dsh-global-todo 0.3.2 → 0.4.1

package/lib/index.js

@@ -25,7 +25,7 @@ import path from 'node:path'
 
 import { createCompletionWatcher } from './completion.js'
 import { createDispatcher } from './dispatch.js'
-import { createSettings, dueAutoCollect, idleSessions } from './settings.js'
+import { createSettings, explainAutoCollect, idleSessions, retryDelayMs } from './settings.js'
 import { createDiagnostics } from './diagnostics.js'
 import { createMetrics } from './metrics.js'
 import { LIMITS } from './model.js'
@@ -35,7 +35,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.3.2'
+export const VERSION = '0.4.1'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'
@@ -47,6 +47,10 @@ export const DEFAULTS = Object.freeze({
   activityLimit: LIMITS.activity,
   requireExistingFiles: true,
   guidance: true,
+  // Starting point for the built-in folder browser when the shell has no picker.
+  // Documented here because a patch override replaces `config` wholesale and has
+  // to restate every key it wants to keep.
+  browseRoot: '',
 })
 
 /**
@@ -169,6 +173,35 @@ export function apply(ctx, config) {
   // clock, so a session in use is never asked.
   const collectPending = {}
   const collectActivity = {}
+  // Sessions whose question failed: when the next attempt is allowed, and how many
+  // attempts have failed. Two maps because the decision layer takes timestamps only.
+  const collectRetry = {}
+  const collectAttempts = {}
+  const ASK_TIMEOUT_MS = 10_000
+  const ASK_MAX_ATTEMPTS = 3
+
+  /**
+   * Bound a promise the plugin does not control.
+   *
+   * `requestCapture` may wait on `agents.resume`, and a resume that never settles left
+   * `asking` true forever — which silences the feature for every conversation, not just
+   * the broken one.
+   */
+  const withinMs = (promise, ms) =>
+    new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error(`等待 ${Math.round(ms / 1000)} 秒没有结果`)), ms)
+      if (typeof timer.unref === 'function') timer.unref()
+      promise.then(
+        (value) => {
+          clearTimeout(timer)
+          resolve(value)
+        },
+        (error) => {
+          clearTimeout(timer)
+          reject(error)
+        },
+      )
+    })
   // When a *person* last wrote in each conversation. The question we send is a message in
   // the conversation too, and re-arming on it is exactly the loop this exists to break — so
   // only `source.kind === 'user'` counts as somebody having answered.
@@ -177,24 +210,46 @@ export function apply(ctx, config) {
   // The live lookup below is only a fallback for a conversation that has not been seen yet.
   const collectDir = {}
 
-  const askSession = (sessionId) => {
+  const askSession = async (sessionId) => {
+    if (autoCollectState.asking === true) return
     autoCollectState.asking = true
-    // Book the cooldown *before* asking: a failed question must not loop.
-    void settings
-      .rememberAsked(sessionId, Date.now())
-      .then(() => dispatcher.requestCapture({ sessionId, authoritative: true }))
-      .then((result) => {
-        autoCollectState.lastAsk = { at: Date.now(), sessionId: result?.sessionId ?? sessionId }
-        autoCollectState.error = null
-      })
-      .catch((error) => {
-        autoCollectState.error = String(error?.message ?? error)
-        logger?.warn?.(`dsh-global-todo: 自动抓取失败（${autoCollectState.error}）`)
-      })
-      .finally(() => {
-        autoCollectState.asking = false
+    autoCollectState.stats.asked += 1
+    try {
+      // Book first: a question that fails must not be repeated in a burst. The booking is
+      // released below when the question did not arrive, because a failure is not an answer.
+      await settings.rememberAsked(sessionId, Date.now())
+      const result = await withinMs(dispatcher.requestCapture({ sessionId, authoritative: true }), ASK_TIMEOUT_MS)
+      autoCollectState.lastAsk = { at: Date.now(), sessionId: result?.sessionId ?? sessionId }
+      autoCollectState.error = null
+      autoCollectState.stats.succeeded += 1
+      autoCollectState.lastRetry = null
+      delete collectRetry[sessionId]
+      delete collectAttempts[sessionId]
+      delete collectPending[sessionId]
+    } catch (error) {
+      const message = String(error?.message ?? error)
+      const attempts = (collectAttempts[sessionId] ?? 0) + 1
+      autoCollectState.error = message
+      autoCollectState.stats.failed += 1
+      // A failure is not an answer: leaving the booking behind made `awaiting-human` keep
+      // the conversation quiet until a person happened to speak again.
+      await settings.forgetAsked(sessionId).catch(() => {})
+      if (attempts >= ASK_MAX_ATTEMPTS) {
+        delete collectRetry[sessionId]
+        delete collectAttempts[sessionId]
         delete collectPending[sessionId]
-      })
+        autoCollectState.stats.dropped += 1
+        autoCollectState.lastDrop = { at: Date.now(), sessionId, attempts, error: message }
+      } else {
+        const at = Date.now()
+        collectAttempts[sessionId] = attempts
+        collectRetry[sessionId] = at + retryDelayMs(attempts)
+        autoCollectState.lastRetry = { at, sessionId, attempts, nextAt: collectRetry[sessionId] }
+      }
+      logger?.warn?.(`dsh-global-todo: 自动抓取失败（${message}），第 ${attempts} 次`)
+    } finally {
+      autoCollectState.asking = false
+    }
   }
 
