pi-web-ui 0.94.0 → 0.95.0

package/dist/server/agent-service.js

@@ -19,16 +19,18 @@ import { createHash, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
 import { appendFileSync, existsSync, readFileSync, rmSync, statSync, mkdirSync, watch, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, createLocalBashOperations, getAgentDir, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, createEditToolDefinition, createLocalBashOperations, createWriteToolDefinition, getAgentDir, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { BgServerTracker } from "./bg-servers.js";
 import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, resolveNpmRegistry, sortUpdateItems, } from "./update-check.js";
 import { hasActiveSubagentRun, hasPendingWaitSubscription, shouldRetainActive } from "./wait-subscription-scan.js";
 import { COMPACTION_PENDING_TYPE, looksLikeChainCorruption, makeCompactionMarkerId, repairSessionFile, } from "./compaction-markers.js";
+import { DANGLING_TOOL_RESULT_TEXT, DANGLING_TOOL_RESULT_TEXT_EN, findDanglingToolCalls, healDanglingToolCallFile, } from "./dangling-tools.js";
 import { removeQueuedByIndexOrText } from "./queue-utils.js";
 import { syncPluginToolsIntoSession } from "./plugins.js";
+import { denialText, } from "./plugin-tool-guard.js";
 import { SettingsService } from "./settings-service.js";
 import { GoalService } from "./goal-service.js";
 import { MarkerService } from "./marker-service.js";
@@ -38,17 +40,26 @@ import { FilesService, MACHINE_ROOT, desktopDirWire, workspacePath } from "./fil
 import { DEFAULT_TOOL_WATCHDOG_TIMEOUT_MS, effectiveToolWatchdogMs, isExtensionDisabled, isExtensionEnabled, normalizeDisabledPluginTools, normalizeRetryMaxAttempts, normalizeSkillList, ClientStateStore, } from "./client-state.js";
 import { bilingual, pick, resolveServerLang } from "./i18n.js";
 import { SubagentTemplatesStore, pickTemplatePrompt } from "./subagent-templates.js";
+import { ApprovalRulesStore } from "./approval-rules.js";
 import { ComposerDraftsStore } from "./composer-drafts.js";
+import { createWorkspaceSnapshot, restoreWorkspaceSnapshot } from "./workspace-snapshot.js";
+import { approvalSuppressionReason, checkDangerousToolCall, isApprovalPolicyEmpty, pluginApprovalCategory, } from "./tool-approval.js";
+import { PlanManager } from "./plan-manager.js";
 import { applyHeadTail, makePersistentTerminalTools, makeTerminalBashTool, stripAnsi, TERMINAL_TOOLS_GUIDANCE, } from "./terminals.js";
-import { applyAgentToolsGating, ASK_USER_QUESTION_TOOL_NAME, BROWSER_PAGE_TOOL_NAME, effectiveDisabledAgentTools, isAgentToolEnabled, isTerminalGuidanceOn, MARKERS_LIST_TOOL_NAME, PRESENT_FILES_TOOL_NAME, } from "./tool-manager.js";
+import { applyAgentToolsGating, ASK_USER_QUESTION_TOOL_NAME, BROWSER_PAGE_TOOL_NAME, effectiveDisabledAgentTools, isAgentToolEnabled, isTerminalGuidanceOn, MARKERS_LIST_TOOL_NAME, PI_AGENT_PRESETS, PI_PERMISSION_OPTIONS, PLAN_UPDATE_TOOL_NAME, PRESENT_FILES_TOOL_NAME, presetAllowsPluginTools, presetHasQuestionnaire, presetShowsSkillCatalog, } from "./tool-manager.js";
 import { WebUIContext } from "./webui-context.js";
 import { DEFAULT_COMPACTION_RESERVE_TOKENS, effectiveSoftCap, softCapToReserve } from "./soft-cap.js";
+import { pruneContextHierarchically } from "./context-budget.js";
 import { decodeText } from "./text-sniff.js";
 import { makeEditSoftTool } from "./edit-soft-tool.js";
 // 覆盖 SDK 内置 read：路径是目录时列出目录条目（行为开关 readDirEnabled，默认开）。
 import { makeReadDirTool } from "./read-tool.js";
 // 展示文件给用户（present_files）：图片/视频内联、文本开预览弹窗、本地打开按钮。
 import { makePresentFilesTool } from "./present-files-tool.js";
+// 主动压缩上下文工具（compact_context）：AI 主动根据当前问题精简上下文并自主控制范围。
+import { makeCompactContextTool, buildCompactionInstructions, DEFAULT_KEEP_RECENT_TOKENS, } from "./compact-context-tool.js";
+// 持久代码求值沙箱（eval）：Python / Node.js 沙箱内核。
+import { disposeAllEvalKernels, disposeEvalSession, makeEvalTool } from "./eval-tool.js";
 // 工具定义说明的归一化（工具卡右键 → 「显示工具详细信息」，见 getToolInfo）。
 import { normalizeToolInfo } from "./tool-info.js";
 import { collectSubagentDescendantIds, makeSubagentTools, subagentTitle, withSubagentOwner, } from "./subagents.js";
@@ -59,6 +70,8 @@ import { ClaimStore, matchClaims, mergeTouchSidecar, readTouchSidecar, removeTou
 import { makeClaimFilesTool } from "./claim-files-tool.js";
 import { makeSkillTool } from "./skill-tool.js";
 import { makeScheduleTools } from "./schedule-agent-tool.js";
+import { makePatchTool } from "./patch-tool.js";
+import { makeLspTool } from "./lsp-tool.js";
 import { sameSessionFile } from "./scheduler-tasks.js";
 import { buildAttachmentMessages, parseModelSpec } from "./attachments.js";
 import { buildVisionBridgePrompt, findVisionModels, transcribeImages } from "./vision-bridge.js";
@@ -247,6 +260,436 @@ export function makeAdaptiveBashTool(killable, terminalBacked, useTerminal) {
         },
     };
 }
+/**
+ * 给已接管工具（bash/read）包上拦截守卫与人机协同审批：
+ * 1. pre guard 命中 deny → 直接阻断；
+ * 2. pre guard 命中 ask 或内置高危操作检测（rm -rf / 敏感文件覆盖等） →
+ *    触发 tool_approval_pending 等待用户审批；
+ *    - 用户选择 approve: 放行执行
+ *    - 用户选择 edit: 使用用户修改后的参数执行（Edit & Run）
+ *    - 用户选择 deny: 阻断并告知模型
+ * 3. post guard 合并（脱敏/补上下文）。
+ */
+export function withToolGuard(def, opts) {
+    const guard = opts.guard;
+    const toolName = opts.toolName;
+    if (!guard && !opts.askApproval)
+        return def;
+    return {
+        ...def,
+        execute: (async (toolCallId, params, signal, onUpdate, ctx) => {
+            const lang = opts.getLang();
+            const conversationId = opts.conversationId?.();
+            let pre;
+            if (guard) {
+                try {
+                    pre = await guard.pre({ toolName, params, conversationId }, lang);
+                }
+                catch {
+                    pre = { verdict: { decision: "allow" } };
+                }
+            }
+            // 检查是否需要人工协同审批（Human-in-the-Loop）
+            let needApproval = false;
+            let approvalReason;
+            let approvalReasonEn;
+            let approvalCategory;
+            if (pre?.verdict.decision === "deny") {
+                const text = denialText(pre.verdict, pre.pluginId ?? "plugin", lang);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { guardDenied: true, decision: pre.verdict.decision, pluginId: pre.pluginId },
+                };
+            }
+            else if (pre?.verdict.decision === "ask") {
+                needApproval = true;
+                approvalReason = pre.verdict.reason ?? "插件要求确认本次操作";
+                approvalReasonEn = pre.verdict.reasonEn ?? "Plugin requested confirmation for this operation";
+                // 插件档位按插件 id 分：用户可以「允许同类」= 该插件的确认以后不再问。
+                approvalCategory = pluginApprovalCategory(pre.pluginId ?? "plugin");
+            }
+            // 内置高危操作检测（如 bash 破坏性命令等）与自定义审批规则
+            if (!needApproval && opts.cwd && opts.askApproval) {
+                const danger = checkDangerousToolCall(toolName, params, opts.cwd, opts.getRoots?.() ?? [], opts.getRules?.());
+                if (danger.denied) {
+                    const reasonText = danger.reason ? ` 原因：${danger.reason}` : "";
+                    const reasonTextEn = danger.reasonEn ? ` Reason: ${danger.reasonEn}` : "";
+                    const text = pick(lang, `【工具执行被审批规则直接阻断】${reasonText}`, `[Tool execution blocked by approval rule]${reasonTextEn}`);
+                    return {
+                        content: [{ type: "text", text }],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    needApproval = true;
+                    approvalReason = danger.reason;
+                    approvalReasonEn = danger.reasonEn;
+                    approvalCategory = danger.category;
+                }
+            }
+            let effectiveParams = params;
+            let userEdited = false;
+            if (needApproval && opts.askApproval) {
+                const res = await opts.askApproval(toolCallId, toolName, params, approvalReason, approvalReasonEn, conversationId, approvalCategory);
+                if (res.decision === "deny") {
+                    const reasonText = res.reason ? ` 原因：${res.reason}` : "";
+                    const reasonTextEn = res.reason ? ` Reason: ${res.reason}` : "";
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(lang, `【操作被用户拒绝】${reasonText}`, `[Operation denied by user]${reasonTextEn}`),
+                            },
+                        ],
+                        details: { guardDenied: true, userDenied: true, reason: res.reason },
+                        isError: true,
+                    };
+                }
+                else if (res.decision === "edit") {
+                    effectiveParams = res.editedParams ?? params;
+                    userEdited = true;
+                }
+            }
+            else if (pre?.verdict.decision === "ask") {
+                // 无审批通道时回落至原先的阻断行为
+                const text = denialText(pre.verdict, pre.pluginId ?? "plugin", lang);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { guardDenied: true, decision: pre.verdict.decision, pluginId: pre.pluginId },
+                };
+            }
+            const result = (await def.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...(result.details ?? {}),
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            if (guard) {
+                let post;
+                try {
+                    post = await guard.post({ toolName, params: effectiveParams, result, conversationId }, lang);
+                }
+                catch {
+                    post = undefined;
+                }
+                if (post?.content)
+                    return { ...result, content: post.content };
+            }
+            return result;
+        }),
+    };
+}
+/** 校验目标路径是否在工作区（或多根工作区）内。 */
+function isInsideWorkspaceRoots(targetPath, cwd, roots = []) {
+    const abs = isAbsolute(targetPath) ? targetPath : resolve(cwd, targetPath);
+    const allRoots = [resolve(cwd), ...roots.map((r) => resolve(r))];
+    return allRoots.some((r) => abs === r || abs.startsWith(r + sep));
+}
+/** 为 write 工具包装会话级权限沙箱与人机协同审批。 */
+function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
+    const base = createWriteToolDefinition(cwd);
+    return {
+        ...base,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止写入文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; writing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = params?.path ?? "";
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; writing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危写操作人机协同审批拦截（如敏感配置修改）与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("write", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件写入被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File write blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "write", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件写入被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File write denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...(result.details ?? {}),
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/** 为 edit 工具包装会话级权限沙箱与人机协同审批。 */
+function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
+    const base = createEditToolDefinition(cwd);
+    return {
+        ...base,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止编辑文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; editing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = params?.path ?? "";
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; editing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危修改人机协同审批拦截与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("edit", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件编辑被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File edit blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "edit", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件编辑被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File edit denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...(result.details ?? {}),
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/** 为 edit_soft 工具包装会话级权限沙箱与人机协同审批。 */
+function wrapEditSoftToolWithPermission(tool, cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
+    return {
+        ...tool,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止编辑文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; editing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = params?.path ?? "";
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; editing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危修改人机协同审批拦截与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("edit_soft", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件编辑被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File edit blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "edit_soft", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件编辑被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File edit denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await tool.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...(result.details ?? {}),
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/**
+ * 结构化任务执行计划更新工具（plan_update）— Plan Mode / Step State Machine。
+ */
+function makePlanUpdateTool(planManager, getActiveConvId, emit, flushSnapshot) {
+    return {
+        name: PLAN_UPDATE_TOOL_NAME,
+        label: "plan_update",
+        description: "Update the structured task execution plan / step state machine (Plan Mode). Use it for non-trivial tasks to break down work into steps, track live progress, and update status (pending -> in_progress -> done/failed).\n更新结构化任务执行计划（步骤状态机）。用于复杂工程任务拆解与实时进度推进。",
+        parameters: Type.Object({
+            steps: Type.Array(Type.Object({
+                id: Type.String({ description: "Unique step ID, e.g. '1', 'step-1'" }),
