pi-web-ui 0.95.0 → 0.96.1

package/dist/server/agent-service.js

@@ -17,14 +17,16 @@ import "./patch-remote-catalog.js";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
-import { appendFileSync, existsSync, readFileSync, rmSync, statSync, mkdirSync, watch, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, readFileSync, renameSync, rmSync, statSync, mkdirSync, watch, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashToolDefinition, createEditToolDefinition, createLocalBashOperations, createWriteToolDefinition, getAgentDir, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { BgServerTracker } from "./bg-servers.js";
-import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, resolveNpmRegistry, sortUpdateItems, } from "./update-check.js";
+import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, detectPiSdkSplit, resolveNpmRegistry, sortUpdateItems, } from "./update-check.js";
+import { checkPluginUpdates } from "./plugin-updater.js";
+import { isBundledInUse, sdkCopies } from "./sdk-origin.js";
 import { hasActiveSubagentRun, hasPendingWaitSubscription, shouldRetainActive } from "./wait-subscription-scan.js";
 import { COMPACTION_PENDING_TYPE, looksLikeChainCorruption, makeCompactionMarkerId, repairSessionFile, } from "./compaction-markers.js";
 import { DANGLING_TOOL_RESULT_TEXT, DANGLING_TOOL_RESULT_TEXT_EN, findDanglingToolCalls, healDanglingToolCallFile, } from "./dangling-tools.js";
@@ -32,17 +34,19 @@ import { removeQueuedByIndexOrText } from "./queue-utils.js";
 import { syncPluginToolsIntoSession } from "./plugins.js";
 import { denialText, } from "./plugin-tool-guard.js";
 import { SettingsService } from "./settings-service.js";
-import { GoalService } from "./goal-service.js";
+import { GoalService, buildDiffFingerprint } from "./goal-service.js";
 import { MarkerService } from "./marker-service.js";
 import { SlashCommandsService, parseSlash } from "./slash-commands.js";
 import { ModelAdminService } from "./model-admin.js";
 import { FilesService, MACHINE_ROOT, desktopDirWire, workspacePath } from "./files-service.js";
-import { DEFAULT_TOOL_WATCHDOG_TIMEOUT_MS, effectiveToolWatchdogMs, isExtensionDisabled, isExtensionEnabled, normalizeDisabledPluginTools, normalizeRetryMaxAttempts, normalizeSkillList, ClientStateStore, } from "./client-state.js";
-import { bilingual, pick, resolveServerLang } from "./i18n.js";
+import { DEFAULT_TOOL_WATCHDOG_TIMEOUT_MS, effectiveToolWatchdogMs, isExtensionDisabled, isExtensionEnabled, normalizeDisabledPluginTools, normalizePathKey, normalizeRetryMaxAttempts, normalizeSkillList, ClientStateStore, } from "./client-state.js";
+import { pick, resolveServerLang } from "./i18n.js";
 import { SubagentTemplatesStore, pickTemplatePrompt } from "./subagent-templates.js";
-import { ApprovalRulesStore } from "./approval-rules.js";
+import { ApprovalRulesStore, extractTargetPath } from "./approval-rules.js";
 import { ComposerDraftsStore } from "./composer-drafts.js";
+import { readPermissionFromSession } from "./permission-preset.js";
 import { createWorkspaceSnapshot, restoreWorkspaceSnapshot } from "./workspace-snapshot.js";
+import { isPathInsideRoot } from "./approval-rules.js";
 import { approvalSuppressionReason, checkDangerousToolCall, isApprovalPolicyEmpty, pluginApprovalCategory, } from "./tool-approval.js";
 import { PlanManager } from "./plan-manager.js";
 import { applyHeadTail, makePersistentTerminalTools, makeTerminalBashTool, stripAnsi, TERMINAL_TOOLS_GUIDANCE, } from "./terminals.js";
@@ -53,7 +57,9 @@ import { pruneContextHierarchically } from "./context-budget.js";
 import { decodeText } from "./text-sniff.js";
 import { makeEditSoftTool } from "./edit-soft-tool.js";
 // 覆盖 SDK 内置 read：路径是目录时列出目录条目（行为开关 readDirEnabled，默认开）。
-import { makeReadDirTool } from "./read-tool.js";
+// 覆盖定义与「与扩展同名工具共存」的注入辅助分在两个文件（后者的依据见 tool-overrides.ts）。
+import { makeReadDirTool, withReadDirSupport } from "./read-tool.js";
+import { installToolOverrides, } from "./tool-overrides.js";
 // 展示文件给用户（present_files）：图片/视频内联、文本开预览弹窗、本地打开按钮。
 import { makePresentFilesTool } from "./present-files-tool.js";
 // 主动压缩上下文工具（compact_context）：AI 主动根据当前问题精简上下文并自主控制范围。
@@ -77,9 +83,9 @@ import { buildAttachmentMessages, parseModelSpec } from "./attachments.js";
 import { buildVisionBridgePrompt, findVisionModels, transcribeImages } from "./vision-bridge.js";
 import { isNotRepoError, scmCommitContext } from "./scm.js";
 import { buildCommitMsgInput, buildCommitMsgPrompt, sanitizeCommitMessage } from "./scm-commitmsg.js";
-import { BUILTIN_SOUL, DEFAULT_PROMPT_TEMPLATE, buildToolsSchemaText, renderPromptTemplate, resolveSectionTexts, } from "./prompt-composer.js";
+import { BUILTIN_SOUL, DEFAULT_PROMPT_TEMPLATE, buildToolsSchemaText, estimatePromptTokens, renderPromptTemplate, resolveSectionTexts, } from "./prompt-composer.js";
 import { launchOrigin, toServiceInfo } from "./launch-origin.js";
-import { serializeMessage, serializeStreamingMessage, stripTransientRetryErrors, } from "./serialize.js";
+import { findEntryByUiId, serializeMessage, serializeStreamingMessage, stripTransientRetryErrors, } from "./serialize.js";
 import { loadCommands, saveCommandsFile, TerminalManager } from "./terminals.js";
 const SNAPSHOT_INTERVAL_MS = 60;
 /** 服务进程所在机器的用户主目录（wire 格式）：进程内不变，模块加载时求值一次，
@@ -181,7 +187,7 @@ Many legacy Chinese text files (.html/.txt/.md/.log, exported documents) are GBK
  * schema stays consistent with the terminal-backed tool.
  */
 export function makeKillableBashTool(cwd, kills, 
-/** per-call 返回文本的服务端语言（默认英文）；工具 definition 走 bilingual 内联双语。 */
+/** per-call 返回文本的服务端语言（默认英文）；工具 definition 为纯英文。 */
 lang = () => "en") {
     const base = createLocalBashOperations();
     const tool = createBashToolDefinition(cwd, {
@@ -206,7 +212,7 @@ lang = () => "en") {
     return {
         name: tool.name,
         label: tool.label,
-        description: "Run a shell command natively (process spawn, no terminal) and return its full output plus exit code — the SDK's plain bash tool. persist is ignored here (no terminal); use head/tail to trim the returned output.",
+        description: "Run a shell command natively (process spawn, no terminal); returns full output plus exit code. persist is ignored here; use head/tail to trim returned output.",
         parameters: Type.Object({
             command: Type.String({ description: "The shell command to run" }),
             timeout: Type.Optional(Type.Number({ description: "Optional timeout in seconds" })),
@@ -246,9 +252,9 @@ export function makeAdaptiveBashTool(killable, terminalBacked, useTerminal) {
     return {
         ...killable,
         description: "Run a shell command and return its full output plus exit code. Behavior depends on the「default bash override」setting (terminalBash):\n" +
-            "Setting OFF → runs natively (process spawn, no terminal) — the SDK's plain bash tool. persist has no effect.\n" +
-            "Setting ON → runs in a visible terminal. persist=true keeps that terminal alive ('ai-bash': shell state such as cd/venv/ssh retained across calls, silent commands move to the background and notify when done); persist=false (default in terminal mode) creates a one-shot terminal that exits when the command finishes while its output stays for review.\n" +
-            "Run the bare command — do NOT pipe through head/tail/more/less (use the head/tail parameters to trim the returned output instead; piping also hides live progress in the visible terminal). For interactive commands (REPLs, prompts, installers asking y/n) set persist=true (terminal mode) and drive them with terminal_input / terminal_key.",
+            "OFF → runs natively (process spawn, no terminal); persist has no effect.\n" +
+            "ON → runs in a visible terminal. persist=true keeps the 'ai-bash' terminal alive (shell state cd/venv/ssh retained across calls); persist=false (default) is a one-shot terminal whose output stays viewable.\n" +
+            "Run the bare command — never pipe through head/tail/more/less (use the head/tail params; pipes hide live progress). For interactive commands (REPLs, y/n prompts) set persist=true and drive them with terminal_input / terminal_key.",
         promptSnippet: "run shell commands",
         execute: (id, params, signal, onUpdate, ctx) => {
             const p = params;
@@ -294,13 +300,37 @@ export function withToolGuard(def, opts) {
             let approvalReason;
             let approvalReasonEn;
             let approvalCategory;
+            // 1. 系统核心安全：内置高危操作检测与自定义审批规则先行（优先级最高，防短路）
+            let danger;
+            if (opts.cwd && opts.askApproval) {
+                danger = checkDangerousToolCall(toolName, params, opts.cwd, opts.getRoots?.() ?? [], opts.getRules?.());
+                if (danger.denied) {
+                    const reasonText = danger.reason ? ` 原因：${danger.reason}` : "";
+                    const reasonTextEn = danger.reasonEn ? ` Reason: ${danger.reasonEn}` : "";
+                    const text = pick(lang, `【工具执行被审批规则直接阻断】${reasonText}`, `[Tool execution blocked by approval rule]${reasonTextEn}`);
+                    return {
+                        content: [{ type: "text", text }],
+                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
+                        isError: true,
+                    };
+                }
+            }
+            // 2. 插件前置守卫 deny 拦截（带 isError 标记）
             if (pre?.verdict.decision === "deny") {
                 const text = denialText(pre.verdict, pre.pluginId ?? "plugin", lang);
                 return {
                     content: [{ type: "text", text }],
                     details: { guardDenied: true, decision: pre.verdict.decision, pluginId: pre.pluginId },
+                    isError: true,
                 };
             }
+            // 3. 决定是否需要弹窗审批（系统高危 ask 优先于插件通用 ask，防止恶意或低危插件掩盖高危告警）
+            if (danger?.dangerous) {
+                needApproval = true;
+                approvalReason = danger.reason;
+                approvalReasonEn = danger.reasonEn;
+                approvalCategory = danger.category;
+            }
             else if (pre?.verdict.decision === "ask") {
                 needApproval = true;
                 approvalReason = pre.verdict.reason ?? "插件要求确认本次操作";
@@ -308,26 +338,6 @@ export function withToolGuard(def, opts) {
                 // 插件档位按插件 id 分：用户可以「允许同类」= 该插件的确认以后不再问。
                 approvalCategory = pluginApprovalCategory(pre.pluginId ?? "plugin");
             }
-            // 内置高危操作检测（如 bash 破坏性命令等）与自定义审批规则
-            if (!needApproval && opts.cwd && opts.askApproval) {
-                const danger = checkDangerousToolCall(toolName, params, opts.cwd, opts.getRoots?.() ?? [], opts.getRules?.());
-                if (danger.denied) {
-                    const reasonText = danger.reason ? ` 原因：${danger.reason}` : "";
-                    const reasonTextEn = danger.reasonEn ? ` Reason: ${danger.reasonEn}` : "";
-                    const text = pick(lang, `【工具执行被审批规则直接阻断】${reasonText}`, `[Tool execution blocked by approval rule]${reasonTextEn}`);
-                    return {
-                        content: [{ type: "text", text }],
-                        details: { guardDenied: true, ruleDenied: true, reason: danger.reason },
-                        isError: true,
-                    };
-                }
-                if (danger.dangerous) {
-                    needApproval = true;
-                    approvalReason = danger.reason;
-                    approvalReasonEn = danger.reasonEn;
-                    approvalCategory = danger.category;
-                }
-            }
             let effectiveParams = params;
             let userEdited = false;
             if (needApproval && opts.askApproval) {
@@ -362,7 +372,7 @@ export function withToolGuard(def, opts) {
             const result = (await def.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
             if (userEdited && result && typeof result === "object") {
                 result.details = {
-                    ...(result.details ?? {}),
+                    ...result.details,
                     userEdited: true,
                     originalParams: params,
                     executedParams: effectiveParams,
@@ -383,15 +393,18 @@ export function withToolGuard(def, opts) {
         }),
     };
 }
-/** 校验目标路径是否在工作区（或多根工作区）内。 */
+/** 校验目标路径是否在工作区（或多根工作区）内。严格规范化防止 ".." 逃逸与 Windows 盘符大小写不一致。 */
 function isInsideWorkspaceRoots(targetPath, cwd, roots = []) {
-    const abs = isAbsolute(targetPath) ? targetPath : resolve(cwd, targetPath);
+    const abs = resolve(cwd, targetPath);
     const allRoots = [resolve(cwd), ...roots.map((r) => resolve(r))];
-    return allRoots.some((r) => abs === r || abs.startsWith(r + sep));
+    return allRoots.some((r) => isPathInsideRoot(abs, r));
 }
-/** 为 write 工具包装会话级权限沙箱与人机协同审批。 */
-function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
-    const base = createWriteToolDefinition(cwd);
+/**
+ * 为 write 工具包装会话级权限沙箱与人机协同审批。
+ * `base` = 覆盖基底：第三方扩展注册的同名 write 优先（见 tool-overrides.ts），
+ * 省略则是 SDK 内置实现 —— 于是权限门禁叠在扩展实现之上，而不是把它顶掉。
+ */
+function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules, base = createWriteToolDefinition(cwd)) {
     return {
         ...base,
         execute: async (toolCallId, params, signal, onUpdate, ctx) => {
@@ -408,7 +421,7 @@ function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askA
                 };
             }
             if (perm === "workspace-write-never") {
-                const p = params?.path ?? "";
+                const p = extractTargetPath(params);
                 if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
                     return {
                         content: [
@@ -461,7 +474,7 @@ function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askA
             const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
             if (userEdited && result && typeof result === "object") {
                 result.details = {
-                    ...(result.details ?? {}),
+                    ...result.details,
                     userEdited: true,
                     originalParams: params,
                     executedParams: effectiveParams,
@@ -471,9 +484,10 @@ function wrapWriteToolWithPermission(cwd, getPermission, getRoots, getLang, askA
         },
     };
 }
-/** 为 edit 工具包装会话级权限沙箱与人机协同审批。 */
-function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules) {
-    const base = createEditToolDefinition(cwd);
+/**
+ * 为 edit 工具包装会话级权限沙箱与人机协同审批（基底语义同 write）。
+ */
+function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askApproval, getConversationId, getRules, base = createEditToolDefinition(cwd)) {
     return {
