agentus 0.5.0 → 0.6.1

package/README.md

@@ -50,12 +50,13 @@ logs in — you just have no backend to start a session on.
 
 A plain Hermes install drives sessions; the cockpit's own extras — per-session **thinking
 depth**, a permission mode that survives a restart, the **context-budget** field, the **status
-channel** (memory recall/save hints in the message stream), per-process skill roots, **background-job
-completion wake-ups** (a finished background process comes back as a turn of its own), and a
-**DeepSeek web backend** (search + extract on the model key) — come from the fork's integration
-build instead. That is a five-line install:
+channel** (memory recall/save hints in the message stream), per-process skill roots, **project
+skills made visible and switchable** (a repo's `.agents/skills` shows up as a `project_skills`
+option instead of being skipped in silence), **background-job completion wake-ups** (a finished
+background process comes back as a turn of its own), and a **DeepSeek web backend** (search +
+extract on the model key) — come from the fork's integration build instead. That is a five-line install:
 [§ Which Hermes to run](docs/installation.md#which-hermes-to-run) — currently the tag
-`agentus/v0.22.0/merge-20261018-1617`, on Hermes `v0.22.0`.
+`agentus/v0.22.0/merge-20261019-2348`, on Hermes `v0.22.0`.
 
 The first slot you start will use the Hermes home **your own agent already uses**
 (`~/.hermes`) unless the backend row names another one — see "HERMES_HOME" below.

package/README.zh-CN.md

@@ -45,11 +45,12 @@ web bundle、配套 APK —— 然后直接退出，不启动任何东西）。
 
 裸装的 Hermes 就能跑会话；驾驶舱自己的那几项能力 —— 按会话切换的**思考深度**、跨重启存活的**权限模式**、
 **上下文预算**输入框、把记忆召回 / 存记忆提示送进消息流的 **status 通道**、按进程指定的技能根、
+**项目 skill 可见可设**（仓库的 `.agents/skills` 会以 `project_skills` 选项出现，而不是被无声跳过）、
 **后台任务完成唤醒**（后台进程跑完会自己开一个回合回来），
 以及 **DeepSeek 的 web 后端**（搜索 + 正文抓取，共用模型 key）—— 来自 fork 的集成构建（tag）。
 装法就五行：
 [§ 该跑哪份 Hermes](docs/installation.zh-CN.md#该跑哪份-hermes) —— 当前是 tag
-`agentus/v0.22.0/merge-20261018-1617`，基座 Hermes `v0.22.0`。
+`agentus/v0.22.0/merge-20261019-2348`，基座 Hermes `v0.22.0`。
 
 你启动的第一个 slot 会使用**你自己的 agent 已经在用的**那个 Hermes home（`~/.hermes`），除非后端那一行
 指定了另一个 —— 见下面的「HERMES_HOME」。

package/docs/installation.md

@@ -39,7 +39,10 @@ mode that survives a restart** and `session/load`, a free-form **context budget*
 cockpit's message stream, **per-process skill roots** (`HERMES_EXTERNAL_SKILLS_DIRS`, which is how a
 slot sees the cockpit's own skill without anything being written into your `~/.hermes`),
 **background-job completion wake-ups** (a finished `terminal(background=true)` job is relayed back as
-a turn of its own, so the agent resumes instead of the turn simply ending), and a
+a turn of its own, so the agent resumes instead of the turn simply ending), **project skills the agent
+can see, trust and edit** (the cockpit reports which project skills a repo has and which tier you
+trust, and writes the trust level back to config — it rides the same status channel; a released
+Hermes silently skips untrusted project skills without saying so), and a
 **DeepSeek web backend** (`search` + `extract` on top of `DEEPSEEK_API_KEY` — DeepSeek has no separate
 search key).
 They live on the ACP branches of the fork
@@ -55,7 +58,7 @@ ref and gets rebuilt, while a tag never moves — so pin the tag. The `agentus/`
 ours apart from upstream's own tags (`v0.22.0`, `v0.22.0+canary.*`), and the timestamp in the
 last segment sorts, so "newest" is a `sort -V`.
 
