pi-web-ui 0.94.1 → 0.96.0

package/dist/server/agent-service.js

@@ -17,38 +17,55 @@ import "./patch-remote-catalog.js";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
-import { appendFileSync, existsSync, readFileSync, rmSync, statSync, mkdirSync, watch, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, readFileSync, renameSync, rmSync, statSync, mkdirSync, watch, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, createLocalBashOperations, getAgentDir, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, createEditToolDefinition, createLocalBashOperations, createWriteToolDefinition, getAgentDir, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { BgServerTracker } from "./bg-servers.js";
-import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, resolveNpmRegistry, sortUpdateItems, } from "./update-check.js";
+import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, detectPiSdkSplit, resolveNpmRegistry, sortUpdateItems, } from "./update-check.js";
+import { checkPluginUpdates } from "./plugin-updater.js";
+import { isBundledInUse, sdkCopies } from "./sdk-origin.js";
 import { hasActiveSubagentRun, hasPendingWaitSubscription, shouldRetainActive } from "./wait-subscription-scan.js";
 import { COMPACTION_PENDING_TYPE, looksLikeChainCorruption, makeCompactionMarkerId, repairSessionFile, } from "./compaction-markers.js";
+import { DANGLING_TOOL_RESULT_TEXT, DANGLING_TOOL_RESULT_TEXT_EN, findDanglingToolCalls, healDanglingToolCallFile, } from "./dangling-tools.js";
 import { removeQueuedByIndexOrText } from "./queue-utils.js";
 import { syncPluginToolsIntoSession } from "./plugins.js";
+import { denialText, } from "./plugin-tool-guard.js";
 import { SettingsService } from "./settings-service.js";
-import { GoalService } from "./goal-service.js";
+import { GoalService, buildDiffFingerprint } from "./goal-service.js";
 import { MarkerService } from "./marker-service.js";
 import { SlashCommandsService, parseSlash } from "./slash-commands.js";
 import { ModelAdminService } from "./model-admin.js";
 import { FilesService, MACHINE_ROOT, desktopDirWire, workspacePath } from "./files-service.js";
-import { DEFAULT_TOOL_WATCHDOG_TIMEOUT_MS, effectiveToolWatchdogMs, isExtensionDisabled, isExtensionEnabled, normalizeDisabledPluginTools, normalizeRetryMaxAttempts, normalizeSkillList, ClientStateStore, } from "./client-state.js";
-import { bilingual, pick, resolveServerLang } from "./i18n.js";
+import { DEFAULT_TOOL_WATCHDOG_TIMEOUT_MS, effectiveToolWatchdogMs, isExtensionDisabled, isExtensionEnabled, normalizeDisabledPluginTools, normalizePathKey, normalizeRetryMaxAttempts, normalizeSkillList, ClientStateStore, } from "./client-state.js";
+import { pick, resolveServerLang } from "./i18n.js";
 import { SubagentTemplatesStore, pickTemplatePrompt } from "./subagent-templates.js";
+import { ApprovalRulesStore, extractTargetPath } from "./approval-rules.js";
 import { ComposerDraftsStore } from "./composer-drafts.js";
+import { readPermissionFromSession } from "./permission-preset.js";
+import { createWorkspaceSnapshot, restoreWorkspaceSnapshot } from "./workspace-snapshot.js";
+import { isPathInsideRoot } from "./approval-rules.js";
+import { approvalSuppressionReason, checkDangerousToolCall, isApprovalPolicyEmpty, pluginApprovalCategory, } from "./tool-approval.js";
+import { PlanManager } from "./plan-manager.js";
 import { applyHeadTail, makePersistentTerminalTools, makeTerminalBashTool, stripAnsi, TERMINAL_TOOLS_GUIDANCE, } from "./terminals.js";
-import { applyAgentToolsGating, ASK_USER_QUESTION_TOOL_NAME, BROWSER_PAGE_TOOL_NAME, effectiveDisabledAgentTools, isAgentToolEnabled, isTerminalGuidanceOn, MARKERS_LIST_TOOL_NAME, PRESENT_FILES_TOOL_NAME, } from "./tool-manager.js";
+import { applyAgentToolsGating, ASK_USER_QUESTION_TOOL_NAME, BROWSER_PAGE_TOOL_NAME, effectiveDisabledAgentTools, isAgentToolEnabled, isTerminalGuidanceOn, MARKERS_LIST_TOOL_NAME, PI_AGENT_PRESETS, PI_PERMISSION_OPTIONS, PLAN_UPDATE_TOOL_NAME, PRESENT_FILES_TOOL_NAME, presetAllowsPluginTools, presetHasQuestionnaire, presetShowsSkillCatalog, } from "./tool-manager.js";
 import { WebUIContext } from "./webui-context.js";
 import { DEFAULT_COMPACTION_RESERVE_TOKENS, effectiveSoftCap, softCapToReserve } from "./soft-cap.js";
+import { pruneContextHierarchically } from "./context-budget.js";
 import { decodeText } from "./text-sniff.js";
 import { makeEditSoftTool } from "./edit-soft-tool.js";
 // 覆盖 SDK 内置 read：路径是目录时列出目录条目（行为开关 readDirEnabled，默认开）。
-import { makeReadDirTool } from "./read-tool.js";
+// 覆盖定义与「与扩展同名工具共存」的注入辅助分在两个文件（后者的依据见 tool-overrides.ts）。
+import { makeReadDirTool, withReadDirSupport } from "./read-tool.js";
+import { installToolOverrides, } from "./tool-overrides.js";
 // 展示文件给用户（present_files）：图片/视频内联、文本开预览弹窗、本地打开按钮。
 import { makePresentFilesTool } from "./present-files-tool.js";
+// 主动压缩上下文工具（compact_context）：AI 主动根据当前问题精简上下文并自主控制范围。
+import { makeCompactContextTool, buildCompactionInstructions, DEFAULT_KEEP_RECENT_TOKENS, } from "./compact-context-tool.js";
+// 持久代码求值沙箱（eval）：Python / Node.js 沙箱内核。
+import { disposeAllEvalKernels, disposeEvalSession, makeEvalTool } from "./eval-tool.js";
 // 工具定义说明的归一化（工具卡右键 → 「显示工具详细信息」，见 getToolInfo）。
 import { normalizeToolInfo } from "./tool-info.js";
 import { collectSubagentDescendantIds, makeSubagentTools, subagentTitle, withSubagentOwner, } from "./subagents.js";
@@ -59,14 +76,16 @@ import { ClaimStore, matchClaims, mergeTouchSidecar, readTouchSidecar, removeTou
 import { makeClaimFilesTool } from "./claim-files-tool.js";
 import { makeSkillTool } from "./skill-tool.js";
 import { makeScheduleTools } from "./schedule-agent-tool.js";
+import { makePatchTool } from "./patch-tool.js";
+import { makeLspTool } from "./lsp-tool.js";
 import { sameSessionFile } from "./scheduler-tasks.js";
 import { buildAttachmentMessages, parseModelSpec } from "./attachments.js";
 import { buildVisionBridgePrompt, findVisionModels, transcribeImages } from "./vision-bridge.js";
 import { isNotRepoError, scmCommitContext } from "./scm.js";
 import { buildCommitMsgInput, buildCommitMsgPrompt, sanitizeCommitMessage } from "./scm-commitmsg.js";
-import { BUILTIN_SOUL, DEFAULT_PROMPT_TEMPLATE, buildToolsSchemaText, renderPromptTemplate, resolveSectionTexts, } from "./prompt-composer.js";
+import { BUILTIN_SOUL, DEFAULT_PROMPT_TEMPLATE, buildToolsSchemaText, estimatePromptTokens, renderPromptTemplate, resolveSectionTexts, } from "./prompt-composer.js";
 import { launchOrigin, toServiceInfo } from "./launch-origin.js";
-import { serializeMessage, serializeStreamingMessage, stripTransientRetryErrors, } from "./serialize.js";
+import { findEntryByUiId, serializeMessage, serializeStreamingMessage, stripTransientRetryErrors, } from "./serialize.js";
 import { loadCommands, saveCommandsFile, TerminalManager } from "./terminals.js";
 const SNAPSHOT_INTERVAL_MS = 60;
 /** 服务进程所在机器的用户主目录（wire 格式）：进程内不变，模块加载时求值一次，
@@ -168,7 +187,7 @@ Many legacy Chinese text files (.html/.txt/.md/.log, exported documents) are GBK
  * schema stays consistent with the terminal-backed tool.
  */
 export function makeKillableBashTool(cwd, kills, 
-/** per-call 返回文本的服务端语言（默认英文）；工具 definition 走 bilingual 内联双语。 */
+/** per-call 返回文本的服务端语言（默认英文）；工具 definition 为纯英文。 */
 lang = () => "en") {
     const base = createLocalBashOperations();
     const tool = createBashToolDefinition(cwd, {
@@ -193,7 +212,7 @@ lang = () => "en") {
     return {
         name: tool.name,
         label: tool.label,
-        description: "Run a shell command natively (process spawn, no terminal) and return its full output plus exit code — the SDK's plain bash tool. persist is ignored here (no terminal); use head/tail to trim the returned output.",
+        description: "Run a shell command natively (process spawn, no terminal); returns full output plus exit code. persist is ignored here; use head/tail to trim returned output.",
         parameters: Type.Object({
             command: Type.String({ description: "The shell command to run" }),
             timeout: Type.Optional(Type.Number({ description: "Optional timeout in seconds" })),
@@ -233,9 +252,9 @@ export function makeAdaptiveBashTool(killable, terminalBacked, useTerminal) {
     return {
         ...killable,
         description: "Run a shell command and return its full output plus exit code. Behavior depends on the「default bash override」setting (terminalBash):\n" +
-            "Setting OFF → runs natively (process spawn, no terminal) — the SDK's plain bash tool. persist has no effect.\n" +
-            "Setting ON → runs in a visible terminal. persist=true keeps that terminal alive ('ai-bash': shell state such as cd/venv/ssh retained across calls, silent commands move to the background and notify when done); persist=false (default in terminal mode) creates a one-shot terminal that exits when the command finishes while its output stays for review.\n" +
-            "Run the bare command — do NOT pipe through head/tail/more/less (use the head/tail parameters to trim the returned output instead; piping also hides live progress in the visible terminal). For interactive commands (REPLs, prompts, installers asking y/n) set persist=true (terminal mode) and drive them with terminal_input / terminal_key.",
+            "OFF → runs natively (process spawn, no terminal); persist has no effect.\n" +
+            "ON → runs in a visible terminal. persist=true keeps the 'ai-bash' terminal alive (shell state cd/venv/ssh retained across calls); persist=false (default) is a one-shot terminal whose output stays viewable.\n" +
+            "Run the bare command — never pipe through head/tail/more/less (use the head/tail params; pipes hide live progress). For interactive commands (REPLs, y/n prompts) set persist=true and drive them with terminal_input / terminal_key.",
         promptSnippet: "run shell commands",
         execute: (id, params, signal, onUpdate, ctx) => {
             const p = params;
@@ -247,6 +266,452 @@ export function makeAdaptiveBashTool(killable, terminalBacked, useTerminal) {
         },
     };
 }
+/**
+ * 给已接管工具（bash/read）包上拦截守卫与人机协同审批：
+ * 1. pre guard 命中 deny → 直接阻断；
+ * 2. pre guard 命中 ask 或内置高危操作检测（rm -rf / 敏感文件覆盖等） →
+ *    触发 tool_approval_pending 等待用户审批；
+ *    - 用户选择 approve: 放行执行
+ *    - 用户选择 edit: 使用用户修改后的参数执行（Edit & Run）
+ *    - 用户选择 deny: 阻断并告知模型
+ * 3. post guard 合并（脱敏/补上下文）。
+ */
+export function withToolGuard(def, opts) {
+    const guard = opts.guard;
+    const toolName = opts.toolName;
+    if (!guard && !opts.askApproval)
+        return def;
+    return {
+        ...def,
+        execute: (async (toolCallId, params, signal, onUpdate, ctx) => {
+            const lang = opts.getLang();
+            const conversationId = opts.conversationId?.();
+            let pre;
+            if (guard) {
+                try {
+                    pre = await guard.pre({ toolName, params, conversationId }, lang);
+                }
+                catch {
+                    pre = { verdict: { decision: "allow" } };
+                }
+            }
+            // 检查是否需要人工协同审批（Human-in-the-Loop）
+            let needApproval = false;
+            let approvalReason;
+            let approvalReasonEn;
+            let approvalCategory;
+            // 1. 系统核心安全：内置高危操作检测与自定义审批规则先行（优先级最高，防短路）
+            let danger;
+            if (opts.cwd && opts.askApproval) {
+                danger = checkDangerousToolCall(toolName, params, opts.cwd, opts.getRoots?.() ?? [], opts.getRules?.());
+                if (danger.denied) {
+                    const reasonText = danger.reason ? ` 原因：${danger.reason}` : "";
+                    const reasonTextEn = danger.reasonEn ? ` Reason: ${danger.reasonEn}` : "";
+                    const text = pick(lang, `【工具执行被审批规则直接阻断】${reasonText}`, `[Tool execution blocked by approval rule]${reasonTextEn}`);
+                    return {
+                        content: [{ type: "text", text }],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+            }
+            // 2. 插件前置守卫 deny 拦截（带 isError 标记）
+            if (pre?.verdict.decision === "deny") {
+                const text = denialText(pre.verdict, pre.pluginId ?? "plugin", lang);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { guardDenied: true, decision: pre.verdict.decision, pluginId: pre.pluginId },
+                    isError: true,
+                };
+            }
+            // 3. 决定是否需要弹窗审批（系统高危 ask 优先于插件通用 ask，防止恶意或低危插件掩盖高危告警）
+            if (danger?.dangerous) {
+                needApproval = true;
+                approvalReason = danger.reason;
+                approvalReasonEn = danger.reasonEn;
+                approvalCategory = danger.category;
+            }
+            else if (pre?.verdict.decision === "ask") {
+                needApproval = true;
+                approvalReason = pre.verdict.reason ?? "插件要求确认本次操作";
+                approvalReasonEn = pre.verdict.reasonEn ?? "Plugin requested confirmation for this operation";
+                // 插件档位按插件 id 分：用户可以「允许同类」= 该插件的确认以后不再问。
+                approvalCategory = pluginApprovalCategory(pre.pluginId ?? "plugin");
+            }
+            let effectiveParams = params;
+            let userEdited = false;
+            if (needApproval && opts.askApproval) {
+                const res = await opts.askApproval(toolCallId, toolName, params, approvalReason, approvalReasonEn, conversationId, approvalCategory);
+                if (res.decision === "deny") {
+                    const reasonText = res.reason ? ` 原因：${res.reason}` : "";
+                    const reasonTextEn = res.reason ? ` Reason: ${res.reason}` : "";
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(lang, `【操作被用户拒绝】${reasonText}`, `[Operation denied by user]${reasonTextEn}`),
+                            },
+                        ],
+                        details: { guardDenied: true, userDenied: true, reason: res.reason },
+                        isError: true,
+                    };
+                }
+                else if (res.decision === "edit") {
+                    effectiveParams = res.editedParams ?? params;
+                    userEdited = true;
+                }
+            }
+            else if (pre?.verdict.decision === "ask") {
+                // 无审批通道时回落至原先的阻断行为
+                const text = denialText(pre.verdict, pre.pluginId ?? "plugin", lang);
+                return {
+                    content: [{ type: "text", text }],
+                    details: { guardDenied: true, decision: pre.verdict.decision, pluginId: pre.pluginId },
+                };
+            }
+            const result = (await def.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...result.details,
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            if (guard) {
+                let post;
+                try {
+                    post = await guard.post({ toolName, params: effectiveParams, result, conversationId }, lang);
+                }
+                catch {
+                    post = undefined;
+                }
+                if (post?.content)
+                    return { ...result, content: post.content };
+            }
+            return result;
+        }),
+    };
+}
+/** 校验目标路径是否在工作区（或多根工作区）内。严格规范化防止 ".." 逃逸与 Windows 盘符大小写不一致。 */
+function isInsideWorkspaceRoots(targetPath, cwd, roots = []) {
+    const abs = resolve(cwd, targetPath);
+    const allRoots = [resolve(cwd), ...roots.map((r) => resolve(r))];
+    return allRoots.some((r) => isPathInsideRoot(abs, r));
+}
+/**
+ * 为 write 工具包装会话级权限沙箱与人机协同审批。
+ * `base` = 覆盖基底：第三方扩展注册的同名 write 优先（见 tool-overrides.ts），
+ * 省略则是 SDK 内置实现 —— 于是权限门禁叠在扩展实现之上，而不是把它顶掉。
+ */
+function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules, base = createWriteToolDefinition(cwd)) {
+    return {
+        ...base,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止写入文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; writing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = extractTargetPath(params);
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; writing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危写操作人机协同审批拦截（如敏感配置修改）与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("write", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件写入被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File write blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "write", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件写入被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File write denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...result.details,
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/**
+ * 为 edit 工具包装会话级权限沙箱与人机协同审批（基底语义同 write）。
+ */
+function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules, base = createEditToolDefinition(cwd)) {
+    return {
+        ...base,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止编辑文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; editing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = extractTargetPath(params);
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; editing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危修改人机协同审批拦截与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("edit", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件编辑被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File edit blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "edit", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件编辑被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File edit denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...result.details,
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/** 为 edit_soft 工具包装会话级权限沙箱与人机协同审批。 */
+function wrapEditSoftToolWithPermission(tool, cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
+    return {
+        ...tool,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止编辑文件。若需修改请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; editing files is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            if (perm === "workspace-write-never") {
+                const p = params?.path ?? "";
+                if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【权限被拒绝】当前会话处于「工作区内修改」（workspace-write-never）模式，禁止修改工作区外部文件（"${p}"）。若需修改请切换至「完全权限」。`, `[Permission Denied] The current session is in 'workspace-write-never' mode; editing files outside the workspace ("${p}") is forbidden. Switch to 'danger-full-access' if needed.`),
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            }
+            // 高危修改人机协同审批拦截与规则匹配
+            let effectiveParams = params;
+            let userEdited = false;
+            if (askApproval) {
+                const danger = checkDangerousToolCall("edit_soft", params, cwd, getRoots(), getRules?.());
+                if (danger.denied) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: pick(getLang(), `【文件编辑被审批规则直接阻断】${danger.reason ? ` 原因：${danger.reason}` : ""}`, `[File edit blocked by approval rule]${danger.reason ? ` Reason: ${danger.reason}` : ""}`),
+                            },
+                        ],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+                if (danger.dangerous) {
+                    const res = await askApproval(toolCallId, "edit_soft", params, danger.reason, danger.reasonEn, getConversationId?.(), danger.category);
+                    if (res.decision === "deny") {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: pick(getLang(), `【文件编辑被用户拒绝】${res.reason ? ` 原因：${res.reason}` : ""}`, `[File edit denied by user]${res.reason ? ` Reason: ${res.reason}` : ""}`),
+                                },
+                            ],
+                            details: { guardDenied: true, userDenied: true, reason: res.reason },
+                            isError: true,
+                        };
+                    }
+                    else if (res.decision === "edit") {
+                        effectiveParams = res.editedParams ?? params;
+                        userEdited = true;
+                    }
+                }
+            }
+            const result = (await tool.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
+            if (userEdited && result && typeof result === "object") {
+                result.details = {
+                    ...result.details,
+                    userEdited: true,
+                    originalParams: params,
+                    executedParams: effectiveParams,
+                };
+            }
+            return result;
+        },
+    };
+}
+/**
+ * 结构化任务执行计划更新工具（plan_update）— Plan Mode / Step State Machine。
+ */
+export function makePlanUpdateTool(planManager, getActiveConvId, emit, flushSnapshot) {
+    return {
+        name: PLAN_UPDATE_TOOL_NAME,
+        label: "plan_update",
+        description: "Update the structured task plan / step state machine (Plan Mode): break non-trivial work into decision-ready steps and track progress (pending -> in_progress -> done/failed). Prefer steps that note discovery conclusions, files to be touched, and a rollback strategy.",
+        promptSnippet: "update structured task plan with decision-ready steps, file touch list, and live status",
+        promptGuidelines: [
+            "When executing non-trivial tasks, use plan_update early to outline decision-ready steps before coding: " +
+                "specify discovery conclusions, explicitly list files to be touched (File Touch List), and note potential rollback strategies",
+            "Keep step status updated as work progresses (pending -> in_progress -> done/failed) so the user has real-time visibility",
+        ],
+        parameters: Type.Object({
+            steps: Type.Array(Type.Object({
+                id: Type.String({ description: "Unique step ID, e.g. '1', 'step-1'" }),
+                title: Type.String({ description: "Short step title" }),
+                status: Type.Optional(Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("done"), Type.Literal("failed")], { description: "Step status: pending | in_progress | done | failed (default: pending)" })),
+                description: Type.Optional(Type.String({
+                    description: "Optional detailed description, acceptance criteria, file touch list, or rollback note.",
+                })),
+            }), { description: "List of plan steps" }),
+            activeStepId: Type.Optional(Type.String({ description: "ID of the step currently being executed" })),
+        }),
+        execute: async (toolCallId, params) => {
+            const convId = getActiveConvId();
+            const p = params;
+            const plan = planManager.setPlan(convId, p.steps, p.activeStepId);
+            emit({
+                type: "plan_updated",
+                conversationId: convId,
+                plan,
+            });
+            flushSnapshot();
+            const summary = planManager.describePlan(convId);
+            return {
+                content: [{ type: "text", text: `Plan updated successfully.\n\n${summary}` }],
+                details: { plan },
+            };
+        },
+    };
+}
+/** 为 bash 工具包装只读拦截。 */
+function wrapBashToolWithPermission(tool, getPermission, getLang) {
+    return {
+        ...tool,
+        execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+            const perm = getPermission();