         ...base,
         execute: async (toolCallId, params, signal, onUpdate, ctx) => {
@@ -490,7 +504,7 @@ function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askAp
                 };
             }
             if (perm === "workspace-write-never") {
-                const p = params?.path ?? "";
+                const p = extractTargetPath(params);
                 if (!isInsideWorkspaceRoots(p, cwd, getRoots())) {
                     return {
                         content: [
@@ -543,7 +557,7 @@ function wrapEditToolWithPermission(cwd, getPermission, getRoots, getLang, askAp
             const result = (await base.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
             if (userEdited && result && typeof result === "object") {
                 result.details = {
-                    ...(result.details ?? {}),
+                    ...result.details,
                     userEdited: true,
                     originalParams: params,
                     executedParams: effectiveParams,
@@ -624,7 +638,7 @@ function wrapEditSoftToolWithPermission(tool, cwd, getPermission, getRoots, getL
             const result = (await tool.execute(toolCallId, effectiveParams, signal, onUpdate, ctx));
             if (userEdited && result && typeof result === "object") {
                 result.details = {
-                    ...(result.details ?? {}),
+                    ...result.details,
                     userEdited: true,
                     originalParams: params,
                     executedParams: effectiveParams,
@@ -637,17 +651,25 @@ function wrapEditSoftToolWithPermission(tool, cwd, getPermission, getRoots, getL
 /**
  * 结构化任务执行计划更新工具（plan_update）— Plan Mode / Step State Machine。
  */
-function makePlanUpdateTool(planManager, getActiveConvId, emit, flushSnapshot) {
+export function makePlanUpdateTool(planManager, getActiveConvId, emit, flushSnapshot) {
     return {
         name: PLAN_UPDATE_TOOL_NAME,
         label: "plan_update",
-        description: "Update the structured task execution plan / step state machine (Plan Mode). Use it for non-trivial tasks to break down work into steps, track live progress, and update status (pending -> in_progress -> done/failed).\n更新结构化任务执行计划（步骤状态机）。用于复杂工程任务拆解与实时进度推进。",
+        description: "Update the structured task plan / step state machine (Plan Mode): break non-trivial work into decision-ready steps and track progress (pending -> in_progress -> done/failed). Prefer steps that note discovery conclusions, files to be touched, and a rollback strategy.",
+        promptSnippet: "update structured task plan with decision-ready steps, file touch list, and live status",
+        promptGuidelines: [
+            "When executing non-trivial tasks, use plan_update early to outline decision-ready steps before coding: " +
+                "specify discovery conclusions, explicitly list files to be touched (File Touch List), and note potential rollback strategies",
+            "Keep step status updated as work progresses (pending -> in_progress -> done/failed) so the user has real-time visibility",
+        ],
         parameters: Type.Object({
             steps: Type.Array(Type.Object({
                 id: Type.String({ description: "Unique step ID, e.g. '1', 'step-1'" }),
                 title: Type.String({ description: "Short step title" }),
                 status: Type.Optional(Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("done"), Type.Literal("failed")], { description: "Step status: pending | in_progress | done | failed (default: pending)" })),
-                description: Type.Optional(Type.String({ description: "Optional detailed description or acceptance criteria" })),
+                description: Type.Optional(Type.String({
+                    description: "Optional detailed description, acceptance criteria, file touch list, or rollback note.",
+                })),
             }), { description: "List of plan steps" }),
             activeStepId: Type.Optional(Type.String({ description: "ID of the step currently being executed" })),
         }),
@@ -697,12 +719,12 @@ function makeMarkersListTool(getActiveId, markerSvc) {
     return {
         name: MARKERS_LIST_TOOL_NAME,
         label: "List marker state",
-        description: "Read-only query of inline marker state. All WRITE operations must use inline markers ([[todo:new:...]] etc.) in the reply body — never use this tool for writes.\n只读查询内联标记状态。状态【写】操作请一律用内联标记（[[todo:new:...]] 等）写在回答正文里，不要调用本工具做写操作。",
+        description: "Read-only query of inline marker state. All WRITE operations must use inline markers ([[todo:new:...]] etc.) in the reply body — never this tool.",
         parameters: Type.Object({
             action: Type.Unsafe({ enum: ["list"] }),
             tool: Type.Optional(Type.Literal("todo")),
             includeDeleted: Type.Optional(Type.Boolean({
-                description: "Whether to include deleted tasks (tombstones, todo only).\n是否包含已删除任务（tombstone，仅 todo）。",
+                description: "Include deleted tasks (tombstones, todo only).",
             })),
         }),
         execute: async (_id, params) => {
@@ -735,23 +757,29 @@ export function makeAskUserQuestionTool(clientSession,
 /** 本 runtime 所属会话：提问跟着对话走，快照只把当前对话的问卷推给客户端。 */
 ownerId) {
     const QuestionOptionSchema = Type.Object({
-        label: Type.String({ description: "Display label for the option" }),
-        description: Type.Optional(Type.String({ description: "Optional description shown below label" })),
+        label: Type.String({ description: "Display label for the option (1-5 words)" }),
+        description: Type.Optional(Type.String({
+            description: "One short sentence explaining the impact or tradeoff if selected.",
+        })),
         preview: Type.Optional(Type.String({
             description: "Optional preview rendered below when this option is selected (markdown or HTML — use for mockups/code/config).",
         })),
     });
     const QuestionSchema = Type.Object({
-        id: Type.String({ description: "Unique identifier for this question" }),
+        id: Type.String({ description: "Unique identifier for this question (snake_case)" }),
         question: Type.String({ description: "The full question text to display (markdown/HTML ok)" }),
         detail: Type.Optional(Type.String({ description: "Optional detail/context shown under the question" })),
         header: Type.Optional(Type.String({ description: "Optional short header for this question" })),
-        options: Type.Optional(Type.Array(QuestionOptionSchema, { description: "Available options to choose from" })),
+        options: Type.Optional(Type.Array(QuestionOptionSchema, {
+            description: "2-4 mutually exclusive choices. Put the recommended option first when there is a clear default.",
+            minItems: 2,
+            maxItems: 4,
+        })),
         multiSelect: Type.Optional(Type.Boolean({ description: "Allow selecting multiple options (default: false)" })),
         dependsOn: Type.Optional(Type.Object({
             questionId: Type.String({ description: "ID of the prior question this question depends on" }),
             value: Type.Optional(Type.Union([Type.String(), Type.Array(Type.String())], {
-                description: "Show this question only when the prior question's answer matches this value (or any in the array). Omit to show whenever answered.",
+                description: "Show only when the prior answer equals this value (or is in the array). Omit to show whenever answered.",
             })),
         })),
         optionsMap: Type.Optional(Type.Record(Type.String(), Type.Array(QuestionOptionSchema), {
@@ -761,20 +789,32 @@ ownerId) {
     return {
         name: "ask_user_question",
         label: "Ask the user",
-        description: "Ask the user focused questions to pin down ambiguous requirements. Use for clarifying the task, confirming decisions, or getting preferences. Each question renders a browser dialog with markdown/HTML rich text; options may carry a `preview`. Submit or cancel to resume.",
-        promptSnippet: bilingual("ask the user focused questions to clarify ambiguous requirements (browser dialog with options/preview)", "向用户提问以澄清含糊的需求（浏览器对话框，支持选项/预览）"),
+        description: "Ask the user focused questions to clarify ambiguous requirements (clarify the task, confirm decisions, get preferences). " +
+            "Strictly ask 1 to 3 questions per call (prefer 1, max 3); provide 2 to 4 mutually exclusive options with the " +
+            "recommended option first, and explain impact/tradeoff in each option description. " +
+            "Each question renders a browser dialog with markdown/HTML rich text; options may carry a `preview`. Submit or cancel to resume.",
+        promptSnippet: "ask the user 1-3 focused questions with recommended options and tradeoffs to clarify requirements",
         promptGuidelines: [
-            bilingual("When requirements are ambiguous, use ask_user_question to ask the user instead of guessing; prefer multiple-choice options, each option may carry a preview", "需求含糊时用 ask_user_question 向用户提问而不是猜测；优先给多选选项，选项可带 preview 预览"),
-            bilingual("A cancelled question comes back as a tool error — respect it and continue without re-asking immediately", "用户取消提问会以工具错误返回——尊重取消决定，不要马上重复追问"),
+            "When requirements are ambiguous, use ask_user_question to clarify instead of guessing: " +
+                "ask 1 to 3 focused questions (prefer 1, max 3), provide 2-4 mutually exclusive options with the " +
+                "recommended option first, and explain impact/tradeoff in description",
+            "A cancelled question comes back as a tool error — respect it and continue without re-asking immediately",
         ],
         parameters: Type.Object({
-            questions: Type.Array(QuestionSchema, { description: "Questions to ask the user" }),
+            questions: Type.Array(QuestionSchema, {
+                description: "Questions to ask the user (strictly 1 to 3 questions; prefer 1).",
+                minItems: 1,
+                maxItems: 3,
+            }),
         }),
         execute: async (_id, params, signal) => {
             const qs = params.questions;
             if (!Array.isArray(qs) || qs.length === 0) {
                 throw new Error("ask_user_question requires at least one question");
             }
+            if (qs.length > 3) {
+                throw new Error("ask_user_question allows at most 3 questions per call to prevent question fatigue (单次提问最多不得超过 3 个问题)");
+            }
             const answers = await clientSession.askUser(qs, {
                 aborted: signal?.aborted,
             }, ownerId);
@@ -877,8 +917,8 @@ ownerId) {
         name: BROWSER_PAGE_TOOL_NAME,
         label: "Browser page",
         description: [
-            'Read or act on a page in the USER\'S OWN browser through the pi-web-ui page-picker extension (the extension talks to this page; the server only forwards the request). Only pages the user has explicitly allowed/paired in that extension can be touched. Call it with op:"pages" first to see which pages are currently available, and use it ONLY when the user asked you to read or operate a web page — never click/type on their pages on your own initiative.',
-            "ops (forwarded to the extension as-is, the server does not interpret them):",
+            'Read or act on a page in the USER\'S OWN browser via the pi-web-ui page-picker extension (the server only forwards). Only pages the user explicitly allowed/paired can be touched. Start with op:"pages" to list available pages, and use ONLY when the user asked you to read or operate a page — never click/type on their pages unprompted.',
+            "ops (forwarded to the extension as-is):",
             "  pages  — no args; lists the pages you may act on",
             '  read   — { what?: "text" | "html" | "title" | "url" | "query", selector?, all? }',
             "  click  — { selector, index? }",
@@ -889,10 +929,12 @@ ownerId) {
             "  eval   — { code } runs JS inside the page (extension-side switch, off by default)",
             "Op options that are not fields of this tool (e.g. read's `limit`) fall back to the extension's defaults. `target` selects the page by origin when more than one is allowed; `timeoutMs` is how long the SERVER waits for the browser (1000-120000, default 30000) before failing the call.",
         ].join("\n"),
-        promptSnippet: bilingual("read or operate a page in the user's browser (page-picker extension; allowed pages only)", "读取/操作用户浏览器里已授权的页面（page-picker 扩展，仅限已授权页面）"),
+        promptSnippet: "read or operate a page in the user's browser (page-picker extension; allowed pages only)",
         promptGuidelines: [
-            bilingual("Only use browser_page when the user asked you to read or act on a page in their browser; never click or type on their pages on your own initiative", "只在用户明确要求读取/操作浏览器页面时才用 browser_page；不要自作主张去点用户的页面"),
-            bilingual('Start with op:"pages" to see which pages are available; the target page must already be allowed in the page-picker extension — when it fails, tell the user what to enable instead of retrying blindly', '先用 op:"pages" 看有哪些可操作页面；目标页面必须已在 page-picker 扩展里授权——失败时把需要开什么告诉用户，不要盲目重试'),
+            "Only use browser_page when the user asked you to read or act on a page in their browser; " +
+                "never click or type on their pages on your own initiative",
+            'Start with op:"pages" to see which pages are available; ' +
+                "the target page must already be allowed in the page-picker extension — when it fails, tell the user what to enable instead of retrying blindly",
         ],
         parameters: Type.Object({
             op: Type.String({
@@ -1126,6 +1168,33 @@ function previewToolResult(result) {
         return "[unserializable result]";
     }
 }
+/**
+ * 转录整文件重写的原子落盘：先写同目录临时文件再 rename。转录是 append-only
+ * 的唯一事实源，compaction 收尾/清理的整文件重写若中途被打断（进程被杀/断电），
+ * 原地 writeFileSync 会留下截断的 JSONL；同目录 rename 是原子的，最坏情况是
+ * 旧文件原样保留，绝不会出现半份转录。Windows 下目标被外部占用（阅读器/杀软
+ * 锁）时 rename 可能 EPERM —— 退回原地写保住功能（旧行为），不因小概率锁失败丢更新。
+ */
+function atomicWriteFileSync(file, data) {
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(tmp, data);
+        try {
+            renameSync(tmp, file);
+        }
+        catch {
+            writeFileSync(file, data);
+        }
+    }
+    finally {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // 临时文件清不掉只能留给下次（同目录 .tmp，不影响转录本身）
+        }
+    }
+}
 /** Cap on simultaneously open NON-subagent conversations of ONE project (each keeps a full
  *  runtime alive; conversations of other projects keep their own lists).