-**Current integration build: `agentus/v0.22.0/merge-20261018-1617`** — the newest tag on the fork,
+**Current integration build: `agentus/v0.22.0/merge-20261019-2348`** — the newest tag on the fork,
 built on Hermes `v0.22.0`. This line is for orientation only, not the source of truth: the
 `TAG=$(…)` step below resolves the newest one on every run, so read it there if this sentence
 ever looks stale.

package/docs/installation.zh-CN.md

@@ -35,7 +35,9 @@ brew install node                 # 或者 https://nodejs.org/en/download
 （带 256K/512K/768K/1M 预设）、把记忆召回 / 存记忆提示送进驾驶舱消息流的 **status 通道**，以及
 **按进程指定的技能根**（`HERMES_EXTERNAL_SKILLS_DIRS` —— 驾驶舱靠它让槽位看见自己的 skill，
 不往你的 `~/.hermes` 写任何东西）、**后台任务完成唤醒**（`terminal(background=true)` 的进程跑完会被
-中继成一个新回合，agent 自己接着干，而不是回合就这么结束），以及 **DeepSeek 的 web 后端**
+中继成一个新回合，agent 自己接着干，而不是回合就这么结束）、**项目 skill 的可见 / 可信任 / 可写**
+（驾驶舱会告诉 agent 这个仓库有哪些项目 skill、你信任哪个层级，并能把信任层级写回配置 —— 信号走
+同一条 status 通道；裸装 Hermes 遇到没信任的项目 skill 是悄悄跳过、不吭声的），以及 **DeepSeek 的 web 后端**
 （`search` + `extract` 都复用
 `DEEPSEEK_API_KEY` —— DeepSeek 没有单独的搜索密钥）。它们在 fork
 [`LiangYang666/hermes-agent`](https://github.com/LiangYang666/hermes-agent) 的 ACP 分支上，
@@ -49,7 +51,7 @@ agentus/<hermes 内部版本>/merge-<YYYYMMDD-HHMM>
 tag。`agentus/` 这个前缀也把它和上游自己的 tag（`v0.22.0`、`v0.22.0+canary.*`）分开；最后一段是时间戳，
 可排序，所以「最新」就是一次 `sort -V`。
 
-**当前集成构建：`agentus/v0.22.0/merge-20261018-1617`** —— fork 上最新的那个 tag，基座 Hermes
+**当前集成构建：`agentus/v0.22.0/merge-20261019-2348`** —— fork 上最新的那个 tag，基座 Hermes
 `v0.22.0`。这行只为一眼看个大概，不是权威：下面的 `TAG=$(…)` 每次都会自己解析出最新，觉得这行过期就
 以它为准。
 

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "agentus",
- "version": "0.5.0",
+ "version": "0.6.1",
  "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
  "license": "Apache-2.0",
  "repository": {
@@ -58,6 +58,8 @@
   "token-format": "tsx scripts/qa/token-format.mts",
   "terminal-palette": "tsx scripts/qa/terminal-palette.mts",
   "android-trust-merge": "node scripts/qa/android-trust-merge.mjs",
+  "cards-persist": "node scripts/qa/cards-persist.mjs",
+  "cold-paging": "tsx scripts/qa/cold-paging.mts",
   "plan-hint-sweep": "node scripts/qa/plan-hint-sweep.mjs",
   "plan-service-sweep": "node scripts/qa/plan-service-sweep.mjs",
   "plan-mcp-sweep": "node scripts/qa/plan-mcp-sweep.mjs",

