feat(tasks): 任务并发上限(可选,超限排队自动补位)

任务页新建任务左侧加「并发设置」齿轮:开关(默认关) + 并发数量(开启默认5)。
开启后新建任务若「运行中」数已达上限,进入「排队中」不启动;有空位时后台
每 5s 自动把最早排队的任务补位启动。

- db: tasks 加持久化 queued 列(schema + ALTER 补旧库);Task.Queued/SetQueued。
- manager: ConcurrencyLimit/SetConcurrency(settings KV);SetTaskQueued(落库+同步内存)。
- 准入与促进器(goals.go):launchTask 统一准入,满则挂起排队;抽出 startTaskEngine
  复用;occupiesSlot/runningTaskCount/queueIfAtCapacity;reconcileConcurrency 每
  scheduler tick 补位(关闭则放行全部排队),concMu 串行化防超发;启动重载/setActive/
  reviveTask 三处'排队则不启动'门。
- settings: /api/settings 增 task_concurrency_enabled/limit;PUT 后立即协调一次。
- web: 齿轮 Dialog(Switch+数量);新增 queued/「排队中」状态(类型/状态色/筛选)。
- 超限只排队新任务,不打断在跑的;排队任务不消耗 LLM(目标拆解推迟到出队)。

go build/vet、tsc 通过;DB queued 往返测试通过。

server/goals.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"sort"
 	"strconv"
 	"strings"
 
@@ -29,21 +30,116 @@ func (s *Server) launchTask(t *Task, seedText string, seedFirstIntent bool) {
 	if seedFirstIntent {
 		s.seedFirstIntent(t)
 	}
-	go func() {
-		s.engine.emitActivity(t, db.Activity{Worker: "planner", Kind: "round",
-			Summary: "第 0 轮目标拆解"})
-		goals := s.createGoals(s.ctx, t, func(r db.Activity) {
-			s.engine.emitActivity(t, r)
-		})
-		for _, g := range goals {
-			summary := g.Text
-			if g.VulnClass != "" {
-				summary = fmt.Sprintf("[%s] %s", g.VulnClass, g.Text)
-			}
-			s.engine.emitActivity(t, db.Activity{Worker: "planner", Kind: "text", Summary: summary})
+	// 并发上限:满了就挂起排队(不做目标拆解、不启动引擎),由 reconcileConcurrency 补位启动。
+	if s.queueIfAtCapacity(t) {
+		return
+	}
+	go s.startTaskEngine(t)
+}
+
+// startTaskEngine does the actual running work: 第0轮目标拆解 + 启动引擎循环。
+// Shared by fresh launches and by the concurrency reconciler promoting a queued task.
+func (s *Server) startTaskEngine(t *Task) {
+	s.engine.emitActivity(t, db.Activity{Worker: "planner", Kind: "round",
+		Summary: "第 0 轮目标拆解"})
+	goals := s.createGoals(s.ctx, t, func(r db.Activity) {
+		s.engine.emitActivity(t, r)
+	})
+	for _, g := range goals {
+		summary := g.Text
+		if g.VulnClass != "" {
+			summary = fmt.Sprintf("[%s] %s", g.VulnClass, g.Text)
 		}
-		s.engine.Run(s.ctx, t)
-	}()
+		s.engine.emitActivity(t, db.Activity{Worker: "planner", Kind: "text", Summary: summary})
+	}
+	s.engine.Run(s.ctx, t)
+}
+
+// occupiesSlot reports whether a task counts against the concurrency cap: it is
+// live (not terminal), not queued, and not paused. A just-created / decomposing
+// task counts too (it will run momentarily).
+func (s *Server) occupiesSlot(t *Task) bool {
+	if t == nil || t.Queued || isTerminalStatus(t.Status) {
+		return false
+	}
+	return !t.Paused && !s.engine.IsPaused(t.ID)
+}
+
+// runningTaskCount counts tasks occupying a concurrency slot, excluding excludeID
+// (pass the candidate's id when deciding admission so it doesn't count itself).
+func (s *Server) runningTaskCount(excludeID string) int {
+	n := 0
+	for _, t := range s.m.List() {
+		if t.ID == excludeID {
+			continue
+		}
+		if s.occupiesSlot(t) {
+			n++
+		}
+	}
+	return n
+}
+
+// queueIfAtCapacity holds a task in the queued state when the concurrency cap is
+// enabled and already full. Returns true if the task was queued (caller must not
+// start it). No-op (false) when the feature is off or a slot is free.
+func (s *Server) queueIfAtCapacity(t *Task) bool {
+	s.concMu.Lock()
+	defer s.concMu.Unlock()
+	enabled, limit := s.m.ConcurrencyLimit()
+	if !enabled || s.runningTaskCount(t.ID) < limit {
+		return false
+	}
+	if err := s.m.SetTaskQueued(t.ID, true); err != nil {
+		log.Printf("[concurrency] task %s 置排队失败: %v", t.ID, err)
+		return false // 落库失败宁可放它跑,也别静默丢任务
+	}
+	t.Queued = true
+	s.engine.emitActivity(t, db.Activity{Worker: "planner", Kind: "text",
+		Summary: fmt.Sprintf("已排队：达到并发上限 %d，等待空位后自动开始", limit)})
+	log.Printf("[concurrency] task %s 排队(并发上限 %d)", t.ID, limit)
+	return true
+}
+
+// reconcileConcurrency promotes queued tasks into free slots. Runs on every
+// scheduler tick. When the feature is disabled it releases ALL queued tasks;
+// when enabled it starts the oldest-queued tasks up to (limit - running).
+func (s *Server) reconcileConcurrency() {
+	s.concMu.Lock()
+	defer s.concMu.Unlock()
+	var queued []*Task
+	for _, t := range s.m.List() {
+		if t.Queued && !isTerminalStatus(t.Status) {
+			queued = append(queued, t)
+		}
+	}
+	if len(queued) == 0 {
+		return
+	}
+	// 最早排队的先启动。
+	sort.Slice(queued, func(i, j int) bool { return queued[i].CreatedAt < queued[j].CreatedAt })
+
+	enabled, limit := s.m.ConcurrencyLimit()
+	slots := len(queued) // feature off → 全部放行
+	if enabled {
+		if !s.engine.Ready() {
+			return // 引擎未就绪(无 LLM):继续挂起,别空跑
+		}
+		slots = limit - s.runningTaskCount("")
+	}
+	for _, t := range queued {
+		if slots <= 0 {
+			break
+		}
+		if err := s.m.SetTaskQueued(t.ID, false); err != nil {
+			log.Printf("[concurrency] task %s 解除排队失败: %v", t.ID, err)
+			continue
+		}
+		t.Queued = false
+		log.Printf("[concurrency] task %s 出队启动", t.ID)
+		go s.startTaskEngine(t)
+		slots--
+	}
 }
 