  *  子代理不计入：子代理是 inMemory 后台任务，不参与此上限，既不占位也不被此上限拦截。 */
@@ -1211,13 +1280,20 @@ function messageSearchText(m) {
     }
     return parts.join("\n");
 }
+/** 转录全文扫描/整读的大小上限（16MB，与 readHistorySession 一致）：
+ *  超限文件同步 readFileSync 会卡事件循环数百毫秒起，搜索不值得。 */
+const MAX_TRANSCRIPT_SCAN_BYTES = 16 * 1024 * 1024;
 /** 扫描一个会话转录文件，收集文本命中查询的消息锚点（role + timestamp，
- *  按转录顺序，最多 cap 个）。仅 user/assistant 消息参与，与搜索范围一致。 */
+ *  按转录顺序，最多 cap 个）。仅 user/assistant 消息参与，与搜索范围一致。
+ *  超过大小上限的转录直接跳过（stat 先行，不整读）—— 全局搜索逐会话同步
+ *  扫描，无上限时一个大转录就能冻住整个事件循环。 */
 function collectSessionAnchors(filePath, q, cap = 10) {
     const anchors = [];
     if (!q)
         return anchors;
     try {
+        if (statSync(filePath).size > MAX_TRANSCRIPT_SCAN_BYTES)
+            return anchors;
         const lines = readFileSync(filePath, "utf8").split("\n");
         for (const line of lines) {
             if (!line.trim())
@@ -1342,6 +1418,35 @@ export function sameCwd(a, b) {
         return false;
     }
 }
+/**
+ * 超时杀进程树的决策（纯函数，可单测）。runAsync 的超时兜底用：
+ * - win32：shell:true 实际起的是 cmd.exe，p.kill() 只杀 cmd 本身，npm/git 的
+ *   孙进程照活 —— 必须走 `taskkill /PID <pid> /T /F` 才能整树带走；
+ * - posix：配合 spawn 的 detached:true，向负 pid（整组）发 SIGTERM。
+ * 返回决策而不是直接执行，执行留在调用方（便于注入/测试）。
+ */
+export function processTreeKillPlan(platform, pid) {
+    if (!pid || pid <= 0)
+        return { kind: "none" };
+    if (platform === "win32")
+        return { kind: "taskkill", cmd: "taskkill", args: ["/PID", String(pid), "/T", "/F"] };
+    return { kind: "group-signal", signal: "SIGTERM" };
+}
+/**
+ * /cwd 目标解析（纯函数，可单测）：
+ * - 相对路径以**当前会话 cwd** 为基准（/cwd src = 当前项目的 src），不按 server
+ *   进程 cwd 解析 —— 两者经常不同，按进程 cwd 切必错位。绝对路径不受基准影响
+ *   （resolve 遇到绝对段会丢弃前面的基准）。
+ * - win32 裸盘符（"C:"）：resolve 会按该盘当前目录解析，必须显式指到盘根；仅
+ *   win32 生效——posix 下 "C:" 仍是普通相对路径，避免误伤同名目录。
+ */
+export function resolveCwdTarget(raw, sessionCwd, platform = process.platform) {
+    const trimmed = String(raw ?? "").trim();
+    if (platform === "win32" && /^[A-Za-z]:$/.test(trimmed)) {
+        return `${trimmed.toUpperCase()}\\`;
+    }
+    return resolve(sessionCwd, trimmed);
+}
 export class ClientSession {
     clientId;
     /** Set by AgentService.attach: reflects the SERVICE-wide quiesce flag
@@ -1532,7 +1637,7 @@ export class ClientSession {
         if (persist) {
             const baseCwdForLimit = parentId ? (this.convs.get(parentId)?.cwd ?? this.cwd) : this.cwd;
             const resolvedCwdForLimit = cwd ? resolve(baseCwdForLimit, cwd) : baseCwdForLimit;
-            const openInProject = [...this.convs.values()].filter((c) => c.cwd === resolvedCwdForLimit && !c.isSubagent).length;
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === resolvedCwdForLimit && !c.isSubagent && !c.isEphemeral).length;
             if (openInProject >= MAX_OPEN_CONVERSATIONS) {
                 throw new Error(pick(this.getLang(), `目标项目运行的普通对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），无法创建持久化对话。请先关闭不需要的对话，或以轻量子代理（persist=false）方式运行`, `The project already has max open regular conversations (${MAX_OPEN_CONVERSATIONS}). Please close some or run as a lightweight subagent (persist=false)`, "agent.conv.limit.reached", { limit: MAX_OPEN_CONVERSATIONS }));
             }
@@ -1577,6 +1682,9 @@ export class ClientSession {
         conv.parentId = parentId ?? this.activeId ?? undefined;
         conv.subagentType = type;
         conv.subagentPrompt = prompt;
+        // 模板快照留在对话上：forceReset 重建 runtime 时工厂要按同一模板组装
+        // （system prompt/技能/扩展白名单），否则重建后回落主会话设置。
+        conv.subagentTemplate = apply;
         // 插件工具门与模板扩展白名单对齐：白名单非空时插件/MCP 工具（无 SDK
         // extensionKey 身份）不进该会话。工厂期 customTools 不注册 + 下面的
         // syncPluginTools 不回补，模板热改不影响已运行的子代理（与 prompt/技能一致）。
@@ -1808,9 +1916,12 @@ export class ClientSession {
     lastSdkAppendFiles = [];
     /** 当前活动会话的工具/资源快照 → composer 输入。cwd 取活动对话的。 */
     composeInputs(src) {
+        const preset = src.preset ?? this.conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
         // 技能名录指纹观测（只打日志，不干预组装；预览与 run 共用此入口，
         // 变化才记一行，首轮静默）。用未注文的目录（fill 前），全文注入不影响指纹。
         this.noteSkillCatalogDigest(src.skills);
+        const showSkills = presetShowsSkillCatalog(preset);
+        const effectiveSkills = showSkills ? this.fillSkillContents(src.skills) : [];
         return {
             cwd: src.cwd,
             systemPromptFile: this.lastBaseSystemPrompt || undefined,
@@ -1823,15 +1934,15 @@ export class ClientSession {
             piExamples: PI_DOC_PATHS.examples,
             appendFiles: this.lastSdkAppendFiles,
             windowsPersona: process.platform === "win32" ? WINDOWS_PERSONA : "",
-            terminalGuidance: isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current))
+            terminalGuidance: isTerminalGuidanceOn(effectiveDisabledAgentTools(this.settingsSvc.current), preset)
                 ? TERMINAL_TOOLS_GUIDANCE
                 : "",
             markersGuidance: this.markerSvc.buildGuidance(),
             // issue #91：组合模板各来源段按客户端 UI 语言渲染（英文默认）。
             lang: this.getLang(),
             contextFiles: src.contextFiles,
-            skills: this.fillSkillContents(src.skills),
-            skillsFullText: normalizeSkillList(this.settingsSvc.current.skillsFullText),
+            skills: effectiveSkills,
+            skillsFullText: showSkills ? normalizeSkillList(this.settingsSvc.current.skillsFullText) : [],
         };
     }
     /** skill 全文注入（{{skills}} 全文模式）：最好努力读名单里技能的文件正文。
@@ -1858,25 +1969,31 @@ export class ClientSession {
             }
         });
     }
-    /** 渲染当前组合模板。模板为空且无任何覆盖时返回 undefined（用 SDK 默认拼装，
-     *  零开销且与原始行为逐字节一致）。 */
+    /** 渲染当前组合模板。当存在自定义模板/覆盖，或者当前会话预设非 standard（如 code/minimal/ask/reader），
+     *  或者存在被禁用的工具时，必须渲染完整系统提示词，保证工具门控、技能隐藏与 Guidelines 严格对齐当前预设；
+     *  仅在完全默认且全功能 standard 状态下返回 undefined 让 SDK 拼装。 */
     renderMainCompose(src) {
         const tpl = (this.settingsSvc.current.promptTemplate ?? "").trim();
         const ovs = this.settingsSvc.current.promptOverrides ?? {};
         const hasOverride = Object.values(ovs).some((v) => typeof v === "string" && v.trim());
-        if (!tpl && !hasOverride)
+        const preset = src.preset ?? this.conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
+        const isCustomized = !!tpl || hasOverride || preset !== "standard" || effectiveDisabledAgentTools(this.settingsSvc.current).length > 0;
+        if (!isCustomized)
             return undefined;
         const texts = resolveSectionTexts(this.composeInputs(src));
-        return renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, ovs);
+        return renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, hasOverride ? ovs : undefined);
     }
-    /** 从活动会话收集工具/资源快照 → 一次算出 ①各来源默认(自动)内容 ②实际生效的
-     *  完整提示词。会话未就绪（或出错）返回 undefined，调用方给空值。 */
-    sessionPromptSnapshot() {
+    /** 从指定会话（缺省 = 活跃会话）收集工具/资源快照 → 一次算出 ①各来源默认(自动)
+     *  内容 ②实际生效的完整提示词。会话未就绪（或出错）返回 undefined，调用方给空值。
+     *  注意必须传目标 conv：preset/工具 schema 都是按会话走的，拿活跃会话的快照
+     *  算后台会话的基线会串账（lastTurnBaseTokens 跨会话污染）。 */
+    sessionPromptSnapshot(target) {
         try {
-            const sess = this.session;
-            if (!sess)
+            const conv = target ?? this.convs.get(this.activeId);
+            if (!conv)
                 return undefined;
-            const cwd = this.convs.get(this.activeId)?.cwd ?? this.cwd;
+            const sess = conv.session;
+            const cwd = conv.cwd;
             const active = sess.getActiveToolNames();
             const snippets = {};
             const guidelines = [];
@@ -1896,6 +2013,7 @@ export class ClientSession {
                 });
             }
             const loader = sess.resourceLoader;
+            const preset = conv?.agentPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
             const texts = resolveSectionTexts(this.composeInputs({
                 cwd,
                 selectedTools: active,
@@ -1907,13 +2025,14 @@ export class ClientSession {
                     description: s.description ?? "",
                     filePath: s.filePath ?? "",
                 })),
+                preset,
             }));
-            // 模板/覆盖渲染（无则保持 SDK 默认拼装，与 renderMainCompose 同规则）。
+            // 模板/覆盖渲染（无自定义模板时用默认模板渲染完整提示词，确保与真实 run 规则一致且包含预设过滤）。
             const tpl = (this.settingsSvc.current.promptTemplate ?? "").trim();
             const ovs = this.settingsSvc.current.promptOverrides ?? {};
             const hasOverride = Object.values(ovs).some((v) => typeof v === "string" && v.trim());
-            const rendered = !tpl && !hasOverride ? undefined : renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, ovs);
-            return { texts, full: rendered ?? sess.systemPrompt, toolsSchema: buildToolsSchemaText(schemaEntries) };
+            const rendered = renderPromptTemplate(tpl || DEFAULT_PROMPT_TEMPLATE, texts, hasOverride ? ovs : undefined);
+            return { texts, full: rendered, toolsSchema: buildToolsSchemaText(schemaEntries) };
         }
         catch {
             // Session not ready yet.
