@rexvane/piweb 0.3.17 → 0.3.19

package/src/lib/growth-tracker.ts

@@ -5,15 +5,17 @@
  *   （工作区还没有任何提交时记成基线）
  * - agent_start → agent_settled 是一轮：结束时提交本轮，提问首行做标题、用户消息 entryId 写进 trailers；
  *   没有改动也提交空 commit，轮号与对话一一对应
+ * - 工作区还不是仓库根目录时，要先征得同意才 `git init`：没决定就向浏览器发一次 growth_consent 并暂不记录，
+ *   拒绝了就停用；同意后（consentAnswered）立即拍基线
  * 提交失败不影响 pi，只向浏览器报一次错；项目过大 / 没有 git 时本会话停用。
  */
 import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
-import { GrowthError, commitRound, recordWorkspaceChanges } from "./growth-service";
+import { type CommitOptions, GrowthError, commitRound, recordWorkspaceChanges } from "./growth-service";
 import { promptsFromEntries } from "./growth-turns";
-import type { GrowthRound, GrowthRoundStatus, WebEvent } from "./types";
+import type { GrowthConsentRequest, GrowthRound, GrowthRoundStatus, WebEvent } from "./types";
 
 const ERROR_THROTTLE_MS = 60_000;
-export const GROWTH_TRACKER_VERSION = 4;
+export const GROWTH_TRACKER_VERSION = 5;
 
 interface SessionEntryLike {
 	type?: string;
@@ -24,11 +26,15 @@ interface SessionEntryLike {
 export interface GrowthTracker {
 	version: number;
 	getError(): string | null;
+	/** 等用户回答的建仓库请求（快照里带上，页面重开也能看到） */
+	getConsentRequest(): GrowthConsentRequest | null;
 	/** 发 prompt 前完成「你的修改」提交，避免它被算进 pi 这一轮 */
 	prepare(): Promise<void>;
 	onEvent(evt: AgentSessionEvent): void;
 	/** 立即记录（项目栏按钮）：把当前改动提交为「你的修改」；没改动返回 null */
 	recordNow(): Promise<GrowthRound | null>;
+	/** 用户回答了建仓库请求（决定已由调用方存好）：同意就立即拍基线，拒绝就停用 */
+	consentAnswered(allow: boolean): Promise<GrowthRound | null>;
 	dispose(): void;
 }
 
@@ -50,8 +56,10 @@ export function createGrowthTracker(opts: {
 	publish: (evt: WebEvent) => void;
 	/** 会话的持久条目（SessionManager.getEntries）：轮结束时从中取本轮的提问 */
 	entries: () => readonly SessionEntryLike[];
+	/** 该工作区是否同意建仓库：true 同意 / false 拒绝 / null 还没问过 */
+	consent: () => Promise<boolean | null>;
 }): GrowthTracker {
-	const { cwd, sessionPath, publish, entries } = opts;
+	const { cwd, sessionPath, publish, entries, consent } = opts;
 	let disabled = false;
 	let disabledFailure: GrowthError | null = null;
 	let disposed = false;
@@ -61,6 +69,11 @@ export function createGrowthTracker(opts: {
 	let chain: Promise<void> = Promise.resolve();
 	/** 本轮开始时会话条目的数量；null = 不在一轮之中 */
 	let runStart: number | null = null;
+	/** 每开始一轮加一：prepare 排队期间 pi 已经开工，就不能再把工作区记成「你的修改」 */
+	let runEpoch = 0;
+	/** 已知工作区要先建仓库；consentRequest = 正在等用户回答 */
+	let needsInit = false;
+	let consentRequest: GrowthConsentRequest | null = null;
 
 	// 提交失败不打扰用户（项目栏退化成普通文件树 + 查看器）：只在服务端日志记一次，没 git / 项目过大就停用本会话的跟踪
 	const reportError = (error: unknown) => {
@@ -95,14 +108,57 @@ export function createGrowthTracker(opts: {
 		return round;
 	};
 
