agentus 0.6.0 → 0.6.1

package/docs/installation.md

@@ -39,7 +39,10 @@ mode that survives a restart** and `session/load`, a free-form **context budget*
 cockpit's message stream, **per-process skill roots** (`HERMES_EXTERNAL_SKILLS_DIRS`, which is how a
 slot sees the cockpit's own skill without anything being written into your `~/.hermes`),
 **background-job completion wake-ups** (a finished `terminal(background=true)` job is relayed back as
-a turn of its own, so the agent resumes instead of the turn simply ending), and a
+a turn of its own, so the agent resumes instead of the turn simply ending), **project skills the agent
+can see, trust and edit** (the cockpit reports which project skills a repo has and which tier you
+trust, and writes the trust level back to config — it rides the same status channel; a released
+Hermes silently skips untrusted project skills without saying so), and a
 **DeepSeek web backend** (`search` + `extract` on top of `DEEPSEEK_API_KEY` — DeepSeek has no separate
 search key).
 They live on the ACP branches of the fork

package/docs/installation.zh-CN.md

@@ -35,7 +35,9 @@ brew install node                 # 或者 https://nodejs.org/en/download
 （带 256K/512K/768K/1M 预设）、把记忆召回 / 存记忆提示送进驾驶舱消息流的 **status 通道**，以及
 **按进程指定的技能根**（`HERMES_EXTERNAL_SKILLS_DIRS` —— 驾驶舱靠它让槽位看见自己的 skill，
 不往你的 `~/.hermes` 写任何东西）、**后台任务完成唤醒**（`terminal(background=true)` 的进程跑完会被
-中继成一个新回合，agent 自己接着干，而不是回合就这么结束），以及 **DeepSeek 的 web 后端**
+中继成一个新回合，agent 自己接着干，而不是回合就这么结束）、**项目 skill 的可见 / 可信任 / 可写**
+（驾驶舱会告诉 agent 这个仓库有哪些项目 skill、你信任哪个层级，并能把信任层级写回配置 —— 信号走
+同一条 status 通道；裸装 Hermes 遇到没信任的项目 skill 是悄悄跳过、不吭声的），以及 **DeepSeek 的 web 后端**
 （`search` + `extract` 都复用
 `DEEPSEEK_API_KEY` —— DeepSeek 没有单独的搜索密钥）。它们在 fork
 [`LiangYang666/hermes-agent`](https://github.com/LiangYang666/hermes-agent) 的 ACP 分支上，

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "agentus",
- "version": "0.6.0",
+ "version": "0.6.1",
  "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
  "license": "Apache-2.0",
  "repository": {
@@ -59,6 +59,7 @@
   "terminal-palette": "tsx scripts/qa/terminal-palette.mts",
   "android-trust-merge": "node scripts/qa/android-trust-merge.mjs",
   "cards-persist": "node scripts/qa/cards-persist.mjs",
+  "cold-paging": "tsx scripts/qa/cold-paging.mts",
   "plan-hint-sweep": "node scripts/qa/plan-hint-sweep.mjs",
   "plan-service-sweep": "node scripts/qa/plan-service-sweep.mjs",
   "plan-mcp-sweep": "node scripts/qa/plan-mcp-sweep.mjs",

