ai_co_discuss 0.2.98 → 0.2.99

package/.agents/skills/discuss-participant/SKILL.md

@@ -35,7 +35,7 @@ description: "AI CoDiscuss 的通用参与技能，所有参与者（包括主
 
 从实际任务或用户指定值核实站点、房间和身份，不从当前网页或最近聊天猜测：站点用 `--site`、进程 `DISCUSS_URL` 或凭据绑定的站点，房间始终显式指定，写入显式 `--as 本人`。任务标明 `access_env: "DISCUSS_ACCESS_FILE"` 时凭据已由进程绑定，`--access-file FILE` 可省略；否则用任务交付的 `access_file`。项目与 cwd 有值时用于本次获准资料；CLI 路径只定位工具，不把 CLI 仓库当作讨论项目或扩大文件权限。
 
-每次 shell 调用都是一次模型往返，手动会话里还可能要用户逐条确认，所以互不依赖的只读命令放进同一条 shell 命令依次执行；写入命令单独执行并核对结果。
+每次 shell 调用都是一次模型往返，手动会话里还可能要用户逐条确认，所以互不依赖的只读命令放进同一条 shell 命令依次执行。正文想好后，生成提交编号、写草稿、`message post` 放进同一条命令，草稿写成功才提交（失败重试仍用这份草稿和编号）；不同的网站写入各自单独执行并核对结果。
 
 ## 阅读
 

package/.agents/skills/discuss-participant/references/free.md

@@ -8,7 +8,7 @@
 
 完成后用 `message post ROOM --as 本人 --kind chat --execution 执行编号 --access-file FILE` 提交一次回答。手动接入的成员没有执行编号：从 `room view` 的 `free.requests` 找到自己的待处理请求，回答时用 `--request 请求编号` 关闭。
 
-任务需要多步操作时，在关键转折处（读完材料、改定方案、验证结果）用一两句中文写出进展，不另调命令：本机接入程序会把这些中途说明显示在网页的处理中卡片，让用户知道你在做什么。只写进展与判断，不复述工具输出，不代替最终回答。
+任务需要多步操作时，在关键转折处（读完材料、改定方案、验证结果）用一两句中文写出进展，不另调命令：本机接入程序会把这些中途说明显示在网页的处理中卡片，让用户知道你在做什么。只写进展与判断，不复述工具输出，不写读技能、执行编号、提交命令之类的操作步骤（用户看不懂也用不上），不代替最终回答；几步就能答完的简单请求不写。
 
 ## 共享工作目录
 

package/backend/free_room.py

@@ -72,8 +72,13 @@ MAX_NOTE_LENGTH = 500
 MAX_NOTES_PER_RENEW = 10
 # A member description is a short note for the scheduler and the host, keyed by the member's name.
 MAX_MEMBER_DESCRIPTION = 500
+# A display label replaces the member's name on screen only; the name stays the member's identity everywhere else.
+MAX_MEMBER_LABEL = 32
 MAX_MEMBER_NAME = 80
 MAX_PATH_LENGTH = 500
+# Refused operations one execution may report, and the length of each field.
+MAX_DENIALS = 20
+MAX_DENIAL_FIELD = 300
 ACTIVE = ("dispatched", "started")
 ACCESS_MODES = ("runner", "manual", "online")
 SCHEDULER_PROVIDERS = ("jev", "decisions")
@@ -267,6 +272,31 @@ def describe_members(connection, room_id, token, payload):
     return {"descriptions": member_descriptions(connection, room_id)}
 