+	const declined = () => {
+		disabled = true;
+		disabledFailure = new GrowthError("growth tracking was declined for this workspace", "unavailable");
+		runStart = null;
+	};
+
+	/**
+	 * 带同意检查地提交：返回 undefined 表示这次没提交（还在等同意 / 已拒绝）。
+	 * 已知要建仓库且还没决定时直接跳过，不再每轮起一个 git 进程去探测。
+	 */
+	const commit = async (run: (options: CommitOptions) => Promise<GrowthRound | null>, abortIf?: () => boolean): Promise<GrowthRound | null | undefined> => {
+		const decision = needsInit ? await consent() : null;
+		if (decision === false) {
+			declined();
+			return undefined;
+		}
+		if (needsInit && decision === null) return undefined;
+		try {
+			return await run({ allowInit: decision === true, abortIf });
+		} catch (error) {
+			if (!(error instanceof GrowthError) || error.code !== "needs-consent") throw error;
+			needsInit = true;
+			const answer = await consent();
+			if (answer === false) {
+				declined();
+				return undefined;
+			}
+			if (answer === true) return run({ allowInit: true, abortIf });
+			if (!consentRequest && !disposed) {
+				consentRequest = { cwd, reason: error.target?.reason ?? "not-git", parent: error.target?.parent };
+				publish({ type: "growth_consent", request: consentRequest, ts: Date.now() });
+			}
+			return undefined;
+		}
+	};
+
+	const recordUserChanges = (abortIf?: () => boolean) =>
+		commit((options) => recordWorkspaceChanges(cwd, sessionPath, options), abortIf);
+
 	return {
 		version: GROWTH_TRACKER_VERSION,
 		getError: () => lastErrorMessage,
+		getConsentRequest: () => consentRequest,
 		prepare() {
 			if (disabled || disposed) return chain;
+			const epoch = runEpoch;
 			return enqueue(async () => {
 				if (disabled || disposed) return;
-				published(await recordWorkspaceChanges(cwd, sessionPath));
+				// 5 秒没拍完提问就放行了：pi 开工后再拍的快照会把它的改动记成「你的修改」
+				const round = await recordUserChanges(() => runEpoch !== epoch);
+				if (round !== undefined) published(round);
 			});
 		},
 		onEvent(evt) {
@@ -110,7 +166,10 @@ export function createGrowthTracker(opts: {
 			switch (evt.type) {
 				case "agent_start":
 					// 自动重试会再次 agent_start：一轮只从第一次开始算
-					if (runStart === null) runStart = entries().length;
+					if (runStart === null) {
+						runStart = entries().length;
+						runEpoch += 1;
+					}
 					break;
 				case "agent_settled": {
 					if (runStart === null) break;
@@ -120,7 +179,8 @@ export function createGrowthTracker(opts: {
 					runStart = null;
 					void enqueue(async () => {
 						if (disabled || disposed) return;
-						published(await commitRound(cwd, { kind: "round", session: sessionPath, title, promptIds: ids, status: roundStatus(run) }));
+						const round = await commit((options) => commitRound(cwd, { kind: "round", session: sessionPath, title, promptIds: ids, status: roundStatus(run) }, options));
+						if (round !== undefined) published(round);
 					});
 					break;
 				}
@@ -135,15 +195,37 @@ export function createGrowthTracker(opts: {
 			await enqueue(async () => {
 				try {
 					if (disabled) throw disabledFailure ?? new GrowthError("growth tracking is disabled for this workspace", "unavailable");
-					result = published(await recordWorkspaceChanges(cwd, sessionPath));
+					const round = await recordUserChanges();
+					if (round === undefined) {
+						throw disabled
+							? disabledFailure ?? new GrowthError("growth tracking is disabled for this workspace", "unavailable")
+							: new GrowthError("growth tracking is waiting for permission to create a git repository", "needs-consent");
+					}
+					result = published(round);
 				} catch (error) {
 					failure = error;
-					reportError(error);
+					if (!(error instanceof GrowthError && error.code === "needs-consent")) reportError(error);
 				}
 			});
 			if (failure) throw failure;
 			return result;
 		},
+		async consentAnswered(allow) {
+			const pending = consentRequest;
+			consentRequest = null;
+			if (pending && !disposed) publish({ type: "growth_consent", request: null, ts: Date.now() });
+			if (!allow) {
+				declined();
+				return null;
+			}
+			if (disabled || disposed) return null;
+			let result: GrowthRound | null = null;
+			await enqueue(async () => {
+				const round = await recordUserChanges();
+				result = round === undefined ? null : published(round);
+			});
+			return result;
+		},
 		dispose() {
 			disposed = true;
 		},