package/packages/server/src/acp/cold-page.ts

@@ -0,0 +1,82 @@
+/** Paging for the COLD session list — the rows that exist on disk with no process behind them.
+ *
+ *  Issue #34: the page used to be ONE global top-N by `lastAt`. Every consumer (rail grouping, the
+ *  rail's 展开其余 counter, search, `cockpit session list --workspace`) then treated that page as the
+ *  complete set, so the busiest workspace ate the whole page and every other workspace's cold
+ *  sessions vanished. It is not a cosmetic loss: a cold row is the ONLY handle that can wake that
+ *  session, so "not in the page" means "unreachable from the UI, even though the transcript is fine".
+ *
+ *  The intent behind the old cap is still real — crash debris accumulates without anyone choosing it
+ *  — so it is kept, but moved to the right axis: **N per workspace** (the same axis the rail already
+ *  groups by) plus a much larger total ceiling as the anti-bloat backstop.
+ *
+ *  Pure on purpose: the caller decides which rows EXIST (the cockpit's own scope rule), this decides
+ *  which of them survive the page. That way the rule is tested without a server or a browser. */
+
+import type { SessionInfo } from "@agentus/shared";
+
+/** How many cold rows a single workspace keeps by default. The rail shows `RAIL_RECENT` (5) before
+ *  「展开其余」, so 20 is the expand depth, not the visible depth. */
+export const COLD_PER_WORKSPACE = 20;
+
+/** Hard ceiling across all workspaces. Chosen to be far above any real installation's workspace
+ *  count × 20 while still bounding what a crash-storm can push into one WS frame. */
+export const COLD_TOTAL_MAX = 400;
+
+/** The cockpit CLI asks for a deeper page than the rail: an agent asking "what is going on in this
+ *  workspace" is not browsing, and it filters by `--workspace` on top. */
+export const COLD_PER_WORKSPACE_COCKPIT = 50;
+
+export interface ColdPage<T> {
+  /** Newest-first, at most `perWorkspace` per workspace and `totalMax` overall. */
+  rows: T[];
+  /** How many cold rows existed before paging — so a caller can tell an empty cockpit from a
+   *  truncated one. */
+  total: number;
+  /** `total - rows.length`: the rows this page left out. Non-zero means "this is a partial view". */
+  omitted: number;
+}
+
+/** Which bucket a cold row belongs to: the workspace the operator sees in the rail, falling back to
+ *  the cwd exactly like `sessionRow()` does — the two must not disagree, or a row would be paged by
+ *  one key and displayed under another. */
+export function coldKeyOf(row: Pick<SessionInfo, "workspace" | "cwd">): string {
+  return row.workspace || row.cwd || "/";
+}
+
+/** Sort rule shared with `list()`: recent activity first, ties broken by creation. */
+export function byActivity(a: Pick<SessionInfo, "lastAt" | "createdAt">, b: Pick<SessionInfo, "lastAt" | "createdAt">): number {
+  return (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt;
+}
+
+/**
+ * Bucket-aware cold paging.
+ *
+ * `sorted` must already be in the caller's display order (newest first). Each workspace keeps the
+ * first `perWorkspace` rows of that order; the survivors are merged and re-sorted so the overall list
+ * still reads newest-first, then cut at `totalMax` only if the merge exceeds it.
+ */
+export function coldPage<T extends Pick<SessionInfo, "workspace" | "cwd" | "lastAt" | "createdAt">>(
+  sorted: readonly T[],
+  perWorkspace: number = COLD_PER_WORKSPACE,
+  totalMax: number = COLD_TOTAL_MAX,
+): ColdPage<T> {
+  const total = sorted.length;
+  const per = Math.max(1, Math.floor(perWorkspace));
+  const cap = Math.max(per, Math.floor(totalMax));
+
+  const buckets = new Map<string, T[]>();
+  for (const row of sorted) {
+    const key = coldKeyOf(row);
+    const bucket = buckets.get(key);
+    if (!bucket) buckets.set(key, [row]);
+    else if (bucket.length < per) bucket.push(row);
+    // else: this workspace already has its page — the rest of its rows are the ones we omit
+  }
+
+  const kept: T[] = [];
+  for (const bucket of buckets.values()) kept.push(...bucket);
+  kept.sort(byActivity);
+  const rows = kept.length > cap ? kept.slice(0, cap) : kept;
+  return { rows, total, omitted: total - rows.length };
+}