+                title: Type.String({ description: "Short step title" }),
+                status: Type.Optional(Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("done"), Type.Literal("failed")], { description: "Step status: pending | in_progress | done | failed (default: pending)" })),
+                description: Type.Optional(Type.String({ description: "Optional detailed description or acceptance criteria" })),
+            }), { description: "List of plan steps" }),
+            activeStepId: Type.Optional(Type.String({ description: "ID of the step currently being executed" })),
+        }),
+        execute: async (toolCallId, params) => {
+            const convId = getActiveConvId();
+            const p = params;
+            const plan = planManager.setPlan(convId, p.steps, p.activeStepId);
+            emit({
+                type: "plan_updated",
+                conversationId: convId,
+                plan,
+            });
+            flushSnapshot();
+            const summary = planManager.describePlan(convId);
+            return {
+                content: [{ type: "text", text: `Plan updated successfully.\n\n${summary}` }],
+                details: { plan },
+            };
+        },
+    };
+}
+/** 为 bash 工具包装只读拦截。 */
+function wrapBashToolWithPermission(tool, getPermission, getLang) {
+    return {
+        ...tool,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止执行终端命令。若需执行请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; running shell commands is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            return tool.execute(toolCallId, params, signal, onUpdate, ctx);
+        },
+    };
+}
 /**
  * 任务列表只读查询工具（todo_list）— 读操作仍走真工具。
  */
@@ -305,6 +748,15 @@ ownerId) {
         header: Type.Optional(Type.String({ description: "Optional short header for this question" })),
         options: Type.Optional(Type.Array(QuestionOptionSchema, { description: "Available options to choose from" })),
         multiSelect: Type.Optional(Type.Boolean({ description: "Allow selecting multiple options (default: false)" })),
+        dependsOn: Type.Optional(Type.Object({
+            questionId: Type.String({ description: "ID of the prior question this question depends on" }),
+            value: Type.Optional(Type.Union([Type.String(), Type.Array(Type.String())], {
+                description: "Show this question only when the prior question's answer matches this value (or any in the array). Omit to show whenever answered.",
+            })),
+        })),
+        optionsMap: Type.Optional(Type.Record(Type.String(), Type.Array(QuestionOptionSchema), {
+            description: "Dynamic options based on prior question's chosen value: e.g. { 'React': [opts...], 'Vue': [opts...] }",
+        })),
     });
     return {
         name: "ask_user_question",
@@ -940,7 +1392,7 @@ export class ClientSession {
         emit: (msg) => this.emit(msg),
         isDisposed: () => this.disposed,
         getCwd: () => this.cwd,
-        getActiveCwd: () => this.conv?.cwd ?? this.cwd,
+        getActiveCwd: () => this.convs.get(this.activeId)?.cwd ?? this.cwd,
         // issue #91：文件服务错误文案按客户端 UI 语言出中英（英文默认）。
         getLang: () => this.getLang(),
     });
@@ -954,6 +1406,9 @@ export class ClientSession {
     /** index.ts 注入（经 AgentService 拷贝到每个新会话）：把 SDK 工具执行事件转发给
      *  插件（PluginManager.emitToolEvent）。未设置时不做任何事。 */
     onToolEvent = undefined;
+    /** index.ts 注入（P1-5，经 AgentService 拷贝到每个新会话）：bash/read 执行前后的
+     *  插件拦截（PluginManager.evaluateToolPre/evaluateToolPost）。未设置时直通。 */
+    toolGuard = undefined;
     /** index.ts 注入：把运行轨迹事件转发给插件（PluginManager.emitRunEvent，
      *  轨迹视图插件靠它聚合时间线）。未设置时不做任何事。 */
     onRunEvent = undefined;
@@ -993,10 +1448,10 @@ export class ClientSession {
         return this.conv.terminals;
     }
     getTerminalManager(conversationId) {
-        return (conversationId ? this.convs.get(conversationId) : this.conv)?.terminals;
+        return (conversationId ? this.convs.get(conversationId) : this.convs.get(this.activeId))?.terminals;
     }
     getTerminalCwd(conversationId) {
-        return (conversationId ? this.convs.get(conversationId) : this.conv)?.cwd ?? this.cwd;
+        return (conversationId ? this.convs.get(conversationId) : this.convs.get(this.activeId))?.cwd ?? this.cwd;
     }
     makeTerminalManager(conversationId, cwd) {
         const mgr = new TerminalManager((msg) => this.emitTerminal(conversationId, msg), cwd, 
@@ -1099,6 +1554,16 @@ export class ClientSession {
         const conversationId = persist ? `conv-${randomUUID().slice(0, 8)}` : `sa-${randomUUID().slice(0, 8)}`;
         const terminals = this.makeTerminalManager(conversationId, resolvedCwd);
         const sessionManager = persist ? SessionManager.create(resolvedCwd) : SessionManager.inMemory(resolvedCwd);
+        if (!persist) {
+            // 为内存子代理提供隔离的临时运行目录（供 SoL-Pi 等依赖 getSessionDir 的扩展正常放置缓存），
+            // 但保持 persist = false（不写 .jsonl 对话文件、不污染历史记录）
+            const ephemeralDir = join(this.agentDir, "subagent-sessions", conversationId);
+            try {
+                mkdirSync(ephemeralDir, { recursive: true });
+                sessionManager.sessionDir = ephemeralDir;
+            }
+            catch { }
+        }
         const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, apply, conversationId), {
             cwd: resolvedCwd,
             agentDir: this.agentDir,
@@ -1136,7 +1601,10 @@ export class ClientSession {
                 // 局部 mock 缺失而崩），但它是 headless 的：UI 输出全部丢弃、弹窗按取消返回，
                 // 因此既不与主对话的 widget/status 串台，也不会让扩展卡在永远无人应答的弹窗上。
                 uiContext: WebUIContext.headless(),
-                onError: (err) => this.emit({ type: "notice", level: "error", text: err.error, textEn: err.error }),
+                onError: this.makeExtensionErrorReporter({
+                    text: `子代理 ${conversationId}：`,
+                    textEn: `Subagent ${conversationId}: `,
+                }),
             });
         }
         catch {
@@ -1268,6 +1736,8 @@ export class ClientSession {
             output: conv.session.getLastAssistantText() ?? "",
             parentId: conv.parentId,
             persisted: isPersisted,
+            handoffTo: conv.peerHandoffTo ? [...conv.peerHandoffTo] : undefined,
+            handoffFrom: conv.peerHandoffFrom ? [...conv.peerHandoffFrom] : undefined,
         };
     }
     /** 子代理最近一次运行的结局：最后一条 assistant 消息的 errorMessage / stopReason。
@@ -1406,7 +1876,7 @@ export class ClientSession {
             const sess = this.session;
             if (!sess)
                 return undefined;
-            const cwd = this.conv?.cwd ?? this.cwd;
+            const cwd = this.convs.get(this.activeId)?.cwd ?? this.cwd;
             const active = sess.getActiveToolNames();
             const snippets = {};
             const guidelines = [];
@@ -1463,6 +1933,96 @@ export class ClientSession {
      * 历史/resume 列表）、listed=true 出现在左栏「运行的对话」并向用户可见——
      * 切换查看 / 输入补充（steer）/ 中止（abort）/ 移出全部复用现有对话机制。
      */
+    subagentHandoffs = [];
+    /**
+     * 多智能体同行协作与直接交接（Peer-to-Peer Subagents & Hand-off）：
+     * 将任务产物、分析结果或后续指令直接从一个子代理路由至另一个同行子代理，
+     * 无需主会话反复充当传声筒消耗双倍 token。
+     */
+    async handoffSubagent(fromRunId, toRunId, payload) {
+        if (fromRunId === toRunId) {
+            throw new Error("Cannot hand off to oneself");
+        }
+        const toConv = this.convs.get(toRunId);
+        if (!toConv) {
+            throw new Error(`Target subagent ${toRunId} not found`);
+        }
+        const fromConv = this.convs.get(fromRunId);
+        const fromType = fromConv?.subagentType ?? "peer";
+        const toType = toConv.subagentType ?? "peer";
+        const handoffMessage = `[Peer Hand-off from ${fromType} subagent (${fromRunId.slice(0, 8)})]:\n\n${payload}`;
+        const record = { fromRunId, toRunId, timestamp: Date.now() };
+        this.subagentHandoffs.push(record);
+        if (!fromConv?.peerHandoffTo) {
+            if (fromConv)
+                fromConv.peerHandoffTo = [];
+        }
+        fromConv?.peerHandoffTo?.push(toRunId);
+        if (!toConv.peerHandoffFrom)
+            toConv.peerHandoffFrom = [];
+        toConv.peerHandoffFrom.push(fromRunId);
+        // 向目标子代理注入对等交接消息
+        await toConv.session.sendUserMessage(handoffMessage, toConv.session.isStreaming ? { deliverAs: "steer" } : undefined);
+        // 广播交接事件
+        this.emit({
+            type: "subagent_handoff",
+            fromRunId,
+            toRunId,
+            payload,
+            timestamp: record.timestamp,
+        });
+        // 向主会话推送通知
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `子代理 ${fromRunId.slice(0, 8)}（${fromType}）已向同行子代理 ${toRunId.slice(0, 8)}（${toType}）直接交接`,
+            textEn: `Subagent ${fromRunId.slice(0, 8)} (${fromType}) handed off directly to ${toRunId.slice(0, 8)} (${toType})`,
+        });
+        this.emitConversations();
+        this.flushSnapshot();
+    }
+    /**
+     * 多级分层上下文预算裁剪（Hierarchical Context Budgeting）：
+     * 当上下文达到预警水位（例如 70%）时，自动执行第一级（远期工具输出裁剪）和
+     * 第二级（已完成步骤折叠），推迟触发全量 LLM 压缩，保留近期关键代码的细节。
+     */
+    applyContextBudgetPruning(conv) {
+        if (!conv?.session)
+            return;
+        try {
+            const contextWindow = contextWindowOf(conv.session);
+            if (!contextWindow || contextWindow <= 0)
+                return;
+            const s = this.settingsSvc.current;
+            const modelId = modelKeyOf(conv.session);
+            const cap = effectiveSoftCap(s.softCapTokens, s.softCapByModel, modelId);
+            const reserve = softCapToReserve(contextWindow, cap) ?? DEFAULT_COMPACTION_RESERVE_TOKENS;
+            const messages = conv.session.agent.state.messages;
+            if (!messages || messages.length === 0)
+                return;
+            const result = pruneContextHierarchically(messages, {
+                contextWindow,
+                reserveTokens: reserve,
+                softCap: cap > 0 ? cap : null,
+            });
+            if (result.tier1.trimmedCount > 0 || result.tier2.foldedCount > 0) {
+                conv.session.agent.state.messages = result.messages;
+                const saved = result.tokensBefore - result.tokensAfter;
+                this.emit({
+                    type: "notice",
+                    level: "info",
+                    text: `分层上下文预算裁剪生效：已释放约 ${saved.toLocaleString()} tokens（裁剪远期工具输出/折叠已完成步骤），推迟全量压缩`,
+                    textEn: `Hierarchical context pruning active: freed ~${saved.toLocaleString()} tokens (trimmed tool outputs / folded steps), deferring full compaction`,
+                });
+                if (conv.id === this.conv.id) {
+                    this.flushSnapshot();
+                }
+            }
+        }
+        catch {
+            /* 预算裁剪尽力而为，不阻断主流程 */
+        }
+    }
     subagentHost = {
         spawnSubagent: (prompt, type, cwd, templateName, model, parentId, persist) => {
             // 模板：存在且启用时应用；传了名字但不可用 → 抛错让工具转给 AI。
@@ -1475,6 +2035,9 @@ export class ClientSession {
         },
         getSubagent: (convId) => this.getSubagentSnapshot(convId),
         listSubagents: (scope) => this.listSubagentSnapshots(scope),
+        handoffSubagent: async (fromRunId, toRunId, payload) => {
+            await this.handoffSubagent(fromRunId, toRunId, payload);
+        },
         steerSubagent: async (convId, message) => {
             const conv = this.convs.get(convId);
             if (!conv?.session)
@@ -1651,6 +2214,120 @@ export class ClientSession {
             store: () => this.getClaimStore?.(),
         };
     }
+    /** compact_context 工具的数据宿主：提供消息统计用于预检，以及注册 pending 压缩请求。
+     *  ownerId 语义同 skill / claimFiles（本 runtime 所属会话，不是派发瞬间 active）。 */
+    compactContextHost(ownerId) {
+        const target = () => {
+            try {
+                return (ownerId ?? "").trim() !== "" ? this.convs.get(ownerId.trim()) : this.convs.get(this.activeId);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        return {
+            conversationId: () => target()?.id ?? this.activeId,
+            getContextStats: () => {
+                const conv = target();
+                if (!conv)
+                    return { messageCount: 0, estimatedTokens: 0 };
+                let messages = [];
+                try {
+                    messages = conv.session.messages;
+                }
+                catch {
+                    messages = [];
+                }
+                let totalChars = 0;
+                for (const m of messages) {
+                    if (m && typeof m === "object" && "content" in m) {
+                        const content = m.content;
+                        if (Array.isArray(content)) {
+                            for (const c of content) {
+                                if (c &&
+                                    typeof c === "object" &&
+                                    "type" in c &&
+                                    c.type === "text" &&
+                                    typeof c.text === "string") {
+                                    totalChars += c.text.length;
+                                }
+                            }
+                        }
+                        else if (typeof content === "string") {
+                            totalChars += content.length;
+                        }
+                    }
+                }
+                return {
+                    messageCount: messages.length,
+                    estimatedTokens: Math.ceil(totalChars / 4),
+                };
+            },
+            scheduleCompaction: (pending) => {
+                const conv = target();
+                if (conv) {
+                    conv.pendingCompaction = pending;
+                }
+            },
+        };
+    }