package/packages/server/src/acp/cold-page.ts

@@ -0,0 +1,82 @@
+/** Paging for the COLD session list — the rows that exist on disk with no process behind them.
+ *
+ *  Issue #34: the page used to be ONE global top-N by `lastAt`. Every consumer (rail grouping, the
+ *  rail's 展开其余 counter, search, `cockpit session list --workspace`) then treated that page as the
+ *  complete set, so the busiest workspace ate the whole page and every other workspace's cold
+ *  sessions vanished. It is not a cosmetic loss: a cold row is the ONLY handle that can wake that
+ *  session, so "not in the page" means "unreachable from the UI, even though the transcript is fine".
+ *
+ *  The intent behind the old cap is still real — crash debris accumulates without anyone choosing it
+ *  — so it is kept, but moved to the right axis: **N per workspace** (the same axis the rail already
+ *  groups by) plus a much larger total ceiling as the anti-bloat backstop.
+ *
+ *  Pure on purpose: the caller decides which rows EXIST (the cockpit's own scope rule), this decides
+ *  which of them survive the page. That way the rule is tested without a server or a browser. */
+
+import type { SessionInfo } from "@agentus/shared";
+
+/** How many cold rows a single workspace keeps by default. The rail shows `RAIL_RECENT` (5) before
+ *  「展开其余」, so 20 is the expand depth, not the visible depth. */
+export const COLD_PER_WORKSPACE = 20;
+
+/** Hard ceiling across all workspaces. Chosen to be far above any real installation's workspace
+ *  count × 20 while still bounding what a crash-storm can push into one WS frame. */
+export const COLD_TOTAL_MAX = 400;
+
+/** The cockpit CLI asks for a deeper page than the rail: an agent asking "what is going on in this
+ *  workspace" is not browsing, and it filters by `--workspace` on top. */
+export const COLD_PER_WORKSPACE_COCKPIT = 50;
+
+export interface ColdPage<T> {
+  /** Newest-first, at most `perWorkspace` per workspace and `totalMax` overall. */
+  rows: T[];
+  /** How many cold rows existed before paging — so a caller can tell an empty cockpit from a
+   *  truncated one. */
+  total: number;
+  /** `total - rows.length`: the rows this page left out. Non-zero means "this is a partial view". */
+  omitted: number;
+}
+
+/** Which bucket a cold row belongs to: the workspace the operator sees in the rail, falling back to
+ *  the cwd exactly like `sessionRow()` does — the two must not disagree, or a row would be paged by
+ *  one key and displayed under another. */
+export function coldKeyOf(row: Pick<SessionInfo, "workspace" | "cwd">): string {
+  return row.workspace || row.cwd || "/";
+}
+
+/** Sort rule shared with `list()`: recent activity first, ties broken by creation. */
+export function byActivity(a: Pick<SessionInfo, "lastAt" | "createdAt">, b: Pick<SessionInfo, "lastAt" | "createdAt">): number {
+  return (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt;
+}
+
+/**
+ * Bucket-aware cold paging.
+ *
+ * `sorted` must already be in the caller's display order (newest first). Each workspace keeps the
+ * first `perWorkspace` rows of that order; the survivors are merged and re-sorted so the overall list
+ * still reads newest-first, then cut at `totalMax` only if the merge exceeds it.
+ */
+export function coldPage<T extends Pick<SessionInfo, "workspace" | "cwd" | "lastAt" | "createdAt">>(
+  sorted: readonly T[],
+  perWorkspace: number = COLD_PER_WORKSPACE,
+  totalMax: number = COLD_TOTAL_MAX,
+): ColdPage<T> {
+  const total = sorted.length;
+  const per = Math.max(1, Math.floor(perWorkspace));
+  const cap = Math.max(per, Math.floor(totalMax));
+
+  const buckets = new Map<string, T[]>();
+  for (const row of sorted) {
+    const key = coldKeyOf(row);
+    const bucket = buckets.get(key);
+    if (!bucket) buckets.set(key, [row]);
+    else if (bucket.length < per) bucket.push(row);
+    // else: this workspace already has its page — the rest of its rows are the ones we omit
+  }
+
+  const kept: T[] = [];
+  for (const bucket of buckets.values()) kept.push(...bucket);
+  kept.sort(byActivity);
+  const rows = kept.length > cap ? kept.slice(0, cap) : kept;
+  return { rows, total, omitted: total - rows.length };
+}