 // reviveTask 让一个已停下的任务重新跑起来:把终态(done/failed/timeout)拉回 running、
@@ -56,6 +152,10 @@ func (s *Server) reviveTask(t *Task) {
 	if t == nil {
 		return
 	}
+	// 排队中的任务不复活启动——它本就等待并发空位,交给 reconcileConcurrency。
+	if t.Queued {
+		return
+	}
 	// 终态 → 拉回 running(SetTaskStatus 会清 completed_at 并同步内存 handle 的 Status,
 	// 使 planner/worker 循环的终态门放行)。
 	if isTerminalStatus(t.Status) {

server/manager.go

@@ -32,6 +32,7 @@ type Task struct {
 	CreatedAt    int64  `json:"created_at"`
 	CompletedAt  int64  `json:"completed_at,omitempty"` // 进入终态的 unix 秒;0=未完成
 	Paused       bool   `json:"paused"`
+	Queued       bool   `json:"queued"` // 因并发上限被挂起、等待空位自动启动;true=尚未开跑
 	ParentRef    string `json:"parent_ref,omitempty"`     // 父任务 id(编排 spawn 记录)
 	LLMProfileID *int64 `json:"llm_profile_id,omitempty"` // 指定运行本任务 planner/worker 的 LLM 配置;nil=用全局激活配置
 	Status       string `json:"status"`                   // persisted lifecycle status (done/failed/timeout 为终态；空/其它则由运行态推导)
@@ -85,12 +86,45 @@ const (
 	settingWebSearchProxy   = "web_search_proxy"
 	settingWorkers          = "workers"
 	settingLLMRecord        = "llm_record"
+	// 任务并发上限:开关 + 上限数。默认关闭;开启后默认上限 5(见 defaultConcurrencyLimit)。
+	settingConcurrencyOn    = "task_concurrency_enabled"
+	settingConcurrencyLimit = "task_concurrency_limit"
 	// defaultWebSearchBackend is used when web search is on but no backend was picked.
 	defaultWebSearchBackend = "ddgs"
 	// defaultWorkers is the concurrent work-agent count when the setting is unset.
 	defaultWorkers = 3
+	// defaultConcurrencyLimit is the simultaneous-running-task cap when the feature
+	// is enabled but no explicit limit was saved.
+	defaultConcurrencyLimit = 5
 )
 