+    /** 执行由 AI 调用 compact_context 安排的上下文压缩（在 agent_settled 阶段调用）。 */
+    async executePendingCompaction(conv, pending) {
+        const instructions = buildCompactionInstructions(pending.focus, pending.summary);
+        const session = conv.session;
+        const model = session.model;
+        let originalKeepRecent;
+        try {
+            originalKeepRecent = session.settingsManager.getCompactionSettings(model).keepRecentTokens;
+        }
+        catch {
+            originalKeepRecent = undefined;
+        }
+        try {
+            if (pending.keepRecentTokens && pending.keepRecentTokens > 0) {
+                session.settingsManager.applyOverrides({
+                    compaction: {
+                        keepRecentTokens: pending.keepRecentTokens,
+                    },
+                });
+            }
+            await session.compact(instructions || undefined);
+            const retainTokens = pending.keepRecentTokens ?? DEFAULT_KEEP_RECENT_TOKENS;
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: `AI 已主动根据当前问题完成上下文压缩（保留 ~${retainTokens.toLocaleString()} tokens 近期上下文，重点保留当前问题相关内容）`,
+                textEn: `Context compacted proactively based on current issue (retained ~${retainTokens.toLocaleString()} tokens, focused on current task)`,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `主动上下文压缩未完成：${msg}`,
+                textEn: `Proactive context compaction did not finish: ${msg}`,
+            });
+        }
+        finally {
+            if (pending.keepRecentTokens && pending.keepRecentTokens > 0) {
+                try {
+                    if (originalKeepRecent !== undefined) {
+                        session.settingsManager.applyOverrides({
+                            compaction: {
+                                keepRecentTokens: originalKeepRecent,
+                            },
+                        });
+                    }
+                }
+                catch {
+                    // best effort
+                }
+            }
+            this.applyCompactionOverrides();
+            this.flushSnapshot();
+        }
+    }
     /** skill 工具的数据宿主：读所属会话 loader 的实时技能表 + 主会话禁用集过滤
      * （与 skillsOverride 主会话语义一致）。ownerId 语义同 browser_page（本
      * runtime 所属会话，不是派发瞬间的 active）。失败回空目录，不抛错。 */
@@ -1742,6 +2419,8 @@ export class ClientSession {
     watchTimer = null;
     /** 子代理模板库（全局共享，<dataDir>/subagent-templates.json）。 */
     subagentTemplates;
+    /** 审批规则库（全局共享，<dataDir>/approval-rules.json）。 */
+    approvalRules;
     /** 未发送输入框草稿（全局共享，<dataDir>/composer-drafts.json，按 sessionId 键入，见 server/composer-drafts.ts）。 */
     drafts;
     /** 内置标记服务（todo/notify/svc/rename 等，可全局/分组开关）。 */
@@ -1756,6 +2435,11 @@ export class ClientSession {
     /** 待答提问（id → 载荷 + resolve）。一次正常只有一个（agent 阻塞在工具执行）；
      *  conversationId 记录谁问的：看门狗豁免、快照恢复都靠它。 */
     pendingQuestions = new Map();
+    /** 任务计划管理器（Plan Mode / Step State Machine）。 */
+    planManager = new PlanManager();
+    approvalSeq = 0;
+    /** 待审批高危工具调用（Human-in-the-Loop: Edit & Run）。 */
+    pendingApprovals = new Map();
     // -----------------------------------------------------------------------
     // 浏览器页面桥（标准 pi 引擎的 browser_page customTool）：模型调工具 → 发
     // page_request 给浏览器 → 前端转 page-picker 扩展 → page_response 回到这里
@@ -1777,6 +2461,7 @@ export class ClientSession {
         this.stateStore = stateStore;
         this.roots = stateStore.getWorkspaceRoots(clientId, cwd);
         this.subagentTemplates = new SubagentTemplatesStore(join(stateStore.dataDir, "subagent-templates.json"));
+        this.approvalRules = new ApprovalRulesStore(join(stateStore.dataDir, "approval-rules.json"));
         this.drafts = new ComposerDraftsStore(join(stateStore.dataDir, "composer-drafts.json"));
         this.markerSvc = new MarkerService({
             clientId,
@@ -1832,7 +2517,8 @@ export class ClientSession {
                 disabledMarkers: [...this.markerSvc.current.disabledMarkers],
                 markers: this.markerSvc.listForUi(),
             }),
-        }, this.subagentTemplates);
+            getApprovalPolicy: () => this.approvalPolicyState(),
+        }, this.subagentTemplates, this.approvalRules);
         this.goalSvc = new GoalService({
             clientId,
             agentDir,
@@ -1998,7 +2684,9 @@ export class ClientSession {
                             // GBK 老中文文件让模型改用终端按正确编码读（iconv/chcp/Get-Content）。
                             out.push(WINDOWS_PERSONA);
                         }
-                        if (isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current))) {
+                        // 终端引导只教「开关开着且预设下仍可用」的工具（见 tool-manager.ts 语义总表）。
+                        const presetForGuidance = this.convs.get(ownerId ?? "")?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+                        if (isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current), presetForGuidance)) {
                             // 终端工具使用引导（全平台）：告诉模型什么场景该用持久终端
                             // 而不是一次性 bash——没有这段模型几乎从不主动选终端工具。
                             // 组内工具全关时不注入（不教 AI 用不存在的工具）。
@@ -2011,12 +2699,17 @@ export class ClientSession {
                             out.push(markerGuidance);
                         return out;
                     },
-                    // 技能：模板非空白名单时只启用白名单里的；否则按主会话禁用集过滤。
+                    // 技能：模板非空白名单时只启用白名单里的（显式配置优先于预设）；
+                    // 否则按主会话禁用集过滤。预设拿掉 skill 加载器时（minimal/code/ask）
+                    // 名录同步隐藏——列出来但调不动只是噪音（见 tool-manager.ts 语义总表）。
                     skillsOverride: (res) => {
                         if (apply && apply.enabledSkills.length > 0) {
                             const set = new Set(apply.enabledSkills);
                             return { ...res, skills: res.skills.filter((s) => set.has(s.name)) };
                         }
+                        const preset = this.convs.get(ownerId ?? "")?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+                        if (!presetShowsSkillCatalog(preset))
+                            return { ...res, skills: [] };
                         return {
                             ...res,
                             skills: res.skills.filter((s) => !this.settingsSvc.current.disabledSkills.includes(s.name)),
@@ -2130,31 +2823,64 @@ export class ClientSession {
                 // 「默认 bash 覆盖」开关（terminalBash）关 → 原生 SDK bash（纯进程、不开终端）；
                 // 开 → 终端接管 bash（persist 决定一次性/持久，可静默自动转后台）。
                 customTools: [
-                    makeAdaptiveBashTool(
+                    // P1-5：bash/read 包插件拦截（pre 拒/问即拦、post 脱敏补上下文；
+                    // 未注入 toolGuard 时 withToolGuard 原样返回，零开销）。
+                    // 权限沙箱拦截（只读模式拦截终端执行）。
+                    wrapBashToolWithPermission(withToolGuard(makeAdaptiveBashTool(
                     // issue #91：bash 返回按客户端 UI 语言出中英（英文默认）。
                     makeKillableBashTool(effectiveCwd, this.bashKills, () => this.getLang()), makeTerminalBashTool(terminals, {
                         cwd: effectiveCwd,
                         // 设置开 = 用终端；此分支里 persist 未显式给时默认一次性（false）。
                         defaultPersist: () => false,
                         idleMs: () => Math.max(0, Math.floor(this.settingsSvc.current.terminalBashIdleMs) || 0),
+                        maxForegroundMs: () => Math.max(0, Math.floor(this.settingsSvc.current.terminalBashMaxForegroundMs) || 0),
                         kills: this.bashKills,
                         notifyBackgroundDone: (info) => this.notifyTerminalBashDone(terminals, info),
                         // issue #91：bash 返回按客户端 UI 语言出中英（英文默认）。
                         lang: () => this.getLang(),
                     }), 
                     // 设置关 → 原生 bash；开 → 终端 bash。
-                    () => this.settingsSvc.current.terminalBash),
+                    () => this.settingsSvc.current.terminalBash), {
+                        toolName: "bash",
+                        guard: this.toolGuard,
+                        conversationId: () => ownerId,
+                        getLang: () => this.getLang(),
+                        cwd: effectiveCwd,
+                        getRoots: () => this.roots,
+                        askApproval: (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category),
+                        getRules: () => this.approvalRules.list(),
+                    }), () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.getLang()),
                     ...makePersistentTerminalTools(terminals, effectiveCwd, () => this.getLang()),
                     // 覆盖 SDK 内置 read（customTools 按 name 覆盖）：路径是目录时列出目录
                     // 条目（复用 SDK ls 的排序/`/` 后缀/截断口径），其余情况原样转发内置实现。
                     // 开关是行为开关（read 本体不可关），每次调用实时读设置——不进
                     // tool-manager 的 ActiveSet 目录。DSH 引擎无 customTool 注册面，不接。
-                    makeReadDirTool(effectiveCwd, {
+                    withToolGuard(makeReadDirTool(effectiveCwd, {
                         dirEnabled: () => this.settingsSvc.current.readDirEnabled !== false,
                         getLang: () => this.getLang(),
+                    }), {
+                        toolName: "read",
+                        guard: this.toolGuard,
+                        conversationId: () => ownerId,
+                        getLang: () => this.getLang(),
+                        cwd: effectiveCwd,
+                        getRoots: () => this.roots,
+                        askApproval: (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category),
+                        getRules: () => this.approvalRules.list(),
                     }),
-                    // 不覆盖内置 edit 的独立宽松编辑工具（缩进不敏感匹配；开关看设置）。
-                    makeEditSoftTool(effectiveCwd, () => this.getLang()),
+                    // 覆盖 SDK 内置 write / edit，并在执行层注入会话级三档权限沙箱门禁与人机协同审批。
+                    wrapWriteToolWithPermission(effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
+                    wrapEditToolWithPermission(effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
+                    // 不覆盖内置 edit 的独立宽松编辑工具（缩进不敏感匹配；开关看设置；带权限沙箱拦截与人机协同）。
+                    wrapEditSoftToolWithPermission(makeEditSoftTool(effectiveCwd, () => this.getLang()), effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
                     // 插件注册的 AI 工具（创建时刻的实时快照，已按 disabledPluginTools 过滤；
                     // 后续注册经 refreshPluginTools 动态补入已有会话）。
                     // 子代理模板带非空扩展白名单时不注入：插件/MCP 工具没有 SDK extensionKey
@@ -2179,6 +2905,8 @@ export class ClientSession {
                         : [makeDelegateTaskTool(this.subagentHost)]),
                     // 内置标记只读查询工具（todo/svc 状态查询，写操作走内联标记）。
                     makeMarkersListTool(() => this.activeId, this.markerSvc),
+                    // 结构化任务计划更新（Plan Mode / Step State Machine）。
+                    makePlanUpdateTool(this.planManager, () => ownerId ?? this.activeId, (msg) => this.emit(msg), () => this.flushSnapshot()),
                     // 标准引擎的 ask_user_question：模型调用 → 浏览器富渲染问卷（复用 DSH
                     // 的 question_pending/question_answer 协议，前端 DshQuestionDialog）。
                     // DSH 引擎不经此（它走 goal-rpc 的 userQuestions provider）。
@@ -2218,11 +2946,25 @@ export class ClientSession {
                     // 子代理会话同样注册（owner 即真正派发的父对话，读该会话 loader）。
                     // DSH 引擎无 customTool 注册面，不接。开关走统一工具 tab。
                     makeSkillTool(this.skillToolHost(ownerId), () => this.getLang()),
+                    // 主动压缩上下文工具（compact_context）：AI 主动根据当前问题精简上下文。
+                    // 开关走统一工具 tab（ActiveSet 门控）。DSH 引擎无 customTool 注册面，不接。
+                    makeCompactContextTool(this.compactContextHost(ownerId), () => this.getLang()),
                     // 定时唤醒三件套（schedule_task/list/cancel，issue #193）：默认绑定
                     // 发起对话（ownerId，无则活动对话），到期 steer 语义唤醒它；子代理
                     // 会话同样注册（owner 即真正派发的父对话）。开关走统一工具 tab。
                     // DSH 引擎无 customTool 注册面，不接。
                     ...makeScheduleTools(this.scheduleToolHost(), ownerId, () => this.getLang()),
+                    // 持久代码求值沙箱（eval）：开关走统一工具 tab（ActiveSet 门控，默认关）。
+                    // ownerId 绑定当前会话；DSH 引擎无 customTool 注册面，不接。
+                    makeEvalTool({
+                        cwd: effectiveCwd,
+                        ownerId,
+                        lang: () => this.getLang(),
+                    }),
+                    // 高可靠行补丁工具（patch，基于内容哈希与语法块级替换）。
+                    makePatchTool({ cwd: effectiveCwd, ownerId }),
+                    // 原生语言服务器工具（lsp，定义跳转/引用/悬停/诊断）。
+                    makeLspTool({ cwd: effectiveCwd, ownerId }),
                 ],
             });
             // 桥接工具归属锚点：SDK 会话对象在本 runtime 生命周期内稳定，过户只搬对话
@@ -2256,6 +2998,9 @@ export class ClientSession {
             session: runtime.session,
             cwd: runtime.cwd,
             createdAt: Date.now(),
+            agentPreset: this.settingsSvc.current.defaultAgentPreset ?? "standard",
+            presetLocked: false,
+            permissionPreset: this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never",
             // A brand-new conversation is not yet LISTED — it enters the running
             // list only when it is displaced to the background while still
             // streaming (its runtime is what `listed` protects). A blank chat is
@@ -2283,6 +3028,7 @@ export class ClientSession {
             queueFollowUp: [],
             toolStartTimes: new Map(),
             toolWatchdogs: new Map(),
+            workspaceSnapshots: [],
         };
     }
     /** Summaries of conversations currently streaming — captured at shutdown
@@ -2396,6 +3142,9 @@ export class ClientSession {
         // Reconnect: push the global default model (the picker's ★ marker +
         // "set as global default" button state).
         this.pushDefaultModel();
+        // Reconnect: push agent presets and permission presets (align with DSH).
