RULES: NotifyRules = {
   approval: true,
   completion: true,
   quietWhenWatching: true,
+  // On by default, but only for the two events worth interrupting a desktop for: a decision waiting
+  // on a human, and a reply that finished while the tab was in the background.
+  web: { enabled: true, turnStart: false, approval: true, completion: true },
 };
 
+/**
+ * Server -> page: one browser notification. The type itself lives in `shared` (it is part of the
+ * browser protocol now — it rides the cockpit's websocket as `{t:"notify"}`), and is re-exported here
+ * so the notify centre keeps one import site.
+ */
+export type { WebNotice } from "../../../shared/src/index.js";
+
 /** Which session the cockpit is showing right now (in-memory only — presence is ephemeral). */
 export interface Presence {
   sessionId: string | null;

package/packages/server/src/settings.ts

@@ -124,13 +124,28 @@ export interface AgentSettings {
   /** minutes of no activity before a live slot's agent process is stopped to reclaim memory;
    *  0 = never. The row and its transcript always survive — this only stops the process. */
   idleKillMin: number;
+  /** 「热备」= how many of the most recently USED sessions keep their agent process no matter how
+   *  quiet they go. A FLOOR, not a ceiling: it names the slots that may not be reclaimed for being
+   *  idle, it does not bound how many may run. Ranked over live AND cold rows by the same clock the
+   *  sweep uses — a slot already reaped must not hand its seat to a session nobody has touched in
+   *  days. Archived rows never occupy a seat. 0 = off (every slot obeys idleKillMin). */
+  warmSlots: number;
+  /** Hours a warm slot may go untouched before even its exemption expires. Without this the warm set
+   *  is a permanent memory floor (5 × ~137 MB RSS measured); with it, a cockpit left alone for a day
+   *  comes back to nothing running. 0 = 不过期. */
+  warmTtlHours: number;
 }
 
-export const AGENT_DEFAULT: AgentSettings = { idleKillMin: 5 };
+export const AGENT_DEFAULT: AgentSettings = { idleKillMin: 5, warmSlots: 5, warmTtlHours: 24 };
 
 /** What the settings page may offer: the ends of the number field. Server-side enforcement uses
  *  the same pair, so a hand-written request cannot store a nonsense value. */
 export const AGENT_IDLE_RANGE: [number, number] = [0, 60];
+/** 0 = off. The upper end is a memory decision (one live agent ≈ 137 MB RSS measured), not a limit
+ *  the server has to defend. */
+export const AGENT_WARM_RANGE: [number, number] = [0, 20];
+/** 0 = 不过期; a week is the longest span worth offering on the page. */
+export const AGENT_WARM_TTL_RANGE: [number, number] = [0, 168];
 
 /** The NUMERIC knobs. `interruptMode` is a two-way choice, not a slider, so it is deliberately
  *  outside both the range table and the loops that validate numbers. */
@@ -293,9 +308,15 @@ function pickCall(raw: unknown): CallSettings {
 function pickAgent(raw: unknown): AgentSettings {
   const out = { ...AGENT_DEFAULT };
   if (raw && typeof raw === "object") {
-    const v = Number((raw as Record<string, unknown>).idleKillMin);
-    const [lo, hi] = AGENT_IDLE_RANGE;
-    if (Number.isFinite(v) && v >= lo && v <= hi) out.idleKillMin = v;
+    const r = raw as Record<string, unknown>;
+    const take = (key: keyof AgentSettings, range: [number, number]): void => {
+      const v = Number(r[key]);
+      const [lo, hi] = range;
+      if (Number.isFinite(v) && v >= lo && v <= hi) out[key] = v;
+    };
+    take("idleKillMin", AGENT_IDLE_RANGE);
+    take("warmSlots", AGENT_WARM_RANGE);
+    take("warmTtlHours", AGENT_WARM_TTL_RANGE);
   }
   return out;
 }
@@ -369,6 +390,8 @@ export function publicSettings(): Record<string, unknown> {
     agent: cache.agent,
     agentDefaults: AGENT_DEFAULT,
     agentIdleRange: AGENT_IDLE_RANGE,
+    agentWarmRange: AGENT_WARM_RANGE,
+    agentWarmTtlRange: AGENT_WARM_TTL_RANGE,
     // the defaults, so the UI can offer "reset to Bailian defaults"
     defaults: { ...DEFAULTS, apiKey: undefined, baseUrl: undefined },
     updatedAt: cache.updatedAt,
@@ -495,18 +518,23 @@ export function savePrefs(patch: Record<string, unknown>): Settings {
 }
 