package/src/lib/models-service.ts

@@ -11,7 +11,8 @@ import { BlockList, isIP } from "node:net";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { getNodeValue, parseTree, printParseErrorCode, type ParseError } from "jsonc-parser";
 import { filterModelsByPiScope } from "./models/model-scope";
-import { getAgentDir, getModelRuntime, resetModelRuntime } from "./pi";
+import { invalidateJsonFilesNamed, readJsonObjectSafe } from "./agent-config";
+import { getAgentDir, getModelRuntime, refreshModelRuntime } from "./pi";
 import { getEnabledModelPatterns } from "./pi-settings";
 import { reloadSessionsForCwd } from "./agent-manager";
 import {
@@ -67,8 +68,24 @@ let builtInProviderIdsPromise: Promise<Set<string>> | null = null;
 let listCache: { at: number; value: Promise<{ providers: ProviderView[]; models: ModelView[] }> } | null = null;
 const LIST_TTL_MS = 5_000;
 
+/**
+ * 认证探测结果单独缓存：目录只活 5 秒，但「这个 provider 能不能用」在一次会话里几乎不变。
+ * 设置面板每次打开都会重建目录，没有这层缓存就要为每个已配置 provider 重跑一次网络往返
+ * （单次超时 5 秒），面板首屏因此抖动。
+ */
+const authCheckCache = new Map<string, { at: number; ready: boolean; source?: string; error?: string }>();
+const AUTH_CHECK_TTL_MS = 60_000;
+
 export function invalidateModelList(): void {
 	listCache = null;
+	authCheckCache.clear();
+	// 凭证/自定义 provider 变了，auth.json 的读盘缓存也要作废（按文件名作废：这里不该去解析 agent 目录）
+	invalidateJsonFilesNamed("auth.json");
+}
+
+/** 目录版本戳：路由层用它决定能不能复用已经压好的响应体 */
+export function modelListStamp(): string {
+	return listCache ? String(listCache.at) : "none";
 }
 