+        this.refreshAgentPresets();
+        this.refreshPermission();
         // PTYs are conversation-owned and survive a socket reconnect.
         this.pushTerminals();
     }
@@ -2416,6 +3165,34 @@ export class ClientSession {
         for (const sink of [...this.sinks])
             sink(msg);
     }
+    /** 扩展错误上报器：同一会话内「扩展 + 事件 + 错误文本」只提示一次，且全量落服务端日志。
+     *
+     *  SDK 的 `ExtensionRunner.emitContext()` 在**每次 provider 请求**前都会跑一遍
+     *  扩展的 `context` hook，并对每个 handler 的报错回调 `onError`。in-memory 会话
+     *  （子代理 / 无痕会话）取不到会话目录（`SessionManager.inMemory(cwd)` 的
+     *  `getSessionDir()` 返回空串），于是「会话目录依赖型」扩展（如 SoL-Pi 的
+     *  `runtimeRoot()`）每轮都抛同一个错——原样广播就等于按轮数刷屏（issue #298）。
+     *
+     *  `prefix` 给 notice 带上会话归属：用户一眼能看出是后台会话的问题，
+     *  而不是当前对话坏了（与同函数内其它子代理通知的口径一致）。 */
+    makeExtensionErrorReporter(prefix) {
+        const seen = new Set();
+        return (err) => {
+            const message = err?.error ?? String(err);
+            const where = [err?.extensionPath, err?.event].filter(Boolean).join(" · ");
+            console.error(`[extension] ${prefix?.text ?? "当前对话"}${where ? ` (${where})` : ""}: ${message}${err?.stack ? `\n${err.stack}` : ""}`);
+            const key = `${err?.extensionPath ?? ""}|${err?.event ?? ""}|${message}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: prefix ? `${prefix.text}扩展报错：${message}` : message,
+                textEn: prefix ? `${prefix.textEn} Extension error: ${message}` : message,
+            });
+        };
+    }
     /** (Re)attach event plumbing to the ACTIVE conversation's session. */
     async bindSession() {
         const conv = this.conv;
@@ -2424,9 +3201,7 @@ export class ClientSession {
         await conv.session.bindExtensions({
             mode: "rpc",
             uiContext: this.webUi,
-            onError: (err) => {
-                this.emit({ type: "notice", level: "error", text: err.error, textEn: err.error });
-            },
+            onError: this.makeExtensionErrorReporter(),
         });
         conv.unsubscribe = conv.session.subscribe((event) => this.onEvent(conv, event));
         // 新会话 / 切换会话 / 强杀重建的必经之路：刚创建的 runtime 用的是 SDK
@@ -3208,6 +3983,24 @@ export class ClientSession {
                 catch {
                     // sidecar 只是加速 + 防压缩丢失，失败了下次重算
                 }
+                // AI 主动上下文压缩：若本轮调过 compact_context，在回合结算后异步执行压缩
+                if (!event.willRetry && !aborted && conv.pendingCompaction && !this.disposed) {
+                    const pending = conv.pendingCompaction;
+                    conv.pendingCompaction = null;
+                    setTimeout(() => {
+                        if (!this.disposed) {
+                            void this.executePendingCompaction(conv, pending);
+                        }
+                    }, 50);
+                }
+                break;
+            }
+            case "agent_settled": {
+                if (conv.pendingCompaction && !this.disposed) {
+                    const pending = conv.pendingCompaction;
+                    conv.pendingCompaction = null;
+                    void this.executePendingCompaction(conv, pending);
+                }
                 break;
             }
             case "entry_appended": {
@@ -3519,6 +4312,12 @@ export class ClientSession {
             sessionId: this.session.sessionId,
             sessionFile: this.session.sessionFile,
             conversationId: this.activeId,
+            // 临时对话标记（issue #285）：提示条/转正按钮跟当前对话走。
+            // 不能只靠 conversations 列表 —— 空白的临时对话不在运行列表里（shownInRunningList
+            // 只列有内容的），刚新建时列表里查不到它，提示条就永远不出现。
+            // 必须**恒存在**（不能只在 true 时展开）：转正后它由 true→false，而增量快照是
+            // `{...ui, ...d.state}` 浅合并，缺字段会把 true 残留下来。
+            isEphemeral: !!this.conv?.isEphemeral,
             rev,
             streamingMessage,
             isStreaming: this.session.isStreaming,
@@ -3539,6 +4338,19 @@ export class ClientSession {
             retry: conv.retryState ?? null,
             compaction: conv.compactionState ?? null,
             pendingQuestion: this.pendingQuestionForSnapshot(),
+            pendingApproval: this.pendingApprovalForSnapshot(),
+            plan: this.planManager.getPlan(this.activeId),
+            subagentHandoffs: this.subagentHandoffs.length > 0 ? [...this.subagentHandoffs] : undefined,
+            agentPreset: conv
+                ? {
+                    id: conv.agentPreset ?? "standard",
+                    name: PI_AGENT_PRESETS.find((p) => p.id === conv.agentPreset)?.name ?? "全功能",
+                    locked: conv.presetLocked || !this.isBlankConversation(conv),
+                }
+                : null,
+            permission: conv
+                ? (conv.permissionPreset ?? this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never")
+                : null,
             // 未发送草稿只跟全量快照走（切会话/new_chat/get_state）：增量 delta 里
             // 这个 key 必须整个缺席（不能是显式的 undefined——前端 delta 合并是
             // {...ui, ...d.state} 整批覆盖，显式 undefined 会把上次全量带回的草稿洗掉）。
@@ -3715,6 +4527,10 @@ export class ClientSession {
             if (p.conversationId === undefined || p.conversationId === conversationId)
                 return true;
         }
+        for (const a of this.pendingApprovals.values()) {
+            if (a.conversationId === undefined || a.conversationId === conversationId)
+                return true;
+        }
         return false;
     }
     /** 标准引擎的 question_answer 路由入口（index.ts 经 cs.answerQuestion?. 转发）。
@@ -3755,6 +4571,220 @@ export class ClientSession {
             ...(q.conversationTitle ? { conversationTitle: q.conversationTitle } : {}),
         });
     }
+    // -----------------------------------------------------------------------
+    // 人机协同工具审批桥（Tool Approval: Human-in-the-Loop Edit & Run）
+    // -----------------------------------------------------------------------
+    /**
+     * 弹审批（Human-in-the-Loop）。**三档放行门禁在入口**（策略纯函数见
+     * server/tool-approval.ts 的 approvalSuppressionReason）：
+     * - 全局开关关（设置 →「工具」页）→ 直接批准（不弹）；
+     * - 本对话「全部允许」/ 已记住该同类 → 直接批准（不弹）。
+     * 门禁都返回已 resolve 的 Promise，调用方（withToolGuard / 三个权限包装）
+     * 无需关心是否真的弹过窗。
+     */
+    askApproval(toolCallId, toolName, params, reason, reasonEn, conversationId, category) {
+        return new Promise((resolve) => {
+            if (this.disposed) {
+                resolve({ decision: "deny", reason: "会话已关闭" });
+                return;
+            }
+            const id = `appr-${++this.approvalSeq}`;
+            const conv = conversationId ? this.convs.get(conversationId) : this.conv;
+            const suppression = approvalSuppressionReason(conv?.approvalPolicy, this.settingsSvc.current.toolApprovalEnabled !== false, category?.id);
+            if (suppression) {
+                // 放行但不弹窗：不记 pending，不发消息，模型继续跑。
+                resolve({ decision: "approve" });
+                return;
+            }
+            const conversationTitle = conv?.title;
+            const entry = {
+                id,
+                toolCallId,
+                toolName,
+                params: params,
+                reason,
+                reasonEn,
+                ...(category ? { category } : {}),
+                conversationId,
+                conversationTitle,
+                resolve,
+                createdAt: Date.now(),
+            };
+            this.pendingApprovals.set(id, entry);
+            this.emit({
+                type: "tool_approval_pending",
+                id,
+                toolCallId,
+                toolName,
+                params: params,
+                reason,
+                reasonEn,
+                ...(category ? { category } : {}),
+                ...(conversationId !== undefined ? { conversationId } : {}),
+                ...(conversationTitle ? { conversationTitle } : {}),
+            });
+            this.flushSnapshot();
+        });
+    }
+    /**
+     * 审批答复。scope（仅 approve 有效）是「不再问」的两档记忆：
+     * - "category"：记住本对话的该同类档位；
+     * - "all"：本对话后续全部允许。
+     * 记住后，同一对话里**已被覆盖的其它待审批项一并放行**（否则用户点了
+     * 「全部允许」却还有几张弹窗挂着等点），并推一次设置面板（撤销区）。
+     */
+    resolveToolApproval(id, decision, editedParams, reason, scope) {
+        const pending = this.pendingApprovals.get(id);
+        if (!pending)
+            return false;
+        const convId = pending.conversationId ?? this.activeId;
+        const conv = this.convs.get(convId);
+        this.pendingApprovals.delete(id);
+        pending.resolve({ decision, editedParams, reason });
+        this.emit({ type: "tool_approval_resolved", id });
+        if (decision === "approve" && scope && scope !== "once" && conv) {
+            const policy = this.ensureApprovalPolicy(conv);
+            if (scope === "all")
+                policy.allowAll = true;
+            else if (pending.category)
+                policy.categories.set(pending.category.id, pending.category);
+            this.emitApprovalPolicyNotice(scope, pending.category, this.approveCoveredPending(convId, policy));
+            this.settingsSvc.push();
+        }
+        this.flushSnapshot();
+        return true;
+    }
+    /** 取出（或建出）对话的审批策略对象。 */
+    ensureApprovalPolicy(conv) {
+        if (!conv.approvalPolicy)
+            conv.approvalPolicy = { allowAll: false, categories: new Map() };
+        return conv.approvalPolicy;
+    }
+    /** 把某对话里已被策略覆盖的其它待审批项一并放行，返回放行条数。 */
+    approveCoveredPending(convId, policy) {
+        let n = 0;
+        // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+        for (const [oid, o] of [...this.pendingApprovals]) {
+            if ((o.conversationId ?? this.activeId) !== convId)
+                continue;
+            if (!approvalSuppressionReason(policy, true, o.category?.id))
+                continue;
+            this.pendingApprovals.delete(oid);
+            o.resolve({ decision: "approve" });
+            this.emit({ type: "tool_approval_resolved", id: oid });
+            n++;
+        }
+        return n;
+    }
+    /** 记住策略后给用户一句回执（文本双语，前端按 locale 自选）。 */
+    emitApprovalPolicyNotice(scope, category, auto = 0) {
+        const tailZh = auto > 0 ? `，并已自动放行另外 ${auto} 项待审批` : "";
+        const tailEn = auto > 0 ? ` (auto-approved ${auto} other pending request(s))` : "";
+        if (scope === "all") {
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: `本对话已允许全部工具审批，后续高危操作不再询问${tailZh}；可在 设置 →「工具」页撤销。`,
+                textEn: `All tool approvals are now allowed in this conversation${tailEn}; revoke it under Settings → Tools.`,
+            });
+            return;
+        }
+        const label = category?.label ?? "同类";
+        const labelEn = category?.labelEn ?? "this category";
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `本对话已允许「${label}」类操作，后续同类不再询问${tailZh}；可在 设置 →「工具」页撤销。`,
+            textEn: `Allowed "${labelEn}" in this conversation${tailEn}; revoke it under Settings → Tools.`,
+        });
+    }
+    /** 全局审批开关被关掉时：挂着的待审批全部按批准放行（否则弹窗还在等人点）。 */
+    autoApprovePendingApprovals(reasonZh, reasonEn) {
+        if (this.pendingApprovals.size === 0)
+            return;
+        let n = 0;
+        // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+        for (const [oid, o] of [...this.pendingApprovals]) {
+            this.pendingApprovals.delete(oid);
+            o.resolve({ decision: "approve" });
+            this.emit({ type: "tool_approval_resolved", id: oid });
+            n++;
+        }
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `${reasonZh}，已自动放行 ${n} 项待审批。`,
+            textEn: `${reasonEn} — auto-approved ${n} pending request(s).`,
+        });
+        this.flushSnapshot();
+    }
+    /**
+     * 设置面板撤销区用：当前对话的审批策略（allowAll + 已记住的同类档位）。
+     * 只回当前对话——撤销本来就是「在这里关掉这里的东西」，别的对话要撤销
+     * 就切过去（策略跟对话走，见 Conversation.approvalPolicy）。
+     */
+    approvalPolicyState() {
+        const conv = this.convs.get(this.activeId);
+        const policy = conv?.approvalPolicy;
+        return {
+            conversationId: this.activeId,
+            allowAll: policy?.allowAll ?? false,
+            categories: policy ? [...policy.categories.values()] : [],
+        };
+    }
+    /**
+     * 设置某对话的审批策略（设置面板撤销用）。只应用给出的字段：allowAll 直接赋值；
+     * categories 给出时作为保留名单整体替换（空数组 = 清掉全部同类记忆）。
+     */
+    setApprovalPolicy(partial) {
+        const convId = partial.conversationId ?? this.activeId;