 /** Agent-process knobs: its own update, like theme/call, so a bad number here cannot lock the
- *  operator out of the page that would fix it. Range-checked against AGENT_IDLE_RANGE before it is
- *  stored — this number decides whether agent processes get killed, so it is not a text field. */
+ *  operator out of the page that would fix it. Range-checked against the section's range table
+ *  before it is stored — these numbers decide whether agent processes get killed, so they are not
+ *  text fields. */
 export function saveAgent(patch: Record<string, unknown>): Settings {
   const a = { ...cache.agent };
-  if ("idleKillMin" in patch) {
-    const raw = typeof patch.idleKillMin === "number" ? patch.idleKillMin : Number(patch.idleKillMin);
-    const [lo, hi] = AGENT_IDLE_RANGE;
+  const set = (key: keyof AgentSettings, range: [number, number], unit: string, off: string): void => {
+    if (!(key in patch)) return;
+    const raw = typeof patch[key] === "number" ? (patch[key] as number) : Number(patch[key]);
+    const [lo, hi] = range;
     if (!Number.isFinite(raw) || raw < lo || raw > hi) {
-      throw new Error(`invalid idleKillMin: ${JSON.stringify(patch.idleKillMin)} (expected ${lo}…${hi} minutes, 0 = off)`);
+      throw new Error(`invalid ${key}: ${JSON.stringify(patch[key])} (expected ${lo}…${hi} ${unit}, ${off})`);
     }
-    a.idleKillMin = raw;
-  }
+    a[key] = raw;
+  };
+  set("idleKillMin", AGENT_IDLE_RANGE, "minutes", "0 = off");
+  set("warmSlots", AGENT_WARM_RANGE, "slots", "0 = off");
+  set("warmTtlHours", AGENT_WARM_TTL_RANGE, "hours", "0 = never expires");
   cache = { ...cache, agent: a, updatedAt: Date.now() };
   persist();
   return cache;

package/packages/shared/src/index.ts

@@ -194,8 +194,48 @@ export type ServerEvent =
   | { t: "plan"; sessionId: string; plan: PlanSnapshot }
   /** context-window usage for a slot (ACP usage_update) */
   | { t: "usage"; sessionId: string; usage: UsageView }
+  /** A browser notification for this machine (the web channel of the notify feature).
+   *
+   *  Same decision as the phone's cards, second renderer: the server maps an ACP event to a
+   *  title/body ONCE (notify/center.ts §ACP mapping) and hands the page a render-ready object, so the
+   *  page never re-derives what happened. Nothing here is Android's `ActivityObject` — no channels,
+   *  importances or actions; a browser ignores them, and sending fields a renderer cannot use is how a
+   *  second contract starts.
+   *
+   *  No cursor and no replay, unlike the phone's device socket: a tab that was closed has a
+   *  transcript to catch up in, and a wall of stale cards after a reload is worse than none. */
+  | { t: "notify"; notice: WebNotice }
   | { t: "error"; error: string };
 
+/**
+ * Server -> page, one browser notification (see the `notify` frame above).
+ *
+ * NOTE for whoever touches drawing: the page's ONLY jobs are (1) is this device allowed and willing
+ * (`Notification` exists, secure context, permission granted, the operator's local switch on), (2) is
+ * this tab in the background (`document.hidden` — the page's own answer to 「我正在看就不弹」, made
+ * where the fact lives), (3) draw it with `noticeId` as the notification `tag`. Everything about WHAT
+ * happened and WHEN to say it is decided server-side. */
+export interface WebNotice {
+  /** `upsert` = show (or replace) the card for `noticeId`; `dismiss` = take it away. */
+  op: "upsert" | "dismiss";
+  /** The page's slot AND its notification `tag`: one id = one card, a newer one replaces the old.
+   *  Chosen so a session's running/done cards replace themselves while each pending approval keeps
+   *  its own (every one of those is a decision still waiting for an answer). */
+  noticeId: string;
+  /** Semantic kind, for the page's own choices (per-kind sound, and whether a click is expected). */
+  kind: "agent_running" | "approval" | "agent_done" | "error";
+  /** What happened (short — the line the OS draws first). */
+  title: string;
+  /** `<会话名> · <detail>`, the same shape the phone's cards use. */
+  body: string;
+  /** Where a click lands, relative to this server (`/?session=<id>`). The phone's tap target is the
+   *  same URL, so "open the session that notified me" has one owner. */
+  open?: string | null;
+  /** True when the card must WAIT for the operator (an approval) rather than fade on its own. */
+  sticky?: boolean;
+  at: number;
+}
+
 export interface TurnTrace {
   model?: string;
   provider?: string;