@@ -1925,6 +2044,30 @@ export class ClientSession {
     promptSnapshot() {
         return this.sessionPromptSnapshot() ?? { full: "", texts: {}, toolsSchema: "" };
     }
+    /** 会话级 Base Tokens 缓存（避免在节流快照热路径上重复计算正则）。 */
+    cachedBaseTokens = null;
+    /** 指定会话（缺省 = 活跃会话）系统提示词 + 工具 schema 的基础 token 开销
+     *  （与设置面板中的「合计」完全一致）。会话未就绪返回 null——调用方必须区分
+     *  null 与 0：把 0 写进 lastTurnBaseTokens 会让后续轮次双计全额 base。 */
+    currentBaseTokens(target) {
+        const conv = target ?? this.convs.get(this.activeId);
+        if (!conv)
+            return null;
+        const now = Date.now();
+        if (this.cachedBaseTokens &&
+            this.cachedBaseTokens.convId === conv.id &&
+            now - this.cachedBaseTokens.at < STATS_CACHE_MS) {
+            return this.cachedBaseTokens.tokens;
+        }
+        const snap = this.sessionPromptSnapshot(conv);
+        if (!snap)
+            return null;
+        const prompt = estimatePromptTokens(snap.full);
+        const schema = estimatePromptTokens(snap.toolsSchema);
+        const tokens = prompt + schema;
+        this.cachedBaseTokens = { at: now, convId: conv.id, tokens };
+        return tokens;
+    }
     /** Web-facing extension UI context (widgets, notifications). */
     webUi = new WebUIContext((msg) => this.emit(msg));
     /**
@@ -2172,11 +2315,18 @@ export class ClientSession {
             },
             readHistorySession: async (path) => {
                 const all = await SessionManager.listAll(piSessionsRoot());
-                const hit = all.find((s) => resolve(s.path) === resolve(path));
+                // win32 路径大小写不敏感：客户端回传的盘符/目录大小写常与服务端
+                // 列表不一致，严格相等会把合法请求误判为“不在白名单”。大小写
+                // 归一后再比（posix 不受影响）。
+                const norm = (p) => {
+                    const r = resolve(p);
+                    return process.platform === "win32" ? r.toLowerCase() : r;
+                };
+                const hit = all.find((s) => norm(s.path) === norm(path));
                 if (!hit)
                     return undefined;
                 try {
-                    if (statSync(hit.path).size > 16 * 1024 * 1024)
+                    if (statSync(hit.path).size > MAX_TRANSCRIPT_SCAN_BYTES)
                         return undefined;
                     const text = readFileSync(hit.path, "utf8");
                     return {
@@ -2278,7 +2428,8 @@ export class ClientSession {
         const model = session.model;
         let originalKeepRecent;
         try {
-            originalKeepRecent = session.settingsManager.getCompactionSettings(model).keepRecentTokens;
+            originalKeepRecent =
+                session.settingsManager.getCompactionSettings(model)?.keepRecentTokens ?? session.settingsManager.getCompactionSettings().keepRecentTokens;
         }
         catch {
             originalKeepRecent = undefined;
@@ -2504,13 +2655,13 @@ export class ClientSession {
                 // （含重试次数覆盖）——依次重放：重试覆盖 → 软上限覆盖 → 终端门控。
                 this.applyRetryOverrides();
                 this.applyCompactionOverrides();
-                // reload() 会把 custom 工具重新加回活跃集——重放终端开关。
-                this.applyToolGating(this.session);
+                // reload() 会把 custom 工具重新加回活跃集——重放当前会话归属预设门控。
+                this.applyToolGating(this.session, this.conv?.agentPreset);
                 await this.pushSlashCommands();
             },
             applyRetryOverrides: () => this.applyRetryOverrides(),
             applyCompactionOverrides: () => this.applyCompactionOverrides(),
-            applyToolGating: () => this.applyToolGating(this.session),
+            applyToolGating: () => this.applyToolGating(this.session, this.conv?.agentPreset),
             promptSnapshot: () => this.promptSnapshot(),
             getMarkerState: () => ({
                 markersEnabled: this.markerSvc.current.markersEnabled,
@@ -2640,7 +2791,7 @@ export class ClientSession {
      * 应用（prompt replace/append + 白名单），其余（终端接管、Windows persona
      * 等）仍跟随主会话设置。undefined = 按主会话设置（普通对话/不选模板的子代理）。
      */
-    makeRuntimeFactory(terminals, apply, ownerId, initialModel) {
+    makeRuntimeFactory(terminals, apply, ownerId, initialModel, targetPreset) {
         return async ({ cwd: effectiveCwd, sessionManager }) => {
             const services = await createAgentSessionServices({
                 cwd: effectiveCwd,
@@ -2761,19 +2912,40 @@ export class ClientSession {
                                         const swapped = tplPrompt + event.systemPrompt.slice(boundary);
                                         return swapped === event.systemPrompt ? undefined : { systemPrompt: swapped };
                                     }
-                                    // 主会话：组合模板渲染（模板为空且无覆盖时返回 undefined = 用 SDK 默认）。
+                                    // 主会话：按当前会话归属预设与真正活跃的工具列表组装系统提示词
+                                    const conv = this.convs.get(ownerId ?? this.activeId) ?? this.conv;
+                                    const sess = conv?.session;
+                                    const activeToolNames = sess ? sess.getActiveToolNames() : [];
+                                    const activeSet = new Set(activeToolNames);
+                                    const activeSnippets = {};
+                                    const activeGuidelines = [];
+                                    if (sess) {
+                                        for (const name of activeSet) {
+                                            const def = sess.getToolDefinition(name);
+                                            if (!def)
+                                                continue;
+                                            if (def.promptSnippet && def.promptSnippet.trim()) {
+                                                activeSnippets[name] = def.promptSnippet.trim();
+                                            }
+                                            if (def.promptGuidelines) {
+                                                activeGuidelines.push(...def.promptGuidelines);
+                                            }
+                                        }
+                                    }
+                                    const currentPreset = conv?.agentPreset ?? targetPreset ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
                                     const opts = event.systemPromptOptions;
                                     const rendered = this.renderMainCompose({
-                                        cwd: typeof opts?.cwd === "string" ? opts.cwd : this.cwd,
-                                        selectedTools: opts?.selectedTools ?? [],
-                                        toolSnippets: opts?.toolSnippets ?? {},
-                                        toolGuidelines: opts?.promptGuidelines ?? [],
+                                        cwd: typeof opts?.cwd === "string" ? opts.cwd : (conv?.cwd ?? effectiveCwd ?? this.cwd),
+                                        selectedTools: activeToolNames.length > 0 ? activeToolNames : (opts?.selectedTools ?? []),
+                                        toolSnippets: activeSnippets,
+                                        toolGuidelines: activeGuidelines,
                                         contextFiles: opts?.contextFiles ?? [],
                                         skills: (opts?.skills ?? []).map((s) => ({
                                             name: s.name,
                                             description: s.description ?? "",
                                             filePath: s.filePath ?? "",
                                         })),
+                                        preset: currentPreset,
                                     });
                                     return rendered ? { systemPrompt: rendered } : undefined;
                                 });
@@ -2852,31 +3024,27 @@ export class ClientSession {
                     }), () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
                         this.settingsSvc.current.defaultPermissionPreset ??
                         "workspace-write-never", () => this.getLang()),
-                    ...makePersistentTerminalTools(terminals, effectiveCwd, () => this.getLang()),
-                    // 覆盖 SDK 内置 read（customTools 按 name 覆盖）：路径是目录时列出目录
-                    // 条目（复用 SDK ls 的排序/`/` 后缀/截断口径），其余情况原样转发内置实现。
-                    // 开关是行为开关（read 本体不可关），每次调用实时读设置——不进
-                    // tool-manager 的 ActiveSet 目录。DSH 引擎无 customTool 注册面，不接。
-                    withToolGuard(makeReadDirTool(effectiveCwd, {
-                        dirEnabled: () => this.settingsSvc.current.readDirEnabled !== false,
-                        getLang: () => this.getLang(),
-                    }), {
-                        toolName: "read",
-                        guard: this.toolGuard,
-                        conversationId: () => ownerId,
-                        getLang: () => this.getLang(),
-                        cwd: effectiveCwd,
-                        getRoots: () => this.roots,
-                        askApproval: (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category),
-                        getRules: () => this.approvalRules.list(),
+                    ...makePersistentTerminalTools(terminals, effectiveCwd, () => this.getLang(), {
+                        checkSafety: (cmd) => {
+                            const perm = (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+                                this.settingsSvc.current.defaultPermissionPreset ??
+                                "workspace-write-never";
+                            if (perm === "read-only") {
+                                const danger = checkDangerousToolCall("bash", { command: cmd }, effectiveCwd, this.roots, this.approvalRules.list());
+                                if (danger.denied || danger.dangerous) {
+                                    return { blocked: true, reason: danger.reason || "只读模式禁止执行高危/破坏性命令" };
+                                }
+                            }
+                            const danger = checkDangerousToolCall("bash", { command: cmd }, effectiveCwd, this.roots, this.approvalRules.list());
+                            if (danger.denied) {
+                                return { blocked: true, reason: danger.reason || "命中系统阻断规则" };
+                            }
+                            return {};
+                        },
                     }),
-                    // 覆盖 SDK 内置 write / edit，并在执行层注入会话级三档权限沙箱门禁与人机协同审批。
-                    wrapWriteToolWithPermission(effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
-                        this.settingsSvc.current.defaultPermissionPreset ??
-                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
-                    wrapEditToolWithPermission(effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
-                        this.settingsSvc.current.defaultPermissionPreset ??
-                        "workspace-write-never", () => this.roots, () => this.getLang(), (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category), () => ownerId, () => this.approvalRules.list()),
+                    // read / write / edit 三处覆盖**不在这里注册**：创建时的 customTools 恒胜、与
+                    // 扩展加载顺序无关，直接塞进来会静默顶掉第三方扩展注册的同名工具（见
+                    // tool-overrides.ts）；它们改在会话建好后由 installToolOverrides 注入。
                     // 不覆盖内置 edit 的独立宽松编辑工具（缩进不敏感匹配；开关看设置；带权限沙箱拦截与人机协同）。
                     wrapEditSoftToolWithPermission(makeEditSoftTool(effectiveCwd, () => this.getLang()), effectiveCwd, () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
                         this.settingsSvc.current.defaultPermissionPreset ??