package/packages/server/src/acp/session-manager.ts

@@ -14,6 +14,14 @@ import type {
   RequestPermissionResponse,
 } from "@agentclientprotocol/sdk";
 import { BACKENDS, buildSpawnEnv, nativePlanSourceOf, type BackendSpec } from "./backends.js";
+import {
+  byActivity,
+  coldPage as pageCold,
+  COLD_PER_WORKSPACE,
+  COLD_PER_WORKSPACE_COCKPIT,
+  COLD_TOTAL_MAX,
+  type ColdPage,
+} from "./cold-page.js";
 import { SKILLS_ROOT, installSkills, resolveSkillsDir } from "../skills/install.js";
 import { classifyError, checkedHealth, effectiveArgs, handshakeFrom, rowToSpec } from "./registry.js";
 import type { BackendHandshake, CheckErrorCode } from "./registry.js";
@@ -177,6 +185,12 @@ interface LiveSession {
     timer: NodeJS.Timeout;
   }>;
   alwaysAllow: Set<string>; // "allow_always" remembered per live session only (AionUi F-PERM-05)
+  /** requestId → seq of the `approval` row this request already wrote into the transcript, so the
+   *  decision can be filled into the SAME row instead of appending a second one. */
+  approvalSeq: Map<string, number>;
+  /** repo root → the `project-skills` row this session already shows, with its payload, so a
+   *  second "untrusted" notice never stacks and a decision can rewrite the row in place. */
+  skillNoticeSeq: Map<string, { seq: number; payload: Record<string, unknown> }>;
   stderrBuf: string[];
   /** What the agent says it can do (initialize.agentCapabilities). `fork` gates title
    *  regeneration, `load` gates resume; `image` is the one a TURN can be refused on — see
@@ -382,12 +396,25 @@ export class SessionManager {
    *
    * The decision is `cancelled` — what the agent would have received had nobody ever answered.
    */
+  /** 把一条已经落库的卡片换成新 payload，并推给所有客户端。
+   *
+   *  审批卡与项目 skill 卡都是「先落行、后补决定」：行必须在请求到达那一刻就写进转录（否则
+   *  刷新之后「弹过这张卡」这件事就不存在了），决定要等操作者点。改 payload 而不改 seq ——
+   *  seq 决定它在聊天记录里的位置，改了它会跳到别的地方。 */
+  #settleRow(live: LiveSession, seq: number | undefined, payload: Record<string, unknown>): void {
+    if (seq === undefined) return;
+    const row = this.#store.updateMessagePayload(seq, live.info.id, payload);
+    if (row) this.#emit({ t: "message", message: row });
+  }
+
   #dropPending(live: LiveSession, decision: PermissionDecision = { outcome: "cancelled" }): void {
     if (!live.pendingPermissions.size) return;
-    for (const [requestId, { resolve, timer }] of live.pendingPermissions) {
+    for (const [requestId, { resolve, timer, view }] of live.pendingPermissions) {
       clearTimeout(timer);
       resolve({ outcome: decision });
       this.#emit({ t: "permission-resolved", requestId, decision });
+      this.#settleRow(live, live.approvalSeq.get(requestId), { ...view, decision });
+      live.approvalSeq.delete(requestId);
     }
     live.pendingPermissions.clear();
   }
@@ -501,7 +528,8 @@ export class SessionManager {
         ...(opts.system ? { system: true } : {}),
         createdAt: now, modes: null, configOptions: [], commands: [],