package/packages/server/src/acp/session-manager.ts

@@ -14,6 +14,14 @@ import type {
   RequestPermissionResponse,
 } from "@agentclientprotocol/sdk";
 import { BACKENDS, buildSpawnEnv, nativePlanSourceOf, type BackendSpec } from "./backends.js";
+import {
+  byActivity,
+  coldPage as pageCold,
+  COLD_PER_WORKSPACE,
+  COLD_PER_WORKSPACE_COCKPIT,
+  COLD_TOTAL_MAX,
+  type ColdPage,
+} from "./cold-page.js";
 import { SKILLS_ROOT, installSkills, resolveSkillsDir } from "../skills/install.js";
 import { classifyError, checkedHealth, effectiveArgs, handshakeFrom, rowToSpec } from "./registry.js";
 import type { BackendHandshake, CheckErrorCode } from "./registry.js";
@@ -945,17 +953,26 @@ export class SessionManager {
    *  reachable in the rail (the old rule showed them under 已归档; the older one dropped them out of
    *  the list entirely, which is how a transcript became unreachable while still on disk).
    *
-   *  Capped, unlike `archived()`: crash debris accumulates without anyone choosing it, and the rail
-   *  has its own recent-N rule anyway. */
-  cold(limit = 20): SessionInfo[] {
-    return this.#store
+   *  Paged **per workspace** (#34), unlike `archived()` which is complete: crash debris accumulates
+   *  without anyone choosing it, so a cap is still right — but the axis has to be the one the rail
+   *  groups by. A global top-N let the busiest workspace eat the page, and since a cold row is the
+   *  only handle that can wake its session, everything it pushed out became unreachable from the UI
+   *  while the transcript sat fine on disk. See `cold-page.ts`. */
+  cold(perWorkspace = COLD_PER_WORKSPACE, totalMax = COLD_TOTAL_MAX): SessionInfo[] {
+    return this.coldPage(perWorkspace, totalMax).rows;
+  }
+
+  /** The same page plus `total`/`omitted`, so a caller can say "this is a partial view" instead of
+   *  presenting a truncated list as the whole cockpit. */
+  coldPage(perWorkspace = COLD_PER_WORKSPACE, totalMax = COLD_TOTAL_MAX): ColdPage<SessionInfo> {
+    const sorted = this.#store
       .listSessions(true)
       // system rows are the cockpit's own (see list()): never offered as a slot to wake
       .filter((r) => r.archivedAt == null && !r.system && !this.#sessions.has(r.id))
       .map((r) => this.#infoFromRow(r))
       // cold rows by the same rule as live ones (recent chat first), THEN take the page
-      .sort((a, b) => (b.lastAt ?? 0) - (a.lastAt ?? 0) || b.createdAt - a.createdAt)
-      .slice(0, limit);
+      .sort(byActivity);
+    return pageCold(sorted, perWorkspace, totalMax);
   }
 
   /** One row in the shape list()/cold()/archived() produce, from a stored row. */
@@ -2233,10 +2250,17 @@ export class SessionManager {
   /** The cockpit CLI's read view (issue #15): the sessions the OPERATOR can see, in one list —
    *  live and cold, never 已归档 (that is the operator's shelf, not work in flight).
    *
-   *  Cold rows are capped by `cold()`'s own page size on purpose: an agent asking "what is going on"
-   *  gets the recent cockpit, not a scrollback of every session this install ever made. */
+   *  Cold rows are paged per workspace by `cold()`, deeper than the rail's own expand depth: an agent
+   *  asking "what is going on" is not browsing, and it filters by `--workspace` on top — but it still
+   *  must not receive a scrollback of every session this install ever made. */
   cockpitRows(): SessionInfo[] {
-    return [...this.list(), ...this.cold(50)];
+    return [...this.list(), ...this.cold(COLD_PER_WORKSPACE_COCKPIT)];
+  }
+
+  /** The cockpit's cold page together with what it left out, so `session list` can report
+   *  `capped` honestly instead of presenting a truncated view as the whole cockpit (#34). */
+  cockpitCold(): ColdPage<SessionInfo> {
+    return this.coldPage(COLD_PER_WORKSPACE_COCKPIT);
   }
 