   ctx.effect(() => {
@@ -266,10 +321,14 @@ export function apply(ctx, config) {
         // With the switch off there is nothing to ask for either, so the candidates are
         // dropped rather than left to fire in a burst the moment it is switched on.
         if (current.autoCollect !== true) {
-          for (const sessionId of idle) delete collectPending[sessionId]
+          for (const sessionId of idle) {
+            delete collectPending[sessionId]
+            // A retry belongs to a candidate; with the switch off there is nothing to retry.
+            delete collectRetry[sessionId]
+            delete collectAttempts[sessionId]
+          }
         }
         autoCollectState.waiting = Object.keys(collectPending).length
-        if (current.autoCollect !== true || autoCollectState.asking === true) return
         // An exemption is keyed on the working directory. What the conversation's own events
         // reported wins, because an unloaded conversation is the normal state of one that has
         // gone quiet; the agents service is only the fallback, and it answers '' for a session
@@ -278,18 +337,30 @@ export function apply(ctx, config) {
         for (const sessionId of Object.keys(collectPending)) {
           dirAt[sessionId] = collectDir[sessionId] ?? dispatcher.sessionDir(sessionId)
         }
-        const due = dueAutoCollect({
+        const decisions = explainAutoCollect({
           pending: collectPending,
           activityAt: collectActivity,
           humanAt: collectHuman,
           dirAt,
+          retryAt: collectRetry,
           settings: current,
           recentSessionId: recentSession.id,
-          now: Date.now(),
+          now,
         })
+        const due = decisions.filter((decision) => decision.ask)
         autoCollectState.waiting = Object.keys(collectPending).length
+        autoCollectState.due = due.length
+        // The reason used to be computed and dropped on the floor; keep the list so /health
+        // can answer "why was this conversation not asked?".
+        autoCollectState.decisions = decisions.slice(0, 20)
+        const shown = due[0] ?? decisions[0]
+        autoCollectState.lastDecision =
+          shown === undefined
+            ? null
+            : { at: now, sessionId: shown.sessionId, ask: shown.ask === true, reason: shown.reason, idleMs: shown.idleMs }
+        if (current.autoCollect !== true || autoCollectState.asking === true) return
         if (due.length === 0) return
-        askSession(due[0].sessionId)
+        void askSession(due[0].sessionId)
       } catch (error) {
         autoCollectState.error = String(error?.message ?? error)
       }
@@ -322,7 +393,20 @@ export function apply(ctx, config) {
   const diagnostics = createDiagnostics({ file: path.join(path.dirname(file), 'client-errors.log'), logger })
   const settingsFile = path.join(path.dirname(file), 'settings.json')
   const settings = createSettings({ file: settingsFile, logger })
-  const autoCollectState = { enabled: false, asking: false, lastAsk: null, error: null }
+  const autoCollectState = {
+    enabled: false,
+    asking: false,
+    lastAsk: null,
+    error: null,
+    waiting: 0,
+    due: 0,
+    decisions: [],
+    lastDecision: null,
+    lastRetry: null,
+    lastDrop: null,
+    // In-memory on purpose: it describes this process, not the list. Restarting resets it.
+    stats: { asked: 0, succeeded: 0, failed: 0, dropped: 0 },
+  }
   ctx.effect(() => {
     void settings.load().then((loaded) => {
       autoCollectState.enabled = loaded.autoCollect === true

package/lib/model.js

@@ -20,7 +20,7 @@ import { LINK_KINDS, linkKey, normalizeLink } from './links.js'
 export const SCHEMA_VERSION = 1
 
