@rexvane/piweb 0.3.17 → 0.3.19

package/src/lib/agent-config.ts

@@ -0,0 +1,134 @@
+/**
+ * agent-config：`~/.pi/agent` 下被反复读取的 JSON 配置（settings.json / auth.json / 项目 settings.json）
+ * 的统一读盘缓存。
+ *
+ * 这些文件在启动、首屏、每个会话快照里都会被读很多次：
+ * - settings.json 单次 read+parse 约 0.3ms，但 `resolveProjectTrust` 走的是**同步**读，出现在
+ *   每次会话创建、每次资源指纹、每次加载器发现里；
+ * - auth.json 在每次模型目录刷新（设置面板/模型选择器）时读一次；
+ * - 项目 `.pi/settings.json` 在插件面板里读。
+ *
+ * 缓存按 (mtime, ctime, size, ino) 校验：文件没变就直接返回内存里的解析结果，文件换了
+ * （pi 自己写、或 PiWeb 的写路径）立刻回源。调用方拿到的是副本，可以随意修改；
+ * 写路径改完文件后应当调用 `invalidateJsonFile()`——同一毫秒内的等长写入不会改变校验戳。
+ */
+import { readFileSync, statSync } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+export type JsonObject = Record<string, unknown>;
+
+interface Entry {
+	stamp: string;
+	value?: JsonObject;
+	error?: Error;
+}
+
+const cache = new Map<string, Entry>();
+
+/** 校验戳：mtime + ctime + 大小 + inode，任一变化都回源 */
+function stampOf(stat: { mtimeMs: number; ctimeMs: number; size: number; ino: number }): string {
+	return `${stat.mtimeMs}:${stat.ctimeMs}:${stat.size}:${stat.ino}`;
+}
+
+function parseJsonObject(text: string, file: string): JsonObject {
+	const parsed: unknown = JSON.parse(text.replace(/^\uFEFF/, ""));
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} must contain a JSON object`);
+	return parsed as JsonObject;
+}
+
+function copyOf(value: JsonObject | undefined): JsonObject {
+	return value ? structuredClone(value) : {};
+}
+
+async function readEntry(file: string): Promise<Entry> {
+	let stat;
+	try {
+		stat = await fs.stat(file);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		const missing: Entry = { stamp: "missing", value: {} };
+		cache.set(file, missing);
+		return missing;
+	}
+	const stamp = stampOf(stat);
+	const cached = cache.get(file);
+	if (cached && cached.stamp === stamp) return cached;
+	const entry: Entry = { stamp };
+	try {
+		entry.value = parseJsonObject(await fs.readFile(file, "utf8"), file);
+	} catch (error) {
+		entry.error = error as Error;
+	}
+	cache.set(file, entry);
+	return entry;
+}
+
+/** 严格读：文件不存在当 `{}`，内容非法抛错（与 pi 自己读 settings.json 的口径一致）。返回副本。 */
+export async function readJsonObject(file: string): Promise<JsonObject> {
+	const entry = await readEntry(file);
+	if (entry.error) throw entry.error;
+	return copyOf(entry.value);
+}
+
+/**
+ * 读-改-写的临界区里用：绕过校验戳直接读盘。别的写入者（pi 的 SettingsManager、pi CLI）不会作废这里的缓存，
+ * 同一时刻落盘的等长内容戳不变，拿缓存去合并会把对方刚写的字段盖回去。返回副本。
+ */
+export async function readJsonObjectFresh(file: string): Promise<JsonObject> {
+	cache.delete(file);
+	return readJsonObject(file);
+}
+
+/** 宽松读：读不到、解析失败都退化成 `{}`（"没配就当默认"的场景）。返回副本。 */
+export async function readJsonObjectSafe(file: string): Promise<JsonObject> {
+	try {
+		return await readJsonObject(file);
+	} catch {
+		return {};
+	}
+}
+
+/** 同步宽松读：给 `resolveProjectTrust` 这类同步路径用，任何失败都返回 `{}`。返回副本。 */
+export function readJsonObjectSync(file: string): JsonObject {
+	try {
+		const stamp = stampOf(statSync(file));
+		const cached = cache.get(file);
+		let entry: Entry;
+		if (cached && cached.stamp === stamp) {
+			entry = cached;
+		} else {
+			entry = { stamp };
+			try {
+				entry.value = parseJsonObject(readFileSync(file, "utf8"), file);
+			} catch (error) {
+				entry.error = error as Error;
+			}
+			cache.set(file, entry);
+		}
+		if (entry.error) throw entry.error;
+		return copyOf(entry.value);
+	} catch {
+		return {};
+	}
+}
+
+/** 写路径改完文件后调用：同一毫秒内的等长写入不会改变校验戳，缓存必须被显式作废。 */
+export function invalidateJsonFile(file: string): void {
+	cache.delete(file);
+}
+
+/**
+ * 按文件名作废（不需要先解析出 agent 目录）。
+ * 凭证登录/登出这类路径只知道"auth.json 变了"，用它避免为了一个文件名去碰用户目录。
+ */
+export function invalidateJsonFilesNamed(basename: string): void {
+	for (const key of [...cache.keys()]) {
+		if (path.basename(key) === basename) cache.delete(key);
+	}
+}
+
+/** 测试与"整目录切换"场景用 */
+export function invalidateAllJsonFiles(): void {
+	cache.clear();
+}