 /** Read the unmodified SDK catalog through its public modelsPath:null option. */
@@ -123,7 +140,7 @@ export async function listModelsForPiWeb(): Promise<{ providers: ProviderView[];
 async function readStoredAuthTypes(): Promise<Map<string, "api_key" | "oauth">> {
 	const out = new Map<string, "api_key" | "oauth">();
 	try {
-		const parsed = JSON.parse(await fs.readFile(path.join(getAgentDir(), "auth.json"), "utf8")) as Record<string, any>;
+		const parsed = await readJsonObjectSafe(path.join(getAgentDir(), "auth.json")) as Record<string, any>;
 		const entries: Array<[string, any]> = [
 			...Object.entries(parsed ?? {}),
 			...Object.entries(parsed?.providers ?? {}),
@@ -165,12 +182,20 @@ async function listModelsUncached(): Promise<{
 			let resolvedAuthSource: string | undefined;
 			let authError: string | undefined;
 			if (auth?.configured === true || authFastPath) {
-				try {
-					const checked = await rt.checkAuth(pid, { signal: AbortSignal.timeout(5000) });
-					authReady = checked !== undefined;
-					resolvedAuthSource = checked?.source;
-				} catch (error) {
-					authError = error instanceof Error ? error.message : String(error);
+				const cached = authCheckCache.get(pid);
+				if (cached && Date.now() - cached.at < AUTH_CHECK_TTL_MS) {
+					authReady = cached.ready;
+					resolvedAuthSource = cached.source;
+					authError = cached.error;
+				} else {
+					try {
+						const checked = await rt.checkAuth(pid, { signal: AbortSignal.timeout(5000) });
+						authReady = checked !== undefined;
+						resolvedAuthSource = checked?.source;
+					} catch (error) {
+						authError = error instanceof Error ? error.message : String(error);
+					}
+					authCheckCache.set(pid, { at: Date.now(), ready: authReady, source: resolvedAuthSource, error: authError });
 				}
 			}
 			return { pid, p, auth, authFastPath, authReady, resolvedAuthSource, authError };
@@ -1311,9 +1336,9 @@ export async function writeCustomProviders(content: string, revision?: string):
 			await fs.rm(temporary, { force: true }).catch(() => undefined);
 		}
 	}));
-	resetModelRuntime();
+	await refreshModelRuntime();
 	invalidateModelList();
-	// 已打开的会话持有保存前的旧 runtime：不清掉的话，在里面选新 provider 的模型
-	// 会报 "No API key for X"（新 runtime 有配置，旧 runtime 查不到）。让活跃会话就地重建。
+	// 会话与共享 runtime 是同一个实例，刷新后目录已是新的；再让活跃会话重载一次，
+	// 把当前模型对象换成新配置（改了 baseUrl / contextWindow 等字段时生效）
 	await reloadSessionsForCwd();
 }

package/src/lib/pi-settings.ts

@@ -5,6 +5,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
+import { invalidateJsonFile, readJsonObject, readJsonObjectFresh } from "./agent-config";
 import { getAgentDir, reloadSettingsManagers } from "./pi";
 import { withExternalSettingsLock, withSettingsWriteLock } from "./settings-write-lock";
 
@@ -30,17 +31,13 @@ const DEFAULTS: PiSettings = {
 	retry: { enabled: true, maxRetries: 3, baseDelayMs: 2000 },
 };
 
+/** settings.json 走统一缓存：文件没变就不重复读盘解析（每次快照 / 模型目录都会读它） */
+function settingsFile(): string {
+	return path.join(getAgentDir(), "settings.json");
+}
+
 async function readSettingsFileStrict(): Promise<Record<string, unknown>> {
-	let text: string;
-	try {
-		text = await fs.readFile(path.join(getAgentDir(), "settings.json"), "utf8");
-	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return {};
-		throw error;
-	}
-	const parsed: unknown = JSON.parse(text.replace(/^\uFEFF/, ""));
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("settings.json must contain a JSON object");
-	return parsed as Record<string, unknown>;
+	return readJsonObject(settingsFile());
 }
 
 /** enabledModels 是 pi 的模型范围；没写或写错就不过滤 PiWeb 的选择器 */
@@ -103,9 +100,9 @@ export function validatePiSettingsPatch(value: unknown): { compaction?: Partial<
 
 export async function patchPiSettings(value: unknown): Promise<void> {
 	const patch = validatePiSettingsPatch(value);
-	const file = path.join(getAgentDir(), "settings.json");
+	const file = settingsFile();
 	await withSettingsWriteLock(file, () => withExternalSettingsLock(file, async () => {
-		const raw = await readSettingsFileStrict();
+		const raw = await readJsonObjectFresh(file);
 		if (patch.compaction) raw.compaction = { ...section(raw, "compaction"), ...patch.compaction };
 		if (patch.retry) raw.retry = { ...section(raw, "retry"), ...patch.retry };
 		await fs.mkdir(path.dirname(file), { recursive: true });
@@ -116,6 +113,7 @@ export async function patchPiSettings(value: unknown): Promise<void> {
 		} finally {
 			await fs.rm(temporary, { force: true }).catch(() => undefined);
 		}
+		invalidateJsonFile(file);
 	}));
 	// 正在运行的会话每次压缩/重试都从 SettingsManager 读：让它们重新读盘，改动立即生效
 	await reloadSettingsManagers();