 
+def member_labels(connection, room_id):
+    """The owner's display labels of members by name; only screens use them, never addressing or credentials."""
+    return {row["name"]: row["label"] for row in connection.execute(
+        "SELECT name,label FROM member_labels WHERE room_id=? ORDER BY name", (room_id,))}
+
+
+def label_members(connection, room_id, token, payload):
+    """Owner sets members' display labels by name; an empty text removes that member's label."""
+    require_owner(connection, room_id, token)
+    labels = payload.get("labels")
+    if (not isinstance(labels, dict) or not labels or len(labels) > MAX_ROOM_AGENTS
+            or any(not isinstance(name, str) or not 0 < len(name) <= MAX_MEMBER_NAME or not isinstance(text, str)
+                   or len(text.strip()) > MAX_MEMBER_LABEL for name, text in labels.items())):
+        raise ValueError(f"labels 须为 {{成员名: 显示名}}，最多 {MAX_ROOM_AGENTS} 位，每个最多 {MAX_MEMBER_LABEL} 字")
+    begin_write(connection)
+    now = int(time.time())
+    for name, text in labels.items():
+        if text.strip():
+            connection.execute("""INSERT INTO member_labels (room_id,name,label,updated_at) VALUES (?,?,?,?)
+                ON CONFLICT(room_id,name) DO UPDATE SET label=excluded.label,updated_at=excluded.updated_at""",
+                               (room_id, name, text.strip(), now))
+        else:
+            connection.execute("DELETE FROM member_labels WHERE room_id=? AND name=?", (room_id, name))
+    return {"labels": member_labels(connection, room_id)}
+
 def note_count(connection, execution_id):
     """How many progress notes an execution has; the texts are read separately so room views stay small."""
     return connection.execute("SELECT COUNT(*) FROM execution_notes WHERE execution_id=?", (execution_id,)).fetchone()[0]
@@ -312,11 +342,13 @@ def recent_executions(connection, room_id):
         (SELECT json_group_array(id) FROM member_requests WHERE execution_id=e.id) AS request_ids,
         (SELECT MAX(answer_id) FROM member_requests WHERE execution_id=e.id) AS answer_id,
         (SELECT MIN(message_id) FROM member_requests WHERE execution_id=e.id) AS request_message_id,
-        (SELECT COUNT(*) FROM execution_notes WHERE execution_id=e.id) AS note_count
+        (SELECT COUNT(*) FROM execution_notes WHERE execution_id=e.id) AS note_count,
+        (SELECT denials FROM execution_denials WHERE execution_id=e.id) AS denials
         FROM member_executions e WHERE room_id=? ORDER BY id DESC LIMIT ?""", (room_id, RECENT_EXECUTIONS))
     return [{**public_execution(row), "cwd": row["cwd"], "changes": json.loads(row["changes"] or "[]"),
              "changes_recorded": bool(row["changes"]), "request_ids": json.loads(row["request_ids"]),
-             "answer_id": row["answer_id"], "request_message_id": row["request_message_id"], "notes": row["note_count"]} for row in rows]
+             "answer_id": row["answer_id"], "request_message_id": row["request_message_id"], "notes": row["note_count"],
+             "denials": json.loads(row["denials"] or "[]")} for row in rows]
 
 
 def possible_conflicts(connection, room_id, names):
@@ -1190,7 +1222,8 @@ def execution_detail(connection, row):
     member = connection.execute("SELECT * FROM room_members WHERE id=?", (row["member_id"],)).fetchone()
     requests = [dict(item) for item in connection.execute(
         "SELECT id,message_id,status,purpose FROM member_requests WHERE execution_id=? ORDER BY id", (row["id"],))]
-    return {**public_execution(row), "member": member["name"], "read_until": member["read_until"], "requests": requests}
+    return {**public_execution(row), "member": member["name"], "read_until": member["read_until"], "requests": requests,
+            "rewound_executions": member_rewinds(connection, member["id"])}
 
 
 def view_execution(connection, room_id, execution_id, token):
@@ -1216,6 +1249,17 @@ def changed_files(payload):
     return sorted(set(files))
 
 
+def denied_actions(payload):
+    """Validate the operations a member's software refused: the tool, what it tried, and the rule that would allow it."""
+    denials = payload.get("denials")
+    def valid(item):
+        return (isinstance(item, dict) and isinstance(item.get("tool"), str) and 0 < len(item["tool"]) <= 40
+                and all(isinstance(item.get(key, ""), str) and len(item.get(key, "")) <= MAX_DENIAL_FIELD for key in ("detail", "rule")))
+    if not isinstance(denials, list) or not 0 < len(denials) <= MAX_DENIALS or not all(map(valid, denials)):
+        raise ValueError(f"denials 须为 1–{MAX_DENIALS} 条 {{tool, detail, rule}}")
+    return [{key: item.get(key, "") for key in ("tool", "detail", "rule")} for item in denials]
+
+
 def renewed_activity(payload, row, now):
     """Validate the runner's reported phase; its output time is kept within the execution, since the runner's clock may differ."""
     activity, activity_at = payload.get("activity"), payload.get("activity_at")
@@ -1250,6 +1294,12 @@ def execution_action(connection, room_id, execution_id, token, payload):
         if row["changes"]:
             raise FileExistsError("本次执行的改动已记录")
         connection.execute("UPDATE member_executions SET changes=? WHERE id=?", (json.dumps(changed_files(payload), ensure_ascii=False), execution_id))
+    elif action == "denials":
+        # Like file changes, read from the software's output once its process ends; recorded once.
+        saved = connection.execute("INSERT OR IGNORE INTO execution_denials (execution_id,room_id,denials) VALUES (?,?,?)",
+                                   (execution_id, room_id, json.dumps(denied_actions(payload), ensure_ascii=False)))
+        if not saved.rowcount:
+            raise FileExistsError("本次执行的拒绝记录已记录")
     elif action == "segments":
         # The last segments and notes arrive after the member's answer ended the execution; such notes are dated at its end.
         finished = 0 if row["status"] in ACTIVE else (row["finished_at"] or 1)
@@ -1299,6 +1349,137 @@ def interrupt_member(connection, room_id, member_id, token):
     return free_view(connection, room_id)
 