package/src/lib/agent-manager.ts

@@ -21,6 +21,7 @@ import {
 	resourceLoaderReady,
 	withResourceLock,
 	TOOL_PRESETS,
+	presetAllowsTool,
 	SessionManager,
 	createAgentSession,
 	getModelRuntime,
@@ -35,6 +36,7 @@ import { sanitizeToolOutput } from "./text-sanitize";
 import { BoundaryError } from "./path-security";
 import { estimateTokensOf } from "./process-format";
 import { getPiSettings } from "./pi-settings";
+import { getGrowthInitConsent, setGrowthInitConsent } from "./workspace-store";
 import { clampThinkingLevel, getSupportedThinkingLevels } from "@earendil-works/pi-ai";
 import type {
 	AgentCommand,
@@ -52,6 +54,7 @@ import type {
 const IDLE_MS = 10 * 60 * 1000;
 const MAX_ACTIVE = 6;
 const BUFFER_CAP = 400;
+const SHUTDOWN_TIMEOUT_MS = 5_000;
 
 interface Managed {
 	sessionPath: string;
@@ -62,11 +65,22 @@ interface Managed {
 	subscribers: Set<(seq: number, json: string) => void>;
 	buffer: { seq: number; json: string }[];
 	seq: number;
+	/**
+	 * 这一份 Managed 的身份，拼进 SSE 事件 id（`<epoch>.<seq>`）。
+	 * seq 每次重新注册（服务重启、空闲回收后再打开）都从 0 数起，光凭 seq 续传
+	 * 会把旧连接的 Last-Event-ID 对到新一轮的事件上。
+	 */
+	epoch: string;
 	ledger: TrajLedger;
 	lastActive: number;
 	toolPreset: ToolPreset;
 	/** 显式逐项选择优先于 preset；保留失效名称以便资源重新启用后恢复用户选择。 */
 	customActiveTools?: string[];
+	/**
+	 * SDK / 扩展要求打开的工具（defaultTools 里的 +codemode、MCP 打开的 codemode、tool_search 载入的工具…）。
+	 * 档位过滤会把它们从激活集里拿掉，记在这里，换到放行它们的档位时才能恢复。
+	 */
+	requestedTools: Set<string>;
 	resourceVersion: number;
 	resourceReloadPending: boolean;
 	resourceReloading: boolean;
@@ -147,12 +161,25 @@ export function toWebMessage(m: any, entryId?: string): WebMessage {
 	return out;
 }
 