package/src/lib/pi.ts

@@ -4,6 +4,7 @@
  */
 import path from "node:path";
 import fs from "node:fs";
+import { readJsonObjectSync } from "./agent-config";
 import {
 	type ModelRuntime as PiModelRuntime,
 	type SettingsManager,
@@ -14,6 +15,9 @@ import {
 	SessionManager,
 	SettingsManager as SettingsManagerClass,
 	createAgentSession,
+	createCodemodeExtension,
+	createMcpExtension,
+	createToolSearchExtension,
 	getAgentDir,
 	hasTrustRequiringProjectResources,
 	loadProjectContextFiles,
@@ -37,19 +41,34 @@ export function getModelRuntime(): Promise<PiModelRuntime> {
 	return modelRuntimePromise;
 }
 
-/** 重建 ModelRuntime（models.json / auth.json 落盘后调用，让目录与认证立即生效） */
-export function resetModelRuntime(): void {
-	modelRuntimePromise = null;
+/**
+ * models.json 落盘后调用：就地刷新共享的 ModelRuntime，让目录与认证立即生效。
+ * 不能换一个新实例 —— 活跃会话、扩展注册的 provider 都挂在旧实例上，换掉后会话里
+ * 选新 provider 的模型会报 "No API key"，扩展 provider 也会从目录里消失。
+ * 只读本地配置不联网；刷新失败才退回整体重建。
+ */
+export async function refreshModelRuntime(): Promise<void> {
+	const pending = modelRuntimePromise;
+	if (!pending) return;
+	try {
+		await (await pending).refresh({ allowNetwork: false });
+	} catch {
+		if (modelRuntimePromise === pending) modelRuntimePromise = null;
+	}
 }
 
 const settingsCache = new Map<string, SettingsManager>();
+/** 缓存键 → 原始目录。键在 Windows 上是小写的，不能拿它当目录交给 SDK 或算资源指纹 */
+const settingsCwds = new Map<string, string>();
 
 // ---------- 项目信任（与 pi 终端同一份 ~/.pi/agent/trust.json） ----------
 
-let trustStore: ProjectTrustStore | null = null;
+let trustStore: { agentDir: string; store: ProjectTrustStore } | null = null;
+/** 跟着 agentDir 走：readTrustFile 每次按当前 agentDir 读，写也必须落在同一份 trust.json */
 function getTrustStore(): ProjectTrustStore {
-	if (!trustStore) trustStore = new ProjectTrustStore(getAgentDir());
-	return trustStore;
+	const agentDir = getAgentDir();
+	if (trustStore?.agentDir !== agentDir) trustStore = { agentDir, store: new ProjectTrustStore(agentDir) };
+	return trustStore.store;
 }
 
 export type ProjectTrustState = {
@@ -61,15 +80,83 @@ export type ProjectTrustState = {
 	source: "not-required" | "remembered" | "default-always" | "default-never" | "undecided";
 };
 