@@ -2970,8 +3138,12 @@ export class ClientSession {
             // 桥接工具归属锚点：SDK 会话对象在本 runtime 生命周期内稳定，过户只搬对话
             // 不改它（见 ClientSession.findConversationHome）。
             bridgeAnchor.session = created.session;
-            // 终端工具开关从创建起就生效（工具始终注册进注册表，只调活跃集）。
-            this.applyToolGating(created.session);
+            // read / write / edit 三处覆盖在会话建好后注入（见 tool-overrides.ts）：SDK 的合并链是
+            // [...扩展工具, ...customTools] 后写赢 ⇒ 创建时塞进 customTools 会**恒定顶掉**第三方
+            // 扩展注册的同名工具（官方 docs/extensions.md 明写扩展可覆盖 read/write/edit）。
+            installToolOverrides(created.session, this.toolOverrideSpecs(ownerId, effectiveCwd));
+            // 终端工具开关与预设门控从创建起就生效（工具始终注册进注册表，只调活跃集）。
+            this.applyToolGating(created.session, targetPreset);
             return {
                 ...created,
                 services,
@@ -3000,7 +3172,9 @@ export class ClientSession {
             createdAt: Date.now(),
             agentPreset: this.settingsSvc.current.defaultAgentPreset ?? "standard",
             presetLocked: false,
-            permissionPreset: this.settingsSvc.current.defaultPermissionPreset ?? "workspace-write-never",
+            permissionPreset: readPermissionFromSession(runtime.session.sessionManager) ??
+                this.settingsSvc.current.defaultPermissionPreset ??
+                "workspace-write-never",
             // A brand-new conversation is not yet LISTED — it enters the running
             // list only when it is displaced to the background while still
             // streaming (its runtime is what `listed` protects). A blank chat is
@@ -3087,7 +3261,7 @@ export class ClientSession {
                     textEn: `Restart interrupted "${r.title}" — reopening it and continuing automatically.`,
                 });
                 await this.switchSession(r.sessionFile);
-                await this.prompt(continueText);
+                await this.promptResumedConversation(r.sessionFile, continueText);
             }
             catch {
                 // switchSession/prompt already surface failures as notices;
@@ -3105,6 +3279,50 @@ export class ClientSession {
             /* staying on the last resumed session is a fine fallback */
         }
     }
+    /** 找持有指定转录文件的本地对话 id（找不到 = 已被关闭/搬走/还没建好）。 */
+    conversationIdBySessionFile(file) {
+        let abs;
+        try {
+            abs = resolve(file);
+        }
+        catch {
+            return null;
+        }
+        for (const c of this.convs.values()) {
+            try {
+                const f = c.session.sessionFile;
+                if (f && resolve(f) === abs)
+                    return c.id;
+            }
+            catch {
+                // session 被替换中 —— 跳过
+            }
+        }
+        return null;
+    }
+    /**
+     * 恢复流程的「继续」投递（resumeInterrupted 专用）。
+     * 读码结论：prompt() 在**调用时刻**同步捕获 active 对话（进入函数第一行取
+     * this.conv，先于任何 await），调用之后发生的切换不影响投递目标。唯一的错投
+     * 窗口在 switchSession 内部：activeId 置位后还要 await bindSession/恢复模型，
+     * 期间用户的并发切换会把 active 挪走 —— 恢复循环接着调 prompt 就会把「继续」
+     * 投进用户当前对话。因此投递前把目标对话修回 active，并在同一同步执行段内
+     * （上一个 await 恢复点之后、无新 await 处）核对 activeId 后才调用 prompt；
+     * 修不回（再次被抢）就放弃自动继续 —— 宁可少投，不投错对话。
+     */
+    async promptResumedConversation(sessionFile, text) {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const targetId = this.conversationIdBySessionFile(sessionFile);
+            if (!targetId)
+                return; // 目标对话已没了（被关/被过户），不投
+            if (this.activeId === targetId) {
+                await this.prompt(text);
+                return;
+            }
+            await this.switchConversation(targetId);
+        }
+        // 两次都没能稳定拿回 active：放弃自动继续，用户可手动点开那条对话。
+    }
     /** Add a socket to this client's broadcast set; flushes buffered startup notices. */
     attachSink(send) {
         this.sinks.add(send);
@@ -3201,7 +3419,7 @@ export class ClientSession {
         await conv.session.bindExtensions({
             mode: "rpc",
             uiContext: this.webUi,
-            onError: this.makeExtensionErrorReporter(),
+            onError: this.makeExtensionErrorReporter(conv.isEphemeral ? { text: `临时对话 ${conv.id}：`, textEn: `Ephemeral chat ${conv.id}: ` } : undefined),
         });
         conv.unsubscribe = conv.session.subscribe((event) => this.onEvent(conv, event));
         // 新会话 / 切换会话 / 强杀重建的必经之路：刚创建的 runtime 用的是 SDK
@@ -3927,6 +4145,7 @@ export class ClientSession {
                     if (stopNotice) {
                         this.emit({ type: "notice", level: "warning", text: stopNotice.text, textEn: stopNotice.textEn });
                     }
+                    this.emitConversations();
                     break;
                 }
                 // 子代理运行报错（provider 400 / 超时等）→ 通知主对话，让用户/AI 知道
@@ -3993,9 +4212,18 @@ export class ClientSession {
                         }
                     }, 50);
                 }
+                // 本轮真正结束且不再重试：立即向客户端广播最新会话状态（流式状态及时复位）
+                if (!event.willRetry) {
+                    this.emitConversations();
+                }
                 break;
             }
             case "agent_settled": {
+                // 记录本会话自己的 Base 基线：currentBaseTokens 必须传 conv（否则串成
+                // 活跃会话的基线）；快照未就绪时保持 undefined，宁可少补偿也不把 0 钉死。
+                const settledBaseTokens = this.currentBaseTokens(conv);
+                if (settledBaseTokens != null)
+                    conv.lastTurnBaseTokens = settledBaseTokens;
                 if (conv.pendingCompaction && !this.disposed) {
                     const pending = conv.pendingCompaction;
                     conv.pendingCompaction = null;
@@ -4278,14 +4506,42 @@ export class ClientSession {
                             tokens: conv.lastCompactionTokens,
                             contextWindow: cu.contextWindow,
                             percent: (conv.lastCompactionTokens / cu.contextWindow) * 100,
-                            estimated: true,
+                            estimated: false,
                             softCap: this.activeSoftCap(cu.contextWindow),
                         };
                     }
+                    // 展示用兜底 0（会话未就绪时旧行为也是 0）；落账 lastTurnBaseTokens 的路径
+                    // 在 agent_settled 处对 null 跳过，不受此兜底影响。
+                    const baseTokens = this.currentBaseTokens(conv) ?? 0;
+                    // 空白会话（尚未发言，SDK 报 0 或 null）：真实反映当前模式/工具配置下的 Base 开销。
+                    if (cu.contextWindow > 0 && (this.isBlankConversation(conv) || cu.tokens == null || cu.tokens === 0)) {
+                        return {
+                            tokens: baseTokens,
+                            contextWindow: cu.contextWindow,
+                            percent: (baseTokens / cu.contextWindow) * 100,
+                            estimated: false,
+                            softCap: this.activeSoftCap(cu.contextWindow),
+                        };
+                    }
+                    // 首轮对话中（尚未有定稿 assistant 消息，SDK cu.tokens 仅为当前消息估算）：叠加 Base 开销
+                    if (conv.lastTurnBaseTokens == null && cu.contextWindow > 0) {
+                        const total = baseTokens + (cu.tokens ?? 0);
+                        return {
+                            tokens: total,
+                            contextWindow: cu.contextWindow,
+                            percent: (total / cu.contextWindow) * 100,
+                            estimated: false,
+                            softCap: this.activeSoftCap(cu.contextWindow),
+                        };
+                    }
+                    // 已有多轮对话历史：若在对话间歇切预设或开关工具，叠加当前 Base 开销相比上一轮定稿时的差额
+                    const baseDelta = baseTokens - (conv.lastTurnBaseTokens ?? baseTokens);
+                    const effectiveTokens = Math.max(0, (cu.tokens ?? 0) + baseDelta);
                     return {
-                        tokens: cu.tokens,
+                        tokens: effectiveTokens,
                         contextWindow: cu.contextWindow,
-                        percent: cu.percent,
+                        percent: cu.contextWindow > 0 ? (effectiveTokens / cu.contextWindow) * 100 : cu.percent,
+                        estimated: false,
                         softCap: this.activeSoftCap(cu.contextWindow),
                     };
                 })(),
@@ -4792,6 +5048,20 @@ export class ClientSession {
         }
         this.pendingQuestions.clear();
     }
+    /** 关闭所有挂起审批（dispose 时清理）：以「拒绝」解析，避免等答复的
+     *  Promise 与对应 runtime 泄漏（会话没了，审批弹窗永远不会有人点）。 */
+    cancelPendingApprovals() {
+        for (const [id, a] of this.pendingApprovals) {
+            this.pendingApprovals.delete(id);
+            try {
+                a.resolve({ decision: "deny", reason: "会话已关闭" });
+            }
+            catch {
+                // 单个 resolve 异常不影响其余清理
+            }
+            this.emit({ type: "tool_approval_resolved", id });
+        }
+    }
     // -----------------------------------------------------------------------
     // 浏览器页面桥（标准 pi 引擎 browser_page customTool）
     // -----------------------------------------------------------------------
@@ -4975,6 +5245,10 @@ export class ClientSession {
                     // Windows: npm and friends are .cmd shims — Node can only exec
                     // them through the shell (otherwise spawn npm → ENOENT).
                     shell: process.platform === "win32",
+                    // posix 下让子进程自成进程组：超时时能整组杀掉（孙进程不残留）。
+                    // 代价是父进程退出后子进程可能短暂存活——这些都是带超时的短命令，
+                    // 可接受；win32 不需要（走 taskkill /T）。
+                    detached: process.platform !== "win32",
                 });
             }
             catch (err) {
@@ -4990,7 +5264,27 @@ export class ClientSession {
                 clearTimeout(t);
                 resolve({ code, out: text ?? out });
             };
-            const t = setTimeout(() => p.kill(), timeoutMs);
+            const t = setTimeout(() => {
+                // 只 p.kill() 杀不掉整棵树（win32 下杀的是 cmd.exe 壳，posix 下
+                // 杀不到孙进程）—— 按平台走整树杀，失败再退回 p.kill 兜底。
+                const plan = processTreeKillPlan(process.platform, p.pid);
+                try {
+                    if (plan.kind === "taskkill") {
+                        // taskkill 独立进程执行：父 cmd 死活不影响命中目标树。
+                        spawn(plan.cmd, plan.args, { stdio: "ignore", windowsHide: true });
+                    }
+                    else if (plan.kind === "group-signal") {
+                        process.kill(-p.pid, plan.signal);
+                    }
+                    else {
+                        p.kill();
+                    }
+                }
+                catch {
+                    // 进程组已不在（正常退出竞态）等 —— 退回直接杀。
+                    p.kill();
+                }
+            }, timeoutMs);
             p.stdout?.on("data", (d) => (out += d.toString()));
             p.stderr?.on("data", (d) => (out += d.toString()));
             p.on("error", (err) => done(-1, String(err)));
@@ -5105,26 +5399,176 @@ export class ClientSession {
     /** Cache window for the all-source check: 30 minutes. */
     static UPDATE_ALL_CACHE_MS = 30 * 60_000;
     updatesAllCache = null;
+    notifiedPluginUpdates = new Set();
+    lastPluginUpdates = [];
+    /**
+     * 主动检查已安装界面插件（<dataDir>/plugins）的更新状态并向客户端推送。
+     */
+    async checkPluginUpdates(manual = false) {
+        const lang = () => this.getLang();
+        try {
+            const updates = await checkPluginUpdates(this.stateStore.dataDir, undefined, lang);
+            const list = updates.map((p) => ({
+                id: p.id,
+                name: p.name,
+                version: p.version,
+                latestVersion: p.latestVersion ?? null,
+                source: p.source,
+                localSha: p.localSha,
+                remoteSha: p.remoteSha,
+                updatable: p.updatable,
+                builtin: p.builtin,
+                error: p.error,
+            }));
+            this.lastPluginUpdates = list;
+            this.emit({ type: "plugin_updates", updates: list });
+            const updatableBuiltins = list.filter((p) => p.builtin && p.updatable);
+            if (manual) {
+                if (updatableBuiltins.length > 0) {
+                    const names = updatableBuiltins.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${updatableBuiltins.length} 个内置插件有更新：${names}`,
+                        textEn: `Update available for ${updatableBuiltins.length} built-in plugin(s): ${names}`,
+                    });
+                }
+                else {
+                    const allUpdatable = list.filter((p) => p.updatable);
+                    if (allUpdatable.length > 0) {
+                        const names = allUpdatable.map((p) => p.name || p.id).join(", ");
+                        this.emit({
+                            type: "notice",
+                            level: "info",
+                            text: `发现 ${allUpdatable.length} 个插件有更新：${names}`,
+                            textEn: `Update available for ${allUpdatable.length} plugin(s): ${names}`,
+                        });
+                    }
+                    else {
+                        this.emit({
+                            type: "notice",
+                            level: "info",
+                            text: "所有插件均为最新版本。",
+                            textEn: "All plugins are up to date.",
+                        });
+                    }
+                }
+            }
+            else {
+                const newUpdatables = updatableBuiltins.filter((p) => {
+                    const key = `${p.id}@${p.latestVersion || p.remoteSha || "upd"}`;
+                    if (this.notifiedPluginUpdates.has(key))
+                        return false;
+                    this.notifiedPluginUpdates.add(key);
+                    return true;
+                });
+                if (newUpdatables.length > 0) {
+                    const names = newUpdatables.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${newUpdatables.length} 个内置插件有更新可用：${names}，可前往设置或更新面板中更新。`,
+                        textEn: `Update available for ${newUpdatables.length} built-in plugin(s): ${names}. You can update in Settings or the Updates panel.`,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            if (manual) {
+                this.emit({
+                    type: "notice",
+                    level: "error",
+                    text: `检查插件更新失败：${err.message}`,
+                    textEn: `Failed to check plugin updates: ${err.message}`,
+                });
+            }
+        }
+    }
     /**
      * All-source update check: pi-web-ui + the pi core + direct pi extensions
-     * from the agent manifest (fallback: raw walk). Re-emits the cached list
+     * from the agent manifest (fallback: raw walk) + installed UI plugins. Re-emits the cached list
      * within UPDATE_ALL_CACHE_MS; pass force=true (explicit refresh) to bypass.