+        const conv = this.convs.get(convId);
+        if (!conv)
+            return;
+        const cur = conv.approvalPolicy;
+        const next = {
+            allowAll: partial.allowAll ?? cur?.allowAll ?? false,
+            categories: new Map(cur?.categories ?? []),
+        };
+        if (partial.categories) {
+            const keep = new Set(partial.categories);
+            // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+            for (const key of [...next.categories.keys()])
+                if (!keep.has(key))
+                    next.categories.delete(key);
+        }
+        conv.approvalPolicy = isApprovalPolicyEmpty(next) ? undefined : next;
+        this.settingsSvc.push();
+        this.flushSnapshot();
+    }
+    pendingApprovalForSnapshot() {
+        for (const [id, p] of this.pendingApprovals) {
+            if (p.conversationId !== undefined && p.conversationId !== this.activeId)
+                continue;
+            return {
+                id,
+                toolCallId: p.toolCallId,
+                toolName: p.toolName,
+                params: p.params,
+                reason: p.reason,
+                reasonEn: p.reasonEn,
+                ...(p.category ? { category: p.category } : {}),
+                conversationId: p.conversationId,
+                conversationTitle: p.conversationTitle,
+            };
+        }
+        return null;
+    }
+    updatePlan(steps, activeStepId, conversationId) {
+        const convId = conversationId ?? this.activeId;
+        const plan = this.planManager.setPlan(convId, steps, activeStepId);
+        this.emit({
+            type: "plan_updated",
+            conversationId: convId,
+            plan,
+        });
+        this.flushSnapshot();
+    }
     /** 关闭所有挂起提问（dispose 时清理）：以「取消」解析，避免模型挂死。 */
     cancelPendingQuestions() {
         for (const [, p] of this.pendingQuestions) {
@@ -4090,7 +5120,7 @@ export class ClientSession {
         }
         try {
             const targets = collectTargets(this.agentDir, ClientSession.currentAppVersion(), undefined, {
-                projectCwd: this.conv?.cwd ?? this.cwd,
+                projectCwd: this.convs.get(this.activeId)?.cwd ?? this.cwd,
             });
             const items = sortUpdateItems(await checkAllUpdates(targets, undefined, () => this.getLang(), resolveNpmRegistry(this.agentDir)));
             this.updatesAllCache = { at: Date.now(), items };
@@ -4327,6 +5357,9 @@ export class ClientSession {
     fetchModelsList(reqId, baseUrl, apiKey, authHeader, api) {
         return this.modelAdmin.fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang());
     }
+    testModelConnection(reqId, baseUrl, apiKey, authHeader, api) {
+        return this.modelAdmin.testConnection(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang());
+    }
     refreshProviderModels(providerId, reqId) {
         return this.modelAdmin.refreshProviderModels(providerId, reqId, () => this.getLang());
     }
@@ -4591,6 +5624,11 @@ export class ClientSession {
             markerChanged = true;
         }
         await this.settingsSvc.set(rest);
+        // 审批总开关被关掉 → 挂着的待审批全部按批准放行（否则弹窗还在等人点，
+        // 而用户已经明确表示「不要再问我了」）。
+        if (rest.toolApprovalEnabled === false) {
+            this.autoApprovePendingApprovals("审批已全局关闭", "Tool approval was disabled globally");
+        }
         if (rest.disabledPluginTools !== undefined) {
             this.refreshPluginTools();
             this.flushSnapshot();
@@ -4637,6 +5675,22 @@ export class ClientSession {
     async saveSubagentTemplate(template) {
         return this.settingsSvc.saveTemplate(template);
     }
+    /** 保存一条审批规则（全局共享）。 */
+    async saveApprovalRule(rule) {
+        return this.settingsSvc.saveApprovalRule(rule);
+    }
+    /** 批量保存审批规则（全局共享）。 */
+    async saveApprovalRules(rules) {
+        return this.settingsSvc.saveApprovalRules(rules);
+    }
+    /** 删除一条自定义审批规则。 */
+    async deleteApprovalRule(id) {
+        return this.settingsSvc.deleteApprovalRule(id);
+    }
+    /** 恢复某条内置审批规则到系统默认。 */
+    async resetBuiltinApprovalRule(id) {
+        return this.settingsSvc.resetBuiltinApprovalRule(id);
+    }
     /** 删除一个子代理模板。 */
     async deleteSubagentTemplate(name) {
         return this.settingsSvc.deleteTemplate(name);
@@ -4645,13 +5699,23 @@ export class ClientSession {
     async applyRuntimeSettings() {
         return this.settingsSvc.applyRuntime();
     }
+    /** 按会话对象反查所属对话的预设（创建早期对话还没进 map 时返回 undefined，
+     *  调用方回落默认预设；比按 activeId 猜更准——后台对话的门控不再吃当前页的预设）。 */
+    presetOfSession(session) {
+        for (const c of this.convs.values())
+            if (c.session === session)
+                return c.agentPreset;
+        return undefined;
+    }
     /** 统一工具门控（tool_manage 唯一落点）：按 disabledAgentTools 把目录内工具
      *  逐个加回/剔除活跃集（工具仍留在注册表，重开可直接加回；live 生效无需
-     *  reload）。session.reload() 与新会话创建都会把 custom 工具加回活跃集，
+     *  reload）。支持按当前会话预设（preset）进行工具过滤。
+     *  session.reload() 与新会话创建都会把 custom 工具加回活跃集，
      *  所以这两条路径之后都要重放本方法（见 reloadSession/创建处）。 */
-    applyToolGating(session) {
-        applyAgentToolsGating(session, effectiveDisabledAgentTools(this.settingsSvc.current));
-        this.syncPluginTools(session);
+    applyToolGating(session, preset) {
+        const targetPreset = preset ?? this.presetOfSession(session) ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+        applyAgentToolsGating(session, effectiveDisabledAgentTools(this.settingsSvc.current), targetPreset);
+        this.syncPluginTools(session, targetPreset);
         // SDK 的 setActiveToolsByName 只改 agent.state.tools，不派发任何事件——门控后
         // 主动推一次快照，否则快照里的 tools 要等下一个 SDK 事件才对齐（会话空闲时永远
         // 等不到；回归：tests/terminal-smoke-test.mjs「agent exposes persistent terminal tools」）。
@@ -4660,9 +5724,139 @@ export class ClientSession {
         if (active && active.session === session)
             this.flushSnapshot();
     }
+    /** 判断是否为空白对话（无消息、无队列、未在流式生成）。 */
+    isBlankConversation(c) {
+        try {
+            return (c.session.state.messages.length === 0 &&
+                c.queueSteering.length === 0 &&
+                c.queueFollowUp.length === 0 &&
+                !c.session.isStreaming);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** 推送 Agent 预设名录（UI 预设条用）。 */
+    async refreshAgentPresets() {
+        this.emit({
+            type: "dsh_presets",
+            presets: PI_AGENT_PRESETS,
+            defaultPreset: this.settingsSvc.current.defaultAgentPreset ?? "standard",
+        });
+    }
+    /** 切换当前空白会话的预设。 */
+    async selectAgentPreset(preset) {
+        const conv = this.conv;
+        if (conv.presetLocked || !this.isBlankConversation(conv)) {
+            conv.presetLocked = true;
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `会话已开始，预设锁定为「${PI_AGENT_PRESETS.find((p) => p.id === conv.agentPreset)?.name ?? conv.agentPreset}」（空白会话可切换）`,
+                textEn: `Session already started; preset locked to "${conv.agentPreset}" (only blank sessions can switch)`,
+            });
+            this.flushSnapshot();
+            return;
+        }
+        const hit = PI_AGENT_PRESETS.find((p) => p.id === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知预设「${preset}」`,
+                textEn: `Unknown preset "${preset}"`,
+            });
+            return;
+        }
+        conv.agentPreset = hit.id;
+        this.applyToolGating(conv.session, hit.id);
+        // 技能名录段/终端引导是按 run 组装的提示词：重载 resourceLoader 让新预设
+        // 即时生效（只有空白会话能切到这里，无历史可丢）。
+        try {
+            await conv.session.resourceLoader.reload();
+        }
+        catch {
+            // loader 未就绪——首轮 run 组装时自然读到新预设。
+        }
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `已切换为「${hit.name}」预设`,
+            textEn: `Switched to preset "${hit.name}"`,
+        });
+        this.flushSnapshot();
+    }
+    /** 设置新会话默认预设。 */
+    async setDefaultAgentPreset(preset) {
+        const hit = PI_AGENT_PRESETS.find((p) => p.id === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知预设「${preset}」，默认预设未改`,
+                textEn: `Unknown preset "${preset}"; default preset unchanged`,
+            });
+            return;
+        }
+        this.settingsSvc.current.defaultAgentPreset = hit.id;
+        this.stateStore.saveSettings(this.clientId, { defaultAgentPreset: hit.id });
+        this.pushSettings();
+        this.refreshAgentPresets();
+        this.flushSnapshot();
+    }
+    /** 推送权限选项表 + 默认权限。 */
+    async refreshPermission() {
+        this.emit({
+            type: "dsh_permission",
+            options: PI_PERMISSION_OPTIONS,
+            defaultPreset: this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never",
+        });
+    }
+    /** 切换当前会话的权限预设（热生效）。 */
+    async setPermissionPreset(preset) {
+        const hit = PI_PERMISSION_OPTIONS.find((p) => p.value === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知权限预设「${preset}」`,
+                textEn: `Unknown permission preset "${preset}"`,
+            });
+            return;
+        }
+        this.conv.permissionPreset = hit.value;
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `当前会话权限已切换为「${hit.name}」`,
+            textEn: `Current session permission switched to "${hit.name}"`,
+        });
+        this.flushSnapshot();
+    }
+    /** 设置新会话默认权限预设。 */
+    async setDefaultPermissionPreset(preset) {
+        const hit = PI_PERMISSION_OPTIONS.find((p) => p.value === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知权限预设「${preset}」，默认未改`,
+                textEn: `Unknown permission preset "${preset}"; default unchanged`,
+            });
+            return;
+        }
+        this.settingsSvc.current.defaultPermissionPreset = hit.value;
+        this.stateStore.saveSettings(this.clientId, { defaultPermissionPreset: hit.value });
+        this.refreshPermission();
+        this.flushSnapshot();
+    }
     /** 当前启用的插件 AI 工具定义（provider 快照按 disabledPluginTools 过滤；
-     *  未知/已卸载插件的禁用条目保留但不影响现有工具）。 */
-    enabledPluginToolDefs() {
+     *  未知/已卸载插件的禁用条目保留但不影响现有工具）。
+     *  预设是第二层门控（见 tool-manager.ts 语义总表）：非 standard 预设下插件工具
+     *  一律不可用（读写未知，保守处理），此时返回空表，调用方负责从会话移除。 */
+    enabledPluginToolDefs(preset) {
+        if (!presetAllowsPluginTools(preset))
+            return [];
         const off = new Set(normalizeDisabledPluginTools(this.settingsSvc.current.disabledPluginTools));
         return (this.pluginToolsProvider?.() ?? []).filter((t) => !off.has(t.name)).map(pluginToolToDefinition);
     }
@@ -4670,14 +5864,24 @@ export class ClientSession {
      *  实际 diff 逻辑在 plugins.ts 的 syncPluginToolsIntoSession（可单测）。
      *  模板白名单的子代理（subagentBarsPluginTools）跳过：工厂期就没注册，这里
      *  不回补，否则白名单等于没关门。 */
-    syncPluginTools(session) {
+    syncPluginTools(session, preset) {
+        let targetPreset = preset;
         for (const conv of this.convs.values()) {
-            if (conv.session === session && conv.subagentBarsPluginTools)
+            if (conv.session !== session)
+                continue;
+            if (conv.subagentBarsPluginTools)
                 return;
+            targetPreset ??= conv.agentPreset;
         }
         try {
-            const defs = this.enabledPluginToolDefs();
-            const next = syncPluginToolsIntoSession(session, defs, this.appliedPluginToolNames);
+            const defs = this.enabledPluginToolDefs(targetPreset);
+            // 移除口径 = 已同步过的 ∪ 全量插件宇宙：创建时工厂直接注册进
+            // _customTools 的工具不在 applied 表里，首轮同步（defs 为空时）否则删不掉。
+            const universe = new Set([
+                ...this.appliedPluginToolNames,
+                ...(this.pluginToolsProvider?.() ?? []).map((t) => t.name),
+            ]);
+            const next = syncPluginToolsIntoSession(session, defs, universe);
             if (next)
                 this.appliedPluginToolNames = new Set(next);
         }
@@ -4935,6 +6139,8 @@ export class ClientSession {
         // switch/new_chat while prompt() is in flight must never target a
         // different conversation.
         const conv = this.conv;
+        const promptAc = new AbortController();
+        conv.activePromptAc = promptAc;
         // 输入框内容被消费（发送/斜杠执行）→ 清掉该会话存过的草稿（best-effort）。
         // 快捷短语发送（不碰输入框）同样清：客户端发送成功后会把当前草稿重存回来。
         // clear() 同时记录 clear 时间戳水位：清掉之后才 landing 的旧 draft_update
@@ -4960,6 +6166,89 @@ export class ClientSession {
             // is refused until admission reopens.