 
+def withdrawals(connection, room_id):
+    """The room's taken-back messages by id, so the page keeps them in place while AI readers skip them."""
+    return [dict(row) for row in connection.execute("""SELECT w.message_id,w.kind FROM message_withdrawals w
+        JOIN messages m ON m.id=w.message_id WHERE m.room_id=? ORDER BY w.message_id""", (room_id,))]
+
+
+def owner_message(connection, room_id, message_id):
+    """One visible message of the user in a free room without an open discussion, which a retract or rewind may take back."""
+    row = connection.execute("SELECT * FROM messages WHERE room_id=? AND id=?", (room_id, message_id)).fetchone()
+    if not row:
+        raise LookupError("消息不存在")
+    if row["author"] != "用户":
+        raise ValueError("只能撤回或编辑用户自己的消息")
+    if room_mode(connection, room_id) != "free":
+        raise ValueError("只有协作房间的消息可以撤回或编辑")
+    if connection.execute("SELECT 1 FROM room_directory WHERE room_id=? AND archived=1", (room_id,)).fetchone():
+        raise ValueError("房间已存档；恢复后才能撤回或编辑")
+    # A discussion's host reads the user's messages itself, with no request that shows whether it began.
+    if connection.execute("SELECT 1 FROM discussion_sessions WHERE room_id=? AND (status IN ('active','paused') OR started_message_id>=?)",
+                          (room_id, message_id)).fetchone():
+        raise FileExistsError("讨论进行中，或这条消息之后开启过讨论，不能撤回或编辑")
+    return row
+
+
+def retract_message(connection, room_id, message_id, token):
+    """Owner takes back a message no member began to handle: its queued requests end and AI readers no longer see it.
+
+    Bound to one known message, so it takes no revision; a message any member started, answered or failed is refused.
+    A member working on an earlier message may still have read it, which the room cannot know.
+
+    Returns:
+        `{"message_id", "text", "duplicate"}`; the text lets the page put it back in the input for editing.
+    """
+    require_owner(connection, room_id, token)
+    begin_write(connection)
+    message = owner_message(connection, room_id, message_id)
+    if connection.execute("SELECT 1 FROM message_withdrawals WHERE message_id=?", (message_id,)).fetchone():
+        return {"message_id": message_id, "text": message["text"], "duplicate": True}
+    if connection.execute("SELECT 1 FROM member_requests WHERE message_id=? AND status IN ('delivering','completed','failed')", (message_id,)).fetchone():
+        raise FileExistsError("已有成员开始处理这条消息，不能撤回；可以编辑这条消息回退到它之前")
+    connection.execute("UPDATE member_requests SET status='cancelled' WHERE message_id=? AND status='pending'", (message_id,))
+    connection.execute("DELETE FROM free_queue WHERE message_id=?", (message_id,))
+    connection.execute("INSERT INTO message_withdrawals (message_id,kind,created_at) VALUES (?,'retracted',?)", (message_id, int(time.time())))
+    settle_batches(connection, room_id)
+    return {"message_id": message_id, "text": message["text"], "duplicate": False}
+
+
+# Software whose session the runner can cut before a taken-back execution; an API member rebuilds its context each time.
+CUTTABLE_ADAPTERS = ("claude", "codex", "codex_cli", "antigravity_cli")
+# Executions a rewind takes back: any touching a message from the rewind point on, and any still running.
+REWOUND_EXECUTIONS = """SELECT e.id,e.member_id FROM member_executions e WHERE e.room_id=? AND (e.status IN ('dispatched','started')
+    OR EXISTS(SELECT 1 FROM member_requests r WHERE r.execution_id=e.id AND (r.message_id>=? OR r.answer_id>=?))) ORDER BY e.id"""
+
+
+def rewind_plan(connection, room_id, message_id):
+    """What rewinding to just before a message takes back, and a revision of the state it was read from.
+
+    Each member reports what happens to its session: `cut` (the runner cuts it before the first taken-back execution),
+    `fresh` (an API member, which rebuilds its context), `unchanged` (no taken-back execution) or `kept` (manual, online or
+    App software whose own window keeps what it saw).
+    """
+    owner_message(connection, room_id, message_id)
+    if connection.execute("SELECT 1 FROM message_withdrawals WHERE message_id=?", (message_id,)).fetchone():
+        raise FileExistsError("这条消息已被撤回或回退")
+    executions = {}
+    for row in connection.execute(REWOUND_EXECUTIONS, (room_id, message_id, message_id)):
+        executions.setdefault(row["member_id"], []).append(row["id"])
+    members = []
+    for row in connection.execute("SELECT id,name,access,adapter FROM room_members WHERE room_id=? AND status<>'removed' ORDER BY id", (room_id,)):
+        taken = executions.get(row["id"], [])
+        session = ("kept" if row["access"] != "runner" or row["adapter"] not in (*CUTTABLE_ADAPTERS, "api")
