feat(console): resource edit flows + memory API parity and timeline/SPA fixes

[TechxTry]

Summary

• Console: edit agents (list + detail), rename session titles, rename vaults / edit credentials, update memory store settings; i18n for edit/save flows
• packages/http-routes memory: store update/archive/delete, memory update/delete, versions + redact — aligned with apps/main and Anthropic-shaped responses
• Timeline: cap chart width/ticks, collapse older turns, memo/content-visibility, cap side-panel JSON to avoid freezes on long sessions
• Tabs: fix orientation selectors so horizontal tabs stack correctly
• main-node: SPA index.html fallback skips /v1, /auth, /health, etc. so missing API routes return JSON instead of HTML

Closes #153

Test plan

• Agents list/detail: Edit → save creates a new version; archived agents cannot edit
• Session detail: rename title (Enter/Save), Escape cancels; empty → untitled affordance
• Vault detail: rename vault; edit credential display name; optional new token; OAuth rename-only hint
• Memory store settings: update name/description via PUT; mount path hint updates; archive/delete still from header
• main-node: PUT/POST /v1/memory_stores/:id, archive, delete; memory PATCH/POST/DELETE; memory_versions list/get/redact
• Session Timeline on a long multi-turn session stays interactive; only latest turn expanded by default
• Horizontal tabs: list above content (not side-by-side)
• Hit a missing /v1/... on main-node → JSON error, not Unexpected token '<'

Made with Cursor

[hrhrng]

Thanks for tackling these self-host and Console gaps. The direction looks useful, and the verify check is green. I found a few issues that should be fixed before merging:

1. Agent model configuration is lossy in agentToForm: an existing { id, speed } model is reduced to the id string, so a name-only edit silently drops speed.
2. Form-mode updates rebuild and replace the entire tools array. Existing custom tools or toolsets that the form does not understand are deleted, and switching Form to YAML or JSON serializes the reduced state. Please preserve unrecognized entries and merge only the form-managed toolsets.
3. TurnCard only reads defaultExpanded during the useState initializer. When a live new turn is appended, the previously latest keyed card remains expanded, so waterfalls accumulate and the long-session performance problem returns.
4. Event.ts is an ISO string, but eventTsMs only accepts a number when processed_at is absent, producing incorrect zero durations.

Please add focused regression coverage for editing an existing agent with non-default model or tool configuration and for appending turns to a live Timeline.

Dismissed because this review was submitted prematurely and did not reflect a completed review.

[hrhrng]

One more clarification on the Agent edit scope: existing agent configs can already contain fields that this form does not model, such as model.speed, custom or unknown toolsets, existing MCP toolset permissions, and the full MCP stdio object. A small edit currently reconstructs these structures and can silently drop or overwrite those values.

I do not think #154 needs to add UI for every AgentConfig field. For this PR, the update path should be lossless: preserve unsupported fields and merge only the fields actually managed by the form. Please add a round-trip regression test for that behavior.

I opened #155 to track complete, full-field AgentConfig editing in Console, including the full MCP stdio configuration. MCP credentials should remain managed through Vaults.

[hrhrng]

One issue with the Timeline optimization: TurnCard initializes collapsed from defaultExpanded only once. When a new turn is appended, the previous latest card keeps its expanded state while the new latest card also mounts expanded. Keeping the Timeline tab open therefore accumulates expanded waterfalls over time and can reintroduce the long-session freeze this change is meant to prevent.

Could we make latest-turn expansion controlled while preserving explicit user overrides, and add a regression test that appends several turns and verifies only the latest auto-expanded turn remains open? Clearing the selection when switching sessions or threads would also be helpful, but the auto-expansion issue is the main blocker.

[TechxTry]

Thanks for the review — addressed in 470becd:

1. Lossless agent update — extracted agentFormCodec; form updates / Form↔YAML|JSON overlay onto a preserved config baseline so model.speed, custom/unknown toolsets, existing mcp_toolset policies, MCP stdio, and other unsupported fields survive a small edit. Full-field UI remains in Console: support lossless, full-field AgentConfig editing #155.
2. Tools merge — only rebuilds the form-managed agent_toolset_20260401 and MCP toolset membership; unrecognized entries are kept.
3. Timeline expansion — latest-turn expansion is controlled via resolveTurnExpanded + overrides; appending turns collapses the previous auto-expanded card unless the user explicitly overrode it. Selection/expansion state resets on session/thread change via key.
4. eventTsMs — parses ISO ts (and still accepts legacy unix seconds); shared with derive.ts.
5. Console: Session detail reads the wrong Vault name field #156 — Session detail vault badge now uses API name.

Added regression tests for agent round-trip, live Timeline append, eventTsMs, and vault label mapping (pnpm --filter managed-agents-console test — 34 passing).

[hrhrng]

I found one remaining lossless-edit edge case: MCP servers are matched back to the preserved config by the editable name (priorByName.get(m.name)). If a stdio MCP is renamed, that lookup misses, so it is rebuilt from only the visible form fields and drops hidden stdio.command/args/env/port (and any other unmodeled keys). mergeToolsField also looks up the existing mcp_toolset policy by the new name, so that policy is replaced with the default always_allow.

Could we carry the original name or another stable row identity through form state, use it to find the preserved MCP server/toolset, and then write the new name? A regression test for renaming a stdio MCP while preserving both the stdio config and the existing tool policy would cover this.