 /** Lifecycle states. `doing` is the explicit "an agent (or I) am on it" state. */
-export const STATUSES = Object.freeze(['open', 'doing', 'done', 'cancelled'])
+export const STATUSES = Object.freeze(['open', 'doing', 'done', 'cancelled', 'archived'])
 
 /** Priorities are deliberately coarse: three levels people actually use. */
 /**
@@ -653,17 +653,17 @@ export function recordDispatch(todo, info, options = {}) {
  * @returns {boolean}
  */
 export function isOverdue(todo, now = Date.now()) {
-  if (todo.dueAt === null || todo.status === 'done' || todo.status === 'cancelled') return false
+  if (todo.dueAt === null || todo.status === 'done' || todo.status === 'cancelled' || todo.status === 'archived') return false
   const due = Date.parse(todo.dueAt)
   return Number.isFinite(due) && due < now
 }
 
 /**
  * @param {object[]} todos
- * @returns {{ total: number, open: number, doing: number, done: number, cancelled: number, overdue: number }}
+ * @returns {{ total: number, open: number, doing: number, done: number, cancelled: number, archived: number, overdue: number }}
  */
 export function counts(todos, now = Date.now()) {
-  const out = { total: todos.length, open: 0, doing: 0, done: 0, cancelled: 0, overdue: 0 }
+  const out = { total: todos.length, open: 0, doing: 0, done: 0, cancelled: 0, archived: 0, overdue: 0 }
   for (const todo of todos) {
     if (todo.status in out) out[todo.status] += 1
     if (isOverdue(todo, now)) out.overdue += 1

package/lib/routes.js

@@ -358,6 +358,10 @@ export function createRoutes(deps) {
       // Counted once: the size feeds the metrics snapshot and the counts the panel
       // reads are the same numbers, so /health cannot contradict itself.
       const counts = await service.stats()
+      // Where the automatic-collect switch came from. `false` because nobody turned it on
+      // and `false` because the file is unreadable look identical from the panel, and the
+      // second one used to be invisible everywhere.
+      const settingsInfo = deps.settings?.info?.() ?? { file: '', at: 0, source: 'default', error: null }
       return {
         plugin: 'dsh-global-todo',
         version,
@@ -403,6 +407,11 @@ export function createRoutes(deps) {
           // The exempted workspaces, so the panel can show which conversations are out of
           // scope instead of leaving the person to guess why nothing was ever asked.
           exemptWorkspaces: deps.settings?.get?.().exemptWorkspaces ?? [],
+          // Reported so "off" can be told apart from "the file did not load".
+          file: settingsInfo.file,
+          loadedAt: settingsInfo.at,
+          loadSource: settingsInfo.source,
+          loadError: settingsInfo.error,
         },
         autoCollect: {
           // Derived from the setting, not from a copy kept elsewhere: two sources for one
@@ -411,6 +420,17 @@ export function createRoutes(deps) {
           asking: deps.autoCollect?.asking === true,
           lastAsk: deps.autoCollect?.lastAsk ?? null,
           error: deps.autoCollect?.error ?? null,
+          // Why a conversation was or was not asked. The decision used to keep the reason
+          // in a local and drop it, so this question had no answer even in the Host.
+          waiting: deps.autoCollect?.waiting ?? 0,
+          due: deps.autoCollect?.due ?? 0,
+          lastDecision: deps.autoCollect?.lastDecision ?? null,
+          decisions: deps.autoCollect?.decisions ?? [],
+          stats: deps.autoCollect?.stats ?? { asked: 0, succeeded: 0, failed: 0, dropped: 0 },
+          // Set after a failed question, so a retry in flight is visible rather than
+          // looking like the feature silently stopped.
+          lastRetry: deps.autoCollect?.lastRetry ?? null,
+          lastDrop: deps.autoCollect?.lastDrop ?? null,
         },
         // 「交给 Agent」 resolves its target from the conversation the user last
         // wrote in, so whether that feed attached is worth reporting too.
@@ -448,6 +468,15 @@ export function createRoutes(deps) {
       return dispatcher.assignMany(body ?? {})
     }),
 