+// ConcurrencyLimit returns whether the simultaneous-running-task cap is enabled and
+// its limit (default 5 when enabled but unset). limit is always >=1 when enabled.
+func (m *Manager) ConcurrencyLimit() (enabled bool, limit int) {
+	on, _, _ := m.pg.GetSetting(settingConcurrencyOn)
+	if strings.TrimSpace(on) != "true" {
+		return false, 0
+	}
+	limit = defaultConcurrencyLimit
+	if v, ok, _ := m.pg.GetSetting(settingConcurrencyLimit); ok {
+		if n, err := strconv.Atoi(strings.TrimSpace(v)); err == nil && n >= 1 {
+			limit = n
+		}
+	}
+	return true, limit
+}
+
+// SetConcurrency persists the running-task concurrency cap. limit<1 is clamped to 1.
+func (m *Manager) SetConcurrency(enabled bool, limit int) error {
+	if limit < 1 {
+		limit = defaultConcurrencyLimit
+	}
+	if err := m.pg.SetSetting(settingConcurrencyLimit, strconv.Itoa(limit)); err != nil {
+		return err
+	}
+	return m.pg.SetSetting(settingConcurrencyOn, strconv.FormatBool(enabled))
+}
+
 // Workers returns the configured concurrent work-agent count (default 3). Read
 // per-task at engine.Run, so a change applies to tasks started afterwards.
 func (m *Manager) Workers() int {
@@ -457,7 +491,7 @@ func unixOrZero(t *time.Time) int64 {
 func taskFromPG(pt *pgdb.Task, store *pgdb.ExplorationStore, ic *intercept.Interceptor) *Task {
 	return &Task{
 		ID: strconv.FormatInt(pt.ID, 10), ExpID: pt.ExplorationID,
-		Description: pt.Description, Goal: pt.Goal, CreatedAt: pt.CreatedAt.Unix(), Paused: pt.Paused,
+		Description: pt.Description, Goal: pt.Goal, CreatedAt: pt.CreatedAt.Unix(), Paused: pt.Paused, Queued: pt.Queued,
 		CompletedAt: unixOrZero(pt.CompletedAt), Status: pt.Status, ParentRef: pt.ParentRef,
 		LLMProfileID:   pt.LLMProfileID,
 		TimeoutSeconds: pt.TimeoutSeconds, PlanHeartbeatSeconds: pt.PlanHeartbeatSeconds,
@@ -526,6 +560,24 @@ func (m *Manager) SetTaskPaused(id string, paused bool) error {
 	return m.pg.SetPaused(n, paused)
 }
 
+// SetTaskQueued persists a task's queued (concurrency-hold) state and syncs the
+// in-memory handle so listTasks/占位统计 see it immediately.
+func (m *Manager) SetTaskQueued(id string, queued bool) error {
+	n, err := strconv.ParseInt(id, 10, 64)
+	if err != nil {
+		return err
+	}
+	if err := m.pg.SetQueued(n, queued); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	if t := m.tasks[id]; t != nil {
+		t.Queued = queued
+	}
+	m.mu.Unlock()
+	return nil
+}
+
 // TaskStatus returns a task's current in-memory status (empty if unknown).
 func (m *Manager) TaskStatus(id string) string {
 	m.mu.RLock()

server/scheduler.go

@@ -50,6 +50,7 @@ func (sc *Scheduler) Run(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case <-t.C:
+			sc.s.reconcileConcurrency() // 并发上限:有空位就把排队任务补位启动
 			sc.step()
 		}
 	}

server/server.go

@@ -42,6 +42,11 @@ type Server struct {
 	skillDir string // root directory for skill subdirectories
 	jwtKey   []byte // HS256 signing key loaded from / generated into dataDir/jwt.key
 