   /** Approvals a session is WAITING on right now — the one fact worth waking another agent for. */

package/packages/server/src/cockpit/api.ts

@@ -195,6 +195,10 @@ export interface ListQuery {
   /** bucket the page instead of returning it flat. `workspace` is the only dimension today because it
    *  is the one the operator's rail groups by — anything else would be an invented taxonomy. */
   by?: "workspace";
+  /** How many cold rows the caller's own page left out (issue #34). Set by the route from
+   *  `cockpitCold()`: absent/0 means "you are looking at everything", non-zero means the view is
+   *  partial and the answer must say so. Never a wire parameter. */
+  coldOmitted?: number;
   /** fixed clock for tests; never set by a caller over the wire */
   now?: number;
 }
@@ -207,7 +211,12 @@ export interface ListResult {
   meta: {
     total: number;
     returned: number;
+    /** TRUE means "this is not the whole answer" — either the list limit cut it, or (`cold_omitted`)
+     *  the cold page itself did. Before #34 only the first was visible, so an agent could not tell a
+     *  complete view from a truncated one. */
     capped: boolean;
+    /** cold rows that existed but never reached this function (0 = nothing was hidden) */
+    cold_omitted: number;
     /** the filters that were actually applied, echoed back so a caller cannot misread an empty list
      *  as "there is nothing" when what happened is "your filter matched nothing" */
     applied: Record<string, string | number | boolean>;
@@ -308,7 +317,10 @@ export function listSessions(rows: CockpitSessionRow[], q: ListQuery = {}): List
   const limit = Math.max(1, Math.min(LIST_LIMIT_MAX, Math.round(q.limit ?? LIST_LIMIT_DEFAULT)));
   applied.limit = limit;
   const total = out.length;
-  const capped = total > limit;
+  const coldOmitted = Math.max(0, Math.floor(q.coldOmitted ?? 0));
+  // `capped` answers "can I trust this as the whole picture?", so a cold page that dropped rows counts
+  // even when the list limit itself did not bite (#34).
+  const capped = total > limit || coldOmitted > 0;
   const page = out.slice(0, limit);
 
   let groups: ListResult["groups"];
@@ -331,7 +343,7 @@ export function listSessions(rows: CockpitSessionRow[], q: ListQuery = {}): List
     }));
   }
 
-  return { rows: page, ...(groups ? { groups } : {}), meta: { total, returned: Math.min(total, limit), capped, applied } };
+  return { rows: page, ...(groups ? { groups } : {}), meta: { total, returned: Math.min(total, limit), capped, cold_omitted: coldOmitted, applied } };
 }
 
 function normPath(p: string): string {

package/packages/server/src/index.ts

@@ -635,7 +635,9 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
       const isOperator = !caller && auth.verifyMachineToken(/^Bearer\s+(.+)$/i.exec(String(req.headers.authorization ?? ""))?.[1] ?? undefined);
       if (!caller && !isOperator) return send(res, 403, { error: COCKPIT_ERRORS.badToken });
       // Scope: what the operator can see. 已归档 is out, on purpose — see `cockpitRows`.
-      const rows = mgr.cockpitRows();
+      // The cold page is taken once so its `omitted` count can travel with the answer (#34).
+      const cold = mgr.cockpitCold();
+      const rows = [...mgr.list(), ...cold.rows];
       const rowOf = (id: string): SessionInfo | null => rows.find((s) => s.id === id) ?? null;
       const summarize = (s: SessionInfo) => sessionRow(s, {
         plan: store.getPlan(s.id),
@@ -673,6 +675,7 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse) => {
           all: sp.get("all") === "1" || sp.get("all") === "true",
           includeSelf: sp.get("include_self") === "1" || sp.get("include_self") === "true",
           by: by as ListQuery["by"],
+          coldOmitted: cold.omitted,
         };
         if (query.sort && !["last", "created", "name"].includes(query.sort)) {
           return send(res, 400, { error: COCKPIT_ERRORS.badRequest, message: `--sort wants last|created|name, got "${query.sort}"` });