+/** 消息对象 → 持久化条目 ID 的索引；条目数一变就重建（会话只追加，改写分支时条目数也会变） */
+const entryIdIndexes = new WeakMap<SessionManager, { count: number; ids: WeakMap<object, string> }>();
+
 function entryIdForMessage(sm: SessionManager, message: any): string | undefined {
 	// SDK 持久化保存同一对象引用。role+timestamp 并不唯一（同毫秒的 queued user/assistant）。
-	for (const entry of [...sm.getEntries()].reverse() as any[]) {
-		if (entry?.type === "message" && entry.message === message) return entry.id;
+	// 不能每条消息都扫一遍：getEntries() 本身就复制整个会话，快照逐条投影时会退化成 O(n²)。
+	if (!message || typeof message !== "object") return undefined;
+	const counter = (sm as unknown as { getEntryCount?: () => number }).getEntryCount;
+	const entries = counter ? null : (sm.getEntries() as any[]);
+	const count = counter ? counter.call(sm) : entries!.length;
+	let index = entryIdIndexes.get(sm);
+	if (!index || index.count !== count) {
+		index = { count, ids: new WeakMap() };
+		for (const entry of entries ?? (sm.getEntries() as any[])) {
+			if (entry?.type === "message" && entry.message && typeof entry.message === "object") index.ids.set(entry.message, entry.id);
+		}
+		entryIdIndexes.set(sm, index);
 	}
-	return undefined;
+	return index.ids.get(message);
 }
 
 function messageStreamId(m: Managed, message: unknown): string | undefined {
@@ -209,7 +236,8 @@ export function captureWriteBase(cwd: string, sessionPath: string, toolCallId: s
 		if (!stat.isFile() || stat.size > WRITE_BASE_MAX_BYTES) return;
 		const previous = readFileSync(abs, "utf8");
 		if (previous.includes("\u0000")) return; // 二进制不做行级 diff
-		if (writeBases.size > 256) writeBases.clear();
+		// 只淘汰最早的一条：整表清空会把其它会话里正在执行的 write 的旧内容一起丢掉
+		if (writeBases.size >= 256) writeBases.delete(writeBases.keys().next().value!);
 		writeBases.set(`${sessionPath}\u0000${toolCallId}`, previous);
 	} catch {
 		/* 新文件或读不到：没有旧内容，走全绿兜底 */
@@ -487,11 +515,11 @@ function translate(m: Managed, evt: AgentSessionEvent): void {
 			break;
 		case "tool_execution_update": {
 			const partial = sanitizeToolOutput(coercePartial((evt as any).partialResult) ?? "");
+			// 不带 args：start 已经发过，前端沿用上一次的值；write 的 args 含整份文件内容，每次进度都重发很浪费
 			publish(m, {
 				type: "tool",
 				id: evt.toolCallId,
 				name: evt.toolName,
-				args: (evt as any).args,
 				state: "running",
 				partialResult: partial.text || undefined,
 				encodingLoss: partial.encodingLoss || undefined,
@@ -592,6 +620,7 @@ function growthOf(m: Managed): GrowthTracker {
 		sessionPath: m.sessionPath,
 		publish: (evt) => publish(m, evt),
 		entries: () => m.sm.getEntries() as never,
+		consent: () => getGrowthInitConsent(m.cwd).catch(() => null),
 	}));
 }
 
@@ -601,12 +630,44 @@ export async function growthRecord(m: Managed): Promise<GrowthRound | null> {
 	return growthOf(m).recordNow();
 }
 
+/**
+ * 用户回答了「要不要在这个工作区建 git 仓库」：决定按工作区记住，同一工作区的其他会话一并收起弹窗；
+ * 同意时由发起的会话立即拍基线（返回这一笔）。
+ */
+export async function growthConsent(m: Managed, allow: boolean): Promise<GrowthRound | null> {
+	touch(m);
+	await setGrowthInitConsent(m.cwd, allow);
+	const same = (p: string) => (process.platform === "win32" ? path.resolve(p).toLowerCase() : path.resolve(p));
+	for (const other of sessions.values()) {
+		if (other !== m && other.growth?.getConsentRequest() && same(other.cwd) === same(m.cwd)) void other.growth.consentAnswered(allow).catch(() => undefined);
+	}
+	return growthOf(m).consentAnswered(allow);
+}
+
 // ---------- 会话生命周期 ----------
 