+                   else "unchanged" if not taken else "fresh" if row["adapter"] == "api" else "cut")
+        members.append({"id": row["id"], "name": row["name"], "executions": taken, "session": session})
+    count = connection.execute("""SELECT COUNT(*) FROM messages m WHERE m.room_id=? AND m.id>=?
+        AND NOT EXISTS(SELECT 1 FROM message_withdrawals w WHERE w.message_id=m.id)""", (room_id, message_id)).fetchone()[0]
+    latest = connection.execute("SELECT COALESCE(MAX(id),0) FROM messages WHERE room_id=?", (room_id,)).fetchone()[0]
+    state = json.dumps([message_id, latest, count, members])
+    return {"message_id": message_id, "messages": count, "members": members,
+            "revision": hashlib.sha256(state.encode("utf-8")).hexdigest()[:12]}
+
+
+def rewind_room(connection, room_id, token, payload):
+    """Owner returns the room to just before one of its messages, as editing that message does.
+
+    Read the plan first (`GET rewind?message_id=`) and send its revision: a missing revision is refused and a changed
+    one conflicts. The message and everything after it stay on the page but leave AI reads; running work stops, open
+    requests on them end, members read again from before the message, and each runner member's session is cut before
+    its first taken-back execution when it next works. Files the members changed are not restored.
+    """
+    require_owner(connection, room_id, token)
+    begin_write(connection)
+    message_id = payload.get("message_id")
+    if type(message_id) is not int:
+        raise ValueError("须提供要回退到其之前的消息编号 message_id")
+    if payload.get("revision") is None:
+        raise ValueError("回退前须先读取回退计划（GET rewind?message_id=），并带上其 revision")
+    plan = rewind_plan(connection, room_id, message_id)
+    if payload["revision"] != plan["revision"]:
+        raise FileExistsError("房间已有新的消息或执行，请重新读取回退计划后再确认")
+    now = int(time.time())
+    for row in connection.execute("SELECT id FROM member_executions WHERE room_id=? AND status IN ('dispatched','started')", (room_id,)).fetchall():
+        finish_execution(connection, row["id"], "cancelled", "用户回退了对话", "cancelled", "user_stop")
+    record_cancel_reasons(connection, "room_id=? AND message_id>=? AND status='pending'", (room_id, message_id), "user_stop")
+    connection.execute("UPDATE member_requests SET status='cancelled' WHERE room_id=? AND message_id>=? AND status='pending'", (room_id, message_id))
+    connection.execute("DELETE FROM free_queue WHERE room_id=? AND message_id>=?", (room_id, message_id))
+    # Batches of taken-back dispatches never hand back, and a dispatch the round limit held from them is never sent.
+    connection.execute("UPDATE free_batches SET settled=1 WHERE room_id=? AND batch_id>=?", (room_id, message_id))
+    connection.execute("UPDATE free_chain_holds SET message_id=0,host_id=0,names='[]',handoff=0 WHERE room_id=? AND message_id>=?", (room_id, message_id))
+    connection.execute("""INSERT INTO message_withdrawals (message_id,kind,created_at) SELECT id,'rewound',? FROM messages m
+        WHERE m.room_id=? AND m.id>=? AND NOT EXISTS(SELECT 1 FROM message_withdrawals w WHERE w.message_id=m.id)""", (now, room_id, message_id))
+    connection.execute("UPDATE room_members SET read_until=MIN(read_until,?) WHERE room_id=?", (message_id - 1, room_id))
+    cuts = {str(member["id"]): member["executions"] for member in plan["members"] if member["session"] == "cut"}
+    cursor = connection.execute("INSERT INTO room_rewinds (room_id,message_id,cuts,created_at) VALUES (?,?,?,?)",
+                                (room_id, message_id, json.dumps(cuts), now))
+    settle_batches(connection, room_id)
+    return {"rewind_id": cursor.lastrowid, **plan}
+
+
+# The runner checks this many of a member's latest rewinds before each execution.
+RECENT_REWINDS = 50
+
+
+def member_rewinds(connection, member_id):
+    """Executions taken back from one member by recent rewinds, oldest first; the runner cuts before the earliest it finds."""
+    taken = set()
+    for row in connection.execute("SELECT cuts FROM room_rewinds WHERE room_id=(SELECT room_id FROM room_members WHERE id=?) ORDER BY id DESC LIMIT ?",
+                                  (member_id, RECENT_REWINDS)):
+        taken.update(json.loads(row["cuts"]).get(str(member_id), []))
+    return sorted(taken)
+
+
 def add_member(connection, room_id, token, payload, now):
     """Owner adds a member while the room keeps running; other members are not interrupted."""
     require_owner(connection, room_id, token)
@@ -1410,7 +1591,7 @@ def discussion_member_action(connection, room_id, member_id, token, payload):
     save_discussion_experts(connection, room_id, experts)
 