-function readDefaultProjectTrust(): "ask" | "always" | "never" {
+/**
+ * 交给 SDK 信任存储的目录写法：Windows 上取真实大小写。
+ *
+ * SDK 用 JS 版 realpathSync 规范化 trust.json 的键，它在 Windows 上**保留输入的大小写**
+ * （`d:\aiapp\piweb` 原样返回，只有 .native 才给 `D:\AIApp\PiWeb`），再按字符串精确匹配。
+ * 同一个目录写进去和查出来的大小写只要不一样，记住的决定就查不到。
+ */
+function trustPath(cwd: string): string {
+	const resolved = path.resolve(cwd);
+	try {
+		return process.platform === "win32" ? fs.realpathSync.native(resolved) : fs.realpathSync(resolved);
+	} catch {
+		return resolved;
+	}
+}
+
+/** trust.json 的解析结果按文件修订缓存：resolveProjectTrust 在指纹、资源清单、快照里被频繁调用 */
+interface TrustFile {
+	revision: string;
+	/** 原样的键 */
+	keys: string[];
+	/** 折叠后的键（Windows 小写）→ 决定 */
+	decisions: Map<string, boolean>;
+}
+let trustFileCache: TrustFile | null = null;
+const foldTrustKey = (value: string) => (process.platform === "win32" ? value.toLowerCase() : value);
+
+/** 读不懂（被写了一半、格式不对）返回 null，调用方退回 SDK 加锁读 */
+function readTrustFile(): TrustFile | null {
+	const file = path.join(getAgentDir(), "trust.json");
+	let revision: string;
+	try {
+		const stat = fs.statSync(file);
+		revision = `${file}:${stat.mtimeMs}:${stat.ctimeMs}:${stat.size}`;
+	} catch {
+		return { revision: "missing", keys: [], decisions: new Map() }; // 还没有 trust.json：什么都没记住
+	}
+	if (trustFileCache?.revision === revision) return trustFileCache;
 	try {
-		const raw = JSON.parse(fs.readFileSync(path.join(getAgentDir(), "settings.json"), "utf8")) as { defaultProjectTrust?: string };
-		return raw.defaultProjectTrust === "always" || raw.defaultProjectTrust === "never" ? raw.defaultProjectTrust : "ask";
+		const parsed = JSON.parse(fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "")) as unknown;
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+		const decisions = new Map<string, boolean>();
+		for (const [key, value] of Object.entries(parsed)) {
+			if (value === true || value === false) decisions.set(foldTrustKey(key), value);
+			else if (value !== null) return null; // SDK 认定为坏文件，交给它报错
+		}
+		trustFileCache = { revision, keys: Object.keys(parsed), decisions };
+		return trustFileCache;
 	} catch {
-		return "ask";
+		return null;
+	}
+}
+
+/**
+ * 记住的信任决定：与 SDK 一样从该目录逐级往上找最近的一条，但 Windows 上不分大小写
+ * （pi 终端写进去的键是当时 shell 里 cwd 的写法，大小写不一定是真实的）。
+ * 不走 SDK 的 get()：它每次都同步加文件锁、失败还会自旋等待。读不懂时再退回 SDK。
+ */
+function rememberedProjectTrust(cwd: string): boolean | null {
+	const trust = readTrustFile();
+	if (!trust) return getTrustStore().get(trustPath(cwd));
+	let current = trustPath(cwd);
+	for (;;) {
+		const decision = trust.decisions.get(foldTrustKey(current));
+		if (decision !== undefined) return decision;
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
 	}
 }
 