+            if (perm === "read-only") {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: pick(getLang(), "【权限被拒绝】当前会话处于「只读模式」（read-only），禁止执行终端命令。若需执行请切换权限预设。", "[Permission Denied] The current session is in 'read-only' mode; running shell commands is forbidden. Switch permission preset if needed."),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            return tool.execute(toolCallId, params, signal, onUpdate, ctx);
+        },
+    };
+}
 /**
  * 任务列表只读查询工具（todo_list）— 读操作仍走真工具。
  */
@@ -254,12 +719,12 @@ function makeMarkersListTool(getActiveId, markerSvc) {
     return {
         name: MARKERS_LIST_TOOL_NAME,
         label: "List marker state",
-        description: "Read-only query of inline marker state. All WRITE operations must use inline markers ([[todo:new:...]] etc.) in the reply body — never use this tool for writes.\n只读查询内联标记状态。状态【写】操作请一律用内联标记（[[todo:new:...]] 等）写在回答正文里，不要调用本工具做写操作。",
+        description: "Read-only query of inline marker state. All WRITE operations must use inline markers ([[todo:new:...]] etc.) in the reply body — never this tool.",
         parameters: Type.Object({
             action: Type.Unsafe({ enum: ["list"] }),
             tool: Type.Optional(Type.Literal("todo")),
             includeDeleted: Type.Optional(Type.Boolean({
-                description: "Whether to include deleted tasks (tombstones, todo only).\n是否包含已删除任务（tombstone，仅 todo）。",
+                description: "Include deleted tasks (tombstones, todo only).",
             })),
         }),
         execute: async (_id, params) => {
@@ -292,37 +757,64 @@ export function makeAskUserQuestionTool(clientSession,
 /** 本 runtime 所属会话：提问跟着对话走，快照只把当前对话的问卷推给客户端。 */
 ownerId) {
     const QuestionOptionSchema = Type.Object({
-        label: Type.String({ description: "Display label for the option" }),
-        description: Type.Optional(Type.String({ description: "Optional description shown below label" })),
+        label: Type.String({ description: "Display label for the option (1-5 words)" }),
+        description: Type.Optional(Type.String({
+            description: "One short sentence explaining the impact or tradeoff if selected.",
+        })),
         preview: Type.Optional(Type.String({
             description: "Optional preview rendered below when this option is selected (markdown or HTML — use for mockups/code/config).",
         })),
     });
     const QuestionSchema = Type.Object({
-        id: Type.String({ description: "Unique identifier for this question" }),
+        id: Type.String({ description: "Unique identifier for this question (snake_case)" }),
         question: Type.String({ description: "The full question text to display (markdown/HTML ok)" }),
         detail: Type.Optional(Type.String({ description: "Optional detail/context shown under the question" })),
         header: Type.Optional(Type.String({ description: "Optional short header for this question" })),
-        options: Type.Optional(Type.Array(QuestionOptionSchema, { description: "Available options to choose from" })),
+        options: Type.Optional(Type.Array(QuestionOptionSchema, {
+            description: "2-4 mutually exclusive choices. Put the recommended option first when there is a clear default.",
+            minItems: 2,
+            maxItems: 4,
+        })),
         multiSelect: Type.Optional(Type.Boolean({ description: "Allow selecting multiple options (default: false)" })),
+        dependsOn: Type.Optional(Type.Object({
+            questionId: Type.String({ description: "ID of the prior question this question depends on" }),
+            value: Type.Optional(Type.Union([Type.String(), Type.Array(Type.String())], {
+                description: "Show only when the prior answer equals this value (or is in the array). Omit to show whenever answered.",
+            })),
+        })),
+        optionsMap: Type.Optional(Type.Record(Type.String(), Type.Array(QuestionOptionSchema), {
+            description: "Dynamic options based on prior question's chosen value: e.g. { 'React': [opts...], 'Vue': [opts...] }",
+        })),
     });
     return {
         name: "ask_user_question",
         label: "Ask the user",
-        description: "Ask the user focused questions to pin down ambiguous requirements. Use for clarifying the task, confirming decisions, or getting preferences. Each question renders a browser dialog with markdown/HTML rich text; options may carry a `preview`. Submit or cancel to resume.",
-        promptSnippet: bilingual("ask the user focused questions to clarify ambiguous requirements (browser dialog with options/preview)", "向用户提问以澄清含糊的需求（浏览器对话框，支持选项/预览）"),
+        description: "Ask the user focused questions to clarify ambiguous requirements (clarify the task, confirm decisions, get preferences). " +
+            "Strictly ask 1 to 3 questions per call (prefer 1, max 3); provide 2 to 4 mutually exclusive options with the " +
+            "recommended option first, and explain impact/tradeoff in each option description. " +
+            "Each question renders a browser dialog with markdown/HTML rich text; options may carry a `preview`. Submit or cancel to resume.",
+        promptSnippet: "ask the user 1-3 focused questions with recommended options and tradeoffs to clarify requirements",
         promptGuidelines: [
-            bilingual("When requirements are ambiguous, use ask_user_question to ask the user instead of guessing; prefer multiple-choice options, each option may carry a preview", "需求含糊时用 ask_user_question 向用户提问而不是猜测；优先给多选选项，选项可带 preview 预览"),
-            bilingual("A cancelled question comes back as a tool error — respect it and continue without re-asking immediately", "用户取消提问会以工具错误返回——尊重取消决定，不要马上重复追问"),
+            "When requirements are ambiguous, use ask_user_question to clarify instead of guessing: " +
+                "ask 1 to 3 focused questions (prefer 1, max 3), provide 2-4 mutually exclusive options with the " +
+                "recommended option first, and explain impact/tradeoff in description",
+            "A cancelled question comes back as a tool error — respect it and continue without re-asking immediately",
         ],
         parameters: Type.Object({
-            questions: Type.Array(QuestionSchema, { description: "Questions to ask the user" }),
+            questions: Type.Array(QuestionSchema, {
+                description: "Questions to ask the user (strictly 1 to 3 questions; prefer 1).",
+                minItems: 1,
+                maxItems: 3,
+            }),
         }),
         execute: async (_id, params, signal) => {
             const qs = params.questions;
             if (!Array.isArray(qs) || qs.length === 0) {
                 throw new Error("ask_user_question requires at least one question");
             }
+            if (qs.length > 3) {
+                throw new Error("ask_user_question allows at most 3 questions per call to prevent question fatigue (单次提问最多不得超过 3 个问题)");
+            }
             const answers = await clientSession.askUser(qs, {
                 aborted: signal?.aborted,
             }, ownerId);
@@ -425,8 +917,8 @@ ownerId) {
         name: BROWSER_PAGE_TOOL_NAME,
         label: "Browser page",
         description: [
-            'Read or act on a page in the USER\'S OWN browser through the pi-web-ui page-picker extension (the extension talks to this page; the server only forwards the request). Only pages the user has explicitly allowed/paired in that extension can be touched. Call it with op:"pages" first to see which pages are currently available, and use it ONLY when the user asked you to read or operate a web page — never click/type on their pages on your own initiative.',
-            "ops (forwarded to the extension as-is, the server does not interpret them):",
+            'Read or act on a page in the USER\'S OWN browser via the pi-web-ui page-picker extension (the server only forwards). Only pages the user explicitly allowed/paired can be touched. Start with op:"pages" to list available pages, and use ONLY when the user asked you to read or operate a page — never click/type on their pages unprompted.',
+            "ops (forwarded to the extension as-is):",
             "  pages  — no args; lists the pages you may act on",
             '  read   — { what?: "text" | "html" | "title" | "url" | "query", selector?, all? }',
             "  click  — { selector, index? }",
@@ -437,10 +929,12 @@ ownerId) {
             "  eval   — { code } runs JS inside the page (extension-side switch, off by default)",
             "Op options that are not fields of this tool (e.g. read's `limit`) fall back to the extension's defaults. `target` selects the page by origin when more than one is allowed; `timeoutMs` is how long the SERVER waits for the browser (1000-120000, default 30000) before failing the call.",
         ].join("\n"),
-        promptSnippet: bilingual("read or operate a page in the user's browser (page-picker extension; allowed pages only)", "读取/操作用户浏览器里已授权的页面（page-picker 扩展，仅限已授权页面）"),
+        promptSnippet: "read or operate a page in the user's browser (page-picker extension; allowed pages only)",
         promptGuidelines: [
-            bilingual("Only use browser_page when the user asked you to read or act on a page in their browser; never click or type on their pages on your own initiative", "只在用户明确要求读取/操作浏览器页面时才用 browser_page；不要自作主张去点用户的页面"),
-            bilingual('Start with op:"pages" to see which pages are available; the target page must already be allowed in the page-picker extension — when it fails, tell the user what to enable instead of retrying blindly', '先用 op:"pages" 看有哪些可操作页面；目标页面必须已在 page-picker 扩展里授权——失败时把需要开什么告诉用户，不要盲目重试'),
+            "Only use browser_page when the user asked you to read or act on a page in their browser; " +
+                "never click or type on their pages on your own initiative",
+            'Start with op:"pages" to see which pages are available; ' +
+                "the target page must already be allowed in the page-picker extension — when it fails, tell the user what to enable instead of retrying blindly",
         ],
         parameters: Type.Object({
             op: Type.String({
@@ -674,6 +1168,33 @@ function previewToolResult(result) {
         return "[unserializable result]";
     }
 }
+/**
+ * 转录整文件重写的原子落盘：先写同目录临时文件再 rename。转录是 append-only
+ * 的唯一事实源，compaction 收尾/清理的整文件重写若中途被打断（进程被杀/断电），
+ * 原地 writeFileSync 会留下截断的 JSONL；同目录 rename 是原子的，最坏情况是
+ * 旧文件原样保留，绝不会出现半份转录。Windows 下目标被外部占用（阅读器/杀软
+ * 锁）时 rename 可能 EPERM —— 退回原地写保住功能（旧行为），不因小概率锁失败丢更新。
+ */
+function atomicWriteFileSync(file, data) {
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(tmp, data);
+        try {
+            renameSync(tmp, file);
+        }
+        catch {
+            writeFileSync(file, data);
+        }
+    }
+    finally {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // 临时文件清不掉只能留给下次（同目录 .tmp，不影响转录本身）
+        }
+    }
+}
 /** Cap on simultaneously open NON-subagent conversations of ONE project (each keeps a full
  *  runtime alive; conversations of other projects keep their own lists).
  *  子代理不计入：子代理是 inMemory 后台任务，不参与此上限，既不占位也不被此上限拦截。 */
@@ -759,13 +1280,20 @@ function messageSearchText(m) {
     }
     return parts.join("\n");
 }
+/** 转录全文扫描/整读的大小上限（16MB，与 readHistorySession 一致）：
+ *  超限文件同步 readFileSync 会卡事件循环数百毫秒起，搜索不值得。 */
+const MAX_TRANSCRIPT_SCAN_BYTES = 16 * 1024 * 1024;
 /** 扫描一个会话转录文件，收集文本命中查询的消息锚点（role + timestamp，
- *  按转录顺序，最多 cap 个）。仅 user/assistant 消息参与，与搜索范围一致。 */
+ *  按转录顺序，最多 cap 个）。仅 user/assistant 消息参与，与搜索范围一致。
+ *  超过大小上限的转录直接跳过（stat 先行，不整读）—— 全局搜索逐会话同步
+ *  扫描，无上限时一个大转录就能冻住整个事件循环。 */
 function collectSessionAnchors(filePath, q, cap = 10) {
     const anchors = [];
     if (!q)
         return anchors;
     try {
+        if (statSync(filePath).size > MAX_TRANSCRIPT_SCAN_BYTES)
+            return anchors;
         const lines = readFileSync(filePath, "utf8").split("\n");
         for (const line of lines) {
             if (!line.trim())
@@ -890,6 +1418,35 @@ export function sameCwd(a, b) {
         return false;
     }
 }
+/**
+ * 超时杀进程树的决策（纯函数，可单测）。runAsync 的超时兜底用：
+ * - win32：shell:true 实际起的是 cmd.exe，p.kill() 只杀 cmd 本身，npm/git 的
+ *   孙进程照活 —— 必须走 `taskkill /PID <pid> /T /F` 才能整树带走；
+ * - posix：配合 spawn 的 detached:true，向负 pid（整组）发 SIGTERM。
+ * 返回决策而不是直接执行，执行留在调用方（便于注入/测试）。
+ */
+export function processTreeKillPlan(platform, pid) {
+    if (!pid || pid <= 0)
+        return { kind: "none" };
+    if (platform === "win32")
+        return { kind: "taskkill", cmd: "taskkill", args: ["/PID", String(pid), "/T", "/F"] };
+    return { kind: "group-signal", signal: "SIGTERM" };
+}
+/**
+ * /cwd 目标解析（纯函数，可单测）：
+ * - 相对路径以**当前会话 cwd** 为基准（/cwd src = 当前项目的 src），不按 server
+ *   进程 cwd 解析 —— 两者经常不同，按进程 cwd 切必错位。绝对路径不受基准影响
+ *   （resolve 遇到绝对段会丢弃前面的基准）。
+ * - win32 裸盘符（"C:"）：resolve 会按该盘当前目录解析，必须显式指到盘根；仅
+ *   win32 生效——posix 下 "C:" 仍是普通相对路径，避免误伤同名目录。
+ */
+export function resolveCwdTarget(raw, sessionCwd, platform = process.platform) {
+    const trimmed = String(raw ?? "").trim();
+    if (platform === "win32" && /^[A-Za-z]:$/.test(trimmed)) {
+        return `${trimmed.toUpperCase()}\\`;
+    }
+    return resolve(sessionCwd, trimmed);
+}
 export class ClientSession {
     clientId;
     /** Set by AgentService.attach: reflects the SERVICE-wide quiesce flag
@@ -940,7 +1497,7 @@ export class ClientSession {
         emit: (msg) => this.emit(msg),
         isDisposed: () => this.disposed,
         getCwd: () => this.cwd,
-        getActiveCwd: () => this.conv?.cwd ?? this.cwd,
+        getActiveCwd: () => this.convs.get(this.activeId)?.cwd ?? this.cwd,
         // issue #91：文件服务错误文案按客户端 UI 语言出中英（英文默认）。
         getLang: () => this.getLang(),
     });
@@ -954,6 +1511,9 @@ export class ClientSession {
     /** index.ts 注入（经 AgentService 拷贝到每个新会话）：把 SDK 工具执行事件转发给
      *  插件（PluginManager.emitToolEvent）。未设置时不做任何事。 */
     onToolEvent = undefined;
+    /** index.ts 注入（P1-5，经 AgentService 拷贝到每个新会话）：bash/read 执行前后的
+     *  插件拦截（PluginManager.evaluateToolPre/evaluateToolPost）。未设置时直通。 */
+    toolGuard = undefined;
     /** index.ts 注入：把运行轨迹事件转发给插件（PluginManager.emitRunEvent，
      *  轨迹视图插件靠它聚合时间线）。未设置时不做任何事。 */
     onRunEvent = undefined;
@@ -993,10 +1553,10 @@ export class ClientSession {
         return this.conv.terminals;
     }
     getTerminalManager(conversationId) {
-        return (conversationId ? this.convs.get(conversationId) : this.conv)?.terminals;
+        return (conversationId ? this.convs.get(conversationId) : this.convs.get(this.activeId))?.terminals;
     }
     getTerminalCwd(conversationId) {
-        return (conversationId ? this.convs.get(conversationId) : this.conv)?.cwd ?? this.cwd;
+        return (conversationId ? this.convs.get(conversationId) : this.convs.get(this.activeId))?.cwd ?? this.cwd;
     }
     makeTerminalManager(conversationId, cwd) {
         const mgr = new TerminalManager((msg) => this.emitTerminal(conversationId, msg), cwd, 
@@ -1077,7 +1637,7 @@ export class ClientSession {
         if (persist) {
             const baseCwdForLimit = parentId ? (this.convs.get(parentId)?.cwd ?? this.cwd) : this.cwd;
             const resolvedCwdForLimit = cwd ? resolve(baseCwdForLimit, cwd) : baseCwdForLimit;
-            const openInProject = [...this.convs.values()].filter((c) => c.cwd === resolvedCwdForLimit && !c.isSubagent).length;
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === resolvedCwdForLimit && !c.isSubagent && !c.isEphemeral).length;
             if (openInProject >= MAX_OPEN_CONVERSATIONS) {
                 throw new Error(pick(this.getLang(), `目标项目运行的普通对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），无法创建持久化对话。请先关闭不需要的对话，或以轻量子代理（persist=false）方式运行`, `The project already has max open regular conversations (${MAX_OPEN_CONVERSATIONS}). Please close some or run as a lightweight subagent (persist=false)`, "agent.conv.limit.reached", { limit: MAX_OPEN_CONVERSATIONS }));
             }
@@ -1099,6 +1659,16 @@ export class ClientSession {
         const conversationId = persist ? `conv-${randomUUID().slice(0, 8)}` : `sa-${randomUUID().slice(0, 8)}`;
         const terminals = this.makeTerminalManager(conversationId, resolvedCwd);
         const sessionManager = persist ? SessionManager.create(resolvedCwd) : SessionManager.inMemory(resolvedCwd);
+        if (!persist) {
+            // 为内存子代理提供隔离的临时运行目录（供 SoL-Pi 等依赖 getSessionDir 的扩展正常放置缓存），
+            // 但保持 persist = false（不写 .jsonl 对话文件、不污染历史记录）
+            const ephemeralDir = join(this.agentDir, "subagent-sessions", conversationId);
+            try {
+                mkdirSync(ephemeralDir, { recursive: true });
+                sessionManager.sessionDir = ephemeralDir;
+            }
+            catch { }
+        }
         const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, apply, conversationId), {
             cwd: resolvedCwd,
             agentDir: this.agentDir,
@@ -1112,6 +1682,9 @@ export class ClientSession {
         conv.parentId = parentId ?? this.activeId ?? undefined;
         conv.subagentType = type;
         conv.subagentPrompt = prompt;
+        // 模板快照留在对话上：forceReset 重建 runtime 时工厂要按同一模板组装
+        // （system prompt/技能/扩展白名单），否则重建后回落主会话设置。
+        conv.subagentTemplate = apply;
         // 插件工具门与模板扩展白名单对齐：白名单非空时插件/MCP 工具（无 SDK
         // extensionKey 身份）不进该会话。工厂期 customTools 不注册 + 下面的
         // syncPluginTools 不回补，模板热改不影响已运行的子代理（与 prompt/技能一致）。
@@ -1136,7 +1709,10 @@ export class ClientSession {
                 // 局部 mock 缺失而崩），但它是 headless 的：UI 输出全部丢弃、弹窗按取消返回，
                 // 因此既不与主对话的 widget/status 串台，也不会让扩展卡在永远无人应答的弹窗上。
                 uiContext: WebUIContext.headless(),
-                onError: (err) => this.emit({ type: "notice", level: "error", text: err.error, textEn: err.error }),
+                onError: this.makeExtensionErrorReporter({
+                    text: `子代理 ${conversationId}：`,
+                    textEn: `Subagent ${conversationId}: `,
+                }),
             });
         }
         catch {
@@ -1268,6 +1844,8 @@ export class ClientSession {
             output: conv.session.getLastAssistantText() ?? "",
             parentId: conv.parentId,
             persisted: isPersisted,
+            handoffTo: conv.peerHandoffTo ? [...conv.peerHandoffTo] : undefined,
+            handoffFrom: conv.peerHandoffFrom ? [...conv.peerHandoffFrom] : undefined,
         };
     }
     /** 子代理最近一次运行的结局：最后一条 assistant 消息的 errorMessage / stopReason。
@@ -1338,9 +1916,12 @@ export class ClientSession {
     lastSdkAppendFiles = [];
     /** 当前活动会话的工具/资源快照 → composer 输入。cwd 取活动对话的。 */
     composeInputs(src) {
+        const preset = src.preset ?? this.conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
         // 技能名录指纹观测（只打日志，不干预组装；预览与 run 共用此入口，
         // 变化才记一行，首轮静默）。用未注文的目录（fill 前），全文注入不影响指纹。
         this.noteSkillCatalogDigest(src.skills);
+        const showSkills = presetShowsSkillCatalog(preset);
+        const effectiveSkills = showSkills ? this.fillSkillContents(src.skills) : [];
         return {
             cwd: src.cwd,
             systemPromptFile: this.lastBaseSystemPrompt || undefined,
@@ -1353,15 +1934,15 @@ export class ClientSession {
             piExamples: PI_DOC_PATHS.examples,
             appendFiles: this.lastSdkAppendFiles,
             windowsPersona: process.platform === "win32" ? WINDOWS_PERSONA : "",
-            terminalGuidance: isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current))
+            terminalGuidance: isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current), preset)
                 ? TERMINAL_TOOLS_GUIDANCE
                 : "",
             markersGuidance: this.markerSvc.buildGuidance(),
             // issue #91：组合模板各来源段按客户端 UI 语言渲染（英文默认）。
             lang: this.getLang(),
             contextFiles: src.contextFiles,
-            skills: this.fillSkillContents(src.skills),
-            skillsFullText: normalizeSkillList(this.settingsSvc.current.skillsFullText),
+            skills: effectiveSkills,
+            skillsFullText: showSkills ? normalizeSkillList(this.settingsSvc.current.skillsFullText) : [],
         };
     }
     /** skill 全文注入（{{skills}} 全文模式）：最好努力读名单里技能的文件正文。
@@ -1388,25 +1969,31 @@ export class ClientSession {
             }
         });
     }
-    /** 渲染当前组合模板。模板为空且无任何覆盖时返回 undefined（用 SDK 默认拼装，
-     *  零开销且与原始行为逐字节一致）。 */
+    /** 渲染当前组合模板。当存在自定义模板/覆盖，或者当前会话预设非 standard（如 code/minimal/ask/reader），
+     *  或者存在被禁用的工具时，必须渲染完整系统提示词，保证工具门控、技能隐藏与 Guidelines 严格对齐当前预设；
+     *  仅在完全默认且全功能 standard 状态下返回 undefined 让 SDK 拼装。 */
     renderMainCompose(src) {
         const tpl = (this.settingsSvc.current.promptTemplate ?? "").trim();
         const ovs = this.settingsSvc.current.promptOverrides ?? {};
         const hasOverride = Object.values(ovs).some((v) => typeof v === "string" && v.trim());
-        if (!tpl && !hasOverride)
+        const preset = src.preset ?? this.conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+        const isCustomized = !!tpl || hasOverride || preset !== "standard" || effectiveDisabledAgentTools(this.settingsSvc.current).length > 0;
+        if (!isCustomized)
             return undefined;
         const texts = resolveSectionTexts(this.composeInputs(src));
-        return renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, ovs);
+        return renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, hasOverride ? ovs : undefined);
     }
-    /** 从活动会话收集工具/资源快照 → 一次算出 ①各来源默认(自动)内容 ②实际生效的
-     *  完整提示词。会话未就绪（或出错）返回 undefined，调用方给空值。 */
-    sessionPromptSnapshot() {
+    /** 从指定会话（缺省 = 活跃会话）收集工具/资源快照 → 一次算出 ①各来源默认(自动)
+     *  内容 ②实际生效的完整提示词。会话未就绪（或出错）返回 undefined，调用方给空值。
+     *  注意必须传目标 conv：preset/工具 schema 都是按会话走的，拿活跃会话的快照
+     *  算后台会话的基线会串账（lastTurnBaseTokens 跨会话污染）。 */
+    sessionPromptSnapshot(target) {
         try {
-            const sess = this.session;
-            if (!sess)
+            const conv = target ?? this.convs.get(this.activeId);
+            if (!conv)
                 return undefined;
-            const cwd = this.conv?.cwd ?? this.cwd;
+            const sess = conv.session;
+            const cwd = conv.cwd;
             const active = sess.getActiveToolNames();
             const snippets = {};
             const guidelines = [];
@@ -1426,6 +2013,7 @@ export class ClientSession {
                 });
             }
             const loader = sess.resourceLoader;
+            const preset = conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
             const texts = resolveSectionTexts(this.composeInputs({
                 cwd,
                 selectedTools: active,
@@ -1437,13 +2025,14 @@ export class ClientSession {
                     description: s.description ?? "",
                     filePath: s.filePath ?? "",
                 })),
+                preset,
             }));
-            // 模板/覆盖渲染（无则保持 SDK 默认拼装，与 renderMainCompose 同规则）。
+            // 模板/覆盖渲染（无自定义模板时用默认模板渲染完整提示词，确保与真实 run 规则一致且包含预设过滤）。
             const tpl = (this.settingsSvc.current.promptTemplate ?? "").trim();
             const ovs = this.settingsSvc.current.promptOverrides ?? {};
             const hasOverride = Object.values(ovs).some((v) => typeof v === "string" && v.trim());
-            const rendered = !tpl && !hasOverride ? undefined : renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, ovs);
-            return { texts, full: rendered ?? sess.systemPrompt, toolsSchema: buildToolsSchemaText(schemaEntries) };
+            const rendered = renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, hasOverride ? ovs : undefined);
+            return { texts, full: rendered, toolsSchema: buildToolsSchemaText(schemaEntries) };
         }
         catch {
             // Session not ready yet.