 
-ADOPTABLE_ADAPTERS = ("claude", "codex", "codex_cli", "antigravity_cli")
+ADOPTABLE_ADAPTERS = ("claude", "codex", "codex_cli", "antigravity", "antigravity_cli")
 
 
 def adopt_manual_member(connection, room_id, member, payload):

package/backend/room_import.py

@@ -166,6 +166,8 @@ def record_statements(tables, room_id, maps):
                    for row in tables.get("member_requests", [])]
     statements += [("INSERT INTO member_suggestions (message_id,member_id) VALUES (?,?)", (messages[row["message_id"]], members[row["member_id"]]))
                    for row in tables.get("member_suggestions", [])]
+    statements += [("INSERT INTO message_withdrawals (message_id,kind,created_at) VALUES (?,?,?)", (messages[row["message_id"]], row["kind"], row["created_at"]))
+                   for row in tables.get("message_withdrawals", [])]
     # Imported recommendations are history only: an open or waiting one no longer acts.
     statements += [("""INSERT INTO member_recommendations (message_id,room_id,member_id,provider,confidence,created_at,expires_at,status,mode)
                        VALUES (?,?,?,?,?,?,?,?,?)""", (messages[row["message_id"]], room_id, members[row["member_id"]], row["provider"], row["confidence"],

package/backend/schema.sql

@@ -550,6 +550,14 @@ CREATE TABLE IF NOT EXISTS member_descriptions (
     updated_at INTEGER NOT NULL,
     PRIMARY KEY(room_id,name)
 );
+-- Display labels the owner gave members (e.g. from a named preset); screens show them, the name stays the identity.
+CREATE TABLE IF NOT EXISTS member_labels (
+    room_id TEXT NOT NULL REFERENCES rooms(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    label TEXT NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY(room_id,name)
+);
 -- Progress notes the runner saw a member's software write between tool calls; numbered per execution so a retried renewal adds nothing.
 CREATE TABLE IF NOT EXISTS execution_notes (
     execution_id INTEGER NOT NULL REFERENCES member_executions(id) ON DELETE CASCADE,
@@ -559,6 +567,13 @@ CREATE TABLE IF NOT EXISTS execution_notes (
     created_at INTEGER NOT NULL,
     PRIMARY KEY(execution_id,seq)
 );
+-- Operations a member's software refused without asking, since a headless run cannot ask for approval; reported once by the
+-- runner after the process ends, as a JSON list of {tool, detail, rule}, so the owner can see and allow them.
+CREATE TABLE IF NOT EXISTS execution_denials (
+    execution_id INTEGER PRIMARY KEY REFERENCES member_executions(id) ON DELETE CASCADE,
+    room_id TEXT NOT NULL REFERENCES rooms(id) ON DELETE CASCADE,
+    denials TEXT NOT NULL
+);
 -- Phases the runner saw a member's software go through in one execution (a free execution or a discussion event), as
 -- millisecond offsets from its delivery; numbered per execution, and a resent segment keeps the later end. Not part of backups.
 CREATE TABLE IF NOT EXISTS execution_segments (
@@ -646,6 +661,22 @@ CREATE TABLE IF NOT EXISTS request_cancel_reasons (
     request_id INTEGER PRIMARY KEY REFERENCES member_requests(id) ON DELETE CASCADE,
     reason TEXT NOT NULL CHECK(reason IN ('user_stop','member_away','member_removed','rerouted','no_reply','archived'))
 );
+-- Messages the owner took back: a retracted one no member began to handle, or the history a rewind returned to before.
+-- AI readers no longer see them; the page keeps each in place. No room column, so it never clashes with messages.room_id in joins.
+CREATE TABLE IF NOT EXISTS message_withdrawals (
+    message_id INTEGER PRIMARY KEY REFERENCES messages(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL CHECK(kind IN ('retracted','rewound')),
+    created_at INTEGER NOT NULL
+);
+-- Each rewind and, per member id, the executions it took back (JSON {member id: [execution ids]}): before the member's next
+-- execution the runner cuts its session before the earliest of them it finds. Not part of backups, since executions are not.
+CREATE TABLE IF NOT EXISTS room_rewinds (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    room_id TEXT NOT NULL REFERENCES rooms(id) ON DELETE CASCADE,
+    message_id INTEGER NOT NULL,
+    cuts TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+);
 -- What produced a decision (model, threshold, prompt and package versions), so ratings stay comparable across versions.
 CREATE TABLE IF NOT EXISTS scheduler_decision_context (
     decision_id INTEGER PRIMARY KEY REFERENCES scheduler_decisions(id) ON DELETE CASCADE,