+    exact('POST', `${ROUTE_BASE}/bulk`, async (request) => {
+      const body = await readJsonBody(request)
+      return service.bulk(
+        body.ids,
+        { status: body.status, addTags: body.addTags, removeTags: body.removeTags },
+        { by: actorOf(body) },
+      )
+    }),
+
     exact('POST', `${ROUTE_BASE}/capture`, async (request) => {
       const body = await readJsonBody(request)
       return dispatcher.requestCapture(body ?? {})

package/lib/service.js

@@ -33,12 +33,15 @@ import {
 } from './model.js'
 
 /** Filters the panel and the tools may ask for. */
-export const FILTERS = Object.freeze(['all', 'active', 'open', 'doing', 'done', 'cancelled', 'overdue'])
+export const FILTERS = Object.freeze(['all', 'active', 'open', 'doing', 'done', 'cancelled', 'archived', 'overdue'])
 
 /** Sort keys the panel and the tools may ask for. */
 export const SORTS = Object.freeze(['created', 'updated', 'due', 'priority'])
 
-const PRIORITY_RANK = { high: 0, normal: 1, low: 2 }
+// Every level the record can hold, or the comparator silently produces NaN for
+// the missing one and the highest-priority items sort last. `urgent` was added
+// to the model without this table, so `sort=priority` put P0 at the bottom.
+const PRIORITY_RANK = { urgent: 0, high: 1, normal: 2, low: 3 }
 
 /**
  * Fold imported records into the current list: a known id wins, a new one appends.
@@ -111,7 +114,7 @@ export function createService(options) {
   /**
    * @param {object[]} todos
    * @param {{ status?: string, query?: string, tag?: string, sort?: string, limit?: number }} [query]
-   * @returns {object[]}
+   * @returns {{ todos: object[], matched: number }} the page and how many matched before it
    */
   /** Friendly level aliases, so search can be written the way the panel talks. */
   const LEVEL_ALIAS = Object.freeze({ p0: 'urgent', p1: 'high', p2: 'normal', p3: 'low' })
@@ -230,17 +233,25 @@ export function createService(options) {
     })
 
     const limit = Number.isInteger(query.limit) && query.limit > 0 ? Math.min(query.limit, 1000) : 200
-    return out.slice(0, limit)
+    // matched is the count before the page is cut. Returning only the page made the
+    // panel show 200 for a list of 350 with no way to tell -- the caller now has
+    // enough to say 'showing 200 of 350' instead of quietly lying.
+    return { todos: out.slice(0, limit), matched: out.length }
   }
 
   /**
    * @param {{ status?: string, query?: string, tag?: string, sort?: string, limit?: number }} [query]
-   * @returns {Promise<{ todos: object[], counts: object, matched: number }>}
+   * @returns {Promise<{ todos: object[], counts: object, matched: number, truncated: boolean }>}
    */
   async function list(query = {}) {
     const todos = await store.all()
     const selected = select(todos, query)
-    return { todos: selected, counts: counts(todos, now()), matched: selected.length }
+    return {
+      todos: selected.todos,
+      counts: counts(todos, now()),
+      matched: selected.matched,
+      truncated: selected.matched > selected.todos.length,
+    }
   }
 