+function readDefaultProjectTrust(): "ask" | "always" | "never" {
+	// 同步读且被 getSettingsManager / 资源指纹反复调用：走统一缓存（文件没变就不重新读盘解析）
+	const raw = readJsonObjectSync(path.join(getAgentDir(), "settings.json")) as { defaultProjectTrust?: string };
+	return raw.defaultProjectTrust === "always" || raw.defaultProjectTrust === "never" ? raw.defaultProjectTrust : "ask";
+}
+
 /**
  * 与 pi 终端 main.ts 同一套判定：目录里没有需要信任的项目资源 → 直接信任；
  * 否则看 trust.json 里记住的决定，再看 defaultProjectTrust；「每次询问」在 Web 里没有阻塞式弹窗，
@@ -84,7 +171,7 @@ export function resolveProjectTrust(cwd: string): ProjectTrustState {
 		required = false;
 	}
 	if (!required) return { required: false, trusted: true, source: "not-required" };
-	const remembered = getTrustStore().get(resolved);
+	const remembered = rememberedProjectTrust(resolved);
 	if (remembered !== null) return { required: true, trusted: remembered, source: "remembered" };
 	const fallback = readDefaultProjectTrust();
 	if (fallback === "always") return { required: true, trusted: true, source: "default-always" };
@@ -98,7 +185,13 @@ export function resolveProjectTrust(cwd: string): ProjectTrustState {
  */
 export function setProjectTrust(cwd: string, decision: boolean | null): ProjectTrustState {
 	const resolved = path.resolve(cwd);
-	getTrustStore().set(resolved, decision);
+	const target = trustPath(resolved);
+	// 同一目录大小写不同的旧键先删掉：查找不分大小写，留着它会顶替（或在「忘记」后复活）这次的决定
+	for (const key of readTrustFile()?.keys ?? []) {
+		if (key !== target && foldTrustKey(key) === foldTrustKey(target)) getTrustStore().set(key, null);
+	}
+	getTrustStore().set(target, decision);
+	trustFileCache = null; // 同一毫秒内连写两次时修订号可能不变，别读到旧缓存
 	const state = resolveProjectTrust(resolved);
 	const key = process.platform === "win32" ? resolved.toLowerCase() : resolved;
 	const sm = settingsCache.get(key);
@@ -109,9 +202,11 @@ export function setProjectTrust(cwd: string, decision: boolean | null): ProjectT
 /** 按当前 trust.json / defaultProjectTrust 重新计算每个已缓存目录的信任态并就地写入其 SettingsManager */
 export function syncProjectTrust(): void {
 	trustStore = null;
+	trustFileCache = null;
 	for (const [key, sm] of settingsCache) {
 		try {
-			sm.setProjectTrusted(resolveProjectTrust(key).trusted);
+			// 缓存键在 Windows 上是小写的，拿原始目录去算（见 settingsCwds）
+			sm.setProjectTrusted(resolveProjectTrust(settingsCwds.get(key) ?? key).trusted);
 		} catch {
 			/* ignore */
 		}
@@ -126,11 +221,14 @@ export function getSettingsManager(cwd: string): SettingsManager {
 	if (!sm) {
 		sm = SettingsManagerClass.create(resolved, getAgentDir(), { projectTrusted: resolveProjectTrust(resolved).trusted });
 		settingsCache.set(key, sm);
+		settingsCwds.set(key, resolved);
 	}
 	return sm;
 }
 
 interface LoaderEntry {
+	/** 原始目录（缓存键在 Windows 上是小写的） */
+	cwd: string;
 	loader: DefaultResourceLoader;
 	ready: Promise<void>;
 	/** 发现缓存的版本；每个热会话分别追踪自己已应用的版本。 */
@@ -151,6 +249,18 @@ export function withResourceLock<T>(fn: () => Promise<T>): Promise<T> {
 	return run;
 }
 