      */
     async checkUpdatesAll(force = false) {
+        // issue #321：pi SDK 副本状态随结果下发（运行中是哪份 / 是否自带 / 机器上有没有
+        // 更新的），UI 据此在更新面板亮「重启跟上」与「安装全局引擎并切换」入口。
+        // 缓存命中也现算：用户升级全局 pi 不经本服务，缓存的 items 不影响这个判据，
+        // 探针本身有 10s memoize，重算便宜。
+        const piSdk = {
+            running: VERSION,
+            bundledInUse: isBundledInUse(sdkCopies(), VERSION),
+            newerInstalled: detectPiSdkSplit(VERSION)?.installed ?? null,
+        };
         if (!force && this.updatesAllCache && Date.now() - this.updatesAllCache.at < ClientSession.UPDATE_ALL_CACHE_MS) {
             this.emit({
                 type: "update_status_all",
                 items: this.updatesAllCache.items,
+                piSdk,
             });
+            if (this.lastPluginUpdates.length > 0) {
+                this.emit({ type: "plugin_updates", updates: this.lastPluginUpdates });
+            }
             return;
         }
         try {
             const targets = collectTargets(this.agentDir, ClientSession.currentAppVersion(), undefined, {
                 projectCwd: this.convs.get(this.activeId)?.cwd ?? this.cwd,
             });
-            const items = sortUpdateItems(await checkAllUpdates(targets, undefined, () => this.getLang(), resolveNpmRegistry(this.agentDir)));
-            this.updatesAllCache = { at: Date.now(), items };
-            this.emit({ type: "update_status_all", items });
+            const items = await checkAllUpdates(targets, undefined, () => this.getLang(), resolveNpmRegistry(this.agentDir));
+            let pluginItems = [];
+            try {
+                const pluginUpdates = await checkPluginUpdates(this.stateStore.dataDir, undefined, () => this.getLang());
+                const list = pluginUpdates.map((p) => ({
+                    id: p.id,
+                    name: p.name,
+                    version: p.version,
+                    latestVersion: p.latestVersion ?? null,
+                    source: p.source,
+                    localSha: p.localSha,
+                    remoteSha: p.remoteSha,
+                    updatable: p.updatable,
+                    builtin: p.builtin,
+                    error: p.error,
+                }));
+                this.lastPluginUpdates = list;
+                this.emit({ type: "plugin_updates", updates: list });
+                pluginItems = pluginUpdates.map((p) => ({
+                    name: p.name ? `${p.name} (${p.id})` : p.id,
+                    kind: "plugin",
+                    current: p.version ? `v${p.version}` : (p.localSha ?? "unknown"),
+                    latest: p.latestVersion ? `v${p.latestVersion}` : (p.remoteSha ?? null),
+                    latestPublishedAt: null,
+                    upToDate: !p.updatable,
+                    error: p.error,
+                    source: p.source,
+                    pluginId: p.id,
+                    builtin: p.builtin,
+                }));
+                const newUpdatables = pluginUpdates
+                    .filter((p) => p.builtin && p.updatable)
+                    .filter((p) => {
+                    const key = `${p.id}@${p.latestVersion || p.remoteSha || "upd"}`;
+                    if (this.notifiedPluginUpdates.has(key))
+                        return false;
+                    this.notifiedPluginUpdates.add(key);
+                    return true;
+                });
+                if (newUpdatables.length > 0) {
+                    const names = newUpdatables.map((p) => p.name || p.id).join(", ");
+                    this.emit({
+                        type: "notice",
+                        level: "info",
+                        text: `发现 ${newUpdatables.length} 个内置插件有更新可用：${names}，可前往设置或更新面板中更新。`,
+                        textEn: `Update available for ${newUpdatables.length} built-in plugin(s): ${names}. You can update in Settings or the Updates panel.`,
+                    });
+                }
+            }
+            catch (err) {
+                console.warn("[agent-service] 检查插件更新失败:", err);
+            }
+            const allItems = sortUpdateItems([...items, ...pluginItems]);
+            this.updatesAllCache = { at: Date.now(), items: allItems };
+            this.emit({ type: "update_status_all", items: allItems, piSdk });
         }
         catch (err) {
             // checkAll degrades per-item; only local enumeration blowing up lands
@@ -5259,7 +5703,7 @@ export class ClientSession {
             // /reload 同样重读磁盘 settings.json——重放重试覆盖 + 软上限覆盖 + 终端门控。
             this.applyRetryOverrides();
             this.applyCompactionOverrides();
-            this.applyToolGating(this.session);
+            this.applyToolGating(this.session, this.conv?.agentPreset);
         },
         pluginCommands: () => this.pluginCommandsProvider?.() ?? [],
         execPluginCommand: async (name, args) => {
@@ -5354,11 +5798,11 @@ export class ClientSession {
     reloadModelsConfig() {
         return this.modelAdmin.reloadModelsConfig();
     }
-    fetchModelsList(reqId, baseUrl, apiKey, authHeader, api) {
-        return this.modelAdmin.fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang());
+    fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, providerId) {
+        return this.modelAdmin.fetchModelsList(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang(), providerId);
     }
-    testModelConnection(reqId, baseUrl, apiKey, authHeader, api) {
-        return this.modelAdmin.testConnection(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang());
+    testModelConnection(reqId, baseUrl, apiKey, authHeader, api, providerId) {
+        return this.modelAdmin.testConnection(reqId, baseUrl, apiKey, authHeader, api, () => this.getLang(), providerId);
     }
     refreshProviderModels(providerId, reqId) {
         return this.modelAdmin.refreshProviderModels(providerId, reqId, () => this.getLang());
@@ -5643,7 +6087,7 @@ export class ClientSession {
                     await this.session.reload();
                     this.applyRetryOverrides();
                     this.applyCompactionOverrides();
-                    this.applyToolGating(this.session);
+                    this.applyToolGating(this.session, this.conv?.agentPreset);
                     await this.pushSlashCommands();
                     this.pushSettings();
                 }
@@ -5707,6 +6151,46 @@ export class ClientSession {
                 return c.agentPreset;
         return undefined;
     }
+    /**
+     * read / write / edit 三处覆盖的注入规格：基底 = 扩展注册的同名工具优先，否则 SDK 内置实现
+     * （见 tool-overrides.ts —— 这三处覆盖不能塞进创建时的 `customTools`，那会静默顶掉扩展的
+     * 同名工具，而官方 docs/extensions.md 明写扩展可覆盖 read/write/edit）。
+     */
+    toolOverrideSpecs(ownerId, cwd) {
+        const currentPermission = () => (ownerId ? this.convs.get(ownerId)?.permissionPreset : undefined) ??
+            this.settingsSvc.current.defaultPermissionPreset ??
+            "workspace-write-never";
+        const approve = (toolCallId, toolName, params, reason, reasonEn, convId, category) => this.askApproval(toolCallId, toolName, params, reason, reasonEn, convId, category);
+        // 行为开关（read 本体不可关）：每次调用实时读设置 —— 不进 tool-manager 的 ActiveSet 目录。
+        const readDirOptions = {
+            dirEnabled: () => this.settingsSvc.current.readDirEnabled !== false,
+            getLang: () => this.getLang(),
+        };
+        const readGuardOptions = {
+            toolName: "read",
+            guard: this.toolGuard,
+            conversationId: () => ownerId,
+            getLang: () => this.getLang(),
+            cwd,
+            getRoots: () => this.roots,
+            askApproval: approve,
+            getRules: () => this.approvalRules.list(),
+        };
+        // 写/编的权限沙箱包装：同一个函数，有扩展同名工具时把它的定义当基底（末参）。
+        const composeWrite = (base) => wrapWriteToolWithPermission(cwd, currentPermission, () => this.roots, () => this.getLang(), approve, () => ownerId, () => this.approvalRules.list(), base);
+        const composeEdit = (base) => wrapEditToolWithPermission(cwd, currentPermission, () => this.roots, () => this.getLang(), approve, () => ownerId, () => this.approvalRules.list(), base);
+        return [
+            {
+                name: "read",
+                // 没有扩展 read：完整覆盖（内置基底 + 英文描述 + file_path 别名）。
+                fallback: () => withToolGuard(makeReadDirTool(cwd, readDirOptions), readGuardOptions),
+                // 有扩展 read：只叠「目录列条目」，它的锚协议/独有参数/渲染全保留（行为委托它）。
+                composeWith: (base) => withToolGuard(withReadDirSupport(base, cwd, readDirOptions), readGuardOptions),
+            },
+            { name: "write", fallback: () => composeWrite(), composeWith: (base) => composeWrite(base) },
+            { name: "edit", fallback: () => composeEdit(), composeWith: (base) => composeEdit(base) },
+        ];
+    }
     /** 统一工具门控（tool_manage 唯一落点）：按 disabledAgentTools 把目录内工具
      *  逐个加回/剔除活跃集（工具仍留在注册表，重开可直接加回；live 生效无需
      *  reload）。支持按当前会话预设（preset）进行工具过滤。
@@ -5716,6 +6200,8 @@ export class ClientSession {
         const targetPreset = preset ?? this.presetOfSession(session) ?? this.settingsSvc.current.defaultAgentPreset ?? "standard";
         applyAgentToolsGating(session, effectiveDisabledAgentTools(this.settingsSvc.current), targetPreset);
         this.syncPluginTools(session, targetPreset);
+        this.sessionStatsCache = null;
+        this.cachedBaseTokens = null;
         // SDK 的 setActiveToolsByName 只改 agent.state.tools，不派发任何事件——门控后
         // 主动推一次快照，否则快照里的 tools 要等下一个 SDK 事件才对齐（会话空闲时永远
         // 等不到；回归：tests/terminal-smoke-test.mjs「agent exposes persistent terminal tools」）。
@@ -5770,6 +6256,8 @@ export class ClientSession {
         }
         conv.agentPreset = hit.id;
         this.applyToolGating(conv.session, hit.id);
+        this.sessionStatsCache = null;
+        this.cachedBaseTokens = null;
         // 技能名录段/终端引导是按 run 组装的提示词：重载 resourceLoader 让新预设
         // 即时生效（只有空白会话能切到这里，无历史可丢）。
         try {
@@ -5784,6 +6272,7 @@ export class ClientSession {
             text: `已切换为「${hit.name}」预设`,
             textEn: `Switched to preset "${hit.name}"`,
         });
+        this.pushSettings();
         this.flushSnapshot();
     }
     /** 设置新会话默认预设。 */
@@ -5824,7 +6313,18 @@ export class ClientSession {
             });
             return;
         }
+        if (this.conv.permissionPreset === hit.value) {
+            return;
+        }
         this.conv.permissionPreset = hit.value;
+        try {
+            // 持久会话：将权限变更写入会话转录日志，切会话/切项目重载时不丢失
+            const sm = this.conv.session.sessionManager;
+            sm?.appendCustomEntry?.("permission/preset", { preset: hit.value });
+        }
+        catch {
+            // best effort for in-memory sessions
+        }
         this.emit({
             type: "notice",
             level: "info",
@@ -6912,12 +7412,22 @@ export class ClientSession {
                     // best-effort：修不好就按原路径重建，下面的守卫会在 prompt 前再拦。
                 }
             }
-            // #235：转录链损坏时修一次再试（见 openManagerAndRuntime）。
-            const opened = await this.openManagerAndRuntime(() => (ownFile && existsSync(ownFile) ? SessionManager.open(ownFile) : SessionManager.continueRecent(conv.cwd)), (m) => createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, undefined, conv.id), {
+            // #280 & #335：转录链损坏时修一次再试（见 openManagerAndRuntime）。
+            // 严禁在 ownFile 不存在时回退到 continueRecent(conv.cwd) 或按 mtime list 历史文件，
+            // 否则会直接接错并顶替同项目的其它历史会话，污染别人的转录记录。
+            const opened = await this.openManagerAndRuntime(() => {
+                if (ownFile && existsSync(ownFile)) {