@@ -1455,6 +2044,30 @@ export class ClientSession {
     promptSnapshot() {
         return this.sessionPromptSnapshot() ?? { full: "", texts: {}, toolsSchema: "" };
     }
+    /** 会话级 Base Tokens 缓存（避免在节流快照热路径上重复计算正则）。 */
+    cachedBaseTokens = null;
+    /** 指定会话（缺省 = 活跃会话）系统提示词 + 工具 schema 的基础 token 开销
+     *  （与设置面板中的「合计」完全一致）。会话未就绪返回 null——调用方必须区分
+     *  null 与 0：把 0 写进 lastTurnBaseTokens 会让后续轮次双计全额 base。 */
+    currentBaseTokens(target) {
+        const conv = target ?? this.convs.get(this.activeId);
+        if (!conv)
+            return null;
+        const now = Date.now();
+        if (this.cachedBaseTokens &&
+            this.cachedBaseTokens.convId === conv.id &&
+            now - this.cachedBaseTokens.at < STATS_CACHE_MS) {
+            return this.cachedBaseTokens.tokens;
+        }
+        const snap = this.sessionPromptSnapshot(conv);
+        if (!snap)
+            return null;
+        const prompt = estimatePromptTokens(snap.full);
+        const schema = estimatePromptTokens(snap.toolsSchema);
+        const tokens = prompt + schema;
+        this.cachedBaseTokens = { at: now, convId: conv.id, tokens };
+        return tokens;
+    }
     /** Web-facing extension UI context (widgets, notifications). */
     webUi = new WebUIContext((msg) => this.emit(msg));
     /**
@@ -1463,6 +2076,96 @@ export class ClientSession {
      * 历史/resume 列表）、listed=true 出现在左栏「运行的对话」并向用户可见——
      * 切换查看 / 输入补充（steer）/ 中止（abort）/ 移出全部复用现有对话机制。
      */
+    subagentHandoffs = [];
+    /**
+     * 多智能体同行协作与直接交接（Peer-to-Peer Subagents & Hand-off）：
+     * 将任务产物、分析结果或后续指令直接从一个子代理路由至另一个同行子代理，
+     * 无需主会话反复充当传声筒消耗双倍 token。
+     */
+    async handoffSubagent(fromRunId, toRunId, payload) {
+        if (fromRunId === toRunId) {
+            throw new Error("Cannot hand off to oneself");
+        }
+        const toConv = this.convs.get(toRunId);
+        if (!toConv) {
+            throw new Error(`Target subagent ${toRunId} not found`);
+        }
+        const fromConv = this.convs.get(fromRunId);
+        const fromType = fromConv?.subagentType ?? "peer";
+        const toType = toConv.subagentType ?? "peer";
+        const handoffMessage = `[Peer Hand-off from ${fromType} subagent (${fromRunId.slice(0, 8)})]:\n\n${payload}`;
+        const record = { fromRunId, toRunId, timestamp: Date.now() };
+        this.subagentHandoffs.push(record);
+        if (!fromConv?.peerHandoffTo) {
+            if (fromConv)
+                fromConv.peerHandoffTo = [];
+        }
+        fromConv?.peerHandoffTo?.push(toRunId);
+        if (!toConv.peerHandoffFrom)
+            toConv.peerHandoffFrom = [];
+        toConv.peerHandoffFrom.push(fromRunId);
+        // 向目标子代理注入对等交接消息
+        await toConv.session.sendUserMessage(handoffMessage, toConv.session.isStreaming ? { deliverAs: "steer" } : undefined);
+        // 广播交接事件
+        this.emit({
+            type: "subagent_handoff",
+            fromRunId,
+            toRunId,
+            payload,
+            timestamp: record.timestamp,
+        });
+        // 向主会话推送通知
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `子代理 ${fromRunId.slice(0, 8)}（${fromType}）已向同行子代理 ${toRunId.slice(0, 8)}（${toType}）直接交接`,
+            textEn: `Subagent ${fromRunId.slice(0, 8)} (${fromType}) handed off directly to ${toRunId.slice(0, 8)} (${toType})`,
+        });
+        this.emitConversations();
+        this.flushSnapshot();
+    }
+    /**
+     * 多级分层上下文预算裁剪（Hierarchical Context Budgeting）：
+     * 当上下文达到预警水位（例如 70%）时，自动执行第一级（远期工具输出裁剪）和
+     * 第二级（已完成步骤折叠），推迟触发全量 LLM 压缩，保留近期关键代码的细节。
+     */
+    applyContextBudgetPruning(conv) {
+        if (!conv?.session)
+            return;
+        try {
+            const contextWindow = contextWindowOf(conv.session);
+            if (!contextWindow || contextWindow <= 0)
+                return;
+            const s = this.settingsSvc.current;
+            const modelId = modelKeyOf(conv.session);
+            const cap = effectiveSoftCap(s.softCapTokens, s.softCapByModel, modelId);
+            const reserve = softCapToReserve(contextWindow, cap) ?? DEFAULT_COMPACTION_RESERVE_TOKENS;
+            const messages = conv.session.agent.state.messages;
+            if (!messages || messages.length === 0)
+                return;
+            const result = pruneContextHierarchically(messages, {
+                contextWindow,
+                reserveTokens: reserve,
+                softCap: cap > 0 ? cap : null,
+            });
+            if (result.tier1.trimmedCount > 0 || result.tier2.foldedCount > 0) {
+                conv.session.agent.state.messages = result.messages;
+                const saved = result.tokensBefore - result.tokensAfter;
+                this.emit({
+                    type: "notice",
+                    level: "info",
+                    text: `分层上下文预算裁剪生效：已释放约 ${saved.toLocaleString()} tokens（裁剪远期工具输出/折叠已完成步骤），推迟全量压缩`,
+                    textEn: `Hierarchical context pruning active: freed ~${saved.toLocaleString()} tokens (trimmed tool outputs / folded steps), deferring full compaction`,
+                });
+                if (conv.id === this.conv.id) {
+                    this.flushSnapshot();
+                }
+            }
+        }
+        catch {
+            /* 预算裁剪尽力而为，不阻断主流程 */
+        }
+    }
     subagentHost = {
         spawnSubagent: (prompt, type, cwd, templateName, model, parentId, persist) => {
             // 模板：存在且启用时应用；传了名字但不可用 → 抛错让工具转给 AI。
@@ -1475,6 +2178,9 @@ export class ClientSession {
         },
         getSubagent: (convId) => this.getSubagentSnapshot(convId),
         listSubagents: (scope) => this.listSubagentSnapshots(scope),
+        handoffSubagent: async (fromRunId, toRunId, payload) => {
+            await this.handoffSubagent(fromRunId, toRunId, payload);
+        },
         steerSubagent: async (convId, message) => {
             const conv = this.convs.get(convId);
             if (!conv?.session)
@@ -1609,11 +2315,18 @@ export class ClientSession {
             },
             readHistorySession: async (path) => {
                 const all = await SessionManager.listAll(piSessionsRoot());
-                const hit = all.find((s) => resolve(s.path) === resolve(path));
+                // win32 路径大小写不敏感：客户端回传的盘符/目录大小写常与服务端
+                // 列表不一致，严格相等会把合法请求误判为“不在白名单”。大小写
+                // 归一后再比（posix 不受影响）。
+                const norm = (p) => {
+                    const r = resolve(p);
+                    return process.platform === "win32" ? r.toLowerCase() : r;
+                };
+                const hit = all.find((s) => norm(s.path) === norm(path));
                 if (!hit)
                     return undefined;
                 try {
-                    if (statSync(hit.path).size > 16 * 1024 * 1024)
+                    if (statSync(hit.path).size > MAX_TRANSCRIPT_SCAN_BYTES)
                         return undefined;
                     const text = readFileSync(hit.path, "utf8");
                     return {
@@ -1651,6 +2364,121 @@ export class ClientSession {
             store: () => this.getClaimStore?.(),
         };
     }
+    /** compact_context 工具的数据宿主：提供消息统计用于预检，以及注册 pending 压缩请求。
+     *  ownerId 语义同 skill / claimFiles（本 runtime 所属会话，不是派发瞬间 active）。 */
+    compactContextHost(ownerId) {
+        const target = () => {
+            try {
+                return (ownerId ?? "").trim() !== "" ? this.convs.get(ownerId.trim()) : this.convs.get(this.activeId);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        return {
+            conversationId: () => target()?.id ?? this.activeId,
+            getContextStats: () => {
+                const conv = target();
+                if (!conv)
+                    return { messageCount: 0, estimatedTokens: 0 };
+                let messages = [];
+                try {
+                    messages = conv.session.messages;
+                }
+                catch {
+                    messages = [];
+                }
+                let totalChars = 0;
+                for (const m of messages) {
+                    if (m && typeof m === "object" && "content" in m) {
+                        const content = m.content;
+                        if (Array.isArray(content)) {
+                            for (const c of content) {
+                                if (c &&
+                                    typeof c === "object" &&
+                                    "type" in c &&
+                                    c.type === "text" &&
+                                    typeof c.text === "string") {
+                                    totalChars += c.text.length;
+                                }
+                            }
+                        }
+                        else if (typeof content === "string") {
+                            totalChars += content.length;
+                        }
+                    }
+                }
+                return {
+                    messageCount: messages.length,
+                    estimatedTokens: Math.ceil(totalChars / 4),
+                };
+            },
+            scheduleCompaction: (pending) => {
+                const conv = target();
+                if (conv) {
+                    conv.pendingCompaction = pending;
+                }
+            },
+        };
+    }
+    /** 执行由 AI 调用 compact_context 安排的上下文压缩（在 agent_settled 阶段调用）。 */
+    async executePendingCompaction(conv, pending) {
+        const instructions = buildCompactionInstructions(pending.focus, pending.summary);
+        const session = conv.session;
+        const model = session.model;
+        let originalKeepRecent;
+        try {
+            originalKeepRecent =
+                session.settingsManager.getCompactionSettings(model)?.keepRecentTokens ?? session.settingsManager.getCompactionSettings().keepRecentTokens;
+        }
+        catch {
+            originalKeepRecent = undefined;
+        }
+        try {
+            if (pending.keepRecentTokens && pending.keepRecentTokens > 0) {
+                session.settingsManager.applyOverrides({
+                    compaction: {
+                        keepRecentTokens: pending.keepRecentTokens,
+                    },
+                });
+            }
+            await session.compact(instructions || undefined);
+            const retainTokens = pending.keepRecentTokens ?? DEFAULT_KEEP_RECENT_TOKENS;
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: `AI 已主动根据当前问题完成上下文压缩（保留 ~${retainTokens.toLocaleString()} tokens 近期上下文，重点保留当前问题相关内容）`,
+                textEn: `Context compacted proactively based on current issue (retained ~${retainTokens.toLocaleString()} tokens, focused on current task)`,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `主动上下文压缩未完成：${msg}`,
+                textEn: `Proactive context compaction did not finish: ${msg}`,
+            });
+        }
+        finally {
+            if (pending.keepRecentTokens && pending.keepRecentTokens > 0) {
+                try {
+                    if (originalKeepRecent !== undefined) {
+                        session.settingsManager.applyOverrides({
+                            compaction: {
+                                keepRecentTokens: originalKeepRecent,
+                            },
+                        });
+                    }
+                }
+                catch {
+                    // best effort
+                }
+            }
+            this.applyCompactionOverrides();
+            this.flushSnapshot();
+        }
+    }
     /** skill 工具的数据宿主：读所属会话 loader 的实时技能表 + 主会话禁用集过滤
      * （与 skillsOverride 主会话语义一致）。ownerId 语义同 browser_page（本
      * runtime 所属会话，不是派发瞬间的 active）。失败回空目录，不抛错。 */
@@ -1742,6 +2570,8 @@ export class ClientSession {
     watchTimer = null;
     /** 子代理模板库（全局共享，<dataDir>/subagent-templates.json）。 */
     subagentTemplates;
+    /** 审批规则库（全局共享，<dataDir>/approval-rules.json）。 */
+    approvalRules;
     /** 未发送输入框草稿（全局共享，<dataDir>/composer-drafts.json，按 sessionId 键入，见 server/composer-drafts.ts）。 */
     drafts;
     /** 内置标记服务（todo/notify/svc/rename 等，可全局/分组开关）。 */
@@ -1756,6 +2586,11 @@ export class ClientSession {
     /** 待答提问（id → 载荷 + resolve）。一次正常只有一个（agent 阻塞在工具执行）；
      *  conversationId 记录谁问的：看门狗豁免、快照恢复都靠它。 */
     pendingQuestions = new Map();
+    /** 任务计划管理器（Plan Mode / Step State Machine）。 */
+    planManager = new PlanManager();
+    approvalSeq = 0;
+    /** 待审批高危工具调用（Human-in-the-Loop: Edit & Run）。 */
+    pendingApprovals = new Map();
     // -----------------------------------------------------------------------
     // 浏览器页面桥（标准 pi 引擎的 browser_page customTool）：模型调工具 → 发
     // page_request 给浏览器 → 前端转 page-picker 扩展 → page_response 回到这里
@@ -1777,6 +2612,7 @@ export class ClientSession {
         this.stateStore = stateStore;
         this.roots = stateStore.getWorkspaceRoots(clientId, cwd);
         this.subagentTemplates = new SubagentTemplatesStore(join(stateStore.dataDir, "subagent-templates.json"));
+        this.approvalRules = new ApprovalRulesStore(join(stateStore.dataDir, "approval-rules.json"));
         this.drafts = new ComposerDraftsStore(join(stateStore.dataDir, "composer-drafts.json"));
         this.markerSvc = new MarkerService({
             clientId,
@@ -1819,20 +2655,21 @@ export class ClientSession {
                 // （含重试次数覆盖）——依次重放：重试覆盖 → 软上限覆盖 → 终端门控。
                 this.applyRetryOverrides();
                 this.applyCompactionOverrides();
-                // reload() 会把 custom 工具重新加回活跃集——重放终端开关。
-                this.applyToolGating(this.session);
+                // reload() 会把 custom 工具重新加回活跃集——重放当前会话归属预设门控。
+                this.applyToolGating(this.session, this.conv?.agentPreset);
                 await this.pushSlashCommands();
             },
             applyRetryOverrides: () => this.applyRetryOverrides(),
             applyCompactionOverrides: () => this.applyCompactionOverrides(),
-            applyToolGating: () => this.applyToolGating(this.session),
+            applyToolGating: () => this.applyToolGating(this.session, this.conv?.agentPreset),
             promptSnapshot: () => this.promptSnapshot(),
             getMarkerState: () => ({
                 markersEnabled: this.markerSvc.current.markersEnabled,
                 disabledMarkers: [...this.markerSvc.current.disabledMarkers],
                 markers: this.markerSvc.listForUi(),
             }),
-        }, this.subagentTemplates);
+            getApprovalPolicy: () => this.approvalPolicyState(),
+        }, this.subagentTemplates, this.approvalRules);
         this.goalSvc = new GoalService({
             clientId,
             agentDir,
@@ -1954,7 +2791,7 @@ export class ClientSession {
      * 应用（prompt replace/append + 白名单），其余（终端接管、Windows persona
      * 等）仍跟随主会话设置。undefined = 按主会话设置（普通对话/不选模板的子代理）。
      */
-    makeRuntimeFactory(terminals, apply, ownerId, initialModel) {
+    makeRuntimeFactory(terminals, apply, ownerId, initialModel, targetPreset) {
         return async ({ cwd: effectiveCwd, sessionManager }) => {
             const services = await createAgentSessionServices({
                 cwd: effectiveCwd,
@@ -1998,7 +2835,9 @@ export class ClientSession {
                             // GBK 老中文文件让模型改用终端按正确编码读（iconv/chcp/Get-Content）。
                             out.push(WINDOWS_PERSONA);
                         }
-                        if (isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current))) {
+                        // 终端引导只教「开关开着且预设下仍可用」的工具（见 tool-manager.ts 语义总表）。
+                        const presetForGuidance = this.convs.get(ownerId ?? "")?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+                        if (isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current), presetForGuidance)) {
                             // 终端工具使用引导（全平台）：告诉模型什么场景该用持久终端
                             // 而不是一次性 bash——没有这段模型几乎从不主动选终端工具。
                             // 组内工具全关时不注入（不教 AI 用不存在的工具）。
@@ -2011,12 +2850,17 @@ export class ClientSession {
                             out.push(markerGuidance);
                         return out;
                     },
-                    // 技能：模板非空白名单时只启用白名单里的；否则按主会话禁用集过滤。
+                    // 技能：模板非空白名单时只启用白名单里的（显式配置优先于预设）；
+                    // 否则按主会话禁用集过滤。预设拿掉 skill 加载器时（minimal/code/ask）
+                    // 名录同步隐藏——列出来但调不动只是噪音（见 tool-manager.ts 语义总表）。
                     skillsOverride: (res) => {
                         if (apply && apply.enabledSkills.length > 0) {
                             const set = new Set(apply.enabledSkills);
                             return { ...res, skills: res.skills.filter((s) => set.has(s.name)) };
                         }
+                        const preset = this.convs.get(ownerId ?? "")?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+                        if (!presetShowsSkillCatalog(preset))
+                            return { ...res, skills: [] };
                         return {
                             ...res,
                             skills: res.skills.filter((s) => !this.settingsSvc.current.disabledSkills.includes(s.name)),
@@ -2068,19 +2912,40 @@ export class ClientSession {
                                         const swapped = tplPrompt + event.systemPrompt.slice(boundary);
                                         return swapped === event.systemPrompt ? undefined : { systemPrompt: swapped };
                                     }
-                                    // 主会话：组合模板渲染（模板为空且无覆盖时返回 undefined = 用 SDK 默认）。
+                                    // 主会话：按当前会话归属预设与真正活跃的工具列表组装系统提示词
+                                    const conv = this.convs.get(ownerId ?? this.activeId) ?? this.conv;
+                                    const sess = conv?.session;
+                                    const activeToolNames = sess ? sess.getActiveToolNames() : [];
+                                    const activeSet = new Set(activeToolNames);
+                                    const activeSnippets = {};
+                                    const activeGuidelines = [];
+                                    if (sess) {
+                                        for (const name of activeSet) {
+                                            const def = sess.getToolDefinition(name);
+                                            if (!def)
+                                                continue;
+                                            if (def.promptSnippet && def.promptSnippet.trim()) {
+                                                activeSnippets[name] = def.promptSnippet.trim();
+                                            }
+                                            if (def.promptGuidelines) {
+                                                activeGuidelines.push(...def.promptGuidelines);
+                                            }
+                                        }
+                                    }
+                                    const currentPreset = conv?.agentPreset ?? targetPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
                                     const opts = event.systemPromptOptions;
                                     const rendered = this.renderMainCompose({
-                                        cwd: typeof opts?.cwd === "string" ? opts.cwd : this.cwd,
-                                        selectedTools: opts?.selectedTools ?? [],
-                                        toolSnippets: opts?.toolSnippets ?? {},
-                                        toolGuidelines: opts?.promptGuidelines ?? [],
+                                        cwd: typeof opts?.cwd === "string" ? opts.cwd : (conv?.cwd ?? effectiveCwd ?? this.cwd),
+                                        selectedTools: activeToolNames.length > 0 ? activeToolNames : (opts?.selectedTools ?? []),
+                                        toolSnippets: activeSnippets,
+                                        toolGuidelines: activeGuidelines,
                                         contextFiles: opts?.contextFiles ?? [],
                                         skills: (opts?.skills ?? []).map((s) => ({
                                             name: s.name,
                                             description: s.description ?? "",
                                             filePath: s.filePath ?? "",
                                         })),
+                                        preset: currentPreset,
                                     });
                                     return rendered ? { systemPrompt: rendered } : undefined;
                                 });
@@ -2130,31 +2995,60 @@ export class ClientSession {
                 // 「默认 bash 覆盖」开关（terminalBash）关 → 原生 SDK bash（纯进程、不开终端）；
                 // 开 → 终端接管 bash（persist 决定一次性/持久，可静默自动转后台）。
                 customTools: [
-                    makeAdaptiveBashTool(
+                    // P1-5：bash/read 包插件拦截（pre 拒/问即拦、post 脱敏补上下文；
+                    // 未注入 toolGuard 时 withToolGuard 原样返回，零开销）。
+                    // 权限沙箱拦截（只读模式拦截终端执行）。
+                    wrapBashToolWithPermission(withToolGuard(makeAdaptiveBashTool(
                     // issue #91：bash 返回按客户端 UI 语言出中英（英文默认）。
                     makeKillableBashTool(effectiveCwd, this.bashKills, () => this.getLang()), makeTerminalBashTool(terminals, {
                         cwd: effectiveCwd,
                         // 设置开 = 用终端；此分支里 persist 未显式给时默认一次性（false）。
                         defaultPersist: () => false,
                         idleMs: () => Math.max(0, Math.floor(this.settingsSvc.current.terminalBashIdleMs) || 0),
+                        maxForegroundMs: () => Math.max(0, Math.floor(this.settingsSvc.current.terminalBashMaxForegroundMs) || 0),
                         kills: this.bashKills,
                         notifyBackgroundDone: (info) => this.notifyTerminalBashDone(terminals, info),
                         // issue #91：bash 返回按客户端 UI 语言出中英（英文默认）。
                         lang: () => this.getLang(),
                     }), 
                     // 设置关 → 原生 bash；开 → 终端 bash。
-                    () => this.settingsSvc.current.terminalBash),
-                    ...makePersistentTerminalTools(terminals, effectiveCwd, () => this.getLang()),
-                    // 覆盖 SDK 内置 read（customTools 按 name 覆盖）：路径是目录时列出目录
-                    // 条目（复用 SDK ls 的排序/`/` 后缀/截断口径），其余情况原样转发内置实现。
-                    // 开关是行为开关（read 本体不可关），每次调用实时读设置——不进
-                    // tool-manager 的 ActiveSet 目录。DSH 引擎无 customTool 注册面，不接。
-                    makeReadDirTool(effectiveCwd, {
-                        dirEnabled: () => this.settingsSvc.current.readDirEnabled !== false,
+                    () => this.settingsSvc.current.terminalBash), {
+                        toolName: "bash",
+                        guard: this.toolGuard,
+                        conversationId: () => ownerId,
                         getLang: () => this.getLang(),
+                        cwd: effectiveCwd,
+                        getRoots: () => this.roots,
+                        askApproval: (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category),
+                        getRules: () => this.approvalRules.list(),
+                    }), () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.getLang()),
+                    ...makePersistentTerminalTools(terminals, effectiveCwd, () => this.getLang(), {
+                        checkSafety: (cmd) => {
+                            const perm = (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                                this.settingsSvc.current.defaultPermissionPreset ??