 function touch(m: Managed): void {
 	m.lastActive = Date.now();
 }
 
+const warmedResourceCwds = new Set<string>();
+
+/**
+ * 打开会话的首个快照要等资源发现（扩展 / 技能 / AGENTS.md / prompt 模板）跑完，本机实测约
+ * 140ms；侧栏一拿到会话列表就把最可能被点开的那个工作区先发现掉，用户点开时直接命中缓存。
+ * 每个 cwd 只做一次，最多两个（别把一堆工作区的扩展全加载起来），失败静默。
+ */
+export function warmSessionResources(cwds: string[]): void {
+	for (const cwd of cwds) {
+		if (!cwd || warmedResourceCwds.size >= 2) return;
+		const key = process.platform === "win32" ? cwd.toLowerCase() : cwd;
+		if (warmedResourceCwds.has(key)) continue;
+		warmedResourceCwds.add(key);
+		if (peekResourceLoader(cwd)) continue;
+		void resourceLoaderReady(cwd).catch(() => undefined);
+	}
+}
+
 export function getManaged(sessionPath: string): Managed {
 	let m = sessions.get(sessionPath);
 	if (!m) {
@@ -634,12 +695,14 @@ function registerManaged(sessionPath: string, cwd: string, sm: SessionManager):
 		subscribers: new Set(),
 		buffer: [],
 		seq: 0,
+		epoch: randomUUID().replace(/-/g, "").slice(0, 12),
 		inflight: null,
 		ui: null,
 		growth: null,
 		ledger: new TrajLedger(initialTrajectory),
 		lastActive: Date.now(),
 		toolPreset: "readonly",
+		requestedTools: new Set(),
 		resourceVersion: 0,
 		resourceReloadPending: false,
 		resourceReloading: false,
@@ -753,7 +816,8 @@ function m_smEntries(session: AgentSession): unknown[] {
 	return s.sm?.getEntries?.() ?? s.sessionManager?.getEntries?.() ?? [];
 }
 
-function environmentTrajectory(m: Managed, session: AgentSession | null): TrajEntry[] {
+/** resources 已经算过（快照）就传进来，免得资源发现结果再读一遍 */
+function environmentTrajectory(m: Managed, session: AgentSession | null, known?: ContextResource[]): TrajEntry[] {
 	const ts = m.ledger.entries[0]?.ts ?? Date.now();
 	const entries: TrajEntry[] = [];
 	if (session?.systemPrompt) {
@@ -767,7 +831,7 @@ function environmentTrajectory(m: Managed, session: AgentSession | null): TrajEn
 	}
 
 	try {
-		const resources = loadContextResources(m.cwd, m.session?.resourceLoader);
+		const resources = known ?? loadContextResources(m.cwd, m.session?.resourceLoader);
 		resources.forEach((resource, index) => entries.push({
 			seq: -2 - index,
 			kind: "context",
@@ -808,6 +872,8 @@ export async function ensureSession(m: Managed): Promise<AgentSession> {
 			created = session;
 			if (m.disposed) throw new Error("session is disposed");
 			m.session = session;
+			// SDK 按 defaultTools 设置算出的初始激活集（含 "+codemode" 这类显式开启）
+			m.requestedTools = new Set(session.getActiveToolNames());
 			installSessionPolicy(m, session);
 			applyToolPolicy(m, session);
 			session.subscribe((evt) => { if (!m.disposed) translate(m, evt); });
@@ -832,8 +898,10 @@ export async function ensureSession(m: Managed): Promise<AgentSession> {
 		} catch (error) {
 			m.ui?.dispose();
 			m.ui = null;
-			created?.dispose();
-			loader.getExtensions().runtime.invalidate();
+			// session_start 可能已经跑过（MCP 在连服务器）：先发 session_shutdown 收尾，再废掉扩展 runtime
+			const runtime = loader.getExtensions().runtime;
+			if (created) void shutdownSession(created).finally(() => runtime.invalidate());
+			else runtime.invalidate();
 			m.session = null;
 			throw error;
 		}
@@ -849,12 +917,74 @@ function isManagedBusy(m: Managed): boolean {
 }
 