+                    return SessionManager.open(ownFile);
+                }
+                return conv.isEphemeral ? SessionManager.inMemory(conv.cwd) : SessionManager.create(conv.cwd);
+            }, (m) => 
+            // 子代理带模板时按原模板重建（conv.subagentTemplate 是派发时工厂
+            // 用的同一快照）；普通对话 undefined，行为不变。
+            createAgentSessionRuntime(this.makeRuntimeFactory(conv.terminals, conv.subagentTemplate, conv.id), {
                 cwd: conv.cwd,
                 agentDir: this.agentDir,
                 sessionManager: m,
-            }), async () => (ownFile && existsSync(ownFile) ? ownFile : (await SessionManager.list(conv.cwd))[0]?.path));
+            }), async () => (ownFile && existsSync(ownFile) ? ownFile : undefined));
             const runtime = opened.runtime;
             if (opened.repair) {
                 for (const n of this.transcriptRepairNotices(opened.repair))
@@ -6990,8 +7500,10 @@ export class ClientSession {
         if (!ephemeral && active && isBlank(active)) {
             if (_preset)
                 await this.selectAgentPreset(_preset);
-            else
+            else {
+                this.pushSettings();
                 this.flushSnapshot();
+            }
             return true;
         }
         if (!ephemeral) {
@@ -7035,10 +7547,25 @@ export class ClientSession {
         try {
             const conversationId = this.nextConversationId();
             const terminals = this.makeTerminalManager(conversationId, this.cwd);
-            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined), {
+            let sessionManager;
+            if (ephemeral) {
+                sessionManager = SessionManager.inMemory(this.cwd);
+                // 为无痕临时会话提供隔离的临时运行目录（供 SoL-Pi 等依赖 getSessionDir 的扩展正常放置缓存），
+                // 但保持 persist = false（不写 .jsonl 对话文件、不污染历史记录）
+                const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conversationId);
+                try {
+                    mkdirSync(ephemeralDir, { recursive: true });
+                    sessionManager.sessionDir = ephemeralDir;
+                }
+                catch { }
+            }
+            else {
+                sessionManager = SessionManager.create(this.cwd);
+            }
+            const runtime = await createAgentSessionRuntime(this.makeRuntimeFactory(terminals, undefined, conversationId, prevModel ?? undefined, _preset), {
                 cwd: this.cwd,
                 agentDir: this.agentDir,
-                sessionManager: ephemeral ? SessionManager.inMemory(this.cwd) : SessionManager.create(this.cwd),
+                sessionManager,
             });
             const conv = this.makeConversation(runtime, conversationId, terminals);
             if (ephemeral)
@@ -7111,6 +7638,7 @@ export class ClientSession {
             void this.pushSlashCommands();
             // 新对话即当前打开 → 插件重拉（轨迹视图跟随）。
             this.notifyConversationChanged();
+            this.pushSettings();
             ready = true;
         }
         catch (err) {
@@ -7217,7 +7745,7 @@ export class ClientSession {
                 };
                 lines[idx] = JSON.stringify(done);
             }
-            writeFileSync(file, lines.join("\n"));
+            atomicWriteFileSync(file, lines.join("\n"));
         }
         catch {
             // Best-effort, same as the write path.
@@ -7238,7 +7766,7 @@ export class ClientSession {
             if (!raw.includes('"pi-web-ui/compaction-pending"'))
                 return;
             const kept = raw.split("\n").filter((line) => !line.includes("pi-web-ui/compaction-pending"));
-            writeFileSync(file, kept.join("\n"));
+            atomicWriteFileSync(file, kept.join("\n"));
             this.emitCompactionInterruptedNotice();
         }
         catch {
@@ -7412,6 +7940,13 @@ export class ClientSession {
             }
             catch { }
         }
+        if (conv.isEphemeral) {
+            const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conv.id);
+            try {
+                rmSync(ephemeralDir, { recursive: true, force: true });
+            }
+            catch { }
+        }
         void conv.runtime.dispose().catch(() => { });
     }
     /** 本会话是否持有这个 SDK 会话对应的对话；命中则给出它的**当前** id
@@ -7431,6 +7966,7 @@ export class ClientSession {
             cwd: c.cwd,
             ...(c.parentId ? { parentId: c.parentId } : {}),
             isSubagent: c.isSubagent,
+            isEphemeral: !!c.isEphemeral,
         }));
     }
     /**
@@ -7479,9 +8015,30 @@ export class ClientSession {
                 pageCalls.push({ resolve: p.resolve, req: p.req, timeoutMs: p.timeoutMs, conversationId: p.conversationId });
             }
         }
+        // 待审批跟对话走：留在源会话就是幽灵弹窗（id 失效点不动，runtime 已搬走，
+        // 永远等不到答复）。只搬归属明确的（conversationId 对得上，与问卷/页调用
+        // 同一规则）；目标侧按新 id 重发弹窗，等待中的 Promise 原样过户不 resolve。
+        const approvals = [];
+        for (const [aid, a] of this.pendingApprovals) {
+            if (a.conversationId !== undefined && set.has(a.conversationId)) {
+                this.pendingApprovals.delete(aid);
+                approvals.push({
+                    resolve: a.resolve,
+                    toolCallId: a.toolCallId,
+                    toolName: a.toolName,
+                    params: a.params,
+                    reason: a.reason,
+                    reasonEn: a.reasonEn,
+                    ...(a.category ? { category: a.category } : {}),
+                    conversationId: a.conversationId,
+                    ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                    createdAt: a.createdAt,
+                });
+            }
+        }
         this.emitConversations();
         this.flushSnapshot();
-        return { ok: true, payload: { convs, questions, pageCalls } };
+        return { ok: true, payload: { convs, questions, pageCalls, approvals } };
     }
     /**
      * 过户转入：把另一会话摘除的对话整体接过来，返回主对话的新 id。
@@ -7562,8 +8119,65 @@ export class ClientSession {
                 timeoutMs: p.timeoutMs,
             });
         }
+        // 迁入的待审批按新 id 重新挂上（等待中的 Promise 未动，模型还在等）。
+        // 主对话的立即弹窗（子代理的靠角标与快照呈现，与问卷同一口径）。
+        for (const a of payload.approvals) {
+            const nid = `appr-${++this.approvalSeq}`;
+            const aConvId = fix(a.conversationId);
+            this.pendingApprovals.set(nid, {
+                id: nid,
+                toolCallId: a.toolCallId,
+                toolName: a.toolName,
+                params: a.params,
+                reason: a.reason,
+                reasonEn: a.reasonEn,
+                ...(a.category ? { category: a.category } : {}),
+                conversationId: aConvId,
+                ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                resolve: a.resolve,
+                createdAt: a.createdAt,
+            });
+            if (aConvId === mainId) {
+                this.emit({
+                    type: "tool_approval_pending",
+                    id: nid,
+                    toolCallId: a.toolCallId,
+                    toolName: a.toolName,
+                    params: a.params,
+                    reason: a.reason,
+                    reasonEn: a.reasonEn,
+                    ...(a.category ? { category: a.category } : {}),
+                    conversationId: aConvId,
+                    ...(a.conversationTitle ? { conversationTitle: a.conversationTitle } : {}),
+                });
+            }
+        }
         return mainId;
     }
+    /**
+     * 切到新工作目录后的“跟随面”刷新（roots / 插件钩子 / 最近项目 / 历史列表 /
+     * 文件树 / 命令目录）。调用方先把 this.cwd 改好再调本函数。
+     * switchConversation 跨项目切换、set_cwd、switchSession 打开别项目的历史
+     * 会话三处共用 —— 之前 switchSession 只改了 cwd 没同步 roots，文件树/
+     * 工作区插件/历史列表都还停在旧项目。集中一处避免再漏。
+     */
+    applyCwdSideEffects(abs) {
+        this.roots = this.stateStore.getWorkspaceRoots(this.clientId, abs);
+        // 工作区跟随型插件（编辑器文件树等）同步切根。
+        try {
+            this.onCwdChanged?.(abs, this.roots);
+        }
+        catch {
+            /* 钩子异常不影响主流程 */
+        }
+        // Remember the new workspace (restore target + recent-project entry).
+        this.stateStore.remember(this.clientId, abs);
+        void this.pushProjects();
+        this.refreshSessionsOnSwitch();
+        void this.listFiles(undefined);
+        // Commands are per-project (.pi/commands.json in the current cwd).
+        void this.listCommands();
+    }
     /** Switch the ACTIVE conversation without interrupting any other chat. */
     async switchConversation(id) {
         if (!this.convs.has(id) || id === this.activeId)
@@ -7588,7 +8202,6 @@ export class ClientSession {
         void this.pushSlashCommands();
         if (cwdChanged) {
             this.cwd = newCwd;
-            this.roots = this.stateStore.getWorkspaceRoots(this.clientId, newCwd);
             // 模型/key 恢复不挡快照：后台做，带代际 guard（用户又切走就跳过），
             // 做完补一次 flush 刷新模型栏。
             {
@@ -7610,20 +8223,11 @@ export class ClientSession {
             }
             // Mirror set_cwd's project-switch side-effects so the whole UI follows
             // the new workspace, not just the chat pane.
-            try {
-                this.onCwdChanged?.(newCwd, this.roots);
-            }
-            catch {
-                /* hook failure must not break the switch */
-            }
-            this.stateStore.remember(this.clientId, newCwd);
-            void this.pushProjects();
-            this.refreshSessionsOnSwitch();
-            void this.listFiles(undefined);
-            void this.listCommands();
+            this.applyCwdSideEffects(newCwd);
         }
         // 当前打开对话变了 → 插件重拉（轨迹视图切会话后即刷新，不等轮询）。
         this.notifyConversationChanged();
+        this.pushSettings();
         this.flushSnapshot();
     }
     /** 左栏「运行的对话」的展示口径（issue #140）。
@@ -7916,6 +8520,23 @@ export class ClientSession {
                     return;
                 }
             }
+            // #145 同款守卫：删之前查一遍其他客户端是否持有这份转录 ——
+            // 对端 runtime 还开着时硬删等于把文件从活 writer 身下抽走（跑着时
+            // 更是两支并发写）。被持有就拒绝删除；本客户端自己的持有已在上面处理。
+            const otherOwner = this.findSessionOwner?.(abs);
+            if (otherOwner) {
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: otherOwner.isStreaming
+                        ? `该对话正在另一处运行中（「${otherOwner.title}」），已停止删除；请先回到原窗口停止或关闭它`
+                        : `该对话在另一处仍开着（「${otherOwner.title}」），已停止删除；请先在原窗口关闭它再删`,
+                    textEn: otherOwner.isStreaming
+                        ? `This conversation is running in another window ("${otherOwner.title}"); delete aborted — stop or close it there first`
+                        : `This conversation is still open in another window ("${otherOwner.title}"); delete aborted — close it there first`,
+                });
+                return;
+            }
             rmSync(abs, { force: true });
             // 转录删了，sidecar 再留着就是孤儿，一起清掉（不存在不报错）。
             removeTouchSidecar(abs);
@@ -8105,6 +8726,13 @@ export class ClientSession {
             }
             conv.isSubagent = false;
             conv.isEphemeral = false;
+            if (wasEphemeral) {
+                const ephemeralDir = join(this.agentDir, "ephemeral-sessions", conv.id);
+                try {
+                    rmSync(ephemeralDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
             this.emitConversations();
             await this.pushProjects();
             this.flushSnapshot();
@@ -8591,9 +9219,9 @@ export class ClientSession {
             // is known-good. This keeps a failed history open entirely non-destructive.