+                                "workspace-write-never";
+                            if (perm === "read-only") {
+                                const danger = checkDangerousToolCall("bash", { command: cmd }, effectiveCwd, this.roots, this.approvalRules.list());
+                                if (danger.denied || danger.dangerous) {
+                                    return { blocked: true, reason: danger.reason || "只读模式禁止执行高危/破坏性命令" };
+                                }
+                            }
+                            const danger = checkDangerousToolCall("bash", { command: cmd }, effectiveCwd, this.roots, this.approvalRules.list());
+                            if (danger.denied) {
+                                return { blocked: true, reason: danger.reason || "命中系统阻断规则" };
+                            }
+                            return {};
+                        },
                     }),
-                    // 不覆盖内置 edit 的独立宽松编辑工具（缩进不敏感匹配；开关看设置）。
-                    makeEditSoftTool(effectiveCwd, () => this.getLang()),
+                    // read / write / edit 三处覆盖**不在这里注册**：创建时的 customTools 恒胜、与
+                    // 扩展加载顺序无关，直接塞进来会静默顶掉第三方扩展注册的同名工具（见
+                    // tool-overrides.ts）；它们改在会话建好后由 installToolOverrides 注入。
+                    // 不覆盖内置 edit 的独立宽松编辑工具（缩进不敏感匹配；开关看设置；带权限沙箱拦截与人机协同）。
+                    wrapEditSoftToolWithPermission(makeEditSoftTool(effectiveCwd, () => this.getLang()), effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                        this.settingsSvc.current.defaultPermissionPreset ??
+                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
                     // 插件注册的 AI 工具（创建时刻的实时快照，已按 disabledPluginTools 过滤；
                     // 后续注册经 refreshPluginTools 动态补入已有会话）。
                     // 子代理模板带非空扩展白名单时不注入：插件/MCP 工具没有 SDK extensionKey
@@ -2179,6 +3073,8 @@ export class ClientSession {
                         : [makeDelegateTaskTool(this.subagentHost)]),
                     // 内置标记只读查询工具（todo/svc 状态查询，写操作走内联标记）。
                     makeMarkersListTool(() => this.activeId, this.markerSvc),
+                    // 结构化任务计划更新（Plan Mode / Step State Machine）。
+                    makePlanUpdateTool(this.planManager, () => ownerId ?? this.activeId, (msg) => this.emit(msg), () => this.flushSnapshot()),
                     // 标准引擎的 ask_user_question：模型调用 → 浏览器富渲染问卷（复用 DSH
                     // 的 question_pending/question_answer 协议，前端 DshQuestionDialog）。
                     // DSH 引擎不经此（它走 goal-rpc 的 userQuestions provider）。
@@ -2218,18 +3114,36 @@ export class ClientSession {
                     // 子代理会话同样注册（owner 即真正派发的父对话，读该会话 loader）。
                     // DSH 引擎无 customTool 注册面，不接。开关走统一工具 tab。
                     makeSkillTool(this.skillToolHost(ownerId), () => this.getLang()),
+                    // 主动压缩上下文工具（compact_context）：AI 主动根据当前问题精简上下文。
+                    // 开关走统一工具 tab（ActiveSet 门控）。DSH 引擎无 customTool 注册面，不接。
+                    makeCompactContextTool(this.compactContextHost(ownerId), () => this.getLang()),
                     // 定时唤醒三件套（schedule_task/list/cancel，issue #193）：默认绑定
                     // 发起对话（ownerId，无则活动对话），到期 steer 语义唤醒它；子代理
                     // 会话同样注册（owner 即真正派发的父对话）。开关走统一工具 tab。
                     // DSH 引擎无 customTool 注册面，不接。
                     ...makeScheduleTools(this.scheduleToolHost(), ownerId, () => this.getLang()),
+                    // 持久代码求值沙箱（eval）：开关走统一工具 tab（ActiveSet 门控，默认关）。
+                    // ownerId 绑定当前会话；DSH 引擎无 customTool 注册面，不接。
+                    makeEvalTool({
+                        cwd: effectiveCwd,
+                        ownerId,
+                        lang: () => this.getLang(),
+                    }),
+                    // 高可靠行补丁工具（patch，基于内容哈希与语法块级替换）。
+                    makePatchTool({ cwd: effectiveCwd, ownerId }),
+                    // 原生语言服务器工具（lsp，定义跳转/引用/悬停/诊断）。
+                    makeLspTool({ cwd: effectiveCwd, ownerId }),
                 ],
             });
             // 桥接工具归属锚点：SDK 会话对象在本 runtime 生命周期内稳定，过户只搬对话
             // 不改它（见 ClientSession.findConversationHome）。
             bridgeAnchor.session = created.session;
-            // 终端工具开关从创建起就生效（工具始终注册进注册表，只调活跃集）。
-            this.applyToolGating(created.session);
+            // read / write / edit 三处覆盖在会话建好后注入（见 tool-overrides.ts）：SDK 的合并链是
+            // [...扩展工具, ...customTools] 后写赢 ⇒ 创建时塞进 customTools 会**恒定顶掉**第三方
+            // 扩展注册的同名工具（官方 docs/extensions.md 明写扩展可覆盖 read/write/edit）。
+            installToolOverrides(created.session, this.toolOverrideSpecs(ownerId, effectiveCwd));
+            // 终端工具开关与预设门控从创建起就生效（工具始终注册进注册表，只调活跃集）。
+            this.applyToolGating(created.session, targetPreset);
             return {
                 ...created,
                 services,
@@ -2256,6 +3170,11 @@ export class ClientSession {
             session: runtime.session,
             cwd: runtime.cwd,
             createdAt: Date.now(),
+            agentPreset: this.settingsSvc.current.defaultAgentPreset ?? "standard",
+            presetLocked: false,
+            permissionPreset: readPermissionFromSession(runtime.session.sessionManager) ??
+                this.settingsSvc.current.defaultPermissionPreset ??
+                "workspace-write-never",
             // A brand-new conversation is not yet LISTED — it enters the running
             // list only when it is displaced to the background while still
             // streaming (its runtime is what `listed` protects). A blank chat is
@@ -2283,6 +3202,7 @@ export class ClientSession {
             queueFollowUp: [],
             toolStartTimes: new Map(),
             toolWatchdogs: new Map(),
+            workspaceSnapshots: [],
         };
     }
     /** Summaries of conversations currently streaming — captured at shutdown
@@ -2341,7 +3261,7 @@ export class ClientSession {
                     textEn: `Restart interrupted "${r.title}" — reopening it and continuing automatically.`,
                 });
                 await this.switchSession(r.sessionFile);
-                await this.prompt(continueText);
+                await this.promptResumedConversation(r.sessionFile, continueText);
             }
             catch {
                 // switchSession/prompt already surface failures as notices;
@@ -2359,6 +3279,50 @@ export class ClientSession {
             /* staying on the last resumed session is a fine fallback */
         }
     }
+    /** 找持有指定转录文件的本地对话 id（找不到 = 已被关闭/搬走/还没建好）。 */
+    conversationIdBySessionFile(file) {
+        let abs;
+        try {
+            abs = resolve(file);
+        }
+        catch {
+            return null;
+        }
+        for (const c of this.convs.values()) {
+            try {
+                const f = c.session.sessionFile;
+                if (f && resolve(f) === abs)
+                    return c.id;
+            }
+            catch {
+                // session 被替换中 —— 跳过
+            }
+        }
+        return null;
+    }
+    /**
+     * 恢复流程的「继续」投递（resumeInterrupted 专用）。
+     * 读码结论：prompt() 在**调用时刻**同步捕获 active 对话（进入函数第一行取
+     * this.conv，先于任何 await），调用之后发生的切换不影响投递目标。唯一的错投
+     * 窗口在 switchSession 内部：activeId 置位后还要 await bindSession/恢复模型，
+     * 期间用户的并发切换会把 active 挪走 —— 恢复循环接着调 prompt 就会把「继续」
+     * 投进用户当前对话。因此投递前把目标对话修回 active，并在同一同步执行段内
+     * （上一个 await 恢复点之后、无新 await 处）核对 activeId 后才调用 prompt；
+     * 修不回（再次被抢）就放弃自动继续 —— 宁可少投，不投错对话。
+     */
+    async promptResumedConversation(sessionFile, text) {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const targetId = this.conversationIdBySessionFile(sessionFile);
+            if (!targetId)
+                return; // 目标对话已没了（被关/被过户），不投
+            if (this.activeId === targetId) {
+                await this.prompt(text);
+                return;
+            }
+            await this.switchConversation(targetId);
+        }
+        // 两次都没能稳定拿回 active：放弃自动继续，用户可手动点开那条对话。
+    }
     /** Add a socket to this client's broadcast set; flushes buffered startup notices. */
     attachSink(send) {
         this.sinks.add(send);
@@ -2396,6 +3360,9 @@ export class ClientSession {
         // Reconnect: push the global default model (the picker's ★ marker +
         // "set as global default" button state).
         this.pushDefaultModel();
+        // Reconnect: push agent presets and permission presets (align with DSH).
+        this.refreshAgentPresets();
+        this.refreshPermission();
         // PTYs are conversation-owned and survive a socket reconnect.
         this.pushTerminals();
     }
@@ -2416,6 +3383,34 @@ export class ClientSession {
         for (const sink of [...this.sinks])
             sink(msg);
     }
+    /** 扩展错误上报器：同一会话内「扩展 + 事件 + 错误文本」只提示一次，且全量落服务端日志。
+     *
+     *  SDK 的 `ExtensionRunner.emitContext()` 在**每次 provider 请求**前都会跑一遍
+     *  扩展的 `context` hook，并对每个 handler 的报错回调 `onError`。in-memory 会话
+     *  （子代理 / 无痕会话）取不到会话目录（`SessionManager.inMemory(cwd)` 的
+     *  `getSessionDir()` 返回空串），于是「会话目录依赖型」扩展（如 SoL-Pi 的
+     *  `runtimeRoot()`）每轮都抛同一个错——原样广播就等于按轮数刷屏（issue #298）。
+     *
+     *  `prefix` 给 notice 带上会话归属：用户一眼能看出是后台会话的问题，
+     *  而不是当前对话坏了（与同函数内其它子代理通知的口径一致）。 */
+    makeExtensionErrorReporter(prefix) {
+        const seen = new Set();
+        return (err) => {
+            const message = err?.error ?? String(err);
+            const where = [err?.extensionPath, err?.event].filter(Boolean).join(" · ");
+            console.error(`[extension] ${prefix?.text ?? "当前对话"}${where ? ` (${where})` : ""}: ${message}${err?.stack ? `\n${err.stack}` : ""}`);
+            const key = `${err?.extensionPath ?? ""}|${err?.event ?? ""}|${message}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: prefix ? `${prefix.text}扩展报错：${message}` : message,
+                textEn: prefix ? `${prefix.textEn} Extension error: ${message}` : message,
+            });
+        };
+    }
     /** (Re)attach event plumbing to the ACTIVE conversation's session. */
     async bindSession() {
         const conv = this.conv;
@@ -2424,9 +3419,7 @@ export class ClientSession {
         await conv.session.bindExtensions({
             mode: "rpc",
             uiContext: this.webUi,
-            onError: (err) => {
-                this.emit({ type: "notice", level: "error", text: err.error, textEn: err.error });
-            },
+            onError: this.makeExtensionErrorReporter(conv.isEphemeral ? { text: `临时对话 ${conv.id}：`, textEn: `Ephemeral chat ${conv.id}: ` } : undefined),
         });
         conv.unsubscribe = conv.session.subscribe((event) => this.onEvent(conv, event));
         // 新会话 / 切换会话 / 强杀重建的必经之路：刚创建的 runtime 用的是 SDK
@@ -3152,6 +4145,7 @@ export class ClientSession {
                     if (stopNotice) {
                         this.emit({ type: "notice", level: "warning", text: stopNotice.text, textEn: stopNotice.textEn });
                     }
+                    this.emitConversations();
                     break;
                 }
                 // 子代理运行报错（provider 400 / 超时等）→ 通知主对话，让用户/AI 知道
@@ -3208,6 +4202,33 @@ export class ClientSession {
                 catch {
                     // sidecar 只是加速 + 防压缩丢失，失败了下次重算
                 }
+                // AI 主动上下文压缩：若本轮调过 compact_context，在回合结算后异步执行压缩
+                if (!event.willRetry && !aborted && conv.pendingCompaction && !this.disposed) {
+                    const pending = conv.pendingCompaction;
+                    conv.pendingCompaction = null;
+                    setTimeout(() => {
+                        if (!this.disposed) {
+                            void this.executePendingCompaction(conv, pending);
+                        }
+                    }, 50);
+                }
+                // 本轮真正结束且不再重试：立即向客户端广播最新会话状态（流式状态及时复位）
+                if (!event.willRetry) {
+                    this.emitConversations();
+                }
+                break;
+            }
+            case "agent_settled": {
+                // 记录本会话自己的 Base 基线：currentBaseTokens 必须传 conv（否则串成
+                // 活跃会话的基线）；快照未就绪时保持 undefined，宁可少补偿也不把 0 钉死。
+                const settledBaseTokens = this.currentBaseTokens(conv);
+                if (settledBaseTokens != null)
+                    conv.lastTurnBaseTokens = settledBaseTokens;
+                if (conv.pendingCompaction && !this.disposed) {
+                    const pending = conv.pendingCompaction;
+                    conv.pendingCompaction = null;
+                    void this.executePendingCompaction(conv, pending);
+                }
                 break;
             }
             case "entry_appended": {
@@ -3485,14 +4506,42 @@ export class ClientSession {
                             tokens: conv.lastCompactionTokens,
                             contextWindow: cu.contextWindow,
                             percent: (conv.lastCompactionTokens / cu.contextWindow) * 100,
-                            estimated: true,
+                            estimated: false,
+                            softCap: this.activeSoftCap(cu.contextWindow),
+                        };
+                    }
+                    // 展示用兜底 0（会话未就绪时旧行为也是 0）；落账 lastTurnBaseTokens 的路径
+                    // 在 agent_settled 处对 null 跳过，不受此兜底影响。
+                    const baseTokens = this.currentBaseTokens(conv) ?? 0;
+                    // 空白会话（尚未发言，SDK 报 0 或 null）：真实反映当前模式/工具配置下的 Base 开销。
+                    if (cu.contextWindow > 0 && (this.isBlankConversation(conv) || cu.tokens == null || cu.tokens === 0)) {
+                        return {
+                            tokens: baseTokens,
+                            contextWindow: cu.contextWindow,
+                            percent: (baseTokens / cu.contextWindow) * 100,
+                            estimated: false,
+                            softCap: this.activeSoftCap(cu.contextWindow),
+                        };
+                    }
+                    // 首轮对话中（尚未有定稿 assistant 消息，SDK cu.tokens 仅为当前消息估算）：叠加 Base 开销
+                    if (conv.lastTurnBaseTokens == null && cu.contextWindow > 0) {
+                        const total = baseTokens + (cu.tokens ?? 0);
+                        return {
+                            tokens: total,
+                            contextWindow: cu.contextWindow,
+                            percent: (total / cu.contextWindow) * 100,
+                            estimated: false,
                             softCap: this.activeSoftCap(cu.contextWindow),
                         };
                     }
+                    // 已有多轮对话历史：若在对话间歇切预设或开关工具，叠加当前 Base 开销相比上一轮定稿时的差额
+                    const baseDelta = baseTokens - (conv.lastTurnBaseTokens ?? baseTokens);
+                    const effectiveTokens = Math.max(0, (cu.tokens ?? 0) + baseDelta);
                     return {
-                        tokens: cu.tokens,
+                        tokens: effectiveTokens,
                         contextWindow: cu.contextWindow,
-                        percent: cu.percent,
+                        percent: cu.contextWindow > 0 ? (effectiveTokens / cu.contextWindow) * 100 : cu.percent,
+                        estimated: false,
                         softCap: this.activeSoftCap(cu.contextWindow),
                     };
                 })(),
@@ -3519,6 +4568,12 @@ export class ClientSession {
             sessionId: this.session.sessionId,
             sessionFile: this.session.sessionFile,
             conversationId: this.activeId,
+            // 临时对话标记（issue #285）：提示条/转正按钮跟当前对话走。
+            // 不能只靠 conversations 列表 —— 空白的临时对话不在运行列表里（shownInRunningList
+            // 只列有内容的），刚新建时列表里查不到它，提示条就永远不出现。
+            // 必须**恒存在**（不能只在 true 时展开）：转正后它由 true→false，而增量快照是
+            // `{...ui, ...d.state}` 浅合并，缺字段会把 true 残留下来。
+            isEphemeral: !!this.conv?.isEphemeral,
             rev,
             streamingMessage,
             isStreaming: this.session.isStreaming,
@@ -3539,6 +4594,19 @@ export class ClientSession {
             retry: conv.retryState ?? null,
             compaction: conv.compactionState ?? null,
             pendingQuestion: this.pendingQuestionForSnapshot(),
+            pendingApproval: this.pendingApprovalForSnapshot(),
+            plan: this.planManager.getPlan(this.activeId),
+            subagentHandoffs: this.subagentHandoffs.length > 0 ? [...this.subagentHandoffs] : undefined,
+            agentPreset: conv
+                ? {
+                    id: conv.agentPreset ?? "standard",
+                    name: PI_AGENT_PRESETS.find((p) => p.id === conv.agentPreset)?.name ?? "全功能",
+                    locked: conv.presetLocked || !this.isBlankConversation(conv),
+                }
+                : null,
+            permission: conv
+                ? (conv.permissionPreset ?? this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never")
+                : null,
             // 未发送草稿只跟全量快照走（切会话/new_chat/get_state）：增量 delta 里
             // 这个 key 必须整个缺席（不能是显式的 undefined——前端 delta 合并是
             // {...ui, ...d.state} 整批覆盖，显式 undefined 会把上次全量带回的草稿洗掉）。
@@ -3715,6 +4783,10 @@ export class ClientSession {
             if (p.conversationId === undefined || p.conversationId === conversationId)
                 return true;
         }
+        for (const a of this.pendingApprovals.values()) {
+            if (a.conversationId === undefined || a.conversationId === conversationId)
+                return true;
+        }
         return false;
     }
     /** 标准引擎的 question_answer 路由入口（index.ts 经 cs.answerQuestion?. 转发）。
@@ -3733,27 +4805,241 @@ export class ClientSession {
         }
         return undefined;
     }
-    /** 取某对话的等答复问卷简要信息（用于会话列表与横幅展示）。 */
-    getPendingQuestionForConv(convId) {
-        for (const [id, p] of this.pendingQuestions) {
-            if (p.conversationId === undefined || p.conversationId === convId) {
-                const q0 = p.questions[0];
-                const title = q0?.header?.trim() || q0?.question?.trim() || undefined;
-                return { id, title };
-            }
+    /** 取某对话的等答复问卷简要信息（用于会话列表与横幅展示）。 */
+    getPendingQuestionForConv(convId) {
+        for (const [id, p] of this.pendingQuestions) {
+            if (p.conversationId === undefined || p.conversationId === convId) {
+                const q0 = p.questions[0];
+                const title = q0?.header?.trim() || q0?.question?.trim() || undefined;
+                return { id, title };
+            }
+        }
+        return undefined;
+    }
+    /** 跨页作答：把别处问卷的原文推给本页弹框（回答经 answerElsewhereQuestion 回去）。 */
+    pushElsewhereQuestion(owner, convId, q) {
+        this.emit({
+            type: "elsewhere_question",
+            owner,
+            convId,
+            id: q.id,
+            questions: q.questions,
+            ...(q.conversationTitle ? { conversationTitle: q.conversationTitle } : {}),
+        });
+    }
+    // -----------------------------------------------------------------------
+    // 人机协同工具审批桥（Tool Approval: Human-in-the-Loop Edit & Run）
+    // -----------------------------------------------------------------------
+    /**
+     * 弹审批（Human-in-the-Loop）。**三档放行门禁在入口**（策略纯函数见
+     * server/tool-approval.ts 的 approvalSuppressionReason）：
+     * - 全局开关关（设置 →「工具」页）→ 直接批准（不弹）；
+     * - 本对话「全部允许」/ 已记住该同类 → 直接批准（不弹）。
+     * 门禁都返回已 resolve 的 Promise，调用方（withToolGuard / 三个权限包装）
+     * 无需关心是否真的弹过窗。
+     */
+    askApproval(toolCallId, toolName, params, reason, reasonEn, conversationId, category) {
+        return new Promise((resolve) => {
+            if (this.disposed) {
+                resolve({ decision: "deny", reason: "会话已关闭" });
+                return;
+            }
+            const id = `appr-${++this.approvalSeq}`;
+            const conv = conversationId ? this.convs.get(conversationId) : this.conv;
+            const suppression = approvalSuppressionReason(conv?.approvalPolicy, this.settingsSvc.current.toolApprovalEnabled !== false, category?.id);
+            if (suppression) {
+                // 放行但不弹窗：不记 pending，不发消息，模型继续跑。
+                resolve({ decision: "approve" });
+                return;
+            }
+            const conversationTitle = conv?.title;
+            const entry = {
+                id,
+                toolCallId,
+                toolName,
+                params: params,
+                reason,
+                reasonEn,
+                ...(category ? { category } : {}),
+                conversationId,
+                conversationTitle,
+                resolve,
+                createdAt: Date.now(),
+            };
+            this.pendingApprovals.set(id, entry);
+            this.emit({
+                type: "tool_approval_pending",
+                id,
+                toolCallId,
+                toolName,
+                params: params,
+                reason,
+                reasonEn,
+                ...(category ? { category } : {}),
+                ...(conversationId !== undefined ? { conversationId } : {}),
+                ...(conversationTitle ? { conversationTitle } : {}),
+            });
+            this.flushSnapshot();
+        });
+    }
+    /**
+     * 审批答复。scope（仅 approve 有效）是「不再问」的两档记忆：
+     * - "category"：记住本对话的该同类档位；
+     * - "all"：本对话后续全部允许。
+     * 记住后，同一对话里**已被覆盖的其它待审批项一并放行**（否则用户点了
+     * 「全部允许」却还有几张弹窗挂着等点），并推一次设置面板（撤销区）。
+     */
+    resolveToolApproval(id, decision, editedParams, reason, scope) {
+        const pending = this.pendingApprovals.get(id);
+        if (!pending)
+            return false;
+        const convId = pending.conversationId ?? this.activeId;
+        const conv = this.convs.get(convId);
+        this.pendingApprovals.delete(id);
+        pending.resolve({ decision, editedParams, reason });
+        this.emit({ type: "tool_approval_resolved", id });
+        if (decision === "approve" && scope && scope !== "once" && conv) {
+            const policy = this.ensureApprovalPolicy(conv);
+            if (scope === "all")
+                policy.allowAll = true;
+            else if (pending.category)
+                policy.categories.set(pending.category.id, pending.category);
+            this.emitApprovalPolicyNotice(scope, pending.category, this.approveCoveredPending(convId, policy));
+            this.settingsSvc.push();
+        }
+        this.flushSnapshot();
+        return true;
+    }
+    /** 取出（或建出）对话的审批策略对象。 */
+    ensureApprovalPolicy(conv) {
+        if (!conv.approvalPolicy)
+            conv.approvalPolicy = { allowAll: false, categories: new Map() };
+        return conv.approvalPolicy;
+    }
+    /** 把某对话里已被策略覆盖的其它待审批项一并放行，返回放行条数。 */
+    approveCoveredPending(convId, policy) {
+        let n = 0;
+        // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+        for (const [oid, o] of [...this.pendingApprovals]) {
+            if ((o.conversationId ?? this.activeId) !== convId)
+                continue;
+            if (!approvalSuppressionReason(policy, true, o.category?.id))
+                continue;
+            this.pendingApprovals.delete(oid);
+            o.resolve({ decision: "approve" });
+            this.emit({ type: "tool_approval_resolved", id: oid });
+            n++;
+        }
+        return n;
+    }
+    /** 记住策略后给用户一句回执（文本双语，前端按 locale 自选）。 */
+    emitApprovalPolicyNotice(scope, category, auto = 0) {
+        const tailZh = auto > 0 ? `，并已自动放行另外 ${auto} 项待审批` : "";
+        const tailEn = auto > 0 ? ` (auto-approved ${auto} other pending request(s))` : "";
+        if (scope === "all") {
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: `本对话已允许全部工具审批，后续高危操作不再询问${tailZh}；可在 设置 →「工具」页撤销。`,
+                textEn: `All tool approvals are now allowed in this conversation${tailEn}; revoke it under Settings → Tools.`,
+            });
+            return;
+        }
+        const label = category?.label ?? "同类";
+        const labelEn = category?.labelEn ?? "this category";
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `本对话已允许「${label}」类操作，后续同类不再询问${tailZh}；可在 设置 →「工具」页撤销。`,
+            textEn: `Allowed "${labelEn}" in this conversation${tailEn}; revoke it under Settings → Tools.`,
+        });
+    }
+    /** 全局审批开关被关掉时：挂着的待审批全部按批准放行（否则弹窗还在等人点）。 */
+    autoApprovePendingApprovals(reasonZh, reasonEn) {
+        if (this.pendingApprovals.size === 0)
+            return;
+        let n = 0;
+        // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+        for (const [oid, o] of [...this.pendingApprovals]) {
+            this.pendingApprovals.delete(oid);
+            o.resolve({ decision: "approve" });
+            this.emit({ type: "tool_approval_resolved", id: oid });
+            n++;
+        }
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `${reasonZh}，已自动放行 ${n} 项待审批。`,
+            textEn: `${reasonEn} — auto-approved ${n} pending request(s).`,
+        });
+        this.flushSnapshot();
+    }
+    /**
+     * 设置面板撤销区用：当前对话的审批策略（allowAll + 已记住的同类档位）。
+     * 只回当前对话——撤销本来就是「在这里关掉这里的东西」，别的对话要撤销
+     * 就切过去（策略跟对话走，见 Conversation.approvalPolicy）。
+     */
+    approvalPolicyState() {
+        const conv = this.convs.get(this.activeId);
+        const policy = conv?.approvalPolicy;
+        return {
+            conversationId: this.activeId,
+            allowAll: policy?.allowAll ?? false,
+            categories: policy ? [...policy.categories.values()] : [],
+        };
+    }
+    /**
+     * 设置某对话的审批策略（设置面板撤销用）。只应用给出的字段：allowAll 直接赋值；
+     * categories 给出时作为保留名单整体替换（空数组 = 清掉全部同类记忆）。
+     */
+    setApprovalPolicy(partial) {
+        const convId = partial.conversationId ?? this.activeId;
+        const conv = this.convs.get(convId);
+        if (!conv)
+            return;
+        const cur = conv.approvalPolicy;
+        const next = {
+            allowAll: partial.allowAll ?? cur?.allowAll ?? false,
+            categories: new Map(cur?.categories ?? []),
+        };
+        if (partial.categories) {
+            const keep = new Set(partial.categories);
+            // eslint-disable-next-line unicorn/no-useless-spread -- 快照：循环里会从 map 删项（迭代中改集合）
+            for (const key of [...next.categories.keys()])
+                if (!keep.has(key))
+                    next.categories.delete(key);
+        }
+        conv.approvalPolicy = isApprovalPolicyEmpty(next) ? undefined : next;
+        this.settingsSvc.push();
+        this.flushSnapshot();
+    }
+    pendingApprovalForSnapshot() {
+        for (const [id, p] of this.pendingApprovals) {
+            if (p.conversationId !== undefined && p.conversationId !== this.activeId)
+                continue;
+            return {
+                id,
+                toolCallId: p.toolCallId,
+                toolName: p.toolName,
+                params: p.params,
+                reason: p.reason,
+                reasonEn: p.reasonEn,
+                ...(p.category ? { category: p.category } : {}),
+                conversationId: p.conversationId,
+                conversationTitle: p.conversationTitle,
+            };
         }
-        return undefined;
+        return null;
     }
-    /** 跨页作答：把别处问卷的原文推给本页弹框（回答经 answerElsewhereQuestion 回去）。 */
-    pushElsewhereQuestion(owner, convId, q) {
+    updatePlan(steps, activeStepId, conversationId) {
+        const convId = conversationId ?? this.activeId;
+        const plan = this.planManager.setPlan(convId, steps, activeStepId);
         this.emit({
-            type: "elsewhere_question",
-            owner,
-            convId,
-            id: q.id,
-            questions: q.questions,
-            ...(q.conversationTitle ? { conversationTitle: q.conversationTitle } : {}),
+            type: "plan_updated",
+            conversationId: convId,
+            plan,
         });
+        this.flushSnapshot();
     }
     /** 关闭所有挂起提问（dispose 时清理）：以「取消」解析，避免模型挂死。 */
     cancelPendingQuestions() {
@@ -3762,6 +5048,20 @@ export class ClientSession {
         }
         this.pendingQuestions.clear();
     }
+    /** 关闭所有挂起审批（dispose 时清理）：以「拒绝」解析，避免等答复的
+     *  Promise 与对应 runtime 泄漏（会话没了，审批弹窗永远不会有人点）。 */
+    cancelPendingApprovals() {
+        for (const [id, a] of this.pendingApprovals) {
+            this.pendingApprovals.delete(id);
+            try {
+                a.resolve({ decision: "deny", reason: "会话已关闭" });
+            }
+            catch {
+                // 单个 resolve 异常不影响其余清理
+            }
+            this.emit({ type: "tool_approval_resolved", id });
+        }
+    }
     // -----------------------------------------------------------------------
     // 浏览器页面桥（标准 pi 引擎 browser_page customTool）
     // -----------------------------------------------------------------------
@@ -3945,6 +5245,10 @@ export class ClientSession {
                     // Windows: npm and friends are .cmd shims — Node can only exec
                     // them through the shell (otherwise spawn npm → ENOENT).