             if (this.quiesceBlocked())
                 return;
+            // 首轮用户发言后锁定当前会话的预设（对齐 DSH 预设语义）
+            conv.presetLocked = true;
+            // #280：悬空 toolCall 守卫——转录尾是「有调用、无结果」时直接 prompt
+            // 会把非法链喂给 provider（有发起迹象但零落盘、零报错的黑洞）。
+            // 非流式时先补合成结果再继续；补不上则响亮拒绝。
+            if (conv.transcriptBlocked && !s.isStreaming) {
+                this.emit({
+                    type: "notice",
+                    level: "error",
+                    text: `发送已拒绝：该对话的记录尾是一个没有结果的工具调用（上次运行被强制终止），且自动修复失败。请从历史记录重新打开该对话，或新建对话后重试。`,
+                    textEn: `Prompt refused: this transcript ends with a tool call that never got a result (last run was force-terminated) and auto-repair failed. Reopen it from history or start a new conversation.`,
+                });
+                this.flushSnapshot();
+                return;
+            }
+            if (!s.isStreaming) {
+                try {
+                    const live = s.agent.state.messages;
+                    const dangling = Array.isArray(live) ? findDanglingToolCalls(live) : [];
+                    if (dangling.length > 0) {
+                        let healed = 0;
+                        try {
+                            const sm = s.sessionManager;
+                            if (typeof sm?.appendMessage === "function") {
+                                for (const d of dangling) {
+                                    sm.appendMessage({
+                                        role: "toolResult",
+                                        toolCallId: d.toolCallId,
+                                        toolName: d.toolName,
+                                        content: [
+                                            {
+                                                type: "text",
+                                                text: `${DANGLING_TOOL_RESULT_TEXT}\n${DANGLING_TOOL_RESULT_TEXT_EN}`,
+                                            },
+                                        ],
+                                        isError: true,
+                                        timestamp: Date.now(),
+                                    });
+                                    healed += 1;
+                                }
+                            }
+                        }
+                        catch {
+                            // 落盘失败走下面的拒绝分支。
+                        }
+                        if (healed === dangling.length && healed > 0) {
+                            conv.transcriptBlocked = false;
+                            try {
+                                await s.reload();
+                                this.applyRetryOverrides();
+                                this.applyCompactionOverrides();
+                                this.applyToolGating(s, conv.agentPreset);
+                            }
+                            catch {
+                                // reload 失败兜底
+                            }
+                            this.emit({
+                                type: "notice",
+                                level: "warning",
+                                text: `检测到上次运行残留的 ${dangling.length} 个无结果工具调用，已自动填入合成结果后继续。如任务未完成请重新执行该工具。`,
+                                textEn: `Found ${dangling.length} tool call(s) without results from the last run; synthetic results were inserted automatically before continuing. Re-run the tool if the task is incomplete.`,
+                            });
+                        }
+                        else {
+                            conv.transcriptBlocked = true;
+                            this.emit({
+                                type: "notice",
+                                level: "error",
+                                text: `发送已拒绝：该对话的记录尾是一个没有结果的工具调用（上次运行被强制终止），且自动修复失败。请从历史记录重新打开该对话，或新建对话后重试。`,
+                                textEn: `Prompt refused: this transcript ends with a tool call that never got a result (last run was force-terminated) and auto-repair failed. Reopen it from history or start a new conversation.`,
+                            });
+                            this.flushSnapshot();
+                            return;
+                        }
+                    }
+                    else {
+                        conv.transcriptBlocked = false;
+                    }
+                }
+                catch {
+                    // 守卫本身绝不挡发送：查不到就按原路径走。
+                }
+            }
             // issue #145：发之前再查一次同文件持有者 —— 拦住「打开时空闲、发送时在跑」的竞态。
             // 没有第二个 writer，就不可能有看不见的第二个 agent。
             const activeFile = this.activeSessionFileResolved();
@@ -5075,16 +6364,23 @@ export class ClientSession {
                         .filter((r) => r.hits.length > 0);
                     const extNoteEn = externalRunners.length > 0 ? ` Touched files of external run(s) are unknown.` : "";
                     const extNoteZh = externalRunners.length > 0 ? `外部运行的文件触碰未知。` : "";
+                    // 预设拿掉问卷工具时（minimal/code/ask），提醒文案不点不存在的工具名，
+                    // 改走正文提问（见 tool-manager.ts 语义总表；认领信息本身照常有用）。
+                    const canAsk = presetHasQuestionnaire(conv.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard");
+                    const askClauseEn = canAsk
+                        ? "use ask_user_question when unsure "
+                        : "ask the user in your reply text when unsure ";
+                    const askClauseZh = canAsk ? "拿不准就用 ask_user_question 让用户选择：" : "拿不准就在回复正文里直接问用户：";
                     let aiReminder;
                     if (clashes.length === 0 && myClaimed.length === 0) {
                         aiReminder =
                             `(System reminder: ${aiItems.length} other run(s) [${aiItems.join("; ")}] ` +
                                 `are currently running in the same project directory. No file written by both you and them was detected, ` +
                                 `so working on different files in parallel is fine; before writing the same files or running project-wide ` +
-                                `commands, assess the conflict risk first, and use ask_user_question when unsure ` +
+                                `commands, assess the conflict risk first, and ${askClauseEn}` +
                                 `(continue in parallel / wait / watch read-only).${extNoteEn}${claimsSummaryEn})\n` +
                                 `（系统提醒：同一项目另有 ${aiItems.length} 处运行（${shown}${more}）。未发现双方都写过的文件，` +
-                                `改不同文件可并行；动同一文件或跑全局命令前先评估冲突，拿不准就用 ask_user_question 让用户选择：` +
+                                `改不同文件可并行；动同一文件或跑全局命令前先评估冲突，${askClauseZh}` +
                                 `并行 / 等它跑完 / 只读围观。${extNoteZh}${claimsSummaryZh}）`;
                     }
                     else {
@@ -5102,10 +6398,10 @@ export class ClientSession {
                         aiReminder =
                             `(System reminder: ${aiItems.length} other run(s) [${aiItems.join("; ")}] ` +
                                 `are currently running in the same project directory. ⚠ ${clashEn} — re-read these files before ` +
-                                `touching them again, and use ask_user_question when unsure ` +
+                                `touching them again, and ${askClauseEn}` +
                                 `(continue in parallel / wait / watch read-only).${extNoteEn})\n` +
                                 `（系统提醒：同一项目另有 ${aiItems.length} 处运行（${shown}${more}）。` +
-                                `${clashZh} —— 再动这些文件前先读最新内容，拿不准就用 ask_user_question 让用户选择：` +
+                                `${clashZh} —— 再动这些文件前先读最新内容，${askClauseZh}` +
                                 `并行 / 等它跑完 / 只读围观。${extNoteZh}）`;
                     }
                     try {
@@ -5157,9 +6453,35 @@ export class ClientSession {
                 // issue #91：附件/视觉桥文案按客户端 UI 语言出中英（英文默认）。
                 getLang: () => this.getLang(),
             }, attachments);
+            if (promptAc.signal.aborted) {
+                conv.activePromptAc = undefined;
+                return;
+            }
             for (const aside of asides) {
-                await s.sendCustomMessage(aside.message, { deliverAs: "nextTurn" });
+                if (s.isStreaming) {
+                    await s.sendCustomMessage(aside.message, { deliverAs: "nextTurn" });
+                }
+                else {
+                    await s.sendCustomMessage(aside.message);
+                }
+            }
+            // 附件处理完毕后立即刷新快照，让引用的文件卡片在等待模型首字前瞬间出现在界面上
+            if (asides.length > 0) {
+                this.flushSnapshot();
             }
+            // 创建工作区版本影子快照（Dual-State Rollback）
+            let snapshotRef = null;
+            try {
+                snapshotRef = await createWorkspaceSnapshot(conv.cwd);
+            }
+            catch {
+                // best-effort
+            }
+            if (promptAc.signal.aborted) {
+                conv.activePromptAc = undefined;
+                return;
+            }
+            conv.activePromptAc = undefined;
             if (s.isStreaming) {
                 // queue=true (补充 button) → followUp: the message is delivered only
                 // after the whole run finishes — the agent finishes what it started,
@@ -5178,8 +6500,29 @@ export class ClientSession {
             else {
                 await s.prompt(text);
             }
+            // 关联快照与本次 prompt 产生的用户消息 entry
+            if (snapshotRef) {
+                try {
+                    const entries = conv.session.sessionManager.buildContextEntries();
+                    const lastUserEntry = [...entries]
+                        .reverse()
+                        .find((e) => e.type === "message" && e.message?.role === "user");
+                    conv.workspaceSnapshots.push({
+                        entryId: lastUserEntry?.id,
+                        timestamp: Date.now(),
+                        snapshotRef,
+                    });
+                    if (conv.workspaceSnapshots.length > 50) {
+                        conv.workspaceSnapshots.shift();
+                    }
+                }
+                catch {
+                    // best-effort
+                }
+            }
         }
         catch (err) {
+            conv.activePromptAc = undefined;
             this.emit({
                 type: "notice",
                 level: "error",
@@ -5201,15 +6544,12 @@ export class ClientSession {
     /**
      * Turn attached files into custom-message payloads.
      *
-     * Text files are size-aware: small files are inlined into the message so the
-     * model sees them immediately; large files are passed as a <file path="...">
-     * reference and the model reads them on demand with its read tool (which has
-     * built-in truncation). Images are always passed as image content. Mode
-     * "lines" inlines only a 1-based inclusive line range of the file. Raw
-     * pasted/dropped/uploaded images (attachment.imageData) skip the workspace
-     * path entirely and go straight to the model as image content. Raw uploaded
-     * files (attachment.fileData) are persisted under <dataDir>/uploads/ and
-     * attached as absolute-path references (small text ones are inlined).
+     * 一律只给路径引用：文本文件（无论大小）都只发 `<file path="..." />`，模型用
+     * 自己的 read 工具按需读（自带截断/分页）——文件内容永不进 prompt。行范围模式
+     * （mode "lines"）在引用上带 lines 属性，告诉模型用户选的是哪几行。
+     * 图片始终作为 image 内容发送。粘贴/拖入/上传的原始图片（attachment.imageData）
+     * 不走工作区路径，直接进模型；上传文件（attachment.fileData）落在
+     * <dataDir>/uploads/ 下，以绝对路径引用。
      */
     /**
      * Hard-abort the running agent (Stop button / global 中断). Tries
@@ -5220,6 +6560,15 @@ export class ClientSession {
      * overnight. The notice fires only on the forced-reset path.
      */
     async abort() {
+        if (this.conv.activePromptAc) {
+            this.conv.activePromptAc.abort();
+            this.conv.activePromptAc = undefined;
+        }
+        const isRunning = this.conversationStreaming(this.conv) || !this.conv.session.isIdle;
+        if (!isRunning) {
+            this.flushSnapshot();
+            return;
+        }
         // 只停止智能体运行本身；AI 在后台启动的服务由「后台任务」面板单独
         // 管理（可逐个停止或全部关闭），不会在停止对话时被连带杀掉。
         await this.interruptRun(this.conv, "已停止");
@@ -5476,6 +6825,9 @@ export class ClientSession {
     }
     /** Interrupt a run: abort, with a force-reset fallback on timeout. */
     async interruptRun(conv, reason) {
+        if (!this.conversationStreaming(conv) && conv.session.isIdle) {
+            return;
+        }
         // The run is only truly stopped when its agent_end event arrives:
         // session.abort() can return without stopping anything when the run is
         // stuck before the agent even started (e.g. a model stream that never
@@ -5513,14 +6865,14 @@ export class ClientSession {
                 textEn: `Abort failed: ${err.message}`,
             });
         }
-        // 3) abort returned but no agent_end within the settle window → the
-        //    run was stuck before it started; force-reset to recover.