package/backend/server.py

@@ -28,8 +28,8 @@ from .free_room import (add_member, after_free_message, authorize_free_write, ch
                         discussion_members, room_mode, save_room_access, sync_discussion_members, view_execution)
 from .free_room import add_discussion_member, convert_suggestion, discussion_member_action, message_suggestions, save_suggestions, sync_participants
 from .free_room import active_members, adopt_recommendation, ask_members, asks_view, checked_asks, recommend_member, register_member, route_held_messages
-from .free_room import describe_members, execution_notes, member_descriptions, reorder_speakers, set_chain_rounds, speaking_order, stop_room_work
-from .free_room import continue_chain, execution_timeline
+from .free_room import describe_members, execution_notes, label_members, member_descriptions, member_labels, reorder_speakers, set_chain_rounds, speaking_order, stop_room_work
+from .free_room import continue_chain, execution_timeline, retract_message, rewind_plan, rewind_room, withdrawals
 from .identity import MAX_ROOM_AGENTS, PARTICIPANTS, is_ai, is_participant
 from .room_import import import_room, imported_attachment
 from .runtime import (authorize_write, begin_write, configure_runtime, event_action,
@@ -107,6 +107,7 @@ ROOM_BACKUP_QUERIES = {
     "scheduler_decisions": f"{DECISION_SELECT} WHERE d.room_id=? ORDER BY d.id",
     "topic_folders": "SELECT * FROM topic_folders WHERE id IN (SELECT folder_id FROM room_folder_assignments WHERE room_id=?)",
     "messages": "SELECT * FROM messages WHERE room_id=? ORDER BY id",
+    "message_withdrawals": "SELECT w.* FROM message_withdrawals w JOIN messages m ON m.id=w.message_id WHERE m.room_id=? ORDER BY w.message_id",
     "attachments": "SELECT * FROM attachments WHERE room_id=? AND message_id IS NOT NULL ORDER BY message_id,position",
     "discussion_turns": "SELECT * FROM discussion_turns WHERE room_id=? ORDER BY id",
     **{table: f"SELECT * FROM {table} WHERE message_id IN (SELECT id FROM messages WHERE room_id=?) ORDER BY message_id"
@@ -125,13 +126,16 @@ MESSAGE_QUERY = """SELECT messages.*, COALESCE(details.kind,'opinion') AS kind,
 COALESCE(details.submitted_by, CASE WHEN messages.source IN ('cli','api','url','user')
 THEN messages.author ELSE '用户' END) AS submitted_by, details.turn_id,
 COALESCE(summaries.text,'') AS summary, COALESCE(summaries.author,'') AS summary_by, timing.elapsed_seconds,
-answered.execution_id, answered.request_message_id
+answered.execution_id, answered.request_message_id, COALESCE(withdrawn.kind,'') AS withdrawn
 FROM messages LEFT JOIN message_details AS details ON details.message_id=messages.id
+LEFT JOIN message_withdrawals AS withdrawn ON withdrawn.message_id=messages.id
 LEFT JOIN message_summaries AS summaries ON summaries.message_id=messages.id
 LEFT JOIN message_timings AS timing ON timing.message_id=messages.id
 LEFT JOIN (SELECT answer_id, MIN(execution_id) AS execution_id, MIN(message_id) AS request_message_id
   FROM member_requests WHERE answer_id IS NOT NULL AND execution_id IS NOT NULL GROUP BY answer_id) AS answered
   ON answered.answer_id=messages.id"""
+# Messages the owner took back leave AI reads; the page asks for them with withdrawn=include to keep them in place.
+INCLUDE_WITHDRAWN = "include"
 