+	// concMu serializes concurrency-cap decisions (admission + reconcile) so a
+	// scheduler tick and an HTTP settings change / task creation can't both count
+	// free slots off the same snapshot and over-promote past the limit.
+	concMu sync.Mutex
+
 	cfgMu     sync.Mutex
 	mainAgent *agent.MainAgent // nil when no LLM provider is configured
 	chatAgent *agent.ChatAgent // conversational runner for the chat page; nil w/o LLM
@@ -227,7 +232,8 @@ func New(ctx context.Context, m *Manager, skillDir string, dataDir string, keyDi
 	}
 	// resume the active task's engine; other tasks resume when opened (setActive).
 	// (a restored-paused task's loops still start but idle until resumed.)
-	if t := m.ActiveTask(); t != nil {
+	// 排队中的任务不在此启动——留给 reconcileConcurrency 按空位补位。
+	if t := m.ActiveTask(); t != nil && !t.Queued {
 		s.engine.Run(ctx, t)
 	}
 	return s
@@ -846,6 +852,8 @@ func (s *Server) listTasks(w http.ResponseWriter, r *http.Request) {
 		switch {
 		case isTerminalStatus(t.Status): // 持久化终态优先（done/failed/timeout）
 			status = t.Status
+		case t.Queued: // 因并发上限挂起、等待空位(尚未启动)
+			status = "queued"
 		case t.Paused || s.engine.IsPaused(t.ID):
 			status = "paused"
 		case s.engine.Ready() && s.engine.Started(t.ID):
@@ -880,7 +888,8 @@ func (s *Server) setActive(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// resume the engine for the opened task (idempotent — no-op if already running).
-	if t, ok := s.m.Task(req.ID); ok {
+	// 排队中的任务:仅设为活跃可查看,不启动引擎(维持并发上限,由 reconcile 补位)。
+	if t, ok := s.m.Task(req.ID); ok && !t.Queued {
 		s.engine.Run(s.ctx, t)
 	}
 	writeJSON(w, 200, map[string]any{"active": req.ID})
@@ -2145,16 +2154,22 @@ func (s *Server) getSettings(w http.ResponseWriter, r *http.Request) {
 func (s *Server) settingsPayload() map[string]any {
 	on, backend, braveKey, tavilyKey, proxy := s.m.WebSearch()
 	pyStored, _, _ := s.m.pg.GetSetting(settingPythonInterp)
+	concOn, concLimit := s.m.ConcurrencyLimit()
+	if concLimit == 0 {
+		concLimit = defaultConcurrencyLimit // 关闭时也回显一个合理默认值给 UI
+	}
 	return map[string]any{
-		"traffic_capture":    s.m.TrafficEnabled(),
-		"llm_record":         s.m.LLMRecordEnabled(),
-		"web_search_enabled": on,
-		"web_search_backend": backend,
-		"brave_key_set":      strings.TrimSpace(braveKey) != "",
-		"tavily_key_set":     strings.TrimSpace(tavilyKey) != "",
-		"web_search_proxy":   proxy,                       // 独立出口代理(http/https/socks5)，空=直连
-		"python_interpreter": strings.TrimSpace(pyStored), // 用户/自动设的值(空=用运行时检测)
-		"workers":            s.m.Workers(),               // 并发工作 agent 数(默认3)；对之后启动的任务生效
+		"traffic_capture":          s.m.TrafficEnabled(),
+		"llm_record":               s.m.LLMRecordEnabled(),
+		"web_search_enabled":       on,
+		"web_search_backend":       backend,
+		"brave_key_set":            strings.TrimSpace(braveKey) != "",
+		"tavily_key_set":           strings.TrimSpace(tavilyKey) != "",
+		"web_search_proxy":         proxy,                       // 独立出口代理(http/https/socks5)，空=直连
+		"python_interpreter":       strings.TrimSpace(pyStored), // 用户/自动设的值(空=用运行时检测)
+		"workers":                  s.m.Workers(),               // 并发工作 agent 数(默认3)；对之后启动的任务生效
+		"task_concurrency_enabled": concOn,                      // 任务并发上限开关(默认关)
+		"task_concurrency_limit":   concLimit,                   // 同时运行任务上限(开启后默认5)
 	}
 }
 
@@ -2188,6 +2203,9 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request) {
 		WebSearchProxy   *string `json:"web_search_proxy"`   // 独立出口代理(http/https/socks5)；null=不改，""=清空
 		PythonInterp     *string `json:"python_interpreter"` // 自定义脚本工具的 python 解释器路径
 		Workers          *int    `json:"workers"`            // 并发工作 agent 数(>0)；对之后启动的任务生效
+		// 任务并发上限:同时「运行中」的任务数上限。关闭=不限;开启后新建任务超限则排队,有空位自动启动。
+		ConcurrencyEnabled *bool `json:"task_concurrency_enabled"`
+		ConcurrencyLimit   *int  `json:"task_concurrency_limit"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeErr(w, 400, err.Error())
@@ -2199,6 +2217,26 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+	if req.ConcurrencyEnabled != nil || req.ConcurrencyLimit != nil {
+		// 部分 PUT:未给的字段用当前值兜底,避免只改一个把另一个重置。
+		curOn, curLimit := s.m.ConcurrencyLimit()
+		if curLimit == 0 {
+			curLimit = defaultConcurrencyLimit
+		}
+		on, limit := curOn, curLimit
+		if req.ConcurrencyEnabled != nil {
+			on = *req.ConcurrencyEnabled
+		}
+		if req.ConcurrencyLimit != nil {
+			limit = *req.ConcurrencyLimit
+		}
+		if err := s.m.SetConcurrency(on, limit); err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
+		// 立即协调一次:关闭时放行全部排队,调高上限时补位启动,不必等下一个 tick。
+		go s.reconcileConcurrency()
+	}
 	if req.PythonInterp != nil {
 		if err := s.m.pg.SetSetting(settingPythonInterp, strings.TrimSpace(*req.PythonInterp)); err != nil {
 			writeErr(w, 500, err.Error())