                     shell: process.platform === "win32",
+                    // posix 下让子进程自成进程组：超时时能整组杀掉（孙进程不残留）。
+                    // 代价是父进程退出后子进程可能短暂存活——这些都是带超时的短命令，
+                    // 可接受；win32 不需要（走 taskkill /T）。
+                    detached: process.platform !== "win32",
                 });
             }
             catch (err) {
@@ -3960,7 +5264,27 @@ export class ClientSession {
                 clearTimeout(t);
                 resolve({ code, out: text ?? out });
             };
-            const t = setTimeout(() => p.kill(), timeoutMs);
+            const t = setTimeout(() => {
+                // 只 p.kill() 杀不掉整棵树（win32 下杀的是 cmd.exe 壳，posix 下
+                // 杀不到孙进程）—— 按平台走整树杀，失败再退回 p.kill 兜底。
+                const plan = processTreeKillPlan(process.platform, p.pid);
+                try {
+                    if (plan.kind === "taskkill") {
+                        // taskkill 独立进程执行：父 cmd 死活不影响命中目标树。
+                        spawn(plan.cmd, plan.args, { stdio: "ignore", windowsHide: true });
+                    }
+                    else if (plan.kind === "group-signal") {
+                        process.kill(-p.pid, plan.signal);
+                    }
+                    else {
+                        p.kill();
+                    }
+                }
+                catch {
+                    // 进程组已不在（正常退出竞态）等 —— 退回直接杀。
+                    p.kill();
+                }
+            }, timeoutMs);
             p.stdout?.on("data", (d) => (out += d.toString()));
             p.stderr?.on("data", (d) => (out += d.toString()));
             p.on("error", (err) => done(-1, String(err)));
@@ -4075,26 +5399,176 @@ export class ClientSession {
     /** Cache window for the all-source check: 30 minutes. */
     static UPDATE_ALL_CACHE_MS = 30 * 60_000;
     updatesAllCache = null;
+    notifiedPluginUpdates = new Set();
+    lastPluginUpdates = [];
+    /**
+     * 主动检查已安装界面插件（<dataDir>/plugins）的更新状态并向客户端推送。
+     */
+    async checkPluginUpdates(manual = false) {
+        const lang = () => this.getLang();
+        try {
+            const updates = await checkPluginUpdates(this.stateStore.dataDir, undefined, lang);
+            const list = updates.map((p) => ({
+                id: p.id,
+                name: p.name,
+                version: p.version,
+                latestVersion: p.latestVersion ?? null,
+                source: p.source,
+                localSha: p.localSha,
+                remoteSha: p.remoteSha,
+                updatable: p.updatable,
+                builtin: p.builtin,
+                error: p.error,
+            }));
+            this.lastPluginUpdates = list;
+            this.emit({ type: "plugin_updates", updates: list });
+            const updatableBuiltins = list.filter((p) => p.builtin && p.updatable);
+            if (manual) {
+                if (updatableBuiltins.length > 0) {
+                    const names = updatableBuiltins.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${updatableBuiltins.length} 个内置插件有更新：${names}`,
+                        textEn: `Update available for ${updatableBuiltins.length} built-in plugin(s): ${names}`,
+                    });
+                }
+                else {
+                    const allUpdatable = list.filter((p) => p.updatable);
+                    if (allUpdatable.length > 0) {
+                        const names = allUpdatable.map((p) => p.name || p.id).join(", ");
+                        this.emit({
+                            type: "notice",
+                            level: "info",
+                            text: `发现 ${allUpdatable.length} 个插件有更新：${names}`,
+                            textEn: `Update available for ${allUpdatable.length} plugin(s): ${names}`,
+                        });
+                    }
+                    else {
+                        this.emit({
+                            type: "notice",
+                            level: "info",
+                            text: "所有插件均为最新版本。",
+                            textEn: "All plugins are up to date.",
+                        });
+                    }
+                }
+            }
+            else {
+                const newUpdatables = updatableBuiltins.filter((p) => {
+                    const key = `${p.id}@${p.latestVersion || p.remoteSha || "upd"}`;
+                    if (this.notifiedPluginUpdates.has(key))
+                        return false;
+                    this.notifiedPluginUpdates.add(key);
+                    return true;
+                });
+                if (newUpdatables.length > 0) {
+                    const names = newUpdatables.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${newUpdatables.length} 个内置插件有更新可用：${names}，可前往设置或更新面板中更新。`,
+                        textEn: `Update available for ${newUpdatables.length} built-in plugin(s): ${names}. You can update in Settings or the Updates panel.`,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            if (manual) {
+                this.emit({
+                    type: "notice",
+                    level: "error",
+                    text: `检查插件更新失败：${err.message}`,
+                    textEn: `Failed to check plugin updates: ${err.message}`,
+                });
+            }
+        }
+    }
     /**
      * All-source update check: pi-web-ui + the pi core + direct pi extensions
-     * from the agent manifest (fallback: raw walk). Re-emits the cached list
+     * from the agent manifest (fallback: raw walk) + installed UI plugins. Re-emits the cached list
      * within UPDATE_ALL_CACHE_MS; pass force=true (explicit refresh) to bypass.
      */
     async checkUpdatesAll(force = false) {
+        // issue #321：pi SDK 副本状态随结果下发（运行中是哪份 / 是否自带 / 机器上有没有
+        // 更新的），UI 据此在更新面板亮「重启跟上」与「安装全局引擎并切换」入口。
+        // 缓存命中也现算：用户升级全局 pi 不经本服务，缓存的 items 不影响这个判据，
+        // 探针本身有 10s memoize，重算便宜。
+        const piSdk = {
+            running: VERSION,
+            bundledInUse: isBundledInUse(sdkCopies(), VERSION),
+            newerInstalled: detectPiSdkSplit(VERSION)?.installed ?? null,
+        };
         if (!force && this.updatesAllCache && Date.now() - this.updatesAllCache.at < ClientSession.UPDATE_ALL_CACHE_MS) {
             this.emit({
                 type: "update_status_all",
                 items: this.updatesAllCache.items,
+                piSdk,
             });
+            if (this.lastPluginUpdates.length > 0) {
+                this.emit({ type: "plugin_updates", updates: this.lastPluginUpdates });
+            }
             return;
         }
         try {
             const targets = collectTargets(this.agentDir, ClientSession.currentAppVersion(), undefined, {
-                projectCwd: this.conv?.cwd ?? this.cwd,
+                projectCwd: this.convs.get(this.activeId)?.cwd ?? this.cwd,
             });
-            const items = sortUpdateItems(await checkAllUpdates(targets, undefined, () => this.getLang(), resolveNpmRegistry(this.agentDir)));
-            this.updatesAllCache = { at: Date.now(), items };
-            this.emit({ type: "update_status_all", items });
+            const items = await checkAllUpdates(targets, undefined, () => this.getLang(), resolveNpmRegistry(this.agentDir));
+            let pluginItems = [];
+            try {
+                const pluginUpdates = await checkPluginUpdates(this.stateStore.dataDir, undefined, () => this.getLang());
+                const list = pluginUpdates.map((p) => ({
+                    id: p.id,
+                    name: p.name,
+                    version: p.version,
+                    latestVersion: p.latestVersion ?? null,
+                    source: p.source,
+                    localSha: p.localSha,
+                    remoteSha: p.remoteSha,
+                    updatable: p.updatable,
+                    builtin: p.builtin,
+                    error: p.error,
+                }));
+                this.lastPluginUpdates = list;
+                this.emit({ type: "plugin_updates", updates: list });
+                pluginItems = pluginUpdates.map((p) => ({
+                    name: p.name ? `${p.name} (${p.id})` : p.id,
+                    kind: "plugin",
+                    current: p.version ? `v${p.version}` : (p.localSha ?? "unknown"),
+                    latest: p.latestVersion ? `v${p.latestVersion}` : (p.remoteSha ?? null),
+                    latestPublishedAt: null,
+                    upToDate: !p.updatable,
+                    error: p.error,
+                    source: p.source,
+                    pluginId: p.id,
+                    builtin: p.builtin,
+                }));
+                const newUpdatables = pluginUpdates
+                    .filter((p) => p.builtin && p.updatable)
+                    .filter((p) => {
+                    const key = `${p.id}@${p.latestVersion || p.remoteSha || "upd"}`;
+                    if (this.notifiedPluginUpdates.has(key))
+                        return false;
+                    this.notifiedPluginUpdates.add(key);
+                    return true;
+                });
+                if (newUpdatables.length > 0) {
+                    const names = newUpdatables.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${newUpdatables.length} 个内置插件有更新可用：${names}，可前往设置或更新面板中更新。`,
+                        textEn: `Update available for ${newUpdatables.length} built-in plugin(s): ${names}. You can update in Settings or the Updates panel.`,
+                    });
+                }
+            }
+            catch (err) {
+                console.warn("[agent-service] 检查插件更新失败:", err);
+            }
+            const allItems = sortUpdateItems([...items, ...pluginItems]);
+            this.updatesAllCache = { at: Date.now(), items: allItems };
+            this.emit({ type: "update_status_all", items: allItems, piSdk });
         }
         catch (err) {
             // checkAll degrades per-item; only local enumeration blowing up lands
@@ -4229,7 +5703,7 @@ export class ClientSession {
             // /reload 同样重读磁盘 settings.json——重放重试覆盖 + 软上限覆盖 + 终端门控。
             this.applyRetryOverrides();
             this.applyCompactionOverrides();
-            this.applyToolGating(this.session);
+            this.applyToolGating(this.session, this.conv?.agentPreset);
         },
         pluginCommands: () => this.pluginCommandsProvider?.() ?? [],
         execPluginCommand: async (name, args) => {
@@ -4324,8 +5798,11 @@ export class ClientSession {
     reloadModelsConfig() {
         return this.modelAdmin.reloadModelsConfig();
     }
-    fetchModelsList(reqId, baseUrl, apiKey, authHeader, api) {
-        return this.modelAdmin.fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang());
+    fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, providerId) {
+        return this.modelAdmin.fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang(), providerId);
+    }
+    testModelConnection(reqId, baseUrl, apiKey, authHeader, api, providerId) {
+        return this.modelAdmin.testConnection(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang(), providerId);
     }
     refreshProviderModels(providerId, reqId) {
         return this.modelAdmin.refreshProviderModels(providerId, reqId, () => this.getLang());
@@ -4591,6 +6068,11 @@ export class ClientSession {
             markerChanged = true;
         }
         await this.settingsSvc.set(rest);
+        // 审批总开关被关掉 → 挂着的待审批全部按批准放行（否则弹窗还在等人点，
+        // 而用户已经明确表示「不要再问我了」）。
+        if (rest.toolApprovalEnabled === false) {
+            this.autoApprovePendingApprovals("审批已全局关闭", "Tool approval was disabled globally");
+        }
         if (rest.disabledPluginTools !== undefined) {
             this.refreshPluginTools();
             this.flushSnapshot();
@@ -4605,7 +6087,7 @@ export class ClientSession {
                     await this.session.reload();
                     this.applyRetryOverrides();
                     this.applyCompactionOverrides();
-                    this.applyToolGating(this.session);
+                    this.applyToolGating(this.session, this.conv?.agentPreset);
                     await this.pushSlashCommands();
                     this.pushSettings();
                 }
@@ -4637,6 +6119,22 @@ export class ClientSession {
     async saveSubagentTemplate(template) {
         return this.settingsSvc.saveTemplate(template);
     }
+    /** 保存一条审批规则（全局共享）。 */
+    async saveApprovalRule(rule) {
+        return this.settingsSvc.saveApprovalRule(rule);
+    }
+    /** 批量保存审批规则（全局共享）。 */
+    async saveApprovalRules(rules) {
+        return this.settingsSvc.saveApprovalRules(rules);
+    }
+    /** 删除一条自定义审批规则。 */
+    async deleteApprovalRule(id) {
+        return this.settingsSvc.deleteApprovalRule(id);
+    }
+    /** 恢复某条内置审批规则到系统默认。 */
+    async resetBuiltinApprovalRule(id) {
+        return this.settingsSvc.resetBuiltinApprovalRule(id);
+    }
     /** 删除一个子代理模板。 */
     async deleteSubagentTemplate(name) {
         return this.settingsSvc.deleteTemplate(name);
@@ -4645,13 +6143,65 @@ export class ClientSession {
     async applyRuntimeSettings() {
         return this.settingsSvc.applyRuntime();
     }
+    /** 按会话对象反查所属对话的预设（创建早期对话还没进 map 时返回 undefined，
+     *  调用方回落默认预设；比按 activeId 猜更准——后台对话的门控不再吃当前页的预设）。 */
+    presetOfSession(session) {
+        for (const c of this.convs.values())
+            if (c.session === session)
+                return c.agentPreset;
+        return undefined;
+    }
+    /**
+     * read / write / edit 三处覆盖的注入规格：基底 = 扩展注册的同名工具优先，否则 SDK 内置实现
+     * （见 tool-overrides.ts —— 这三处覆盖不能塞进创建时的 `customTools`，那会静默顶掉扩展的
+     * 同名工具，而官方 docs/extensions.md 明写扩展可覆盖 read/write/edit）。
+     */
+    toolOverrideSpecs(ownerId, cwd) {
+        const currentPermission = () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+            this.settingsSvc.current.defaultPermissionPreset ??