-        if (!ended) {
+        // 3) abort returned but no agent_end within the settle window:
+        //    仅在 session 依然处于非 idle 状态（即真正卡住）时才等待并强制重置
+        if (!ended && !conv.session.isIdle) {
             await new Promise((r) => setTimeout(r, ClientSession.HARD_ABORT_SETTLE_MS));
         }
         clearTimeout(abortTimer);
         off();
-        if (!ended)
+        if (!ended && !conv.session.isIdle)
             force();
     }
     /** Force-reset a conversation: dispose the stuck runtime (kills the hung
@@ -5528,18 +6880,44 @@ export class ClientSession {
      *  persisted session. The conversation record itself is kept (same id,
      *  same cwd, same serialization caches), so the UI stays attached. */
     async forceResetConversation(conv, reason) {
+        // #280：先记下本次对话自己的会话文件——重建必须回到同一个文件，
+        // 不能用 continueRecent(cwd) 按 mtime 取「最近」（同 cwd 多会话时会接错文件）。
+        const ownFile = (() => {
+            try {
+                const f = conv.session.sessionFile;
+                return typeof f === "string" && f ? f : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
         try {
             conv.unsubscribe?.();
             conv.unsubscribe = undefined;
             this.clearAllToolWatchdogs(conv);
             conv.toolStartTimes.clear();
+            disposeEvalSession(conv.id);
             await conv.runtime.dispose();
+            // #280：dispose 丢弃了内存里的在飞状态（未落盘的工具结果蒸发），
+            // 文件尾可能留下一个悬空 toolCall——先补合成 toolResult 再重建，
+            // 否则重建后的 prompt 会把非法转录链喂给 provider（零落盘黑洞）。
+            let healedCount = 0;
+            if (ownFile && existsSync(ownFile)) {
+                try {
+                    const n = healDanglingToolCallFile(ownFile);
+                    if (n > 0)
+                        healedCount = n;
+                }
+                catch {
+                    // best-effort：修不好就按原路径重建，下面的守卫会在 prompt 前再拦。
+                }
+            }
             // #235：转录链损坏时修一次再试（见 openManagerAndRuntime）。
-            const opened = await this.openManagerAndRuntime(() => SessionManager.continueRecent(conv.cwd), (m) => createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, undefined, conv.id), {
+            const opened = await this.openManagerAndRuntime(() => (ownFile && existsSync(ownFile) ? SessionManager.open(ownFile) : SessionManager.continueRecent(conv.cwd)), (m) => createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, undefined, conv.id), {
                 cwd: conv.cwd,
                 agentDir: this.agentDir,
                 sessionManager: m,
-            }), async () => (await SessionManager.list(conv.cwd))[0]?.path);
+            }), async () => (ownFile && existsSync(ownFile) ? ownFile : (await SessionManager.list(conv.cwd))[0]?.path));
             const runtime = opened.runtime;
             if (opened.repair) {
                 for (const n of this.transcriptRepairNotices(opened.repair))
@@ -5547,6 +6925,27 @@ export class ClientSession {
             }
             conv.runtime = runtime;
             conv.session = runtime.session;
+            if (healedCount > 0) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `上次运行被强制终止，${healedCount} 个无结果的工具调用已自动填入合成结果（转录链已修复）。建议检查任务状态，必要时重新执行该工具。`,
+                    textEn: `The last run was force-terminated; ${healedCount} tool call(s) without results were filled with synthetic results (transcript healed). Verify task state and re-run the tool if needed.`,
+                });
+            }
+            // #280：重建后复查——新 runtime 仍以悬空 toolCall 开头说明修复没落盘
+            // （文件被删/只读等），此时响亮拒绝后续 prompt 而不是静默黑洞。
+            try {
+                const msgs = conv.session.agent.state.messages;
+                const still = Array.isArray(msgs) ? findDanglingToolCalls(msgs) : [];
+                if (still.length > 0)
+                    conv.transcriptBlocked = true;
+                else
+                    conv.transcriptBlocked = false;
+            }
+            catch {
+                // ignore：守卫是兜底，查不到就让 prompt 路径再查。
+            }
             this.emit({
                 type: "notice",
                 level: "warning",
@@ -5570,8 +6969,7 @@ export class ClientSession {
      *  空白新对话」——/new <prompt> 只在 true 时投递首条提示；false 表示没能进入
      *  新对话（准入关闭 / 同项目对话数达上限 / runtime 创建失败），此时照发会把
      *  首条提示投进用户原本正在用的那个对话里。 */
-    async newChat(_preset) {
-        // _preset: DSH Agent 预设（pi 引擎无此概念，忽略；wire 统一见 protocol new_chat）。
+    async newChat(_preset, ephemeral) {
         if (this.quiesceBlocked())
             return false;
         // Reuse an already-open blank conversation instead of piling up new ones
@@ -5589,31 +6987,41 @@ export class ClientSession {
             }
         };
         const active = this.conv;
-        if (active && isBlank(active)) {
-            this.flushSnapshot();
+        if (!ephemeral && active && isBlank(active)) {
+            if (_preset)
+                await this.selectAgentPreset(_preset);
+            else
+                this.flushSnapshot();
             return true;
         }
-        for (const conv of this.convs.values()) {
-            if (conv.id === this.activeId)
-                continue;
-            if (isBlank(conv)) {
-                await this.switchConversation(conv.id);
-                this.flushSnapshot();
-                return true;
+        if (!ephemeral) {
+            for (const conv of this.convs.values()) {
+                if (conv.id === this.activeId)
+                    continue;
+                if (isBlank(conv)) {
+                    await this.switchConversation(conv.id);
+                    if (_preset)
+                        await this.selectAgentPreset(_preset);
+                    else
+                        this.flushSnapshot();
+                    return true;
+                }
             }
         }
         // Cap is per project — conversations of other projects keep their own
         // lists and don't consume this project's slots. Subagents don't count
-        // (inMemory 后台任务，不占位）。
-        const openInProject = [...this.convs.values()].filter((c) => c.cwd === this.cwd && !c.isSubagent).length;
-        if (openInProject >= MAX_OPEN_CONVERSATIONS) {
-            this.emit({
-                type: "notice",
-                level: "warning",
-                text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
-                textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
-            });
-            return false;
+        // (inMemory 后台任务，不占位）。临时会话也不占名额。
+        if (!ephemeral) {
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === this.cwd && !c.isSubagent && !c.isEphemeral).length;
+            if (openInProject >= MAX_OPEN_CONVERSATIONS) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
+                    textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
+                });
+                return false;
+            }
         }
         // The outgoing conversation is left behind — apply the running-list
         // lifecycle. Removal is deferred until the new chat exists so the active
@@ -5630,11 +7038,32 @@ export class ClientSession {
             const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined), {
                 cwd: this.cwd,
                 agentDir: this.agentDir,
-                sessionManager: SessionManager.create(this.cwd),
+                sessionManager: ephemeral ? SessionManager.inMemory(this.cwd) : SessionManager.create(this.cwd),
             });
             const conv = this.makeConversation(runtime, conversationId, terminals);
+            if (ephemeral)
+                conv.isEphemeral = true;
+            if (_preset) {
+                const hit = PI_AGENT_PRESETS.find((p) => p.id === _preset);
+                if (hit)
+                    conv.agentPreset = hit.id;
+            }
+            // 创建即按归属预设门控：工厂内只能按 active/默认兜底（conv 还没进 map），
+            // 默认预设非 standard 时那个结果是错的，这里用 conv 自身预设显式重放一次。
+            // conv 尚未进 map，preset 必须显式传，插件同步才能正确剥离。
+            this.applyToolGating(conv.session, conv.agentPreset);
             this.convs.set(conv.id, conv);
             this.activeId = conv.id;
+            if (_preset && conv.agentPreset !== (this.settingsSvc.current.defaultAgentPreset ?? "standard")) {
+                // 显式预设与默认不一致：工厂组装提示词时用的是默认视图，重载一次对齐
+                // （技能名录/终端引导；此时 conv 已进 map，override 能读到归属预设）。
+                try {
+                    await conv.session.resourceLoader.reload();
+                }
+                catch {
+                    // loader 未就绪——首轮 run 组装时自然对齐。
+                }
+            }
             if (displaced)
                 this.removeConversation(displaced.id);
             await this.bindSession();
@@ -5848,6 +7277,7 @@ export class ClientSession {
     /**
      * #235：已知路径先修后开（openConversation 走这条——单文件预扫描零负担）。
      * 返回 null = 文件健康或无需处理；返回 repair = 修过，调用方弹提示。
+     * #280：顺带修悬空 toolCall（强制重置/崩溃残留的有调用无结果），修过同样弹提示。
      */
     repairTranscriptFileBeforeOpen(filePath) {
         let repair = null;
@@ -5857,8 +7287,27 @@ export class ClientSession {
         catch {
             return null;
         }
-        if (!repair?.changed)
+        if (!repair?.changed) {
+            // #280：压缩链健康时仍要查悬空 toolCall（崩溃/强制重置残留）。
+            let healed = 0;
+            try {
+                const n = healDanglingToolCallFile(filePath);
+                if (n > 0)
+                    healed = n;
+            }
+            catch {
+                // best-effort
+            }
+            if (healed <= 0)
+                return null;
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `该对话上次运行残留 ${healed} 个无结果的工具调用，已自动填入合成结果。如任务未完成请重新执行该工具。`,
+                textEn: `${healed} tool call(s) without results from the last run were filled with synthetic results. Re-run the tool if the task is incomplete.`,
+            });
             return null;
+        }
         for (const n of this.transcriptRepairNotices(repair))
             this.emit(n);
         return repair;
@@ -5950,9 +7399,19 @@ export class ClientSession {
         }
         this.convs.delete(id);
         this.clearAllToolWatchdogs(conv);
+        // 关对话 → 连它的 eval 内核（Python/Node 子进程 + 临时沙箱目录）一起回收：
+        // 这些进程是 detached 进程组，父进程退出不会自动带走它们。
+        disposeEvalSession(id);
         conv.terminals.killAll();
         conv.unsubscribe?.();
         conv.unsubscribe = undefined;
+        if (conv.isSubagent) {
+            const ephemeralDir = join(this.agentDir, "subagent-sessions", conv.id);
+            try {
+                rmSync(ephemeralDir, { recursive: true, force: true });
+            }
+            catch { }
+        }
         void conv.runtime.dispose().catch(() => { });
     }
     /** 本会话是否持有这个 SDK 会话对应的对话；命中则给出它的**当前** id
@@ -6228,6 +7687,7 @@ export class ClientSession {
                 messageCount,
                 isStreaming,
                 isSubagent: !!conv.isSubagent,
+                ...(conv.isEphemeral ? { isEphemeral: true } : {}),
                 // 落盘会话才有文件（inMemory 子代理缺省）：右键复制路径 / AI 按 path 读历史时用。
                 ...(() => {
                     try {
@@ -6246,6 +7706,7 @@ export class ClientSession {
                     return pq ? { hasQuestion: true, questionId: pq.id, questionTitle: pq.title } : {};
                 })(),
                 parentId: conv.parentId,
+                ...(conv.forkFrom ? { forkFrom: conv.forkFrom } : {}),
             });
         }
         // issue #145：流式集合签名变化 → 通知其他客户端重推（左栏「另一处正在运行」近实时）。
@@ -6584,8 +8045,8 @@ export class ClientSession {
         });
     }
     /**
-     * 将内存子代理（inMemory）固化为普通持久化对话：
-     * 写入磁盘 .jsonl 会话文件，清除 isSubagent 标记，使它进入历史会话列表并长久保留。
+     * 将内存会话（inMemory 子代理 / 临时对话）固化为普通持久化对话：
+     * 写入磁盘 .jsonl 会话文件，清除 isSubagent / isEphemeral 标记，使它进入历史会话列表并长久保留。
      */
     async persistConversation(id) {
         const conv = this.convs.get(id);
@@ -6599,7 +8060,7 @@ export class ClientSession {
             return;
         }
         const sm = conv.session.sessionManager;
-        if (!conv.isSubagent && sm?.isPersisted?.()) {
+        if (!conv.isSubagent && !conv.isEphemeral && sm?.isPersisted?.()) {
             this.emit({
                 type: "notice",
                 level: "info",
@@ -6608,6 +8069,8 @@ export class ClientSession {
             });
             return;
         }
+        // 固化对象是临时对话时文案换一套（用户看到的是「临时对话」而非「子代理」）。
+        const wasEphemeral = !!conv.isEphemeral;
         try {
             const cwd = conv.cwd || this.cwd;
             const sampleSm = SessionManager.create(cwd);
@@ -6641,14 +8104,19 @@ export class ClientSession {
                 sm.flushed = true;
             }
             conv.isSubagent = false;
+            conv.isEphemeral = false;
             this.emitConversations();
             await this.pushProjects();
             this.flushSnapshot();
             this.emit({
                 type: "notice",
                 level: "info",
-                text: `已将子代理「${conv.title}」固化为普通对话，并保存至历史记录`,
-                textEn: `Solidified subagent "${conv.title}" into a regular conversation saved to history`,
+                text: wasEphemeral
+                    ? `已将临时对话「${conv.title}」保存为正式对话，并存入历史记录`
+                    : `已将子代理「${conv.title}」固化为普通对话，并保存至历史记录`,
+                textEn: wasEphemeral
+                    ? `Saved ephemeral conversation "${conv.title}" as a regular conversation in history`
+                    : `Solidified subagent "${conv.title}" into a regular conversation saved to history`,
             });
         }
         catch (err) {
@@ -6656,8 +8124,8 @@ export class ClientSession {
             this.emit({
                 type: "notice",
                 level: "error",
-                text: `固化子代理失败：${msg}`,
-                textEn: `Failed to persist subagent: ${msg}`,
+                text: `固化失败：${msg}`,
+                textEn: `Failed to persist conversation: ${msg}`,
             });
         }
     }
@@ -7208,6 +8676,288 @@ export class ClientSession {
         }
         return null;
     }
+    /**
+     * Map any rendered message id (u-*, a-*, t-*, b-*, c-*, or raw entry id)
+     * back to its append-only session entry in the given conversation.
+     */
+    resolveMessageEntry(conv, messageId) {
+        const userSeqByTs = new Map();
+        const assistantSeqByTs = new Map();
+        let globalSeq = 0;
+        const entries = conv.session.sessionManager.buildContextEntries();
+        for (const entry of entries) {
+            globalSeq += 1;
+            if (entry.id === messageId)
+                return entry;
+            if (entry.type === "message") {
+                const m = entry.message;
+                if (!m)
+                    continue;
+                let uiId = "";
+                if (m.role === "user") {
+                    const ts = m.timestamp ?? 0;
+                    const seq = (userSeqByTs.get(ts) ?? 0) + 1;
+                    userSeqByTs.set(ts, seq);
+                    uiId = `u-${ts}-${seq}`;
+                }
+                else if (m.role === "assistant") {
+                    const ts = m.timestamp ?? 0;
+                    const seq = (assistantSeqByTs.get(ts) ?? 0) + 1;
+                    assistantSeqByTs.set(ts, seq);
+                    uiId = `a-${ts}-${seq}`;
+                }
+                else if (m.role === "toolResult") {
+                    uiId = `t-${m.toolCallId}`;
+                }
+                else if (m.role === "bashExecution") {
+                    uiId = `b-${m.timestamp}-${globalSeq}`;
+                }
+                if (uiId === messageId)
+                    return entry;
+            }
+            else if (entry.type === "custom_message") {
+                const ts = entry.timestamp ? new Date(entry.timestamp).getTime() : 0;
+                const uiId = `c-${ts}-${globalSeq}`;
+                if (uiId === messageId)
+                    return entry;
+            }
+        }
+        // 兜底：getEntry 查整棵树
+        return conv.session.sessionManager.getEntry(messageId) ?? null;
+    }
+    /**
+     * Fork a NEW branch conversation from a specific historical message position.
+     * Truncates the transcript before (or at) that message as the context of the
+     * new conversation, allowing the user to explore alternative lines of thought
+     * without affecting the original conversation.