+/**
+ * SDK 的内置扩展（MCP、codemode、tool_search）：pi 命令行自己会带上，SDK 使用方要自己传，
+ * 不传 PiWeb 里就没有 mcp.json 配的服务器、也没有 codemode。名字与 CLI 一致（路径 `builtin:<name>`），
+ * settings 里的 `-builtin:mcp` 才能停用它们。llama.cpp 那个内置扩展 SDK 没有公开导出，补不了。
+ * 工厂每次加载都新建自己的状态；MCP 要等 session_start 才连服务器，只做清单的发现缓存不会拉起进程。
+ */
+const BUILTIN_EXTENSIONS = [
+	{ name: "codemode", factory: createCodemodeExtension(), replaceable: true, builtin: true as const },
+	{ name: "tool-search", factory: createToolSearchExtension(), replaceable: true, builtin: true as const },
+	{ name: "mcp", factory: createMcpExtension(), replaceable: true, builtin: true as const },
+];
+
 function loaderKey(cwd: string): string {
 	const resolved = path.resolve(cwd);
 	return process.platform === "win32" ? resolved.toLowerCase() : resolved;
@@ -160,7 +270,7 @@ function loaderKey(cwd: string): string {
 export async function createSessionResourceLoader(cwd: string): Promise<DefaultResourceLoader> {
 	const settingsManager = getSettingsManager(cwd);
 	settingsManager.setProjectTrusted(resolveProjectTrust(cwd).trusted);
-	const loader = new DefaultResourceLoader({ cwd: path.resolve(cwd), agentDir: getAgentDir(), settingsManager });
+	const loader = new DefaultResourceLoader({ cwd: path.resolve(cwd), agentDir: getAgentDir(), settingsManager, extensionFactories: BUILTIN_EXTENSIONS });
 	const reload = loader.reload.bind(loader);
 	loader.reload = async (options) => {
 		settingsManager.setProjectTrusted(resolveProjectTrust(cwd).trusted);
@@ -183,8 +293,8 @@ export function getResourceLoader(cwd: string): DefaultResourceLoader {
 	const key = loaderKey(cwd);
 	let entry = loaderCache.get(key);
 	if (!entry) {
-		const loader = new DefaultResourceLoader({ cwd: path.resolve(cwd), agentDir: getAgentDir(), settingsManager: getSettingsManager(cwd) });
-		entry = { loader, ready: Promise.resolve(), version: 0, fingerprint: "" };
+		const loader = new DefaultResourceLoader({ cwd: path.resolve(cwd), agentDir: getAgentDir(), settingsManager: getSettingsManager(cwd), extensionFactories: BUILTIN_EXTENSIONS });
+		entry = { cwd: path.resolve(cwd), loader, ready: Promise.resolve(), version: 0, fingerprint: "" };
 		loaderCache.set(key, entry);
 		queueLoaderReload(cwd, entry);
 	}
@@ -315,7 +425,8 @@ export async function reloadAllLoaders(): Promise<string[]> {
 	const reloaded: string[] = [];
 	for (const [key, entry] of loaderCache) {
 		try {
-			await queueLoaderReload(key, entry);
+			// 用原始目录：小写键会让资源指纹对不上（每次都多重载一轮），信任查找也会出错
+			await queueLoaderReload(entry.cwd, entry);
 			reloaded.push(key);
 		} catch {
 			/* 单个失败不影响其他 */
@@ -362,6 +473,22 @@ export function openSessionManager(sessionPath: string): SessionManager {
 /** 工具预设 → pi 工具白名单 */
 export const TOOL_PRESETS: Record<"readonly" | "standard" | "full", string[]> = {
 	readonly: ["read", "grep", "find", "ls"],
-	standard: ["read", "grep", "find", "ls", "bash", "edit", "write"],
+	standard: ["read", "grep", "find", "ls", "bash", "edit", "write", "codemode", "tool_search"],
 	full: [], // 空 = 不限制（全部可用工具）
 };
+
+const MCP_RESOURCE_TOOLS = new Set(["list_mcp_resources", "list_mcp_resource_templates", "read_mcp_resource"]);
+
+/** 与 SDK isMcpToolName 一致：MCP 服务器工具 `mcp__<server>__<tool>` 与三个资源工具 */
+export function isMcpToolName(name: string): boolean {
+	return name.startsWith("mcp__") || MCP_RESOURCE_TOOLS.has(name);
+}
+
+/**
+ * 档位是否放行某个工具（只是上限，开不开由 SDK / 扩展决定）。
+ * standard 另外放行 MCP 工具：服务器是用户自己在 mcp.json 里配的；readonly 不放，MCP 工具能写盘、调外部服务。
+ */
+export function presetAllowsTool(preset: keyof typeof TOOL_PRESETS, name: string): boolean {
+	if (preset === "full") return true;
+	return TOOL_PRESETS[preset].includes(name) || (preset === "standard" && isMcpToolName(name));
+}