 function allowedToolNames(m: Managed, session: AgentSession): string[] {
-	const allowed = m.customActiveTools ?? (m.toolPreset === "full" ? undefined : TOOL_PRESETS[m.toolPreset]);
-	return listAllToolNames(session).filter((name) => !allowed || allowed.includes(name));
+	const custom = m.customActiveTools;
+	return listAllToolNames(session).filter((name) => (custom ? custom.includes(name) : presetAllowsTool(m.toolPreset, name)));
+}
+
+/** SDK 注册即激活的规则：direct / model-only 曝光、且没有写 defaultActive: false */
+function activatedOnRegistration(session: AgentSession): Set<string> {
+	return new Set(session.getAllTools()
+		.filter((tool) => (tool.exposure === "direct" || tool.exposure === "model-only") && session.getToolDefinition(tool.name)?.defaultActive !== false)
+		.map((tool) => tool.name));
+}
+
+/**
+ * 档位只是上限，开哪些仍按 SDK 的规则：注册即激活的，加上 SDK / 扩展明确要求打开的（requestedTools）。
+ * codemode、tool_search 是 defaultActive: false，延迟加载的 MCP 工具不直接声明——把放行的全打开，
+ * 每次请求要多带几千 token，延迟加载也白做。逐项选择（customActiveTools）是用户点名要的，照单全开。
+ */
+function policyToolNames(m: Managed, session: AgentSession): string[] {
+	const allowed = allowedToolNames(m, session);
+	if (m.customActiveTools) return allowed;
+	const auto = activatedOnRegistration(session);
+	return allowed.filter((name) => auto.has(name) || m.requestedTools.has(name));
 }
 
+/** installSessionPolicy 包装前的原始 setActiveToolsByName：PiWeb 自己落策略时不能被记成"扩展要求" */
+const rawSetActiveTools = new WeakMap<AgentSession, (names: string[]) => void>();
+
 function applyToolPolicy(m: Managed, session: AgentSession): void {
-	session.setActiveToolsByName(allowedToolNames(m, session));
+	const names = policyToolNames(m, session);
+	(rawSetActiveTools.get(session) ?? session.setActiveToolsByName.bind(session))(names);
+}
+
+/**
+ * SDK 的 session.dispose() 不发 session_shutdown（只有 AgentSessionRuntime 发）：不补发，扩展收不到收尾信号，
+ * 内置 MCP 拉起的 stdio 服务器进程会一直挂着。先同步停掉 agent，收尾最多等 5 秒，再 dispose。
+ */
+const shuttingDown = new WeakMap<AgentSession, Promise<void>>();
+
+function shutdownSession(session: AgentSession): Promise<void> {
+	// 创建中途被回收时，disposeSession 与 ensureSession 的 catch 会各收尾一次
+	const existing = shuttingDown.get(session);
+	if (existing) return existing;
+	try {
+		session.agent.abort();
+	} catch {
+		/* ignore */
+	}
+	let shutdown: Promise<unknown> = Promise.resolve();
+	try {
+		const runner = session.extensionRunner;
+		if (runner.hasHandlers("session_shutdown")) shutdown = runner.emit({ type: "session_shutdown", reason: "quit" });
+	} catch {
+		/* 扩展 runtime 已失效：没有可收尾的了 */
+	}
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<void>((resolve) => {
+		timer = setTimeout(resolve, SHUTDOWN_TIMEOUT_MS);
+		timer.unref?.();
+	});
+	const done = Promise.race([shutdown.then(() => undefined, () => undefined), timeout]).finally(() => {
+		clearTimeout(timer);
+		try {
+			session.dispose();
+		} catch {
+			/* ignore */
+		}
+	});
+	shuttingDown.set(session, done);
+	return done;
 }
 