       },
-      child, busy: false, pendingPermissions: new Map(), alwaysAllow: new Set(), stderrBuf: [],
+      child, busy: false, pendingPermissions: new Map(), alwaysAllow: new Set(),
+      approvalSeq: new Map(), skillNoticeSeq: new Map(), stderrBuf: [],
       background: [], pendingCompletions: [],
       caps: { fork: false, load: false, image: false }, turnSeq: 0, collectors: new Map(), planReminderPending: true,
       planToken: randomUUID(),
@@ -686,7 +714,8 @@ export class SessionManager {
         usage: (row.usage ?? null) as SessionInfo["usage"],
         commands: normCommands(row.commands),
       },
-      child, busy: false, pendingPermissions: new Map(), alwaysAllow: new Set(), stderrBuf: [],
+      child, busy: false, pendingPermissions: new Map(), alwaysAllow: new Set(),
+      approvalSeq: new Map(), skillNoticeSeq: new Map(), stderrBuf: [],
       background: [], pendingCompletions: [],
       caps: { fork: false, load: false, image: false }, turnSeq: 0, collectors: new Map(), planReminderPending: true,
       planToken: randomUUID(),
@@ -924,17 +953,26 @@ export class SessionManager {
    *  reachable in the rail (the old rule showed them under 已归档; the older one dropped them out of
    *  the list entirely, which is how a transcript became unreachable while still on disk).
    *
-   *  Capped, unlike `archived()`: crash debris accumulates without anyone choosing it, and the rail
-   *  has its own recent-N rule anyway. */
-  cold(limit = 20): SessionInfo[] {
-    return this.#store
+   *  Paged **per workspace** (#34), unlike `archived()` which is complete: crash debris accumulates
+   *  without anyone choosing it, so a cap is still right — but the axis has to be the one the rail
+   *  groups by. A global top-N let the busiest workspace eat the page, and since a cold row is the
+   *  only handle that can wake its session, everything it pushed out became unreachable from the UI
+   *  while the transcript sat fine on disk. See `cold-page.ts`. */
+  cold(perWorkspace = COLD_PER_WORKSPACE, totalMax = COLD_TOTAL_MAX): SessionInfo[] {
+    return this.coldPage(perWorkspace, totalMax).rows;
+  }
+
+  /** The same page plus `total`/`omitted`, so a caller can say "this is a partial view" instead of
+   *  presenting a truncated list as the whole cockpit. */
+  coldPage(perWorkspace = COLD_PER_WORKSPACE, totalMax = COLD_TOTAL_MAX): ColdPage<SessionInfo> {
+    const sorted = this.#store
       .listSessions(true)
       // system rows are the cockpit's own (see list()): never offered as a slot to wake
       .filter((r) => r.archivedAt == null && !r.system && !this.#sessions.has(r.id))
       .map((r) => this.#infoFromRow(r))
       // cold rows by the same rule as live ones (recent chat first), THEN take the page
-      .sort((a, b) => (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt)
-      .slice(0, limit);
+      .sort(byActivity);
+    return pageCold(sorted, perWorkspace, totalMax);
   }
 