 
 def room_backup(connection, room_id):
@@ -274,6 +278,8 @@ def require_room(connection, room_id):
         room["held_since"] = 0
         room["free"] = free_view(connection, room_id)
     room["descriptions"] = member_descriptions(connection, room_id)
+    room["labels"] = member_labels(connection, room_id)
+    room["withdrawals"] = withdrawals(connection, room_id)
     room["speaking_order"] = speaking_order(connection, room)
     return room
 
@@ -672,13 +678,15 @@ def manage_room(connection, room_id, action, payload):
 
 def delete_room_records(connection, room_id):
     """Remove a room's dependent records in the caller's transaction."""
-    for table in ("member_recommendations", "free_queue", "speaking_orders", "member_requests", "member_descriptions", "execution_notes", "execution_segments", "member_executions", "member_sessions", "member_registrations", "room_members", "room_modes", "free_batches", "free_chains", "free_handoffs", "free_settings", "free_round_limits", "free_chain_holds", "room_links",
+    for table in ("member_recommendations", "free_queue", "speaking_orders", "member_requests", "member_descriptions", "member_labels", "execution_notes", "execution_segments", "member_executions", "member_sessions", "member_registrations", "room_members", "room_modes", "free_batches", "free_chains", "free_handoffs", "free_settings", "free_round_limits", "free_chain_holds", "room_links",
                   "discussion_options", "round_budgets", "scheduler_decisions", "scheduler_routing", "discussion_conclusions", "discussion_sessions"):
         if table == "scheduler_decisions":
             for child in ("scheduler_feedback", "scheduler_decision_context", "scheduler_decision_inputs"):
                 connection.execute(f"DELETE FROM {child} WHERE decision_id IN (SELECT id FROM scheduler_decisions WHERE room_id=?)", (room_id,))
             connection.execute("DELETE FROM scheduler_decision_details WHERE decision_id IN (SELECT id FROM scheduler_decisions WHERE room_id=?)", (room_id,))
         connection.execute(f"DELETE FROM {table} WHERE room_id=?", (room_id,))
+    connection.execute("DELETE FROM message_withdrawals WHERE message_id IN (SELECT id FROM messages WHERE room_id=?)", (room_id,))
+    connection.execute("DELETE FROM room_rewinds WHERE room_id=?", (room_id,))
     connection.execute("DELETE FROM message_timings WHERE message_id IN (SELECT id FROM messages WHERE room_id=?)", (room_id,))
     connection.execute("DELETE FROM message_summaries WHERE message_id IN (SELECT id FROM messages WHERE room_id=?)", (room_id,))
     connection.execute("DELETE FROM message_details WHERE message_id IN (SELECT id FROM messages WHERE room_id=?)", (room_id,))
@@ -891,6 +899,9 @@ def attachment_view(row):
 def message_with_attachments(connection, row):
     """Attach the published file list to an original message."""
     message = dict(row)
+    if message["withdrawn"] == "retracted":
+        # The owner retracted it before anyone handled it: only the page that retracted it keeps the text.
+        return {**message, "text": "", "summary": "", "suggestions": [], "attachments": []}
     message["suggestions"] = message_suggestions(connection, message["id"])
     message["attachments"] = [attachment_view(item) for item in connection.execute(
         "SELECT * FROM attachments WHERE message_id=? ORDER BY position,id", (message["id"],))]
@@ -1467,6 +1478,8 @@ def message_filters(room_id, params):
             raise ValueError("after 需为非负消息编号，不能与翻页同时使用")
         clauses.append("messages.id>?")
         values.append(after)
+    if params.get("withdrawn") != INCLUDE_WITHDRAWN:
+        clauses.append("withdrawn.message_id IS NULL")
     return " AND ".join(clauses), values
 