   /**
@@ -607,6 +618,54 @@ export function createService(options) {
     })
   }
 
+  /**
+   * Apply one change to several todos.
+   *
+   * Each record goes through the same validation and trail as a single edit. A stale id is
+   * reported in `unmatched` instead of failing the batch: a selection is a human gesture, and
+   * one row that moved must not discard the other nine.
+   *
+   * @param {string[]} ids
+   * @param {{ status?: string, addTags?: string[], removeTags?: string[] }} change
+   * @param {{ by?: 'human' | 'agent' }} [context]
+   * @returns {Promise<{ updated: number, ids: string[], unmatched: string[], errors: { id: string, error: string }[] }>}
+   */
+  async function bulk(ids, change = {}, context = {}) {
+    const wanted = Array.isArray(ids) ? ids.filter((id) => typeof id === 'string' && id.trim() !== '') : []
+    if (wanted.length === 0) throw new TodoError('invalid-body', '要改哪些待办？给一个非空的 ids')
+    const hasStatus = typeof change.status === 'string' && change.status !== ''
+    const addTags = Array.isArray(change.addTags) ? change.addTags : []
+    const removeTags = Array.isArray(change.removeTags) ? change.removeTags : []
+    if (!hasStatus && addTags.length === 0 && removeTags.length === 0) {
+      throw new TodoError('invalid-body', '批量修改需要 status / addTags / removeTags 之一')
+    }
+    const updated = []
+    const unmatched = []
+    const errors = []
+    for (const id of wanted) {
+      try {
+        const todo = await store.update((doc) => {
+          const target = doc.todos.find((candidate) => candidate.id === id)
+          if (target === undefined) return { result: null }
+          const patch = {}
+          if (hasStatus) patch.status = change.status
+          if (addTags.length > 0 || removeTags.length > 0) {
+            const merged = new Map(target.tags.map((tag) => [tag.toLowerCase(), tag]))
+            for (const tag of addTags) merged.set(String(tag).toLowerCase(), String(tag))
+            for (const tag of removeTags) merged.delete(String(tag).toLowerCase())
+            patch.tags = [...merged.values()]
+          }
+          const changed = applyPatch(target, patch, { ...modelOptions(context.by), ...linkOptions() })
+          return changed.length === 0 ? { result: target } : { next: doc.todos, result: target }
+        })
+        if (todo === null) unmatched.push(id)
+        else updated.push(id)
+      } catch (error) {
+        errors.push({ id, error: error instanceof TodoError ? error.message : String(error?.message ?? error) })
+      }
+    }
+    return { updated: updated.length, ids: updated, unmatched, errors }
+  }
   /** @returns {Promise<object>} counts for the panel header and tool summaries */
   async function stats() {
     const todos = await store.all()
@@ -626,6 +685,7 @@ export function createService(options) {
     findBySession,
     remove,
     restore,
+    bulk,
     addLink,
     removeLink,
     recordDispatch,

package/lib/settings.js

@@ -13,6 +13,21 @@ import { readFile, writeFile } from 'node:fs/promises'
 /** How many sessions the cooldown bookkeeping remembers. */
 const ASKED_LIMIT = 50
 
+/**
+ * Backoff after a failed question, in order. A failed resume is often transient, so the
+ * first retry is a minute away; three failures mean the conversation is not reachable now.
+ */
+export const RETRY_DELAYS_MS = Object.freeze([60_000, 300_000, 1_500_000])
+
+/**
+ * @param {number} attempts - 1-based failure count
+ * @returns {number} milliseconds to wait before the next attempt
+ */
+export function retryDelayMs(attempts) {
+  const index = Math.min(Math.max(Number(attempts) || 1, 1), RETRY_DELAYS_MS.length) - 1
+  return RETRY_DELAYS_MS[index]
+}
+
 /** How many exempt workspaces are remembered. */
 const EXEMPT_LIMIT = 50
 
@@ -100,6 +115,9 @@ export function isExemptWorkspace(sessionDir, exemptWorkspaces) {
  */
 export function createSettings(options) {
   let state = normalizeSettings(SETTINGS_DEFAULTS)
+  // How the file arrived. An off switch and a broken file look identical from the panel,
+  // and that ambiguity is exactly what made a silent failure to load invisible.
+  let loadInfo = { file: options.file ?? '', source: 'default', at: 0, error: null }
   // The startup read is kicked off without being awaited (the plugin cannot block its own
   // mount on a file), and it replaces the *whole* state. A write that lands while it is
   // still in flight is therefore undone by it — the panel's toggle would flip back and the
@@ -118,10 +136,25 @@ export function createSettings(options) {
     /** Read once at startup; a missing or broken file means the defaults. */
     async load() {
       startup = (async () => {
+        let text = null
         try {
-          state = normalizeSettings(JSON.parse(await readFile(options.file, 'utf8')))
-        } catch {
+          text = await readFile(options.file, 'utf8')
+        } catch (error) {
           state = normalizeSettings(SETTINGS_DEFAULTS)
+          loadInfo = {
+            file: options.file ?? '',
+            source: error?.code === 'ENOENT' ? 'missing' : 'unreadable',
+            at: Date.now(),
+            error: error?.code === 'ENOENT' ? null : String(error?.message ?? error),
+          }
+          return
+        }
+        try {
+          state = normalizeSettings(JSON.parse(text))
+          loadInfo = { file: options.file ?? '', source: 'file', at: Date.now(), error: null }
+        } catch (error) {
+          state = normalizeSettings(SETTINGS_DEFAULTS)
+          loadInfo = { file: options.file ?? '', source: 'corrupt', at: Date.now(), error: String(error?.message ?? error) }
         }
       })()
       await startup
@@ -131,6 +164,10 @@ export function createSettings(options) {
     get() {
       return { ...state, asked: { ...state.asked } }
     },
+    /** Where the settings came from and whether the file was readable, for /health. */
+    info() {
+      return { ...loadInfo }
+    },
     /** A patch a route or a test can send; unknown fields are ignored. */
     async update(patch) {
       await startup
@@ -146,6 +183,22 @@ export function createSettings(options) {
       await persist()
       return this.get()
     },
+    /**
+     * Undo a booking whose question never arrived.
+     *
+     * A failed ask used to leave the booking behind, and `awaiting-human` then kept the
+     * conversation silent until a person spoke again — one transient resume failure turned
+     * the feature off for that conversation.
+     */
+    async forgetAsked(sessionId) {
+      await startup
+      if (typeof sessionId !== 'string' || sessionId === '' || !(sessionId in state.asked)) return this.get()
+      const asked = { ...state.asked }
+      delete asked[sessionId]
+      state = normalizeSettings({ ...state, asked })
+      await persist()
+      return this.get()
+    },
   }
 }
 