+            "workspace-write-never";
+        const approve = (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category);
+        // 行为开关（read 本体不可关）：每次调用实时读设置 —— 不进 tool-manager 的 ActiveSet 目录。
+        const readDirOptions = {
+            dirEnabled: () => this.settingsSvc.current.readDirEnabled !== false,
+            getLang: () => this.getLang(),
+        };
+        const readGuardOptions = {
+            toolName: "read",
+            guard: this.toolGuard,
+            conversationId: () => ownerId,
+            getLang: () => this.getLang(),
+            cwd,
+            getRoots: () => this.roots,
+            askApproval: approve,
+            getRules: () => this.approvalRules.list(),
+        };
+        // 写/编的权限沙箱包装：同一个函数，有扩展同名工具时把它的定义当基底（末参）。
+        const composeWrite = (base) => wrapWriteToolWithPermission(cwd, currentPermission, () => this.roots, () => this.getLang(), approve, () => ownerId, () => this.approvalRules.list(), base);
+        const composeEdit = (base) => wrapEditToolWithPermission(cwd, currentPermission, () => this.roots, () => this.getLang(), approve, () => ownerId, () => this.approvalRules.list(), base);
+        return [
+            {
+                name: "read",
+                // 没有扩展 read：完整覆盖（内置基底 + 英文描述 + file_path 别名）。
+                fallback: () => withToolGuard(makeReadDirTool(cwd, readDirOptions), readGuardOptions),
+                // 有扩展 read：只叠「目录列条目」，它的锚协议/独有参数/渲染全保留（行为委托它）。
+                composeWith: (base) => withToolGuard(withReadDirSupport(base, cwd, readDirOptions), readGuardOptions),
+            },
+            { name: "write", fallback: () => composeWrite(), composeWith: (base) => composeWrite(base) },
+            { name: "edit", fallback: () => composeEdit(), composeWith: (base) => composeEdit(base) },
+        ];
+    }
     /** 统一工具门控（tool_manage 唯一落点）：按 disabledAgentTools 把目录内工具
      *  逐个加回/剔除活跃集（工具仍留在注册表，重开可直接加回；live 生效无需
-     *  reload）。session.reload() 与新会话创建都会把 custom 工具加回活跃集，
+     *  reload）。支持按当前会话预设（preset）进行工具过滤。
+     *  session.reload() 与新会话创建都会把 custom 工具加回活跃集，
      *  所以这两条路径之后都要重放本方法（见 reloadSession/创建处）。 */
-    applyToolGating(session) {
-        applyAgentToolsGating(session, effectiveDisabledAgentTools(this.settingsSvc.current));
-        this.syncPluginTools(session);
+    applyToolGating(session, preset) {
+        const targetPreset = preset ?? this.presetOfSession(session) ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+        applyAgentToolsGating(session, effectiveDisabledAgentTools(this.settingsSvc.current), targetPreset);
+        this.syncPluginTools(session, targetPreset);
+        this.sessionStatsCache = null;
+        this.cachedBaseTokens = null;
         // SDK 的 setActiveToolsByName 只改 agent.state.tools，不派发任何事件——门控后
         // 主动推一次快照，否则快照里的 tools 要等下一个 SDK 事件才对齐（会话空闲时永远
         // 等不到；回归：tests/terminal-smoke-test.mjs「agent exposes persistent terminal tools」）。
@@ -4660,9 +6210,153 @@ export class ClientSession {
         if (active && active.session === session)
             this.flushSnapshot();
     }
+    /** 判断是否为空白对话（无消息、无队列、未在流式生成）。 */
+    isBlankConversation(c) {
+        try {
+            return (c.session.state.messages.length === 0 &&
+                c.queueSteering.length === 0 &&
+                c.queueFollowUp.length === 0 &&
+                !c.session.isStreaming);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** 推送 Agent 预设名录（UI 预设条用）。 */
+    async refreshAgentPresets() {
+        this.emit({
+            type: "dsh_presets",
+            presets: PI_AGENT_PRESETS,
+            defaultPreset: this.settingsSvc.current.defaultAgentPreset ?? "standard",
+        });
+    }
+    /** 切换当前空白会话的预设。 */
+    async selectAgentPreset(preset) {
+        const conv = this.conv;
+        if (conv.presetLocked || !this.isBlankConversation(conv)) {
+            conv.presetLocked = true;
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `会话已开始，预设锁定为「${PI_AGENT_PRESETS.find((p) => p.id === conv.agentPreset)?.name ?? conv.agentPreset}」（空白会话可切换）`,
+                textEn: `Session already started; preset locked to "${conv.agentPreset}" (only blank sessions can switch)`,
+            });
+            this.flushSnapshot();
+            return;
+        }
+        const hit = PI_AGENT_PRESETS.find((p) => p.id === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知预设「${preset}」`,
+                textEn: `Unknown preset "${preset}"`,
+            });
+            return;
+        }
+        conv.agentPreset = hit.id;
+        this.applyToolGating(conv.session, hit.id);
+        this.sessionStatsCache = null;
+        this.cachedBaseTokens = null;
+        // 技能名录段/终端引导是按 run 组装的提示词：重载 resourceLoader 让新预设
+        // 即时生效（只有空白会话能切到这里，无历史可丢）。
+        try {
+            await conv.session.resourceLoader.reload();
+        }
+        catch {
+            // loader 未就绪——首轮 run 组装时自然读到新预设。
+        }
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `已切换为「${hit.name}」预设`,
+            textEn: `Switched to preset "${hit.name}"`,
+        });
+        this.pushSettings();
+        this.flushSnapshot();
+    }
+    /** 设置新会话默认预设。 */
+    async setDefaultAgentPreset(preset) {
+        const hit = PI_AGENT_PRESETS.find((p) => p.id === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知预设「${preset}」，默认预设未改`,
+                textEn: `Unknown preset "${preset}"; default preset unchanged`,
+            });
+            return;
+        }
+        this.settingsSvc.current.defaultAgentPreset = hit.id;
+        this.stateStore.saveSettings(this.clientId, { defaultAgentPreset: hit.id });
+        this.pushSettings();
+        this.refreshAgentPresets();
+        this.flushSnapshot();
+    }
+    /** 推送权限选项表 + 默认权限。 */
+    async refreshPermission() {
+        this.emit({
+            type: "dsh_permission",
+            options: PI_PERMISSION_OPTIONS,
+            defaultPreset: this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never",
+        });
+    }
+    /** 切换当前会话的权限预设（热生效）。 */
+    async setPermissionPreset(preset) {
+        const hit = PI_PERMISSION_OPTIONS.find((p) => p.value === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知权限预设「${preset}」`,
+                textEn: `Unknown permission preset "${preset}"`,
+            });
+            return;
+        }
+        if (this.conv.permissionPreset === hit.value) {
+            return;
+        }
+        this.conv.permissionPreset = hit.value;
+        try {
+            // 持久会话：将权限变更写入会话转录日志，切会话/切项目重载时不丢失
+            const sm = this.conv.session.sessionManager;
+            sm?.appendCustomEntry?.("permission/preset", { preset: hit.value });
+        }
+        catch {
+            // best effort for in-memory sessions
+        }
+        this.emit({
+            type: "notice",
+            level: "info",
+            text: `当前会话权限已切换为「${hit.name}」`,
+            textEn: `Current session permission switched to "${hit.name}"`,
+        });
+        this.flushSnapshot();
+    }
+    /** 设置新会话默认权限预设。 */
+    async setDefaultPermissionPreset(preset) {
+        const hit = PI_PERMISSION_OPTIONS.find((p) => p.value === preset);
+        if (!hit) {
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `未知权限预设「${preset}」，默认未改`,
+                textEn: `Unknown permission preset "${preset}"; default unchanged`,
+            });
+            return;
+        }
+        this.settingsSvc.current.defaultPermissionPreset = hit.value;
+        this.stateStore.saveSettings(this.clientId, { defaultPermissionPreset: hit.value });
+        this.refreshPermission();
+        this.flushSnapshot();
+    }
     /** 当前启用的插件 AI 工具定义（provider 快照按 disabledPluginTools 过滤；
-     *  未知/已卸载插件的禁用条目保留但不影响现有工具）。 */
-    enabledPluginToolDefs() {
+     *  未知/已卸载插件的禁用条目保留但不影响现有工具）。
+     *  预设是第二层门控（见 tool-manager.ts 语义总表）：非 standard 预设下插件工具
+     *  一律不可用（读写未知，保守处理），此时返回空表，调用方负责从会话移除。 */
+    enabledPluginToolDefs(preset) {
+        if (!presetAllowsPluginTools(preset))
+            return [];
         const off = new Set(normalizeDisabledPluginTools(this.settingsSvc.current.disabledPluginTools));
         return (this.pluginToolsProvider?.() ?? []).filter((t) => !off.has(t.name)).map(pluginToolToDefinition);
     }
@@ -4670,14 +6364,24 @@ export class ClientSession {
      *  实际 diff 逻辑在 plugins.ts 的 syncPluginToolsIntoSession（可单测）。
      *  模板白名单的子代理（subagentBarsPluginTools）跳过：工厂期就没注册，这里
      *  不回补，否则白名单等于没关门。 */
-    syncPluginTools(session) {
+    syncPluginTools(session, preset) {
+        let targetPreset = preset;
         for (const conv of this.convs.values()) {
-            if (conv.session === session && conv.subagentBarsPluginTools)
+            if (conv.session !== session)
+                continue;
+            if (conv.subagentBarsPluginTools)
                 return;
+            targetPreset ??= conv.agentPreset;
         }
         try {
-            const defs = this.enabledPluginToolDefs();
-            const next = syncPluginToolsIntoSession(session, defs, this.appliedPluginToolNames);
+            const defs = this.enabledPluginToolDefs(targetPreset);
+            // 移除口径 = 已同步过的 ∪ 全量插件宇宙：创建时工厂直接注册进
+            // _customTools 的工具不在 applied 表里，首轮同步（defs 为空时）否则删不掉。
+            const universe = new Set([
+                ...this.appliedPluginToolNames,
+                ...(this.pluginToolsProvider?.() ?? []).map((t) => t.name),
+            ]);
+            const next = syncPluginToolsIntoSession(session, defs, universe);
             if (next)
                 this.appliedPluginToolNames = new Set(next);
         }
@@ -4935,6 +6639,8 @@ export class ClientSession {
         // switch/new_chat while prompt() is in flight must never target a
         // different conversation.
         const conv = this.conv;
+        const promptAc = new AbortController();
+        conv.activePromptAc = promptAc;
         // 输入框内容被消费（发送/斜杠执行）→ 清掉该会话存过的草稿（best-effort）。
         // 快捷短语发送（不碰输入框）同样清：客户端发送成功后会把当前草稿重存回来。
         // clear() 同时记录 clear 时间戳水位：清掉之后才 landing 的旧 draft_update
@@ -4960,6 +6666,89 @@ export class ClientSession {
             // is refused until admission reopens.
             if (this.quiesceBlocked())
                 return;
+            // 首轮用户发言后锁定当前会话的预设（对齐 DSH 预设语义）
+            conv.presetLocked = true;
+            // #280：悬空 toolCall 守卫——转录尾是「有调用、无结果」时直接 prompt
+            // 会把非法链喂给 provider（有发起迹象但零落盘、零报错的黑洞）。
+            // 非流式时先补合成结果再继续；补不上则响亮拒绝。
+            if (conv.transcriptBlocked && !s.isStreaming) {
+                this.emit({
+                    type: "notice",
+                    level: "error",
+                    text: `发送已拒绝：该对话的记录尾是一个没有结果的工具调用（上次运行被强制终止），且自动修复失败。请从历史记录重新打开该对话，或新建对话后重试。`,
+                    textEn: `Prompt refused: this transcript ends with a tool call that never got a result (last run was force-terminated) and auto-repair failed. Reopen it from history or start a new conversation.`,
+                });
+                this.flushSnapshot();
+                return;
+            }
+            if (!s.isStreaming) {
+                try {
+                    const live = s.agent.state.messages;
+                    const dangling = Array.isArray(live) ? findDanglingToolCalls(live) : [];
+                    if (dangling.length > 0) {
+                        let healed = 0;
+                        try {
+                            const sm = s.sessionManager;
+                            if (typeof sm?.appendMessage === "function") {
+                                for (const d of dangling) {
+                                    sm.appendMessage({
+                                        role: "toolResult",
+                                        toolCallId: d.toolCallId,
+                                        toolName: d.toolName,
+                                        content: [
+                                            {
+                                                type: "text",
+                                                text: `${DANGLING_TOOL_RESULT_TEXT}\n${DANGLING_TOOL_RESULT_TEXT_EN}`,
+                                            },
+                                        ],
+                                        isError: true,
+                                        timestamp: Date.now(),
+                                    });
+                                    healed += 1;
+                                }
+                            }
+                        }
+                        catch {
+                            // 落盘失败走下面的拒绝分支。
+                        }
+                        if (healed === dangling.length && healed > 0) {
+                            conv.transcriptBlocked = false;
+                            try {
+                                await s.reload();
+                                this.applyRetryOverrides();
+                                this.applyCompactionOverrides();
+                                this.applyToolGating(s, conv.agentPreset);
+                            }
+                            catch {
+                                // reload 失败兜底
+                            }
+                            this.emit({
+                                type: "notice",
+                                level: "warning",
+                                text: `检测到上次运行残留的 ${dangling.length} 个无结果工具调用，已自动填入合成结果后继续。如任务未完成请重新执行该工具。`,
+                                textEn: `Found ${dangling.length} tool call(s) without results from the last run; synthetic results were inserted automatically before continuing. Re-run the tool if the task is incomplete.`,
+                            });
+                        }
+                        else {
+                            conv.transcriptBlocked = true;
+                            this.emit({
+                                type: "notice",
+                                level: "error",
+                                text: `发送已拒绝：该对话的记录尾是一个没有结果的工具调用（上次运行被强制终止），且自动修复失败。请从历史记录重新打开该对话，或新建对话后重试。`,
+                                textEn: `Prompt refused: this transcript ends with a tool call that never got a result (last run was force-terminated) and auto-repair failed. Reopen it from history or start a new conversation.`,
+                            });
+                            this.flushSnapshot();
+                            return;
+                        }
+                    }
+                    else {
+                        conv.transcriptBlocked = false;
+                    }
+                }
+                catch {
+                    // 守卫本身绝不挡发送：查不到就按原路径走。
+                }
+            }
             // issue #145：发之前再查一次同文件持有者 —— 拦住「打开时空闲、发送时在跑」的竞态。
             // 没有第二个 writer，就不可能有看不见的第二个 agent。
             const activeFile = this.activeSessionFileResolved();
@@ -5075,16 +6864,23 @@ export class ClientSession {
                         .filter((r) => r.hits.length > 0);
                     const extNoteEn = externalRunners.length > 0 ? ` Touched files of external run(s) are unknown.` : "";
                     const extNoteZh = externalRunners.length > 0 ? `外部运行的文件触碰未知。` : "";
+                    // 预设拿掉问卷工具时（minimal/code/ask），提醒文案不点不存在的工具名，
+                    // 改走正文提问（见 tool-manager.ts 语义总表；认领信息本身照常有用）。
+                    const canAsk = presetHasQuestionnaire(conv.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard");
+                    const askClauseEn = canAsk
+                        ? "use ask_user_question when unsure "
+                        : "ask the user in your reply text when unsure ";
+                    const askClauseZh = canAsk ? "拿不准就用 ask_user_question 让用户选择：" : "拿不准就在回复正文里直接问用户：";
                     let aiReminder;
                     if (clashes.length === 0 && myClaimed.length === 0) {
                         aiReminder =
                             `(System reminder: ${aiItems.length} other run(s) [${aiItems.join("; ")}] ` +
                                 `are currently running in the same project directory. No file written by both you and them was detected, ` +
                                 `so working on different files in parallel is fine; before writing the same files or running project-wide ` +
-                                `commands, assess the conflict risk first, and use ask_user_question when unsure ` +
+                                `commands, assess the conflict risk first, and ${askClauseEn}` +
                                 `(continue in parallel / wait / watch read-only).${extNoteEn}${claimsSummaryEn})\n` +
                                 `（系统提醒：同一项目另有 ${aiItems.length} 处运行（${shown}${more}）。未发现双方都写过的文件，` +
-                                `改不同文件可并行；动同一文件或跑全局命令前先评估冲突，拿不准就用 ask_user_question 让用户选择：` +
+                                `改不同文件可并行；动同一文件或跑全局命令前先评估冲突，${askClauseZh}` +
                                 `并行 / 等它跑完 / 只读围观。${extNoteZh}${claimsSummaryZh}）`;
                     }
                     else {
@@ -5102,10 +6898,10 @@ export class ClientSession {
                         aiReminder =
                             `(System reminder: ${aiItems.length} other run(s) [${aiItems.join("; ")}] ` +
                                 `are currently running in the same project directory. ⚠ ${clashEn} — re-read these files before ` +
-                                `touching them again, and use ask_user_question when unsure ` +
+                                `touching them again, and ${askClauseEn}` +
                                 `(continue in parallel / wait / watch read-only).${extNoteEn})\n` +
                                 `（系统提醒：同一项目另有 ${aiItems.length} 处运行（${shown}${more}）。` +
-                                `${clashZh} —— 再动这些文件前先读最新内容，拿不准就用 ask_user_question 让用户选择：` +
+                                `${clashZh} —— 再动这些文件前先读最新内容，${askClauseZh}` +
                                 `并行 / 等它跑完 / 只读围观。${extNoteZh}）`;
                     }
                     try {
@@ -5157,9 +6953,35 @@ export class ClientSession {
                 // issue #91：附件/视觉桥文案按客户端 UI 语言出中英（英文默认）。
                 getLang: () => this.getLang(),
             }, attachments);
+            if (promptAc.signal.aborted) {
+                conv.activePromptAc = undefined;
+                return;
+            }
             for (const aside of asides) {
-                await s.sendCustomMessage(aside.message, { deliverAs: "nextTurn" });
+                if (s.isStreaming) {
+                    await s.sendCustomMessage(aside.message, { deliverAs: "nextTurn" });
+                }
+                else {
+                    await s.sendCustomMessage(aside.message);
+                }
+            }
+            // 附件处理完毕后立即刷新快照，让引用的文件卡片在等待模型首字前瞬间出现在界面上
+            if (asides.length > 0) {
+                this.flushSnapshot();
+            }
+            // 创建工作区版本影子快照（Dual-State Rollback）
+            let snapshotRef = null;
+            try {
+                snapshotRef = await createWorkspaceSnapshot(conv.cwd);
+            }
+            catch {
+                // best-effort
             }
+            if (promptAc.signal.aborted) {
+                conv.activePromptAc = undefined;
+                return;
+            }
+            conv.activePromptAc = undefined;
             if (s.isStreaming) {
                 // queue=true (补充 button) → followUp: the message is delivered only
                 // after the whole run finishes — the agent finishes what it started,
@@ -5178,8 +7000,29 @@ export class ClientSession {
             else {
                 await s.prompt(text);
             }
+            // 关联快照与本次 prompt 产生的用户消息 entry
+            if (snapshotRef) {
+                try {
+                    const entries = conv.session.sessionManager.buildContextEntries();
+                    const lastUserEntry = [...entries]
+                        .reverse()
+                        .find((e) => e.type === "message" && e.message?.role === "user");
+                    conv.workspaceSnapshots.push({
+                        entryId: lastUserEntry?.id,
+                        timestamp: Date.now(),
+                        snapshotRef,
+                    });
+                    if (conv.workspaceSnapshots.length > 50) {
+                        conv.workspaceSnapshots.shift();
+                    }
+                }
+                catch {
+                    // best-effort
+                }
+            }
         }
         catch (err) {
+            conv.activePromptAc = undefined;
             this.emit({
                 type: "notice",
                 level: "error",
@@ -5201,15 +7044,12 @@ export class ClientSession {
     /**
      * Turn attached files into custom-message payloads.
      *
-     * Text files are size-aware: small files are inlined into the message so the
-     * model sees them immediately; large files are passed as a <file path="...">
-     * reference and the model reads them on demand with its read tool (which has
-     * built-in truncation). Images are always passed as image content. Mode
-     * "lines" inlines only a 1-based inclusive line range of the file. Raw
-     * pasted/dropped/uploaded images (attachment.imageData) skip the workspace
-     * path entirely and go straight to the model as image content. Raw uploaded
-     * files (attachment.fileData) are persisted under <dataDir>/uploads/ and
-     * attached as absolute-path references (small text ones are inlined).
+     * 一律只给路径引用：文本文件（无论大小）都只发 `<file path="..." />`，模型用
+     * 自己的 read 工具按需读（自带截断/分页）——文件内容永不进 prompt。行范围模式
+     * （mode "lines"）在引用上带 lines 属性，告诉模型用户选的是哪几行。
+     * 图片始终作为 image 内容发送。粘贴/拖入/上传的原始图片（attachment.imageData）
+     * 不走工作区路径，直接进模型；上传文件（attachment.fileData）落在
+     * <dataDir>/uploads/ 下，以绝对路径引用。
      */
     /**
      * Hard-abort the running agent (Stop button / global 中断). Tries
@@ -5220,6 +7060,15 @@ export class ClientSession {
      * overnight. The notice fires only on the forced-reset path.
      */
     async abort() {
+        if (this.conv.activePromptAc) {
+            this.conv.activePromptAc.abort();
+            this.conv.activePromptAc = undefined;
+        }
+        const isRunning = this.conversationStreaming(this.conv) || !this.conv.session.isIdle;
+        if (!isRunning) {
+            this.flushSnapshot();
+            return;
+        }
         // 只停止智能体运行本身；AI 在后台启动的服务由「后台任务」面板单独
         // 管理（可逐个停止或全部关闭），不会在停止对话时被连带杀掉。
         await this.interruptRun(this.conv, "已停止");
@@ -5476,6 +7325,9 @@ export class ClientSession {
     }
     /** Interrupt a run: abort, with a force-reset fallback on timeout. */
     async interruptRun(conv, reason) {
+        if (!this.conversationStreaming(conv) && conv.session.isIdle) {
+            return;
+        }
         // The run is only truly stopped when its agent_end event arrives:
         // session.abort() can return without stopping anything when the run is
         // stuck before the agent even started (e.g. a model stream that never
@@ -5513,14 +7365,14 @@ export class ClientSession {
                 textEn: `Abort failed: ${err.message}`,
             });
         }
-        // 3) abort returned but no agent_end within the settle window → the
-        //    run was stuck before it started; force-reset to recover.