   /** One row in the shape list()/cold()/archived() produce, from a stored row. */
@@ -1239,6 +1277,15 @@ export class SessionManager {
       rejected = true;
       actual = String(s.info.configOptions.find((o) => o.id === configId)?.currentValue ?? "");
     }
+    if (configId === "project_skills" && !rejected) {
+      // 决定落在卡上：卡片是「问过」的证据，改配置却不改卡，读起来就像问完没下文。
+      for (const [root, cur] of s.skillNoticeSeq) {
+        if (cur.payload.root && String(cur.payload.root) !== root) continue;
+        const payload = { ...cur.payload, state: actual };
+        cur.payload = payload;
+        this.#settleRow(s, cur.seq, payload);
+      }
+    }
     if (rejected) {
       this.#emit({
         t: "config-rejected",
@@ -1832,6 +1879,8 @@ export class SessionManager {
     s.pendingPermissions.delete(requestId);
     pending.resolve({ outcome: decision });
     this.#emit({ t: "permission-resolved", requestId, decision });
+    this.#settleRow(s, s.approvalSeq.get(requestId), { ...pending.view, decision });
+    s.approvalSeq.delete(requestId);
     return true;
   }
 
@@ -1892,6 +1941,33 @@ export class SessionManager {
       this.#queueOrWakeCompletion(live, finishedText);
       return;
     }
+    // Project skills the agent is NOT loading (fork: `_meta.hermes = {kind:"project_skills"}`).
+    // The same door, one more kind. It rides the live status channel on purpose: the sentence is
+    // about THIS open, and persisting it would put 「这个仓库有 N 个 skill 未启用」 above a
+    // conversation from last month — the very thing the status path already refuses to store.
+    const projectSkills = projectSkillsNoticeOf(u);
+    if (projectSkills) {
+      // 一张卡而不是一行闪现的状态：操作者要能在聊天记录里看到「这个仓库有 N 个 skill 没启用」，
+      // 并就地做决定（信任 / 先不）。每个 repo root 只落一次，重复打开不会堆卡片。
+      const rootKey = projectSkills.root || "(no root)";
+      if (!live.skillNoticeSeq.has(rootKey)) {
+        const payload: Record<string, unknown> = {
+          root: projectSkills.root,
+          count: projectSkills.count,
+          text: projectSkills.text,
+          state: "ask",
+        };
+        const row = this.#store.appendMessage({
+          sessionId: live.info.id,
+          kind: "project-skills",
+          payload,
+          createdAt: Date.now(),
+        });
+        live.skillNoticeSeq.set(rootKey, { seq: row.seq, payload });
+        this.#emit({ t: "message", message: row });
+      }
+      return;
+    }
     const statusText = statusLineOf(u);
     if (statusText) {
       const statusKind = statusKindOf(u);
@@ -2074,6 +2150,18 @@ export class SessionManager {
         outcome: { outcome: "selected", optionId: remembered.optionId } as never,
       });
     }
+    // 落一行再弹卡（操作者 2026-10-19）：审批只以 transient 事件存在时，弹窗关掉/刷新/换设备之后
+    // 就什么都不剩了 —— 「刚才那个请求我批的什么」无从查起。行在请求到达这一刻写，决定稍后补进
+    // 同一行（#settleRow），于是聊天记录里留下一条带结论的记录。
+    const approvalRow = this.#store.appendMessage({
+      sessionId: live.info.id,
+      kind: "approval",
+      payload: { ...view, decision: null },
+      createdAt: view.createdAt,
+    });
+    live.approvalSeq.set(requestId, approvalRow.seq);
+    this.#touch(live, approvalRow.createdAt);
+    this.#emit({ t: "message", message: approvalRow });
     this.#emit({ t: "permission", request: view });
     return new Promise<RequestPermissionResponse>((resolve) => {
       const timer = setTimeout(() => {
@@ -2081,6 +2169,9 @@ export class SessionManager {
         const d: PermissionDecision = { outcome: "cancelled" };
         resolve({ outcome: d });
         this.#emit({ t: "permission-resolved", requestId, decision: d });
+        // 超时也是「有结论」：卡片上要留下「没人答，已取消」，不能一直挂着等批准。
+        this.#settleRow(live, live.approvalSeq.get(requestId), { ...view, decision: d });
+        live.approvalSeq.delete(requestId);
       }, PERMISSION_TIMEOUT_MS);
       live.pendingPermissions.set(requestId, { view, resolve, timer });
     });
@@ -2159,10 +2250,17 @@ export class SessionManager {
   /** The cockpit CLI's read view (issue #15): the sessions the OPERATOR can see, in one list —
    *  live and cold, never 已归档 (that is the operator's shelf, not work in flight).
    *
-   *  Cold rows are capped by `cold()`'s own page size on purpose: an agent asking "what is going on"
-   *  gets the recent cockpit, not a scrollback of every session this install ever made. */
+   *  Cold rows are paged per workspace by `cold()`, deeper than the rail's own expand depth: an agent
+   *  asking "what is going on" is not browsing, and it filters by `--workspace` on top — but it still
+   *  must not receive a scrollback of every session this install ever made. */
   cockpitRows(): SessionInfo[] {
-    return [...this.list(), ...this.cold(50)];
+    return [...this.list(), ...this.cold(COLD_PER_WORKSPACE_COCKPIT)];
+  }
+
+  /** The cockpit's cold page together with what it left out, so `session list` can report
+   *  `capped` honestly instead of presenting a truncated view as the whole cockpit (#34). */
+  cockpitCold(): ColdPage<SessionInfo> {
+    return this.coldPage(COLD_PER_WORKSPACE_COCKPIT);
   }
 
   /** Approvals a session is WAITING on right now — the one fact worth waking another agent for. */
@@ -2569,6 +2667,28 @@ function hermesPayload(u: Record<string, unknown>): Record<string, unknown> {
   return meta?.hermes ?? {};
 }
 