@@ -166,11 +219,29 @@ export function createSettings(options) {
  * @returns {{ sessionId: string, idleMs: number }[]}
  */
 export function dueAutoCollect(input) {
-  const due = []
+  return explainAutoCollect(input)
+    .filter((decision) => decision.ask)
+    .map((decision) => ({ sessionId: decision.sessionId, idleMs: decision.idleMs }))
+}
+
+/**
+ * The same decisions, with the reason kept.
+ *
+ * `dueAutoCollect` used to compute the reason and throw it away, which is why "why was this
+ * conversation not asked?" had no answer anywhere. `/health` reads this list.
+ *
+ * @param {object} input - the same shape `dueAutoCollect` takes, plus optional `retryAt`
+ * @returns {{ sessionId: string, ask: boolean, reason: string, idleMs: number }[]}
+ */
+export function explainAutoCollect(input) {
+  const out = []
   for (const sessionId of Object.keys(input.pending ?? {})) {
     const lastAt = input.activityAt?.[sessionId]
     // Fail closed: without a known "went quiet at", there is nothing to wait for.
-    if (!Number.isFinite(lastAt) || lastAt <= 0) continue
+    if (!Number.isFinite(lastAt) || lastAt <= 0) {
+      out.push({ sessionId, ask: false, reason: 'no-activity', idleMs: 0 })
+      continue
+    }
     const idleMs = input.now - lastAt
     const decision = decideAutoCollect({
       settings: input.settings,
@@ -180,11 +251,12 @@ export function dueAutoCollect(input) {
       idleMs,
       humanAt: input.humanAt,
       sessionDir: input.dirAt?.[sessionId],
+      retryAt: input.retryAt,
       now: input.now,
     })
-    if (decision.ask) due.push({ sessionId, idleMs })
+    out.push({ sessionId, idleMs, ask: decision.ask, reason: decision.reason })
   }
-  return due
+  return out
 }
 
 /**
@@ -228,6 +300,7 @@ export function idleSessions(input) {
  * @param {number} [input.idleMs]
  * @param {Record<string, number>} [input.humanAt] - when a person last wrote, per session
  * @param {string} [input.sessionDir] - the conversation's working directory, when known
+ * @param {Record<string, number>} [input.retryAt] - next retry time per session after a failure
  * @param {number} input.now
  * @returns {{ ask: boolean, reason: string }}
  */
@@ -240,12 +313,24 @@ export function decideAutoCollect(input) {
   if (isExemptWorkspace(input.sessionDir ?? '', input.settings.exemptWorkspaces)) {
     return { ask: false, reason: 'exempt-workspace' }
   }
+  // Fail closed on an unknown directory. The exemption is keyed on where the conversation
+  // works, and a place nobody can name cannot be checked against it -- asking there would
+  // volunteer a question where the person may well have meant to exclude. The cost is a
+  // conversation whose cwd the Host never reported, and the event tracker normally supplies
+  // it on the first message.
+  if (typeof input.sessionDir !== 'string' || input.sessionDir === '') {
+    return { ask: false, reason: 'unknown-dir' }
+  }
   if (input.turnReason !== 'completed') return { ask: false, reason: `turn-${input.turnReason ?? 'unknown'}` }
   // Only where a person actually is: a hand-off, a subagent or a background run must
   // not be interrupted with "anything to follow up on?".
   if (input.recentSessionId === '' || input.sessionId !== input.recentSessionId) {
     return { ask: false, reason: 'not-the-users-conversation' }
   }
+  // A failed question backs off instead of retrying on the next tick. The booking is cleared
+  // on failure (see index.js), so without this the retry would be immediate.
+  const retryAt = input.retryAt?.[input.sessionId]
+  if (Number.isFinite(retryAt) && retryAt > input.now) return { ask: false, reason: 'retry-wait' }
   // One question per person-turn — and the rule that ends the loop.
   //
   // The question is itself a message in the conversation: it restarted the quiet clock