 function publishTools(m: Managed, session: AgentSession): void {
@@ -864,9 +994,14 @@ function publishTools(m: Managed, session: AgentSession): void {
 /** SDK reload 自动启用扩展工具，注册新工具也会刷新全集；统一在激活边界收敛到服务端选择。 */
 function installSessionPolicy(m: Managed, session: AgentSession): void {
 	const setActive = session.setActiveToolsByName.bind(session);
+	rawSetActiveTools.set(session, setActive);
 	session.setActiveToolsByName = (names) => {
+		const wanted = [...new Set(names)];
+		// 扩展传的是完整列表（多半是 getActiveTools() 加减几项）：原本激活、这次没列的算关掉，其余都算要求打开
+		for (const name of listActiveTools(session)) if (!wanted.includes(name)) m.requestedTools.delete(name);
+		for (const name of wanted) m.requestedTools.add(name);
 		const allowed = allowedToolNames(m, session);
-		setActive([...new Set(names)].filter((name) => allowed.includes(name)));
+		setActive(wanted.filter((name) => allowed.includes(name)));
 	};
 	const reload = session.reload.bind(session);
 	session.reload = async (options) => {
@@ -877,6 +1012,8 @@ function installSessionPolicy(m: Managed, session: AgentSession): void {
 			await withResourceLock(async () => {
 				if (m.disposed || m.runActive || !session.isIdle) throw new Error("session is busy");
 				await reload({ beforeSessionStart: async () => {
+					// reload 绕过包装直接按 defaultTools 重算了激活集（新加进 defaultTools 的工具会被打开）
+					for (const name of listActiveTools(session)) m.requestedTools.add(name);
 					applyToolPolicy(m, session);
 					await options?.beforeSessionStart?.();
 					applyToolPolicy(m, session);
@@ -913,22 +1050,12 @@ export function disposeSession(m: Managed): void {
 	m.ui = null;
 	m.growth?.dispose();
 	m.growth = null;
-	try {
-		m.session?.dispose();
-	} catch {
-		/* ignore */
-	}
+	if (m.session) void shutdownSession(m.session);
 	// 正在创建中的会话：创建完成后立即销毁，否则它会挂在已被移出池的
 	// Managed 上，订阅与句柄永久泄漏（同一 JSONL 还会出现双活跃会话）。
 	if (m.creating) {
 		void m.creating
-			.then((session) => {
-				try {
-					session?.dispose();
-				} catch {
-					/* ignore */
-				}
-			})
+			.then((session) => (session ? shutdownSession(session) : undefined))
 			.catch(() => undefined);
 	}
 	for (const send of m.subscribers) {
@@ -971,7 +1098,13 @@ export function reap(): void {
 	}
 }
 
-setInterval(reap, 60_000).unref?.();
+// 定时器挂 globalThis：开发热重载会重新求值本模块，不清掉旧的就会一份份叠加
+{
+	const store = globalThis as typeof globalThis & { __piWebReaper?: ReturnType<typeof setInterval> };
+	if (store.__piWebReaper) clearInterval(store.__piWebReaper);
+	store.__piWebReaper = setInterval(reap, 60_000);
+	store.__piWebReaper.unref?.();
+}
 
 /** 归档会话的保留期清理：只删「已归档且长期无活动」的会话；正在使用的会话一律跳过 */
 function isSessionInUse(sessionPath: string): boolean {
@@ -1044,6 +1177,11 @@ async function reloadManagedResources(m: Managed): Promise<boolean> {
 	m.resourceReloadPending = false;
 	try {
 		await m.session.reload();
+		// SDK 的 reload 不会换当前模型对象：models.json 改了 baseUrl / contextWindow 后，
+		// 会话手里还是旧对象。按 provider/id 从（已就地刷新的）共享 runtime 取一次新的。
+		const current = m.session.model;
+		const fresh = current && m.session.modelRuntime.getModel(current.provider, current.id);
+		if (fresh && fresh !== current) m.session.agent.state.model = fresh;
 		return true;
 	} catch (err) {
 		publish(m, { type: "error", message: `重载扩展失败：${String((err as Error)?.message ?? err)}`, ts: Date.now() });
@@ -1209,10 +1347,12 @@ export async function buildSnapshot(m: Managed): Promise<WebSnapshot> {
 		name = "";
 	}
 
-	// 上下文注入资源（AGENTS.md 与扩展附加 prompt）
+	// 上下文注入资源（AGENTS.md 与扩展附加 prompt）；读失败时轨迹那边仍按原样自己再试一次
 	let contextResources: ContextResource[] = [];
+	let contextResourcesLoaded = false;
 	try {
 		contextResources = loadContextResources(m.cwd, m.session?.resourceLoader);
+		contextResourcesLoaded = true;
 	} catch {
 		contextResources = [];
 	}
@@ -1228,7 +1368,7 @@ export async function buildSnapshot(m: Managed): Promise<WebSnapshot> {
 	const resources = collectResources(m);
 
 	const baseTrajectory = m.ledger.entries.length ? m.ledger.entries : coldTrajectory(m);
-	const trajectory = [...environmentTrajectory(m, session), ...baseTrajectory];
+	const trajectory = [...environmentTrajectory(m, session, contextResourcesLoaded ? contextResources : undefined), ...baseTrajectory];
 