-        if (!ended) {
+        // 3) abort returned but no agent_end within the settle window:
+        //    仅在 session 依然处于非 idle 状态（即真正卡住）时才等待并强制重置
+        if (!ended && !conv.session.isIdle) {
             await new Promise((r) => setTimeout(r, ClientSession.HARD_ABORT_SETTLE_MS));
         }
         clearTimeout(abortTimer);
         off();
-        if (!ended)
+        if (!ended && !conv.session.isIdle)
             force();
     }
     /** Force-reset a conversation: dispose the stuck runtime (kills the hung
@@ -5528,18 +7380,54 @@ export class ClientSession {
      *  persisted session. The conversation record itself is kept (same id,
      *  same cwd, same serialization caches), so the UI stays attached. */
     async forceResetConversation(conv, reason) {
+        // #280：先记下本次对话自己的会话文件——重建必须回到同一个文件，
+        // 不能用 continueRecent(cwd) 按 mtime 取「最近」（同 cwd 多会话时会接错文件）。
+        const ownFile = (() => {
+            try {
+                const f = conv.session.sessionFile;
+                return typeof f === "string" && f ? f : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
         try {
             conv.unsubscribe?.();
             conv.unsubscribe = undefined;
             this.clearAllToolWatchdogs(conv);
             conv.toolStartTimes.clear();
+            disposeEvalSession(conv.id);
             await conv.runtime.dispose();
-            // #235：转录链损坏时修一次再试（见 openManagerAndRuntime）。
-            const opened = await this.openManagerAndRuntime(() => SessionManager.continueRecent(conv.cwd), (m) => createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, undefined, conv.id), {
+            // #280：dispose 丢弃了内存里的在飞状态（未落盘的工具结果蒸发），
+            // 文件尾可能留下一个悬空 toolCall——先补合成 toolResult 再重建，
+            // 否则重建后的 prompt 会把非法转录链喂给 provider（零落盘黑洞）。
+            let healedCount = 0;
+            if (ownFile && existsSync(ownFile)) {
+                try {
+                    const n = healDanglingToolCallFile(ownFile);
+                    if (n > 0)
+                        healedCount = n;
+                }
+                catch {
+                    // best-effort：修不好就按原路径重建，下面的守卫会在 prompt 前再拦。
+                }
+            }
+            // #280 & #335：转录链损坏时修一次再试（见 openManagerAndRuntime）。
+            // 严禁在 ownFile 不存在时回退到 continueRecent(conv.cwd) 或按 mtime list 历史文件，
+            // 否则会直接接错并顶替同项目的其它历史会话，污染别人的转录记录。
+            const opened = await this.openManagerAndRuntime(() => {
+                if (ownFile && existsSync(ownFile)) {
+                    return SessionManager.open(ownFile);
+                }
+                return conv.isEphemeral ? SessionManager.inMemory(conv.cwd) : SessionManager.create(conv.cwd);
+            }, (m) => 
+            // 子代理带模板时按原模板重建（conv.subagentTemplate 是派发时工厂
+            // 用的同一快照）；普通对话 undefined，行为不变。
+            createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, conv.subagentTemplate, conv.id), {
                 cwd: conv.cwd,
                 agentDir: this.agentDir,
                 sessionManager: m,
-            }), async () => (await SessionManager.list(conv.cwd))[0]?.path);
+            }), async () => (ownFile && existsSync(ownFile) ? ownFile : undefined));
             const runtime = opened.runtime;
             if (opened.repair) {
                 for (const n of this.transcriptRepairNotices(opened.repair))
@@ -5547,6 +7435,27 @@ export class ClientSession {
             }
             conv.runtime = runtime;
             conv.session = runtime.session;
+            if (healedCount > 0) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `上次运行被强制终止，${healedCount} 个无结果的工具调用已自动填入合成结果（转录链已修复）。建议检查任务状态，必要时重新执行该工具。`,
+                    textEn: `The last run was force-terminated; ${healedCount} tool call(s) without results were filled with synthetic results (transcript healed). Verify task state and re-run the tool if needed.`,
+                });
+            }
+            // #280：重建后复查——新 runtime 仍以悬空 toolCall 开头说明修复没落盘
+            // （文件被删/只读等），此时响亮拒绝后续 prompt 而不是静默黑洞。
+            try {
+                const msgs = conv.session.agent.state.messages;
+                const still = Array.isArray(msgs) ? findDanglingToolCalls(msgs) : [];
+                if (still.length > 0)
+                    conv.transcriptBlocked = true;
+                else
+                    conv.transcriptBlocked = false;
+            }
+            catch {
+                // ignore：守卫是兜底，查不到就让 prompt 路径再查。
+            }
             this.emit({
                 type: "notice",
                 level: "warning",
@@ -5570,8 +7479,7 @@ export class ClientSession {
      *  空白新对话」——/new <prompt> 只在 true 时投递首条提示；false 表示没能进入
      *  新对话（准入关闭 / 同项目对话数达上限 / runtime 创建失败），此时照发会把
      *  首条提示投进用户原本正在用的那个对话里。 */
-    async newChat(_preset) {
-        // _preset: DSH Agent 预设（pi 引擎无此概念，忽略；wire 统一见 protocol new_chat）。
+    async newChat(_preset, ephemeral) {
         if (this.quiesceBlocked())
             return false;
         // Reuse an already-open blank conversation instead of piling up new ones
@@ -5589,31 +7497,43 @@ export class ClientSession {
             }
         };
         const active = this.conv;
-        if (active && isBlank(active)) {
-            this.flushSnapshot();
+        if (!ephemeral && active && isBlank(active)) {
+            if (_preset)
+                await this.selectAgentPreset(_preset);
+            else {
+                this.pushSettings();
+                this.flushSnapshot();
+            }
             return true;
         }
-        for (const conv of this.convs.values()) {
-            if (conv.id === this.activeId)
-                continue;
-            if (isBlank(conv)) {
-                await this.switchConversation(conv.id);
-                this.flushSnapshot();
-                return true;
+        if (!ephemeral) {
+            for (const conv of this.convs.values()) {
+                if (conv.id === this.activeId)
+                    continue;
+                if (isBlank(conv)) {
+                    await this.switchConversation(conv.id);
+                    if (_preset)
+                        await this.selectAgentPreset(_preset);
+                    else
+                        this.flushSnapshot();
+                    return true;
+                }
             }
         }
         // Cap is per project — conversations of other projects keep their own
         // lists and don't consume this project's slots. Subagents don't count
-        // (inMemory 后台任务，不占位）。
-        const openInProject = [...this.convs.values()].filter((c) => c.cwd === this.cwd && !c.isSubagent).length;
-        if (openInProject >= MAX_OPEN_CONVERSATIONS) {
-            this.emit({
-                type: "notice",
-                level: "warning",
-                text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
-                textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
-            });
-            return false;
+        // (inMemory 后台任务，不占位）。临时会话也不占名额。
+        if (!ephemeral) {
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === this.cwd && !c.isSubagent && !c.isEphemeral).length;
+            if (openInProject >= MAX_OPEN_CONVERSATIONS) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
+                    textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
+                });
+                return false;
+            }
         }
         // The outgoing conversation is left behind — apply the running-list
         // lifecycle. Removal is deferred until the new chat exists so the active
@@ -5627,14 +7547,50 @@ export class ClientSession {
         try {
             const conversationId = this.nextConversationId();
             const terminals = this.makeTerminalManager(conversationId, this.cwd);
-            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined), {
+            let sessionManager;
+            if (ephemeral) {
+                sessionManager = SessionManager.inMemory(this.cwd);
+                // 为无痕临时会话提供隔离的临时运行目录（供 SoL-Pi 等依赖 getSessionDir 的扩展正常放置缓存），
+                // 但保持 persist = false（不写 .jsonl 对话文件、不污染历史记录）
+                const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conversationId);
+                try {
+                    mkdirSync(ephemeralDir, { recursive: true });
+                    sessionManager.sessionDir = ephemeralDir;
+                }
+                catch { }
+            }
+            else {
+                sessionManager = SessionManager.create(this.cwd);
+            }
+            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined, _preset), {
                 cwd: this.cwd,
                 agentDir: this.agentDir,
-                sessionManager: SessionManager.create(this.cwd),
+                sessionManager,
             });
             const conv = this.makeConversation(runtime, conversationId, terminals);
+            if (ephemeral)
+                conv.isEphemeral = true;
+            if (_preset) {
+                const hit = PI_AGENT_PRESETS.find((p) => p.id === _preset);
+                if (hit)
+                    conv.agentPreset = hit.id;
+            }
+            // 创建即按归属预设门控：工厂内只能按 active/默认兜底（conv 还没进 map），
+            // 默认预设非 standard 时那个结果是错的，这里用 conv 自身预设显式重放一次。
+            // conv 尚未进 map，preset 必须显式传，插件同步才能正确剥离。
+            this.applyToolGating(conv.session, conv.agentPreset);
             this.convs.set(conv.id, conv);
             this.activeId = conv.id;
+            if (_preset && conv.agentPreset !== (this.settingsSvc.current.defaultAgentPreset ?? "standard")) {
+                // 显式预设与默认不一致：工厂组装提示词时用的是默认视图，重载一次对齐
+                // （技能名录/终端引导；此时 conv 已进 map，override 能读到归属预设）。
+                try {
+                    await conv.session.resourceLoader.reload();
+                }
+                catch {
+                    // loader 未就绪——首轮 run 组装时自然对齐。
+                }
+            }
             if (displaced)
                 this.removeConversation(displaced.id);
             await this.bindSession();
@@ -5682,6 +7638,7 @@ export class ClientSession {
             void this.pushSlashCommands();
             // 新对话即当前打开 → 插件重拉（轨迹视图跟随）。
             this.notifyConversationChanged();
+            this.pushSettings();
             ready = true;
         }
         catch (err) {
@@ -5788,7 +7745,7 @@ export class ClientSession {
                 };
                 lines[idx] = JSON.stringify(done);
             }
-            writeFileSync(file, lines.join("\n"));
+            atomicWriteFileSync(file, lines.join("\n"));
         }
         catch {
             // Best-effort, same as the write path.
@@ -5809,7 +7766,7 @@ export class ClientSession {
             if (!raw.includes('"pi-web-ui/compaction-pending"'))
                 return;
             const kept = raw.split("\n").filter((line) => !line.includes("pi-web-ui/compaction-pending"));
-            writeFileSync(file, kept.join("\n"));
+            atomicWriteFileSync(file, kept.join("\n"));
             this.emitCompactionInterruptedNotice();
         }
         catch {
@@ -5848,6 +7805,7 @@ export class ClientSession {
     /**
      * #235：已知路径先修后开（openConversation 走这条——单文件预扫描零负担）。
      * 返回 null = 文件健康或无需处理；返回 repair = 修过，调用方弹提示。
+     * #280：顺带修悬空 toolCall（强制重置/崩溃残留的有调用无结果），修过同样弹提示。
      */
     repairTranscriptFileBeforeOpen(filePath) {
         let repair = null;
@@ -5857,8 +7815,27 @@ export class ClientSession {
         catch {
             return null;
         }
-        if (!repair?.changed)
+        if (!repair?.changed) {
+            // #280：压缩链健康时仍要查悬空 toolCall（崩溃/强制重置残留）。
+            let healed = 0;
+            try {
+                const n = healDanglingToolCallFile(filePath);
+                if (n > 0)
+                    healed = n;
+            }
+            catch {
+                // best-effort
+            }
+            if (healed <= 0)
+                return null;
+            this.emit({
+                type: "notice",
+                level: "warning",
+                text: `该对话上次运行残留 ${healed} 个无结果的工具调用，已自动填入合成结果。如任务未完成请重新执行该工具。`,
+                textEn: `${healed} tool call(s) without results from the last run were filled with synthetic results. Re-run the tool if the task is incomplete.`,
+            });
             return null;
+        }
         for (const n of this.transcriptRepairNotices(repair))
             this.emit(n);
         return repair;
@@ -5950,9 +7927,26 @@ export class ClientSession {
         }
         this.convs.delete(id);
         this.clearAllToolWatchdogs(conv);
+        // 关对话 → 连它的 eval 内核（Python/Node 子进程 + 临时沙箱目录）一起回收：
+        // 这些进程是 detached 进程组，父进程退出不会自动带走它们。
+        disposeEvalSession(id);
         conv.terminals.killAll();
         conv.unsubscribe?.();
         conv.unsubscribe = undefined;
+        if (conv.isSubagent) {
+            const ephemeralDir = join(this.agentDir, "subagent-sessions", conv.id);
+            try {
+                rmSync(ephemeralDir, { recursive: true, force: true });
+            }
+            catch { }
+        }
+        if (conv.isEphemeral) {
+            const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conv.id);
+            try {
+                rmSync(ephemeralDir, { recursive: true, force: true });
+            }
+            catch { }
+        }
         void conv.runtime.dispose().catch(() => { });
     }
     /** 本会话是否持有这个 SDK 会话对应的对话；命中则给出它的**当前** id
@@ -5972,6 +7966,7 @@ export class ClientSession {
             cwd: c.cwd,
             ...(c.parentId ? { parentId: c.parentId } : {}),
             isSubagent: c.isSubagent,
+            isEphemeral: !!c.isEphemeral,
         }));
     }
     /**
@@ -6020,9 +8015,30 @@ export class ClientSession {
                 pageCalls.push({ resolve: p.resolve, req: p.req, timeoutMs: p.timeoutMs, conversationId: p.conversationId });
             }
         }
+        // 待审批跟对话走：留在源会话就是幽灵弹窗（id 失效点不动，runtime 已搬走，
+        // 永远等不到答复）。只搬归属明确的（conversationId 对得上，与问卷/页调用
+        // 同一规则）；目标侧按新 id 重发弹窗，等待中的 Promise 原样过户不 resolve。
+        const approvals = [];
+        for (const [aid, a] of this.pendingApprovals) {
+            if (a.conversationId !== undefined && set.has(a.conversationId)) {
+                this.pendingApprovals.delete(aid);
+                approvals.push({
+                    resolve: a.resolve,
+                    toolCallId: a.toolCallId,
+                    toolName: a.toolName,
+                    params: a.params,
+                    reason: a.reason,
+                    reasonEn: a.reasonEn,
+                    ...(a.category ? { category: a.category } : {}),
+                    conversationId: a.conversationId,
+                    ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                    createdAt: a.createdAt,
+                });
+            }
+        }
         this.emitConversations();
         this.flushSnapshot();
-        return { ok: true, payload: { convs, questions, pageCalls } };
+        return { ok: true, payload: { convs, questions, pageCalls, approvals } };
     }
     /**
      * 过户转入：把另一会话摘除的对话整体接过来，返回主对话的新 id。
@@ -6103,8 +8119,65 @@ export class ClientSession {
                 timeoutMs: p.timeoutMs,
             });
         }
+        // 迁入的待审批按新 id 重新挂上（等待中的 Promise 未动，模型还在等）。
+        // 主对话的立即弹窗（子代理的靠角标与快照呈现，与问卷同一口径）。
+        for (const a of payload.approvals) {
+            const nid = `appr-${++this.approvalSeq}`;
+            const aConvId = fix(a.conversationId);
+            this.pendingApprovals.set(nid, {
+                id: nid,
+                toolCallId: a.toolCallId,
+                toolName: a.toolName,
+                params: a.params,
+                reason: a.reason,
+                reasonEn: a.reasonEn,
+                ...(a.category ? { category: a.category } : {}),
+                conversationId: aConvId,
+                ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                resolve: a.resolve,
+                createdAt: a.createdAt,
+            });
+            if (aConvId === mainId) {
+                this.emit({
+                    type: "tool_approval_pending",
+                    id: nid,
+                    toolCallId: a.toolCallId,
+                    toolName: a.toolName,
+                    params: a.params,
+                    reason: a.reason,
+                    reasonEn: a.reasonEn,
+                    ...(a.category ? { category: a.category } : {}),
+                    conversationId: aConvId,
+                    ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                });
+            }
+        }
         return mainId;
     }
+    /**
+     * 切到新工作目录后的“跟随面”刷新（roots / 插件钩子 / 最近项目 / 历史列表 /
+     * 文件树 / 命令目录）。调用方先把 this.cwd 改好再调本函数。
+     * switchConversation 跨项目切换、set_cwd、switchSession 打开别项目的历史
+     * 会话三处共用 —— 之前 switchSession 只改了 cwd 没同步 roots，文件树/
+     * 工作区插件/历史列表都还停在旧项目。集中一处避免再漏。
+     */
+    applyCwdSideEffects(abs) {
+        this.roots = this.stateStore.getWorkspaceRoots(this.clientId, abs);
+        // 工作区跟随型插件（编辑器文件树等）同步切根。
+        try {
+            this.onCwdChanged?.(abs, this.roots);
+        }
+        catch {
+            /* 钩子异常不影响主流程 */
+        }
+        // Remember the new workspace (restore target + recent-project entry).
+        this.stateStore.remember(this.clientId, abs);
+        void this.pushProjects();
+        this.refreshSessionsOnSwitch();
+        void this.listFiles(undefined);
+        // Commands are per-project (.pi/commands.json in the current cwd).
+        void this.listCommands();
+    }
     /** Switch the ACTIVE conversation without interrupting any other chat. */
     async switchConversation(id) {
         if (!this.convs.has(id) || id === this.activeId)
@@ -6129,7 +8202,6 @@ export class ClientSession {
         void this.pushSlashCommands();
         if (cwdChanged) {
             this.cwd = newCwd;
-            this.roots = this.stateStore.getWorkspaceRoots(this.clientId, newCwd);
             // 模型/key 恢复不挡快照：后台做，带代际 guard（用户又切走就跳过），
             // 做完补一次 flush 刷新模型栏。
             {
@@ -6151,20 +8223,11 @@ export class ClientSession {
             }
             // Mirror set_cwd's project-switch side-effects so the whole UI follows
             // the new workspace, not just the chat pane.
-            try {
-                this.onCwdChanged?.(newCwd, this.roots);
-            }
-            catch {
-                /* hook failure must not break the switch */
-            }
-            this.stateStore.remember(this.clientId, newCwd);
-            void this.pushProjects();
-            this.refreshSessionsOnSwitch();
-            void this.listFiles(undefined);
-            void this.listCommands();
+            this.applyCwdSideEffects(newCwd);
         }
         // 当前打开对话变了 → 插件重拉（轨迹视图切会话后即刷新，不等轮询）。
         this.notifyConversationChanged();
+        this.pushSettings();
         this.flushSnapshot();
     }
     /** 左栏「运行的对话」的展示口径（issue #140）。
@@ -6228,6 +8291,7 @@ export class ClientSession {
                 messageCount,
                 isStreaming,
                 isSubagent: !!conv.isSubagent,
+                ...(conv.isEphemeral ? { isEphemeral: true } : {}),
                 // 落盘会话才有文件（inMemory 子代理缺省）：右键复制路径 / AI 按 path 读历史时用。
                 ...(() => {
                     try {
@@ -6246,6 +8310,7 @@ export class ClientSession {
                     return pq ? { hasQuestion: true, questionId: pq.id, questionTitle: pq.title } : {};
                 })(),
                 parentId: conv.parentId,
+                ...(conv.forkFrom ? { forkFrom: conv.forkFrom } : {}),
             });
         }
         // issue #145：流式集合签名变化 → 通知其他客户端重推（左栏「另一处正在运行」近实时）。
@@ -6455,6 +8520,23 @@ export class ClientSession {
                     return;
                 }
             }
+            // #145 同款守卫：删之前查一遍其他客户端是否持有这份转录 ——
+            // 对端 runtime 还开着时硬删等于把文件从活 writer 身下抽走（跑着时
+            // 更是两支并发写）。被持有就拒绝删除；本客户端自己的持有已在上面处理。
+            const otherOwner = this.findSessionOwner?.(abs);
+            if (otherOwner) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: otherOwner.isStreaming
+                        ? `该对话正在另一处运行中（「${otherOwner.title}」），已停止删除；请先回到原窗口停止或关闭它`
+                        : `该对话在另一处仍开着（「${otherOwner.title}」），已停止删除；请先在原窗口关闭它再删`,
+                    textEn: otherOwner.isStreaming
+                        ? `This conversation is running in another window ("${otherOwner.title}"); delete aborted — stop or close it there first`
+                        : `This conversation is still open in another window ("${otherOwner.title}"); delete aborted — close it there first`,
+                });
+                return;
+            }
             rmSync(abs, { force: true });
             // 转录删了，sidecar 再留着就是孤儿，一起清掉（不存在不报错）。
             removeTouchSidecar(abs);
@@ -6584,8 +8666,8 @@ export class ClientSession {
         });
     }
     /**
-     * 将内存子代理（inMemory）固化为普通持久化对话：
-     * 写入磁盘 .jsonl 会话文件，清除 isSubagent 标记，使它进入历史会话列表并长久保留。
+     * 将内存会话（inMemory 子代理 / 临时对话）固化为普通持久化对话：
+     * 写入磁盘 .jsonl 会话文件，清除 isSubagent / isEphemeral 标记，使它进入历史会话列表并长久保留。
      */
     async persistConversation(id) {
         const conv = this.convs.get(id);
@@ -6599,7 +8681,7 @@ export class ClientSession {
             return;
         }
         const sm = conv.session.sessionManager;
-        if (!conv.isSubagent && sm?.isPersisted?.()) {
+        if (!conv.isSubagent && !conv.isEphemeral && sm?.isPersisted?.()) {
             this.emit({
                 type: "notice",
                 level: "info",
@@ -6608,6 +8690,8 @@ export class ClientSession {
             });
             return;
         }
+        // 固化对象是临时对话时文案换一套（用户看到的是「临时对话」而非「子代理」）。
+        const wasEphemeral = !!conv.isEphemeral;
         try {
             const cwd = conv.cwd || this.cwd;
             const sampleSm = SessionManager.create(cwd);
@@ -6641,14 +8725,26 @@ export class ClientSession {
                 sm.flushed = true;
             }
             conv.isSubagent = false;
+            conv.isEphemeral = false;
+            if (wasEphemeral) {
+                const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conv.id);
+                try {
+                    rmSync(ephemeralDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
             this.emitConversations();
             await this.pushProjects();
             this.flushSnapshot();
             this.emit({
                 type: "notice",
                 level: "info",
-                text: `已将子代理「${conv.title}」固化为普通对话，并保存至历史记录`,
-                textEn: `Solidified subagent "${conv.title}" into a regular conversation saved to history`,
+                text: wasEphemeral
+                    ? `已将临时对话「${conv.title}」保存为正式对话，并存入历史记录`
+                    : `已将子代理「${conv.title}」固化为普通对话，并保存至历史记录`,
+                textEn: wasEphemeral
+                    ? `Saved ephemeral conversation "${conv.title}" as a regular conversation in history`
+                    : `Solidified subagent "${conv.title}" into a regular conversation saved to history`,
             });
         }
         catch (err) {
@@ -6656,8 +8752,8 @@ export class ClientSession {
             this.emit({
                 type: "notice",
                 level: "error",
-                text: `固化子代理失败：${msg}`,
-                textEn: `Failed to persist subagent: ${msg}`,
+                text: `固化失败：${msg}`,
+                textEn: `Failed to persist conversation: ${msg}`,
             });
         }
     }
@@ -7123,9 +9219,9 @@ export class ClientSession {
             // is known-good. This keeps a failed history open entirely non-destructive.
             const oldListed = this.conv.listed;
             const displaced = this.displaceActive();
-            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetCwd && !c.isSubagent).length +
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetCwd && !c.isSubagent && !c.isEphemeral).length +
                 1 -
-                (displaced?.cwd === targetCwd && !displaced?.isSubagent ? 1 : 0);
+                (displaced?.cwd === targetCwd && !displaced?.isSubagent && !displaced?.isEphemeral ? 1 : 0);
             if (openInProject > MAX_OPEN_CONVERSATIONS) {
                 // displaceActive() may have promoted a streaming conversation into the
                 // running list. Roll that presentation-only mutation back because no
@@ -7156,6 +9252,9 @@ export class ClientSession {
                 this.removeConversation(displaced.id);
             await this.bindSession();
             this.cwd = targetCwd;
+            // 打开的历史会话可能属于另一个项目 —— 工作区跟随面（roots/文件树/
+            // 历史列表/命令目录/最近项目）必须跟着切，否则 UI 停在旧项目。
+            this.applyCwdSideEffects(targetCwd);
             await this.restoreProjectProviderKeysForCwd(targetCwd);
             await this.restoreProjectModelForCwd(targetCwd);
             this.conv.lastActiveAt = Date.now();
@@ -7167,6 +9266,7 @@ export class ClientSession {
             void this.pushSlashCommands();
             // 切历史会话成功 → 插件重拉（轨迹视图立即显示该会话时间线）。
             this.notifyConversationChanged();
+            this.pushSettings();
         }
         catch (err) {
             openedTerminals?.killAll();
@@ -7208,6 +9308,280 @@ export class ClientSession {
         }
         return null;
     }
+    /**
+     * Map any rendered message id (u-*, a-*, t-*, b-*, c-*, or raw entry id)
+     * back to its append-only session entry in the given conversation.
+     */
+    resolveMessageEntry(conv, messageId) {
+        // The matcher re-derives rendered ids with the SAME derivation
+        // serializeCachedFor() used to hand them to the browser (uiMessageId +
+        // the counter below). Historically this recomputed ids with its own
+        // numbering (per-timestamp assistant seq, branch-entry global seq),
+        // which never matched what was rendered — fork/rollback on any
+        // assistant bubble failed 100% of the time (issue #381).
+        const entries = conv.session.sessionManager.buildContextEntries();
+        const found = findEntryByUiId(entries, messageId, (m) => this.uiMessageKey(conv, m).n);
+        // 兜底：getEntry 查整棵树
+        return found ?? conv.session.sessionManager.getEntry(messageId) ?? null;
+    }
+    /**
+     * Fork a NEW branch conversation from a specific historical message position.
+     * Truncates the transcript before (or at) that message as the context of the
+     * new conversation, allowing the user to explore alternative lines of thought
+     * without affecting the original conversation.