+/** Untrusted project skills the agent reported at session open, or null.
+ *
+ *  Shape (fork `acp_adapter/server.py::_notify_project_skills`): empty thought chunk with
+ *  `_meta.hermes = {kind:"project_skills", state:"untrusted", root, skillCount, text}`. The agent
+ *  sends it only when the repo actually carries skills AND nobody has decided yet — so a plain
+ *  checkout never produces one, and an unknown kind is still ignored silently (that is what lets
+ *  the two repositories ship independently).
+ */
+function projectSkillsNoticeOf(
+  u: Record<string, unknown>,
+): { text: string; root: string; count: number } | null {
+  if (hermesKindOf(u) !== "project_skills") return null;
+  const payload = hermesPayload(u);
+  const text = typeof payload.text === "string" ? payload.text.trim() : "";
+  if (!text) return null;
+  return {
+    text,
+    root: typeof payload.root === "string" ? payload.root : "",
+    count: typeof payload.skillCount === "number" ? payload.skillCount : 0,
+  };
+}
+
 /** The completion sentence a finished background process produced (#22), or null. */
 function completionTextOf(u: Record<string, unknown>): string | null {
   if (hermesKindOf(u) !== "completion") return null;

package/packages/server/src/cockpit/api.ts

@@ -195,6 +195,10 @@ export interface ListQuery {
   /** bucket the page instead of returning it flat. `workspace` is the only dimension today because it
    *  is the one the operator's rail groups by — anything else would be an invented taxonomy. */
   by?: "workspace";
+  /** How many cold rows the caller's own page left out (issue #34). Set by the route from
+   *  `cockpitCold()`: absent/0 means "you are looking at everything", non-zero means the view is
+   *  partial and the answer must say so. Never a wire parameter. */
+  coldOmitted?: number;
   /** fixed clock for tests; never set by a caller over the wire */
   now?: number;
 }
@@ -207,7 +211,12 @@ export interface ListResult {
   meta: {
     total: number;
     returned: number;
+    /** TRUE means "this is not the whole answer" — either the list limit cut it, or (`cold_omitted`)
+     *  the cold page itself did. Before #34 only the first was visible, so an agent could not tell a
+     *  complete view from a truncated one. */
     capped: boolean;
+    /** cold rows that existed but never reached this function (0 = nothing was hidden) */
+    cold_omitted: number;
     /** the filters that were actually applied, echoed back so a caller cannot misread an empty list
      *  as "there is nothing" when what happened is "your filter matched nothing" */
     applied: Record<string, string | number | boolean>;
@@ -308,7 +317,10 @@ export function listSessions(rows: CockpitSessionRow[], q: ListQuery = {}): List
   const limit = Math.max(1, Math.min(LIST_LIMIT_MAX, Math.round(q.limit ?? LIST_LIMIT_DEFAULT)));
   applied.limit = limit;
   const total = out.length;
-  const capped = total > limit;
+  const coldOmitted = Math.max(0, Math.floor(q.coldOmitted ?? 0));
+  // `capped` answers "can I trust this as the whole picture?", so a cold page that dropped rows counts
+  // even when the list limit itself did not bite (#34).
+  const capped = total > limit || coldOmitted > 0;
   const page = out.slice(0, limit);
 
   let groups: ListResult["groups"];
@@ -331,7 +343,7 @@ export function listSessions(rows: CockpitSessionRow[], q: ListQuery = {}): List
     }));
   }
 