+     */
+    async forkSession(messageId, position = "before", targetConvId) {
+        if (this.quiesceBlocked())
+            return;
+        const targetConv = (targetConvId ? this.convs.get(targetConvId) : this.conv) ?? this.conv;
+        const entry = this.resolveMessageEntry(targetConv, messageId);
+        if (!entry) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: "找不到指定的消息节点（可能已被压缩或不在当前分支）",
+                textEn: "Message node to fork from not found (may have been compacted or is on another branch)",
+            });
+            this.flushSnapshot();
+            return;
+        }
+        const targetLeafId = position === "at" ? entry.id : entry.parentId;
+        try {
+            const currentSessionFile = targetConv.session.sessionFile;
+            const isPersisted = targetConv.session.sessionManager.isPersisted() && currentSessionFile && existsSync(currentSessionFile);
+            const prevModel = targetConv.session.agent.state.model ?? null;
+            const prevThinking = targetConv.session.thinkingLevel ?? null;
+            const conversationId = this.nextConversationId();
+            const terminals = this.makeTerminalManager(conversationId, targetConv.cwd);
+            let forkedManager;
+            if (isPersisted) {
+                const sessionDir = targetConv.session.sessionManager.getSessionDir();
+                let forkedSessionPath;
+                if (!targetLeafId) {
+                    const sm = SessionManager.create(targetConv.cwd, sessionDir);
+                    sm.newSession({ parentSession: currentSessionFile });
+                    forkedSessionPath = sm.getSessionFile();
+                }
+                else {
+                    const sm = SessionManager.open(currentSessionFile, sessionDir);
+                    forkedSessionPath = sm.createBranchedSession(targetLeafId);
+                }
+                if (!forkedSessionPath) {
+                    throw new Error("Failed to create forked session file");
+                }
+                forkedManager = SessionManager.open(forkedSessionPath, sessionDir);
+            }
+            else {
+                forkedManager = SessionManager.create(targetConv.cwd);
+                if (targetLeafId) {
+                    const branch = targetConv.session.sessionManager.getBranch(targetLeafId);
+                    for (const e of branch) {
+                        if (e.type === "message") {
+                            try {
+                                forkedManager.appendMessage(e.message);
+                            }
+                            catch {
+                                // skip malformed/unsupported message entries in memory mode
+                            }
+                        }
+                    }
+                }
+            }
+            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined), {
+                cwd: targetConv.cwd,
+                agentDir: this.agentDir,
+                sessionManager: forkedManager,
+            });
+            const newConv = this.makeConversation(runtime, conversationId, terminals);
+            if (targetConv.agentPreset)
+                newConv.agentPreset = targetConv.agentPreset;
+            if (targetConv.permissionPreset)
+                newConv.permissionPreset = targetConv.permissionPreset;
+            newConv.forkFrom = {
+                conversationId: targetConv.id,
+                messageId,
+                title: targetConv.title,
+            };
+            this.convs.set(conversationId, newConv);
+            this.activeId = conversationId;
+            await this.bindSession();
+            if (prevModel && this.sharedModelRuntime) {
+                try {
+                    const pm = prevModel;
+                    await this.restoreKeyForModel(`${pm.provider}/${pm.id}`, targetConv.cwd);
+                    await this.session.setModel(prevModel);
+                }
+                catch {
+                    // keep default
+                }
+            }
+            if (prevThinking) {
+                try {
+                    this.session.setThinkingLevel(prevThinking);
+                }
+                catch {
+                    // keep default
+                }
+            }
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: "🌱 已派生新分支会话并自动切换（原对话保持不变）",
+                textEn: "🌱 Forked new branch session and switched to it (original preserved)",
+            });
+        }
+        catch (err) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: `派生分支会话失败：${err.message}`,
+                textEn: `Failed to fork branch session: ${err.message}`,
+            });
+        }
+        this.flushSnapshot();
+    }
+    /**
+     * 回滚会话至指定消息检查点（Checkpoint Rollback）：
+     * 丢弃该消息之后的所有内容，并就地重置 session 状态，用户可直接在此继续提问。
+     */
+    async rollbackSession(messageId, targetConvId, restoreWorkspace) {
+        if (this.quiesceBlocked())
+            return;
+        const targetConv = (targetConvId ? this.convs.get(targetConvId) : this.conv) ?? this.conv;
+        const entry = this.resolveMessageEntry(targetConv, messageId);
+        if (!entry) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: "找不到指定的回滚检查点（可能已被压缩或不存在）",
+                textEn: "Rollback checkpoint not found (may have been compacted or not exist)",
+            });
+            this.flushSnapshot();
+            return;
+        }
+        try {
+            if (targetConv.session.isStreaming) {
+                await targetConv.session.abort();
+            }
+            // 重置分支 leaf 到目标 entry.id
+            targetConv.session.sessionManager.branch(entry.id);
+            const branchedContext = targetConv.session.sessionManager.buildSessionContext();
+            targetConv.session.agent.state.messages = [...branchedContext.messages];
+            if (branchedContext.thinkingLevel) {
+                try {
+                    targetConv.session.setThinkingLevel(branchedContext.thinkingLevel);
+                }
+                catch {
+                    // ignore
+                }
+            }
+            await targetConv.session.reload();
+            // 重新应用设置和门控
+            this.applyRetryOverrides();
+            this.applyCompactionOverrides();
+            this.applyToolGating(targetConv.session, targetConv.agentPreset);
+            // 清理该会话的 UI 消息缓存和序列化映射
+            targetConv.uiMessageCache.clear();
+            targetConv.msgIds.clear();
+            targetConv.userSeqByTs.clear();
+            targetConv.nextMsgId = 1;
+            targetConv.lastMessagesSig = "";
+            targetConv.lastMessagesArray = [];
+            targetConv.queueSteering = [];
+            targetConv.queueFollowUp = [];
+            try {
+                targetConv.session.clearQueue?.();
+            }
+            catch {
+                // best effort
+            }
+            // 联动还原物理工作区文件（Dual-State Rollback）
+            let workspaceRestored = false;
+            if (restoreWorkspace) {
+                const entryTs = entry.message?.timestamp ??
+                    entry.timestamp ??
+                    0;
+                // 查找最贴近该 entry 的快照（按 entryId 或 <= entryTs 的最后一份快照）
+                const snapshots = targetConv.workspaceSnapshots ?? [];
+                let matched = snapshots.find((s) => s.entryId === entry.id);
+                if (!matched) {
+                    const eligible = snapshots.filter((s) => entryTs === 0 || s.timestamp <= entryTs + 2000);
+                    matched = eligible[eligible.length - 1];
+                }
+                if (!matched && snapshots.length > 0) {
+                    matched = snapshots[0];
+                }
+                if (matched) {
+                    const res = await restoreWorkspaceSnapshot(targetConv.cwd, matched.snapshotRef);
+                    if (res.success) {
+                        workspaceRestored = true;
+                    }
+                    else {
+                        this.emit({
+                            type: "notice",
+                            level: "warning",
+                            text: `会话已回滚，但工作区物理文件还原失败：${res.error}`,
+                            textEn: `Session rolled back, but workspace file restore failed: ${res.error}`,
+                        });
+                    }
+                }
+                else {
+                    this.emit({
+                        type: "notice",
+                        level: "warning",
+                        text: "未找到对应检查点的工作区快照（可能非 Git 仓库或尚未记录），工作区文件未改动。",
+                        textEn: "No workspace snapshot found for this checkpoint (not a Git repo or snapshot unavailable); files left untouched.",
+                    });
+                }
+            }
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: workspaceRestored
+                    ? "已回滚至选定消息，工作区物理文件已联动还原至该检查点时刻。"
+                    : "已回滚至选定消息，后续内容已丢弃，可直接继续对话。",
+                textEn: workspaceRestored
+                    ? "Rolled back to selected message; workspace physical files restored to checkpoint state."
+                    : "Rolled back to selected message; subsequent content discarded, ready to continue.",
+            });
+            this.emittedMessages = null;
+            this.emitConversations();
+            this.flushSnapshot(true);
+        }
+        catch (err) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: `回滚失败：${err.message}`,
+                textEn: `Rollback failed: ${err.message}`,
+            });
+        }
+    }
     /**
      * Edit a past user question and re-ask it: forks a NEW session file that
      * keeps everything up to (but not including) that question, then sends the
@@ -7432,7 +9182,7 @@ export class ClientSession {
      */
     async scmGenCommitMessage(reqId) {
         const lang = this.getLang();
-        const cwd = this.conv?.cwd ?? this.cwd;
+        const cwd = this.convs.get(this.activeId)?.cwd ?? this.cwd;
         const reply = (ok, extra) => {
             this.emit({ type: "scm_data", reqId, kind: "commitmsg", ok, ...extra });
         };
@@ -8061,6 +9811,8 @@ export class ClientSession {
         this.bg.stop();
         for (const conv of this.convs.values()) {
             this.clearAllToolWatchdogs(conv);
+            // 逐个对话回收 eval 内核；下面的兜底再清一次表（含已 delete 的残留）。
+            disposeEvalSession(conv.id);
             conv.unsubscribe?.();
             try {
                 await conv.runtime.dispose();
@@ -8069,6 +9821,7 @@ export class ClientSession {
                 // best effort
             }
         }
+        disposeAllEvalKernels();
     }
 }
 /** issue #226：插件无头调用的工作目录校验（纯函数，可单测）。
@@ -8111,6 +9864,8 @@ export class AgentService {
     cwd;
     /** index.ts 注入：SDK 工具执行事件的插件转发钩子，attach 时拷贝到每个新会话。 */
     onToolEvent = undefined;
+    /** index.ts 注入：bash/read 插件拦截钩子，attach 时拷贝到每个新会话。 */
+    toolGuard = undefined;
     /** index.ts 注入：运行轨迹事件的插件转发钩子，attach 时拷贝到每个新会话。 */
     onRunEvent = undefined;
     /** index.ts 注入：对话切换通知钩子，attach 时拷贝到每个新会话。 */
@@ -8418,12 +10173,29 @@ export class AgentService {
         for (const [clientId, cs] of this.clients) {
             if (clientId === excludeClientId)
                 continue;
+            // issue #291：跳过无浏览器连接的残骸（非伪客户端 sinkCount=0 = 断连留存）。
+            // 伪客户端（scheduler:/plugin:）不走浏览器，sinkCount 永远为 0，保留。
+            if (!AgentService.isPseudoClientId(clientId) && cs.sinkCount() === 0)
+                continue;
             for (const r of cs.streamingSummariesAll())
                 out.push({ ...r, owner: clientId });
         }
         return out;
     }
-    /** issue #145：某客户端流式集合变化 → 其他客户端重推 conversations。 */
+    /** issue #291：删除定时任务后回收对应伪客户端，避免残留在 elsewhere 列表。 */
+    releaseSchedulerClient(taskId) {
+        const safe = String(taskId ?? "").replace(/[^A-Za-z0-9_-]/g, "") || "task";
+        const clientId = `scheduler:${safe}`;
+        const cs = this.clients.get(clientId);
+        if (!cs)
+            return;
+        // 伪客户端常驻一个 noop sink（chatFromScheduler 的 attach），所以不能按
+        // sinkCount 判断「有没有浏览器」—— 它永远为 1。这里就是它的回收点。
+        this.clients.delete(clientId);
+        // 通知其他客户端刷新 elsewhere 列表。
+        this.pokeExternalRunning(clientId);
+    }
+    /** issue #145: 某客户端流式集合变化 → 其他客户端重推 conversations。 */
     pokeExternalRunning(excludeClientId) {
         for (const [clientId, cs] of this.clients) {
             if (clientId === excludeClientId)
@@ -8932,11 +10704,15 @@ export class AgentService {
                     const saved = this.stateStore.get(clientId);
                     if (saved.lastCwd && saved.lastCwd !== this.cwd) {
                         try {
-                            if (statSync(saved.lastCwd).isDirectory())
+                            // issue #295：异步 stat —— 同步 stat 落在坏挂载（已卸载的外部卷/
+                            // autofs 触发点）上会在内核里挂起，冻住整个事件循环（含控制
+                            // socket 与其他客户端的心跳）；异步版本只挡本连接，超时提示照发。
+                            const { stat } = await import("node:fs/promises");
+                            if ((await stat(saved.lastCwd)).isDirectory())
                                 cwd = saved.lastCwd;
                         }
                         catch {
-                            // gone (unmounted drive / deleted) — fall back to the default
+                            // gone (unmounted drive / deleted / hanging mount) — fall back to the default
                         }
                     }
                     // Sessions use the SDK default per-project dir — no per-client dir.
@@ -8988,6 +10764,7 @@ export class AgentService {
         // Forward hooks (set once by index.ts) to every session.
         cs.onQuit = this.onQuit;
         cs.onToolEvent = this.onToolEvent;
+        cs.toolGuard = this.toolGuard;
         cs.onRunEvent = this.onRunEvent;
         cs.onConversationChanged = () => this.onConversationChanged?.();
         cs.pluginToolsProvider = this.pluginToolsProvider;
@@ -9040,7 +10817,14 @@ export class AgentService {
     }
     /** Remove a socket from a client's broadcast set (called on socket close). */
     detach(clientId, send) {
-        this.clients.get(clientId)?.detachSink(send);
+        const cs = this.clients.get(clientId);
+        cs?.detachSink(send);
+        // issue #291：最后一个 sink 断开 = 该客户端不再在线 → 它的对话不该再出现在
+        // 别人的 elsewhere 列表（listExternalRunning 已跳过 sinkCount=0 的非伪客户端，
+        // 但列表是推过去的，得让其他客户端重推一次才能立刻消失）。
+        if (cs && !AgentService.isPseudoClientId(clientId) && cs.sinkCount() === 0) {
+            this.pokeExternalRunning(clientId);
+        }
     }
     get(clientId) {
         return this.clients.get(clientId);