 	return {
 		seq: snapSeq ?? m.seq,
@@ -1242,12 +1382,15 @@ export async function buildSnapshot(m: Managed): Promise<WebSnapshot> {
 		messages,
 		userTurns: userTurnsFromEntries(m.sm.getEntries() as any[]),
 		growthError: m.growth?.getError?.() ?? null,
+		growthConsent: m.growth?.getConsentRequest?.() ?? null,
 		model,
 		thinkingLevel,
 		thinkingLevels,
 		toolPreset: m.toolPreset,
 		customActiveTools: m.customActiveTools ?? null,
 		extensionUiRequests: m.ui?.getPendingRequests() ?? [],
+		// 扩展 setStatus 的当前值：重连拿快照时页脚状态不能丢
+		extensionStatuses: Object.fromEntries(m.ui?.statuses ?? []),
 		tools,
 		stats,
 		contextUsage,
@@ -1267,6 +1410,19 @@ function coldTrajectory(m: Managed): TrajEntry[] {
 
 // ---------- SSE 订阅 ----------
 
+/** SSE 事件 id：`<epoch>.<seq>` */
+export function sseEventId(m: Managed, seq: number): string {
+	return `${m.epoch}.${seq}`;
+}
+
+/** 解析浏览器带回的 Last-Event-ID；不是这一份 Managed 发的（epoch 对不上）一律当没有，走快照 */
+export function parseLastEventId(m: Managed, raw: string | null): number | undefined {
+	const match = /^([A-Za-z0-9]+)\.(\d+)$/.exec(raw?.trim() ?? "");
+	if (!match || match[1] !== m.epoch) return undefined;
+	const seq = Number(match[2]);
+	return Number.isSafeInteger(seq) ? seq : undefined;
+}
+
 export function subscribe(
 	m: Managed,
 	send: (seq: number, json: string) => void,
@@ -1298,6 +1454,47 @@ export interface CommandResult {
 	data?: Record<string, unknown>;
 }
 