-  return { rows: page, ...(groups ? { groups } : {}), meta: { total, returned: Math.min(total, limit), capped, applied } };
+  return { rows: page, ...(groups ? { groups } : {}), meta: { total, returned: Math.min(total, limit), capped, cold_omitted: coldOmitted, applied } };
 }
 
 function normPath(p: string): string {

package/packages/server/src/index.ts

@@ -635,7 +635,9 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
       const isOperator = !caller && auth.verifyMachineToken(/^Bearer\s+(.+)$/i.exec(String(req.headers.authorization ?? ""))?.[1] ?? undefined);
       if (!caller && !isOperator) return send(res, 403, { error: COCKPIT_ERRORS.badToken });
       // Scope: what the operator can see. 已归档 is out, on purpose — see `cockpitRows`.
-      const rows = mgr.cockpitRows();
+      // The cold page is taken once so its `omitted` count can travel with the answer (#34).
+      const cold = mgr.cockpitCold();
+      const rows = [...mgr.list(), ...cold.rows];
       const rowOf = (id: string): SessionInfo | null => rows.find((s) => s.id === id) ?? null;
       const summarize = (s: SessionInfo) => sessionRow(s, {
         plan: store.getPlan(s.id),
@@ -673,6 +675,7 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
           all: sp.get("all") === "1" || sp.get("all") === "true",
           includeSelf: sp.get("include_self") === "1" || sp.get("include_self") === "true",
           by: by as ListQuery["by"],
+          coldOmitted: cold.omitted,
         };
         if (query.sort && !["last", "created", "name"].includes(query.sort)) {
           return send(res, 400, { error: COCKPIT_ERRORS.badRequest, message: `--sort wants last|created|name, got "${query.sort}"` });

package/packages/server/src/store/store.ts

@@ -924,6 +924,34 @@ export class Store {
     return { ...m, seq };
   }
 
+  /**
+   * 换掉一行已有消息的 payload（seq 与 created_at 不动）。
+   *
+   * 为什么需要：审批卡、项目 skill 卡都**先生成一模一样的行、随后才由操作者做决定**。行必须在
+   * 请求到达那一刻就落库（否则「弹出来过」这件事在刷新后就不存在），而决定要在几秒/几分钟后
+   * 补上。改 seq 会让它在转录里换位置，改 created_at 会让「什么时候问的」变成「什么时候答的」。
+   */
+  updateMessagePayload(seq: number, sessionId: string, payload: unknown): StoredMessage | null {
+    this.#db
+      .prepare("update messages set payload = ? where session_id = ? and seq = ?")
+      .run(JSON.stringify(payload), sessionId, seq);
+    const row = this.#db
+      .prepare("select seq, session_id, kind, payload, tool_call_id, created_at from messages where session_id = ? and seq = ?")
+      .get(sessionId, seq) as
+      | { seq: number; session_id: string; kind: string; payload: string; tool_call_id: string | null; created_at: number }
+      | undefined;
+    if (!row) return null;
+    return {
+      seq: row.seq,
+      sessionId: row.session_id,
+      kind: row.kind as StoredMessage["kind"],
+      payload: JSON.parse(row.payload) as unknown,
+      toolCallId: row.tool_call_id ?? undefined,
+      createdAt: row.created_at,
+    };
+  }
+
+
   /**
    * 一条「状态行」落库（操作者 2026-10-18）：回忆了几条记忆、上下文压缩了、有警告。
    *

package/packages/shared/src/index.ts

@@ -435,8 +435,12 @@ export interface StoredMessage {
   /** `note` = a 「状态行」 that is not a message: 「recalled 8 memories」 / 「compacting」 / a warning.
    *  Deliberately a transcript row (not a separate table): its position IS the seq — after the
    *  operator's sentence, before the reply — and the page already orders, pages and replays by seq.
-   *  `meta` stays what it was: a line the HOST says (a rejected send), never persisted. */
-  kind: "user" | "agent" | "thought" | "tool" | "plan" | "meta" | "note";
+   *  `meta` stays what it was: a line the HOST says (a rejected send), never persisted.
+   *  `approval` = an approval request as a transcript row (it asks a question, then carries the
+   *  decision), and `project-skills` = the agent reporting that this repo ships skills it is NOT
+   *  loading. Both are DUrable on purpose: a modal that vanishes leaves no record of what was
+   *  asked or what was answered. */
+  kind: "user" | "agent" | "thought" | "tool" | "plan" | "meta" | "note" | "approval" | "project-skills";
   payload: unknown; // raw ACP content/update fragment (kept lossless)
   toolCallId?: string; // set for kind=tool; upsert key
   createdAt: number;