Restrict session termination to support sessions only

- Persistent agents: No "End Session" menu, shows "Managed by Administrator"
- Persistent agents: Always reconnect, can only be removed via admin disconnect
- Support sessions: User can end via tray icon
- Tray icon still shows for persistent agents (status display only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

agent/src/main.rs

@@ -187,7 +187,8 @@ async fn run_agent(config: config::Config) -> Result<()> {
     }
 
     // Create tray icon
-    let tray = match tray::TrayController::new(&hostname, config.support_code.as_deref()) {
+    // Only support sessions can be ended by user - persistent agents are admin-managed
+    let tray = match tray::TrayController::new(&hostname, config.support_code.as_deref(), is_support_session) {
         Ok(t) => {
             info!("Tray icon created");
             Some(t)
@@ -208,13 +209,16 @@ async fn run_agent(config: config::Config) -> Result<()> {
     loop {
         info!("Connecting to server...");
 
-        // Check if user requested exit via tray before connecting
+        // Check if user requested exit via tray before connecting (support sessions only)
+        if is_support_session {
             if let Some(ref t) = tray {
                 if t.exit_requested() {
                     info!("Exit requested by user");
+                    cleanup_on_exit();
                     return Ok(());
                 }
             }
+        }
 
         match session.connect().await {
             Ok(_) => {
@@ -290,16 +294,7 @@ async fn run_agent(config: config::Config) -> Result<()> {
             return Ok(());
         }
 
-        // Check if user requested exit via tray
+        // Wait before reconnecting (persistent agents only - support sessions already exited above)
-        if let Some(ref t) = tray {
-            if t.exit_requested() {
-                info!("Exit requested by user");
-                cleanup_on_exit();
-                return Ok(());
-            }
-        }
-
-        // Wait before reconnecting (only for persistent agent connections)
         info!("Reconnecting in 5 seconds...");
         tokio::time::sleep(tokio::time::Duration::from_secs(5)).await;
     }

agent/src/tray/mod.rs

@@ -36,18 +36,26 @@ pub struct TrayController {
 
 impl TrayController {
     /// Create a new tray controller
-    pub fn new(machine_name: &str, support_code: Option<&str>) -> Result<Self> {
+    /// `allow_end_session` - If true, show "End Session" menu item (only for support sessions)
+    pub fn new(machine_name: &str, support_code: Option<&str>, allow_end_session: bool) -> Result<Self> {
         // Create menu items
         let status_text = if let Some(code) = support_code {
             format!("Support Session: {}", code)
         } else {
-            "Connected".to_string()
+            "Persistent Agent".to_string()
         };
 
         let status_item = MenuItem::new(&status_text, false, None);
         let machine_item = MenuItem::new(format!("Machine: {}", machine_name), false, None);
         let separator = PredefinedMenuItem::separator();
-        let end_session_item = MenuItem::new("End Session", true, None);
+
+        // Only show "End Session" for support sessions
+        // Persistent agents can only be removed by admin
+        let end_session_item = if allow_end_session {
+            MenuItem::new("End Session", true, None)
+        } else {
+            MenuItem::new("Managed by Administrator", false, None)
+        };
 
         // Build menu
         let menu = Menu::new();