package/lib/tools.js

@@ -416,13 +416,14 @@ export function createTools(service, options = {}) {
       name: 'global_todo_list',
       description:
         '查「全局待办」。默认返回未完成（active = open + doing）的条目，按加入时间倒序。'
-        + '每条都会带上加入时间；带附件的会列出附件标题。',
+        + '每条都会带上加入时间；带附件的会列出附件标题。'
+        + '结果超过 limit 时 truncated=true，matched 说明一共匹配了多少条。',
       parameters: {
         type: 'object',
         properties: {
           status: {
             type: 'string',
-            enum: ['all', 'active', 'open', 'doing', 'done', 'cancelled', 'overdue'],
+            enum: ['all', 'active', 'open', 'doing', 'done', 'cancelled', 'archived', 'overdue'],
             description: '缺省 active',
           },
           query: { type: 'string', description: '在标题、描述、标签、附件里模糊匹配' },
@@ -442,6 +443,10 @@ export function createTools(service, options = {}) {
             count: { type: 'integer' },
             counts: { type: 'object' },
             todos: { type: 'array', items: TODO_SHAPE },
+            // Present only when the page was cut; the model should know it is not
+            // looking at the whole match set before it concludes anything.
+            matched: { type: 'integer' },
+            truncated: { type: 'boolean' },
           },
           required: ['count', 'counts', 'todos'],
         },
@@ -452,8 +457,12 @@ export function createTools(service, options = {}) {
             )
           }
           const lines = value.todos.map((todo) => todoLine(todo))
+          const cut =
+            value.truncated === true
+              ? `\n（只显示前 ${value.count} 条，共 ${value.matched} 条匹配；用 status / query / limit 缩小范围）`
+              : ''
           return text(
-            `${value.count} 条待办（全库 ${value.counts.total} 条，逾期 ${value.counts.overdue} 条）：\n${lines.join('\n')}`,
+            `${value.count} 条待办（全库 ${value.counts.total} 条，逾期 ${value.counts.overdue} 条）：\n${lines.join('\n')}${cut}`,
           )
         },
       },
@@ -473,6 +482,8 @@ export function createTools(service, options = {}) {
           count: outcome.value.todos.length,
           counts: outcome.value.counts,
           todos: outcome.value.todos.map((todo) => presentTodo(todo, now())),
+          matched: outcome.value.matched,
+          truncated: outcome.value.truncated,
         }
       },
     },
@@ -507,7 +518,7 @@ export function createTools(service, options = {}) {
     {
       name: 'global_todo_update',
       description:
-        '改一条全局待办。只传要改的字段；`dueAt: ""` 清空截止时间，`tags: []` 清空标签，`links` 是整体替换（要单独加附件请用 global_todo_link）。',
+        '改一条全局待办。只传要改的字段；`dueAt: ""` 清空截止时间，`tags: []` 清空标签，`links` 是整体替换（要单独加附件请用 global_todo_link），`status` 可以设为 archived（归档，不删除）。',
       parameters: {
         type: 'object',
         properties: {
@@ -515,6 +526,9 @@ export function createTools(service, options = {}) {
           title: { type: 'string' },
           description: { type: 'string' },
           priority: { type: 'string', enum: [...PRIORITIES] },
+          // `status` belongs here: marking something in progress used to require the tool
+          // named `global_todo_done`, and archiving had no entry point at all.
+          status: { type: 'string', enum: [...STATUSES], description: 'open / doing / done / cancelled / archived' },
           dueAt: { oneOf: [{ type: 'string' }, { type: 'null' }], description: '空串或 null 表示清空' },
           tags: { type: 'array', items: { type: 'string' } },
           links: LINKS_INPUT,