 
@@ -1694,7 +1707,7 @@ class DiscussionHandler(BaseHTTPRequestHandler):
     def respond(self, body, status=200, content_type="application/json"):
         """Send a UTF-8 response that browsers and proxies must not cache."""
         parts = urlsplit(self.path).path.strip("/").split("/")
-        action = (self.payload_cache or {}).get("action")
+        action = (getattr(self, "payload_cache", None) or {}).get("action")
         # Timeline segments are read by the timeline page on its own schedule, so they wake no other page.
         quiet_renewal = (parts[3:4] == ["events"] and action == "renew") or (parts[3:4] in (["events"], ["executions"]) and action == "segments")
         if (self.command == "POST" and 200 <= status < 300 and parts[:2] in (["api", "rooms"], ["api", "folders"])
@@ -1854,7 +1867,7 @@ class DiscussionHandler(BaseHTTPRequestHandler):
         """Forward authenticated browser requests to the shared Node entrypoint and pin their website."""
         site = self.local_request_site(method)
         route = parts[2:]
-        if method == "OPTIONS" and route in (["settings"], ["launch"], ["room-models"], ["room-member"], ["room-member-access"], ["room-member-adapter"], ["room-profiles"], ["room-restore"], ["models"], ["api-key"], ["api-check"],
+        if method == "OPTIONS" and route in (["settings"], ["launch"], ["room-models"], ["room-member"], ["room-member-access"], ["room-member-allow"], ["room-member-adapter"], ["room-profiles"], ["room-restore"], ["room-fork"], ["models"], ["api-key"], ["api-check"],
                                              ["scheduler-check"], ["pick-directory"], ["projects"], ["presets"], ["machine-link"], ["admin-account"]):
             return self.respond({"ok": True})
         if route == ["settings"] and method in ("GET", "POST"):
@@ -1873,9 +1886,9 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             command = "api-check"
         elif route == ["scheduler-check"] and method == "POST":
             command = "scheduler-check"
-        elif route in (["room-member"], ["room-member-access"], ["room-member-adapter"]) and method == "POST":
+        elif route in (["room-member"], ["room-member-access"], ["room-member-allow"], ["room-member-adapter"]) and method == "POST":
             command = route[0]
-        elif route in (["room-profiles"], ["room-restore"]) and method == "POST":
+        elif route in (["room-profiles"], ["room-restore"], ["room-fork"]) and method == "POST":
             command = route[0]
         elif route == ["pick-directory"] and method == "POST":
             command = "pick-directory"
@@ -1894,7 +1907,7 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             if self.headers.get_content_type() != "application/json":
                 raise ValueError("本机操作须使用 application/json")
             payload = self.read_payload()
-            if command in ("start", "room-config", "room-models", "room-member", "room-member-access", "room-member-adapter", "room-profiles", "room-restore"):
+            if command in ("start", "room-config", "room-models", "room-member", "room-member-access", "room-member-allow", "room-member-adapter", "room-profiles", "room-restore", "room-fork"):
                 payload.pop("access_file", None)
                 payload.update(site=site, entry="web")
             if command == "machine-link":
@@ -2070,6 +2083,10 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             result = describe_members(connection, room_id, token, self.read_payload())
             connection.commit()
             return self.respond(result)
+        if parts[3:] == ["labels"] and method == "POST":
+            result = label_members(connection, room_id, token, self.read_payload())
+            connection.commit()
+            return self.respond(result)
         if parts[3:] == ["budget"] and method == "POST":
             result = set_chain_rounds(connection, room_id, token, self.read_payload())
             connection.commit()
@@ -2093,6 +2110,17 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             result = require_room(connection, room_id)
             connection.commit()
             return self.respond(result)
+        if len(parts) == 6 and parts[3] == "messages" and parts[5] == "retract" and method == "POST":
+            result = retract_message(connection, room_id, int(parts[4]), token)
+            connection.commit()
+            return self.respond(result)
+        if parts[3:] == ["rewind"]:
+            if method == "GET":
+                require_owner(connection, room_id, token)
+                return self.respond(rewind_plan(connection, room_id, int(params.get("message_id", 0))))
+            result = rewind_room(connection, room_id, token, self.read_payload())
+            connection.commit()
+            return self.respond(result)
         free = room_mode(connection, room_id) == "free"
         # A discussion keeps the local service's inbox and per-member executions for the user's direct questions.
         if parts[3:4] in (["inbox"], ["executions"]) or (free and parts[3:4] in (["members"], ["suggestions"], ["recommendations"])):