+     */
+    async forkSession(messageId, position = "before", targetConvId) {
+        if (this.quiesceBlocked())
+            return;
+        const targetConv = (targetConvId ? this.convs.get(targetConvId) : this.conv) ?? this.conv;
+        const entry = this.resolveMessageEntry(targetConv, messageId);
+        if (!entry) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: "找不到指定的消息节点（可能已被压缩或不在当前分支）",
+                textEn: "Message node to fork from not found (may have been compacted or is on another branch)",
+            });
+            this.flushSnapshot();
+            return;
+        }
+        const targetLeafId = position === "at" ? entry.id : entry.parentId;
+        try {
+            const currentSessionFile = targetConv.session.sessionFile;
+            const isPersisted = targetConv.session.sessionManager.isPersisted() && currentSessionFile && existsSync(currentSessionFile);
+            const prevModel = targetConv.session.agent.state.model ?? null;
+            const prevThinking = targetConv.session.thinkingLevel ?? null;
+            const conversationId = this.nextConversationId();
+            const terminals = this.makeTerminalManager(conversationId, targetConv.cwd);
+            let forkedManager;
+            if (isPersisted) {
+                const sessionDir = targetConv.session.sessionManager.getSessionDir();
+                let forkedSessionPath;
+                if (!targetLeafId) {
+                    const sm = SessionManager.create(targetConv.cwd, sessionDir);
+                    sm.newSession({ parentSession: currentSessionFile });
+                    forkedSessionPath = sm.getSessionFile();
+                }
+                else {
+                    const sm = SessionManager.open(currentSessionFile, sessionDir);
+                    forkedSessionPath = sm.createBranchedSession(targetLeafId);
+                }
+                if (!forkedSessionPath) {
+                    throw new Error("Failed to create forked session file");
+                }
+                forkedManager = SessionManager.open(forkedSessionPath, sessionDir);
+            }
+            else {
+                forkedManager = SessionManager.create(targetConv.cwd);
+                if (targetLeafId) {
+                    const branch = targetConv.session.sessionManager.getBranch(targetLeafId);
+                    for (const e of branch) {
+                        if (e.type === "message") {
+                            try {
+                                forkedManager.appendMessage(e.message);
+                            }
+                            catch {
+                                // skip malformed/unsupported message entries in memory mode
+                            }
+                        }
+                    }
+                }
+            }
+            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined), {
+                cwd: targetConv.cwd,
+                agentDir: this.agentDir,
+                sessionManager: forkedManager,
+            });
+            const newConv = this.makeConversation(runtime, conversationId, terminals);
+            if (targetConv.agentPreset)
+                newConv.agentPreset = targetConv.agentPreset;
+            if (targetConv.permissionPreset)
+                newConv.permissionPreset = targetConv.permissionPreset;
+            newConv.forkFrom = {
+                conversationId: targetConv.id,
+                messageId,
+                title: targetConv.title,
+            };
+            // 与 newChat/switchSession 同一护栏：fork 出的对话也占项目名额，被换下
+            // 的旧 active 也要走运行列表生命周期（该保留的保留、该释放的释放）。
+            // 之前两者皆无 —— 可以无限 fork 堆爆名额，旧对话也永远留在列表里。
+            // 顺序照 switchSession：新 runtime 建好才 displace，失败不伤现有对话。
+            const oldListed = this.conv.listed;
+            const displaced = this.displaceActive();
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetConv.cwd && !c.isSubagent && !c.isEphemeral).length +
+                1 -
+                (displaced?.cwd === targetConv.cwd && !displaced?.isSubagent && !displaced?.isEphemeral ? 1 : 0);
+            if (openInProject > MAX_OPEN_CONVERSATIONS) {
+                // displaceActive() 可能只是把旧对话标成后台展示（presentation-only）；
+                // 没有切换发生时回滚该标记，新 fork 的 runtime/终端直接释放。
+                this.conv.listed = oldListed;
+                terminals.killAll();
+                await runtime.dispose();
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
+                    textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
+                });
+                return;
+            }
+            this.convs.set(conversationId, newConv);
+            this.activeId = conversationId;
+            if (displaced)
+                this.removeConversation(displaced.id);
+            await this.bindSession();
+            if (prevModel && this.sharedModelRuntime) {
+                try {
+                    const pm = prevModel;
+                    await this.restoreKeyForModel(`${pm.provider}/${pm.id}`, targetConv.cwd);
+                    await this.session.setModel(prevModel);
+                }
+                catch {
+                    // keep default
+                }
+            }
+            if (prevThinking) {
+                try {
+                    this.session.setThinkingLevel(prevThinking);
+                }
+                catch {
+                    // keep default
+                }
+            }
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: "🌱 已派生新分支会话并自动切换（原对话保持不变）",
+                textEn: "🌱 Forked new branch session and switched to it (original preserved)",
+            });
+        }
+        catch (err) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: `派生分支会话失败：${err.message}`,
+                textEn: `Failed to fork branch session: ${err.message}`,
+            });
+        }
+        this.flushSnapshot();
+    }
+    /**
+     * 回滚会话至指定消息检查点（Checkpoint Rollback）：
+     * 丢弃该消息之后的所有内容，并就地重置 session 状态，用户可直接在此继续提问。
+     */
+    async rollbackSession(messageId, targetConvId, restoreWorkspace) {
+        if (this.quiesceBlocked())
+            return;
+        const targetConv = (targetConvId ? this.convs.get(targetConvId) : this.conv) ?? this.conv;
+        const entry = this.resolveMessageEntry(targetConv, messageId);
+        if (!entry) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: "找不到指定的回滚检查点（可能已被压缩或不存在）",
+                textEn: "Rollback checkpoint not found (may have been compacted or not exist)",
+            });
+            this.flushSnapshot();
+            return;
+        }
+        try {
+            if (targetConv.session.isStreaming) {
+                await targetConv.session.abort();
+            }
+            // 重置分支 leaf 到目标 entry.id
+            targetConv.session.sessionManager.branch(entry.id);
+            const branchedContext = targetConv.session.sessionManager.buildSessionContext();
+            targetConv.session.agent.state.messages = [...branchedContext.messages];
+            if (branchedContext.thinkingLevel) {
+                try {
+                    targetConv.session.setThinkingLevel(branchedContext.thinkingLevel);
+                }
+                catch {
+                    // ignore
+                }
+            }
+            await targetConv.session.reload();
+            // 重新应用设置和门控
+            this.applyRetryOverrides();
+            this.applyCompactionOverrides();
+            this.applyToolGating(targetConv.session, targetConv.agentPreset);
+            // 清理该会话的 UI 消息缓存和序列化映射
+            targetConv.uiMessageCache.clear();
+            targetConv.msgIds.clear();
+            targetConv.userSeqByTs.clear();
+            targetConv.nextMsgId = 1;
+            targetConv.lastMessagesSig = "";
+            targetConv.lastMessagesArray = [];
+            targetConv.queueSteering = [];
+            targetConv.queueFollowUp = [];
+            try {
+                targetConv.session.clearQueue?.();
+            }
+            catch {
+                // best effort
+            }
+            // 联动还原物理工作区文件（Dual-State Rollback）
+            let workspaceRestored = false;
+            if (restoreWorkspace) {
+                const entryTs = entry.message?.timestamp ??
+                    entry.timestamp ??
+                    0;
+                // 查找最贴近该 entry 的快照（按 entryId 或 <= entryTs 的最后一份快照）
+                const snapshots = targetConv.workspaceSnapshots ?? [];
+                let matched = snapshots.find((s) => s.entryId === entry.id);
+                if (!matched) {
+                    const eligible = snapshots.filter((s) => entryTs === 0 || s.timestamp <= entryTs + 2000);
+                    matched = eligible[eligible.length - 1];
+                }
+                if (!matched && snapshots.length > 0) {
+                    matched = snapshots[0];
+                }
+                if (matched) {
+                    const res = await restoreWorkspaceSnapshot(targetConv.cwd, matched.snapshotRef);
+                    if (res.success) {
+                        workspaceRestored = true;
+                    }
+                    else {
+                        this.emit({
+                            type: "notice",
+                            level: "warning",
+                            text: `会话已回滚，但工作区物理文件还原失败：${res.error}`,
+                            textEn: `Session rolled back, but workspace file restore failed: ${res.error}`,
+                        });
+                    }
+                }
+                else {
+                    this.emit({
+                        type: "notice",
+                        level: "warning",
+                        text: "未找到对应检查点的工作区快照（可能非 Git 仓库或尚未记录），工作区文件未改动。",
+                        textEn: "No workspace snapshot found for this checkpoint (not a Git repo or snapshot unavailable); files left untouched.",
+                    });
+                }
+            }
+            this.emit({
+                type: "notice",
+                level: "info",
+                text: workspaceRestored
+                    ? "已回滚至选定消息，工作区物理文件已联动还原至该检查点时刻。"
+                    : "已回滚至选定消息，后续内容已丢弃，可直接继续对话。",
+                textEn: workspaceRestored
+                    ? "Rolled back to selected message; workspace physical files restored to checkpoint state."
+                    : "Rolled back to selected message; subsequent content discarded, ready to continue.",
+            });
+            this.emittedMessages = null;
+            this.emitConversations();
+            this.flushSnapshot(true);
+        }
+        catch (err) {
+            this.emit({
+                type: "notice",
+                level: "error",
+                text: `回滚失败：${err.message}`,
+                textEn: `Rollback failed: ${err.message}`,
+            });
+        }
+    }
     /**
      * Edit a past user question and re-ask it: forks a NEW session file that
      * keeps everything up to (but not including) that question, then sends the
@@ -7328,7 +9702,7 @@ export class ClientSession {
         const run = (async () => {
             try {
                 const saved = this.stateStore.get(this.clientId);
-                const removedProjects = new Set(this.stateStore.getRemovedProjects(this.clientId));
+                const removedProjects = new Set(this.stateStore.getRemovedProjects(this.clientId).map(normalizePathKey));
                 const map = new Map();
                 for (const p of saved.projects)
                     map.set(p.path, p.lastUsed);
@@ -7345,7 +9719,7 @@ export class ClientSession {
                 // is useless in the picker. Tombstoned entries (explicitly removed by
                 // the user) stay hidden even though session files still mention them.
                 const projects = [...map.entries()]
-                    .filter(([path]) => !removedProjects.has(path) && existsSync(path))
+                    .filter(([path]) => !removedProjects.has(normalizePathKey(path)) && existsSync(path))
                     .map(([path, lastUsed]) => ({ path, lastUsed }))
                     .sort((a, b) => b.lastUsed - a.lastUsed)
                     .slice(0, 20);
@@ -7365,11 +9739,17 @@ export class ClientSession {
         await run;
     }
     /** 缓存命中时把当前 cwd 并进去：命中则刷新 lastUsed 重排，未命中则补到首位
-     *  （remember 刚写入的新项目在 TTL 窗口内也可见，不必等下一次扫盘）。 */
+     *  （remember 刚写入的新项目在 TTL 窗口内也可见，不必等下一次扫盘）。
+     *  若当前工作区已被显式移出，则不强行塞回最近列表。 */
     withCurrentCwd(projects, now) {
-        if (projects.some((p) => p.path === this.cwd)) {
+        const currentKey = normalizePathKey(this.cwd);
+        const removedKeys = new Set(this.stateStore.getRemovedProjects(this.clientId).map(normalizePathKey));
+        if (removedKeys.has(currentKey)) {
+            return projects;
+        }
+        if (projects.some((p) => normalizePathKey(p.path) === currentKey)) {
             return projects
-                .map((p) => (p.path === this.cwd && p.lastUsed < now ? { ...p, lastUsed: now } : p))
+                .map((p) => (normalizePathKey(p.path) === currentKey && p.lastUsed < now ? { ...p, lastUsed: now } : p))
                 .sort((a, b) => b.lastUsed - a.lastUsed);
         }
         return [{ path: this.cwd, lastUsed: now }, ...projects].slice(0, 20);
@@ -7432,7 +9812,7 @@ export class ClientSession {
      */
     async scmGenCommitMessage(reqId) {
         const lang = this.getLang();
-        const cwd = this.conv?.cwd ?? this.cwd;
+        const cwd = this.convs.get(this.activeId)?.cwd ?? this.cwd;
         const reply = (ok, extra) => {
             this.emit({ type: "scm_data", reqId, kind: "commitmsg", ok, ...extra });
         };
@@ -7599,7 +9979,7 @@ export class ClientSession {
     }
     async setCwd(newCwd) {
         try {
-            const { resolve, sep } = await import("node:path");
+            const { resolve } = await import("node:path");
             this.files.unwatchGit(); // stale repo's watcher must not fire across projects
             const fs = await import("node:fs/promises");
             const trimmed = newCwd.trim();
@@ -7613,11 +9993,9 @@ export class ClientSession {
                 });
                 return;
             }
-            // Windows 裸盘符（"C:"）：resolve 会按该盘当前目录解析，必须显式指到盘根；
-            // 仅 win32 生效——posix 下 "C:" 仍是普通相对路径，避免误伤同名目录。
-            const abs = process.platform === "win32" && /^[A-Za-z]:$/.test(trimmed)
-                ? `${trimmed.toUpperCase()}${sep}`
-                : resolve(trimmed);
+            // Windows 裸盘符（"C:"）与相对路径基准的处理收敛到 resolveCwdTarget
+            // （纯函数，含 win32/posix 差异说明与单测）。
+            const abs = resolveCwdTarget(trimmed, this.cwd);
             const st = await fs.stat(abs);
             if (!st.isDirectory()) {
                 throw new Error("路径不是目录");
@@ -7727,7 +10105,6 @@ export class ClientSession {
             this.conv.promptedSinceActive = false;
             this.conv.lastActiveAt = Date.now();
             this.cwd = abs;
-            this.roots = this.stateStore.getWorkspaceRoots(this.clientId, abs);
             // 模型/key 恢复不挡快照：后台做，带切换代际 guard（用户又切走就跳过，
             // 否则会把旧项目的 key 套到新对话上），做完补一次 flush 刷新模型栏。
             {
@@ -7747,16 +10124,7 @@ export class ClientSession {
                     }
                 })();
             }
-            // 工作区跟随型插件（编辑器文件树等）同步切根。
-            try {
-                this.onCwdChanged?.(abs, this.roots);
-            }
-            catch {
-                /* 钩子异常不影响主流程 */
-            }
-            // Remember the new workspace (restore target + recent-project entry).
-            this.stateStore.remember(this.clientId, abs);
-            void this.pushProjects();
+            this.applyCwdSideEffects(abs);
             this.webUi.refresh();
             this.emitConversations();
             this.goalSvc.emitGoalStatus();
@@ -7768,12 +10136,9 @@ export class ClientSession {
                 text: `已切换到工作目录：${abs}`,
                 textEn: `Switched to directory: ${abs}`,
             });
-            this.refreshSessionsOnSwitch();
-            void this.listFiles(undefined);
-            // Commands are per-project (.pi/commands.json in the current cwd).
-            void this.listCommands();
             // 切项目即换了当前打开对话 → 插件重拉。
             this.notifyConversationChanged();
+            this.pushSettings();
         }
         catch (err) {
             this.emit({
@@ -7839,14 +10204,30 @@ export class ClientSession {
     async clearGoal() {
         return this.goalSvc.clearGoal();
     }
-    /** Run a git diff (unstaged + staged) in a conversation's workspace, or
-     * "" when not a repo. */
+    /**
+     * Run a git diff (unstaged + staged) in a conversation's workspace, or
+     * "" when not a repo.
+     *
+     * 返回值是 goal 审查用的「变更指纹」，构造规则（截断与等值比较的相互作用）
+     * 见 buildDiffFingerprint：diff 为空时以排序后的 `git status --porcelain`
+     * 兜底（未跟踪文件也算变更），diff 非空时正文截断后拼 [diff-meta] 尾段，
+     * 避免大 diff 截断后两轮前缀相同被误判成停滞。
+     */
     async gitDiff(cwd) {
         try {
             const { code, out } = await this.runAsync("git", ["diff", "HEAD"], 10_000, cwd);
             if (code !== 0)
                 return "";
-            return out.slice(0, 60_000);
+            let status = "";
+            try {
+                const st = await this.runAsync("git", ["status", "--porcelain"], 10_000, cwd);
+                if (st.code === 0)
+                    status = st.out;
+            }
+            catch {
+                // status 拍不到 → 指纹退化为纯 diff，行为与旧版一致
+            }
+            return buildDiffFingerprint(out, status);
         }
         catch {
             return "";
@@ -8058,9 +10439,13 @@ export class ClientSession {
         this.cancelPendingQuestions();
         // 同理关闭挂起的页面调用（以失败解析：对面是扩展，没有答可等）。
         this.cancelPendingPageCalls();
+        // 挂起的工具审批一并清掉（以「拒绝」解析，防 Promise/runtime 泄漏）。
+        this.cancelPendingApprovals();
         this.bg.stop();
         for (const conv of this.convs.values()) {
             this.clearAllToolWatchdogs(conv);
+            // 逐个对话回收 eval 内核；下面的兜底再清一次表（含已 delete 的残留）。
+            disposeEvalSession(conv.id);
             conv.unsubscribe?.();
             try {
                 await conv.runtime.dispose();
@@ -8069,6 +10454,7 @@ export class ClientSession {
                 // best effort
             }
         }
+        disposeAllEvalKernels();
     }
 }
 /** issue #226：插件无头调用的工作目录校验（纯函数，可单测）。
@@ -8111,6 +10497,8 @@ export class AgentService {
     cwd;
     /** index.ts 注入：SDK 工具执行事件的插件转发钩子，attach 时拷贝到每个新会话。 */
     onToolEvent = undefined;
+    /** index.ts 注入：bash/read 插件拦截钩子，attach 时拷贝到每个新会话。 */
+    toolGuard = undefined;
     /** index.ts 注入：运行轨迹事件的插件转发钩子，attach 时拷贝到每个新会话。 */
     onRunEvent = undefined;
     /** index.ts 注入：对话切换通知钩子，attach 时拷贝到每个新会话。 */
@@ -8418,12 +10806,34 @@ export class AgentService {
         for (const [clientId, cs] of this.clients) {
             if (clientId === excludeClientId)
                 continue;
+            // issue #291：跳过无浏览器连接的残骸（非伪客户端 sinkCount=0 = 断连留存）。
+            // 伪客户端（scheduler:/plugin:）不走浏览器，sinkCount 永远为 0，保留。
+            if (!AgentService.isPseudoClientId(clientId) && cs.sinkCount() === 0)
+                continue;
             for (const r of cs.streamingSummariesAll())
                 out.push({ ...r, owner: clientId });
         }
         return out;
     }
-    /** issue #145：某客户端流式集合变化 → 其他客户端重推 conversations。 */
+    /** issue #291：删除定时任务后回收对应伪客户端，避免残留在 elsewhere 列表。 */
+    releaseSchedulerClient(taskId) {
+        const safe = String(taskId ?? "").replace(/[^A-Za-z0-9_-]/g, "") || "task";
+        const clientId = `scheduler:${safe}`;
+        const cs = this.clients.get(clientId);
+        if (!cs)
+            return;
+        // 伪客户端常驻一个 noop sink（chatFromScheduler 的 attach），所以不能按
+        // sinkCount 判断「有没有浏览器」—— 它永远为 1。这里就是它的回收点。
+        this.clients.delete(clientId);
+        // 先摘出 map 再异步 dispose：只删 map 的话，对话的 runtime/终端/看门狗
+        // 计时器全都留在内存里（泄漏），转录还挂着活 writer（同文件双写者风险）。
+        void cs.dispose().catch(() => {
+            // 回收失败不拦主流程：尽力而为，进程退出时 OS 兜底
+        });
+        // 通知其他客户端刷新 elsewhere 列表。
+        this.pokeExternalRunning(clientId);
+    }
+    /** issue #145: 某客户端流式集合变化 → 其他客户端重推 conversations。 */
     pokeExternalRunning(excludeClientId) {
         for (const [clientId, cs] of this.clients) {
             if (clientId === excludeClientId)
@@ -8798,9 +11208,9 @@ export class AgentService {
         }
         const moveIds = [convId, ...collectSubagentDescendantIds(briefs, convId)];
         const moveSet = new Set(moveIds);
-        // 容量：与 switchSession 同口径（目标项目非子代理 8 个）。
-        const movedMains = briefs.filter((b) => moveSet.has(b.id) && !b.isSubagent).length;
-        const openInProject = target.takeoverBriefs().filter((b) => b.cwd === main.cwd && !b.isSubagent).length + movedMains;
+        // 容量：与 switchSession 同口径（目标项目非子代理且非临时会话 8 个）。
+        const movedMains = briefs.filter((b) => moveSet.has(b.id) && !b.isSubagent && !b.isEphemeral).length;
+        const openInProject = target.takeoverBriefs().filter((b) => b.cwd === main.cwd && !b.isSubagent && !b.isEphemeral).length + movedMains;
         if (openInProject > MAX_OPEN_CONVERSATIONS) {
             fail(`目标项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`, `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`);
             return;
@@ -8904,7 +11314,9 @@ export class AgentService {
                 // 流式增量经尾部 attachSink 直接推给新 socket）。
                 // 有其他在线标签时不认领（issue #10 隔离优先）；quiesce 排空期也放行
                 // （这是重连既有工作，不是新工作）。本段无 await，并发 attach 原子。
-                const orphan = this.findAdoptableOrphan(clientId);
+                // 伪客户端（scheduler:/plugin:，定时任务/插件的无头调用）绝不认领：
+                // 否则无头会话会改键劫持用户关浏览器留下的残会话。
+                const orphan = AgentService.isPseudoClientId(clientId) ? null : this.findAdoptableOrphan(clientId);
                 if (orphan) {
                     this.clients.delete(orphan.oldId);
                     this.clients.set(clientId, orphan.cs);
@@ -8932,11 +11344,15 @@ export class AgentService {
                     const saved = this.stateStore.get(clientId);
                     if (saved.lastCwd && saved.lastCwd !== this.cwd) {
                         try {
-                            if (statSync(saved.lastCwd).isDirectory())
+                            // issue #295：异步 stat —— 同步 stat 落在坏挂载（已卸载的外部卷/
+                            // autofs 触发点）上会在内核里挂起，冻住整个事件循环（含控制
+                            // socket 与其他客户端的心跳）；异步版本只挡本连接，超时提示照发。
+                            const { stat } = await import("node:fs/promises");
+                            if ((await stat(saved.lastCwd)).isDirectory())
                                 cwd = saved.lastCwd;
                         }
                         catch {
-                            // gone (unmounted drive / deleted) — fall back to the default
+                            // gone (unmounted drive / deleted / hanging mount) — fall back to the default
                         }
                     }
                     // Sessions use the SDK default per-project dir — no per-client dir.
@@ -8988,6 +11404,7 @@ export class AgentService {
         // Forward hooks (set once by index.ts) to every session.
         cs.onQuit = this.onQuit;
         cs.onToolEvent = this.onToolEvent;
+        cs.toolGuard = this.toolGuard;
         cs.onRunEvent = this.onRunEvent;
         cs.onConversationChanged = () => this.onConversationChanged?.();
         cs.pluginToolsProvider = this.pluginToolsProvider;
@@ -9040,7 +11457,14 @@ export class AgentService {
     }
     /** Remove a socket from a client's broadcast set (called on socket close). */
     detach(clientId, send) {
-        this.clients.get(clientId)?.detachSink(send);
+        const cs = this.clients.get(clientId);
+        cs?.detachSink(send);
+        // issue #291：最后一个 sink 断开 = 该客户端不再在线 → 它的对话不该再出现在
+        // 别人的 elsewhere 列表（listExternalRunning 已跳过 sinkCount=0 的非伪客户端，
+        // 但列表是推过去的，得让其他客户端重推一次才能立刻消失）。
+        if (cs && !AgentService.isPseudoClientId(clientId) && cs.sinkCount() === 0) {
+            this.pokeExternalRunning(clientId);
+        }
     }
     get(clientId) {
         return this.clients.get(clientId);