+/**
+ * 发 prompt 前给生长记录拍基线。基线不能无限阻塞提问（git 不可用时每次探测至多 30s 超时）：
+ * 5s 内没完成就放行，快照后台补拍（工具结束后照常记步，外部修改兜底）。
+ */
+async function prepareGrowthBriefly(m: Managed): Promise<void> {
+	await Promise.race([
+		growthOf(m).prepare().catch(() => undefined),
+		new Promise<void>((resolve) => setTimeout(resolve, 5000)),
+	]);
+}
+
+/** 交给 SDK，并在「受理」那一刻返回，而不是等整轮跑完；受理之后的错误经 SSE 可见 */
+function submitPrompt(
+	m: Managed,
+	session: AgentSession,
+	text: string,
+	options: Pick<NonNullable<Parameters<AgentSession["prompt"]>[1]>, "images" | "streamingBehavior"> = {},
+): Promise<CommandResult> {
+	return new Promise<CommandResult>((resolve) => {
+		let accepted = false;
+		const run = session.prompt(text, {
+			...options,
+			source: "rpc",
+			preflightResult: (success) => {
+				if (success) {
+					accepted = true;
+					resolve({ ok: true, data: { accepted: true } });
+				}
+			},
+		});
+		// 同步挂好 rejection handler；接受后的错误仍经 SSE 可见，不能成为未处理拒绝。
+		void run.then(() => {
+			if (!accepted) resolve({ ok: false, error: "prompt completed without acceptance" });
+		}, (error) => {
+			const message = String(error?.message ?? error);
+			if (accepted) publish(m, { type: "error", message, ts: Date.now() });
+			else resolve({ ok: false, error: message });
+		});
+	});
+}
+
 export async function execute(m: Managed, cmd: AgentCommand): Promise<CommandResult> {
 	touch(m);
 	try {
@@ -1316,37 +1513,9 @@ export async function execute(m: Managed, cmd: AgentCommand): Promise<CommandRes
 					if (m.disposed) throw new Error("session is disposed");
 					// 只有用户显式选择 steer/followUp 才排队；旧的普通提交不能悄悄成为 steering。
 					if ((session.isStreaming || m.runActive) && !cmd.behavior) return { ok: false, error: "session is busy; choose steer or followUp" };
-					if (!session.isStreaming) {
-						// 基线快照不能无限阻塞首条 prompt（git 不可用时每次探测至多 30s 超时）：
-						// 5s 内没完成就放行 prompt，快照后台补拍（工具结束后照常记步，外部修改兜底）。
-						await Promise.race([
-							growthOf(m).prepare().catch(() => undefined),
-							new Promise<void>((resolve) => setTimeout(resolve, 5000)),
-						]);
-					}
+					if (!session.isStreaming) await prepareGrowthBriefly(m);
 					if (m.disposed) throw new Error("session is disposed");
-					return await new Promise<CommandResult>((resolve) => {
-						let accepted = false;
-						const run = session.prompt(text, {
-							images: cmd.images,
-							streamingBehavior: cmd.behavior,
-							source: "rpc",
-							preflightResult: (success) => {
-								if (success) {
-									accepted = true;
-									resolve({ ok: true, data: { accepted: true } });
-								}
-							},
-						});
-						// 同步挂好 rejection handler；接受后的错误仍经 SSE 可见，不能成为未处理拒绝。
-						void run.then(() => {
-							if (!accepted) resolve({ ok: false, error: "prompt completed without acceptance" });
-						}, (error) => {
-							const message = String(error?.message ?? error);
-							if (accepted) publish(m, { type: "error", message, ts: Date.now() });
-							else resolve({ ok: false, error: message });
-						});
-					});
+					return await submitPrompt(m, session, text, { images: cmd.images, streamingBehavior: cmd.behavior });
 				} finally {
 					m.promptSubmitting = false;
 					if (!m.disposed) publish(m, { type: "status", isStreaming: isManagedBusy(m), state: isManagedBusy(m) ? "running" : "idle", ts: Date.now() });
@@ -1405,6 +1574,15 @@ export async function execute(m: Managed, cmd: AgentCommand): Promise<CommandRes
 				const preset = cmd.preset as ToolPreset;
 				if (!Object.hasOwn(TOOL_PRESETS, preset)) return { ok: false, error: "invalid tool preset" };
 				if (isManagedBusy(m)) return { ok: false, error: "cannot change tools while the agent is running" };
+				if (!m.session && !m.creating) {
+					// 冷会话只记下选择，等真正启动时（ensureSession → applyToolPolicy）再生效。
+					// 不能为了切个档位就冷启动 agent：打开会话时前端会恢复本地档位，
+					// 若这里 ensureSession，光是浏览历史会话就会跑一遍扩展的 session_start。
+					m.toolPreset = preset;
+					m.customActiveTools = undefined;
+					publish(m, { type: "tools", active: [], all: [], toolPreset: preset, customActiveTools: null, ts: Date.now() });
+					return { ok: true };
+				}
 				const session = await ensureSession(m);
 				if (isManagedBusy(m)) return { ok: false, error: "cannot change tools while the agent is running" };
 				m.toolPreset = preset;
@@ -1467,11 +1645,15 @@ export async function execute(m: Managed, cmd: AgentCommand): Promise<CommandRes
 					if (m.disposed) throw new Error("session is disposed");
 					const moved = await session.navigateTree(entryId);
 					if (moved?.cancelled) return { ok: false, error: "edit cancelled" };
-					await growthOf(m).prepare().catch(() => undefined);
-					await session.prompt(text);
-					return { ok: true };
+					await prepareGrowthBriefly(m);
+					if (m.disposed) throw new Error("session is disposed");
+					// 与普通 prompt 一样在受理时就返回：等整轮跑完的话，这期间 promptSubmitting 一直为真，
+					// 插话 / 排队 / 新消息全被拒，HTTP 请求也一直挂着
+					return await submitPrompt(m, session, text);
 				} finally {
 					m.promptSubmitting = false;
+					if (!m.disposed) publish(m, { type: "status", isStreaming: isManagedBusy(m), state: isManagedBusy(m) ? "running" : "idle", ts: Date.now() });
+					if (m.resourceReloadPending) queueMicrotask(() => void reloadManagedResources(m));
 				}
 			}
 			case "rename": {