             const oldListed = this.conv.listed;
             const displaced = this.displaceActive();
-            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetCwd && !c.isSubagent).length +
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetCwd && !c.isSubagent && !c.isEphemeral).length +
                 1 -
-                (displaced?.cwd === targetCwd && !displaced?.isSubagent ? 1 : 0);
+                (displaced?.cwd === targetCwd && !displaced?.isSubagent && !displaced?.isEphemeral ? 1 : 0);
             if (openInProject > MAX_OPEN_CONVERSATIONS) {
                 // displaceActive() may have promoted a streaming conversation into the
                 // running list. Roll that presentation-only mutation back because no
@@ -8624,6 +9252,9 @@ export class ClientSession {
                 this.removeConversation(displaced.id);
             await this.bindSession();
             this.cwd = targetCwd;
+            // 打开的历史会话可能属于另一个项目 —— 工作区跟随面（roots/文件树/
+            // 历史列表/命令目录/最近项目）必须跟着切，否则 UI 停在旧项目。
+            this.applyCwdSideEffects(targetCwd);
             await this.restoreProjectProviderKeysForCwd(targetCwd);
             await this.restoreProjectModelForCwd(targetCwd);
             this.conv.lastActiveAt = Date.now();
@@ -8635,6 +9266,7 @@ export class ClientSession {
             void this.pushSlashCommands();
             // 切历史会话成功 → 插件重拉（轨迹视图立即显示该会话时间线）。
             this.notifyConversationChanged();
+            this.pushSettings();
         }
         catch (err) {
             openedTerminals?.killAll();
@@ -8681,49 +9313,16 @@ export class ClientSession {
      * back to its append-only session entry in the given conversation.
      */
     resolveMessageEntry(conv, messageId) {
-        const userSeqByTs = new Map();
-        const assistantSeqByTs = new Map();
-        let globalSeq = 0;
+        // The matcher re-derives rendered ids with the SAME derivation
+        // serializeCachedFor() used to hand them to the browser (uiMessageId +
+        // the counter below). Historically this recomputed ids with its own
+        // numbering (per-timestamp assistant seq, branch-entry global seq),
+        // which never matched what was rendered — fork/rollback on any
+        // assistant bubble failed 100% of the time (issue #381).
         const entries = conv.session.sessionManager.buildContextEntries();
-        for (const entry of entries) {
-            globalSeq += 1;
-            if (entry.id === messageId)
-                return entry;
-            if (entry.type === "message") {
-                const m = entry.message;
-                if (!m)
-                    continue;
-                let uiId = "";
-                if (m.role === "user") {
-                    const ts = m.timestamp ?? 0;
-                    const seq = (userSeqByTs.get(ts) ?? 0) + 1;
-                    userSeqByTs.set(ts, seq);
-                    uiId = `u-${ts}-${seq}`;
-                }
-                else if (m.role === "assistant") {
-                    const ts = m.timestamp ?? 0;
-                    const seq = (assistantSeqByTs.get(ts) ?? 0) + 1;
-                    assistantSeqByTs.set(ts, seq);
-                    uiId = `a-${ts}-${seq}`;
-                }
-                else if (m.role === "toolResult") {
-                    uiId = `t-${m.toolCallId}`;
-                }
-                else if (m.role === "bashExecution") {
-                    uiId = `b-${m.timestamp}-${globalSeq}`;
-                }
-                if (uiId === messageId)
-                    return entry;
-            }
-            else if (entry.type === "custom_message") {
-                const ts = entry.timestamp ? new Date(entry.timestamp).getTime() : 0;
-                const uiId = `c-${ts}-${globalSeq}`;
-                if (uiId === messageId)
-                    return entry;
-            }
-        }
+        const found = findEntryByUiId(entries, messageId, (m) => this.uiMessageKey(conv, m).n);
         // 兜底：getEntry 查整棵树
-        return conv.session.sessionManager.getEntry(messageId) ?? null;
+        return found ?? conv.session.sessionManager.getEntry(messageId) ?? null;
     }
     /**
      * Fork a NEW branch conversation from a specific historical message position.
@@ -8803,8 +9402,33 @@ export class ClientSession {
                 messageId,
                 title: targetConv.title,
             };
+            // 与 newChat/switchSession 同一护栏：fork 出的对话也占项目名额，被换下
+            // 的旧 active 也要走运行列表生命周期（该保留的保留、该释放的释放）。
+            // 之前两者皆无 —— 可以无限 fork 堆爆名额，旧对话也永远留在列表里。
+            // 顺序照 switchSession：新 runtime 建好才 displace，失败不伤现有对话。
+            const oldListed = this.conv.listed;
+            const displaced = this.displaceActive();
+            const openInProject = [...this.convs.values()].filter((c) => c.cwd === targetConv.cwd && !c.isSubagent && !c.isEphemeral).length +
+                1 -
+                (displaced?.cwd === targetConv.cwd && !displaced?.isSubagent && !displaced?.isEphemeral ? 1 : 0);
+            if (openInProject > MAX_OPEN_CONVERSATIONS) {
+                // displaceActive() 可能只是把旧对话标成后台展示（presentation-only）；
+                // 没有切换发生时回滚该标记，新 fork 的 runtime/终端直接释放。
+                this.conv.listed = oldListed;
+                terminals.killAll();
+                await runtime.dispose();
+                this.emit({
+                    type: "notice",
+                    level: "warning",
+                    text: `当前项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`,
+                    textEn: `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`,
+                });
+                return;
+            }
             this.convs.set(conversationId, newConv);
             this.activeId = conversationId;
+            if (displaced)
+                this.removeConversation(displaced.id);
             await this.bindSession();
             if (prevModel && this.sharedModelRuntime) {
                 try {
@@ -9078,7 +9702,7 @@ export class ClientSession {
         const run = (async () => {
             try {
                 const saved = this.stateStore.get(this.clientId);
-                const removedProjects = new Set(this.stateStore.getRemovedProjects(this.clientId));
+                const removedProjects = new Set(this.stateStore.getRemovedProjects(this.clientId).map(normalizePathKey));
                 const map = new Map();
                 for (const p of saved.projects)
                     map.set(p.path, p.lastUsed);
@@ -9095,7 +9719,7 @@ export class ClientSession {
                 // is useless in the picker. Tombstoned entries (explicitly removed by
                 // the user) stay hidden even though session files still mention them.
                 const projects = [...map.entries()]
-                    .filter(([path]) => !removedProjects.has(path) && existsSync(path))
+                    .filter(([path]) => !removedProjects.has(normalizePathKey(path)) && existsSync(path))
                     .map(([path, lastUsed]) => ({ path, lastUsed }))
                     .sort((a, b) => b.lastUsed - a.lastUsed)
                     .slice(0, 20);
@@ -9115,11 +9739,17 @@ export class ClientSession {
         await run;
     }
     /** 缓存命中时把当前 cwd 并进去：命中则刷新 lastUsed 重排，未命中则补到首位
-     *  （remember 刚写入的新项目在 TTL 窗口内也可见，不必等下一次扫盘）。 */
+     *  （remember 刚写入的新项目在 TTL 窗口内也可见，不必等下一次扫盘）。
+     *  若当前工作区已被显式移出，则不强行塞回最近列表。 */
     withCurrentCwd(projects, now) {
-        if (projects.some((p) => p.path === this.cwd)) {
+        const currentKey = normalizePathKey(this.cwd);
+        const removedKeys = new Set(this.stateStore.getRemovedProjects(this.clientId).map(normalizePathKey));
+        if (removedKeys.has(currentKey)) {
+            return projects;
+        }
+        if (projects.some((p) => normalizePathKey(p.path) === currentKey)) {
             return projects
-                .map((p) => (p.path === this.cwd && p.lastUsed < now ? { ...p, lastUsed: now } : p))
+                .map((p) => (normalizePathKey(p.path) === currentKey && p.lastUsed < now ? { ...p, lastUsed: now } : p))
                 .sort((a, b) => b.lastUsed - a.lastUsed);
         }
         return [{ path: this.cwd, lastUsed: now }, ...projects].slice(0, 20);
@@ -9349,7 +9979,7 @@ export class ClientSession {
     }
     async setCwd(newCwd) {
         try {
-            const { resolve, sep } = await import("node:path");
+            const { resolve } = await import("node:path");
             this.files.unwatchGit(); // stale repo's watcher must not fire across projects
             const fs = await import("node:fs/promises");
             const trimmed = newCwd.trim();
@@ -9363,11 +9993,9 @@ export class ClientSession {
                 });
                 return;
             }
-            // Windows 裸盘符（"C:"）：resolve 会按该盘当前目录解析，必须显式指到盘根；
-            // 仅 win32 生效——posix 下 "C:" 仍是普通相对路径，避免误伤同名目录。
-            const abs = process.platform === "win32" && /^[A-Za-z]:$/.test(trimmed)
-                ? `${trimmed.toUpperCase()}${sep}`
-                : resolve(trimmed);
+            // Windows 裸盘符（"C:"）与相对路径基准的处理收敛到 resolveCwdTarget
+            // （纯函数，含 win32/posix 差异说明与单测）。
+            const abs = resolveCwdTarget(trimmed, this.cwd);
             const st = await fs.stat(abs);
             if (!st.isDirectory()) {
                 throw new Error("路径不是目录");
@@ -9477,7 +10105,6 @@ export class ClientSession {
             this.conv.promptedSinceActive = false;
             this.conv.lastActiveAt = Date.now();
             this.cwd = abs;
-            this.roots = this.stateStore.getWorkspaceRoots(this.clientId, abs);
             // 模型/key 恢复不挡快照：后台做，带切换代际 guard（用户又切走就跳过，
             // 否则会把旧项目的 key 套到新对话上），做完补一次 flush 刷新模型栏。
             {
@@ -9497,16 +10124,7 @@ export class ClientSession {
                     }
                 })();
             }
-            // 工作区跟随型插件（编辑器文件树等）同步切根。
-            try {
-                this.onCwdChanged?.(abs, this.roots);
-            }
-            catch {
-                /* 钩子异常不影响主流程 */
-            }
-            // Remember the new workspace (restore target + recent-project entry).
-            this.stateStore.remember(this.clientId, abs);
-            void this.pushProjects();
+            this.applyCwdSideEffects(abs);
             this.webUi.refresh();
             this.emitConversations();
             this.goalSvc.emitGoalStatus();
@@ -9518,12 +10136,9 @@ export class ClientSession {
                 text: `已切换到工作目录：${abs}`,
                 textEn: `Switched to directory: ${abs}`,
             });
-            this.refreshSessionsOnSwitch();
-            void this.listFiles(undefined);
-            // Commands are per-project (.pi/commands.json in the current cwd).
-            void this.listCommands();
             // 切项目即换了当前打开对话 → 插件重拉。
             this.notifyConversationChanged();
+            this.pushSettings();
         }
         catch (err) {
             this.emit({
@@ -9589,14 +10204,30 @@ export class ClientSession {
     async clearGoal() {
         return this.goalSvc.clearGoal();
     }
-    /** Run a git diff (unstaged + staged) in a conversation's workspace, or
-     * "" when not a repo. */
+    /**
+     * Run a git diff (unstaged + staged) in a conversation's workspace, or
+     * "" when not a repo.
+     *
+     * 返回值是 goal 审查用的「变更指纹」，构造规则（截断与等值比较的相互作用）
+     * 见 buildDiffFingerprint：diff 为空时以排序后的 `git status --porcelain`
+     * 兜底（未跟踪文件也算变更），diff 非空时正文截断后拼 [diff-meta] 尾段，
+     * 避免大 diff 截断后两轮前缀相同被误判成停滞。
+     */
     async gitDiff(cwd) {
         try {
             const { code, out } = await this.runAsync("git", ["diff", "HEAD"], 10_000, cwd);
             if (code !== 0)
                 return "";
-            return out.slice(0, 60_000);
+            let status = "";
+            try {
+                const st = await this.runAsync("git", ["status", "--porcelain"], 10_000, cwd);
+                if (st.code === 0)
+                    status = st.out;
+            }
+            catch {
+                // status 拍不到 → 指纹退化为纯 diff，行为与旧版一致
+            }
+            return buildDiffFingerprint(out, status);
         }
         catch {
             return "";
@@ -9808,6 +10439,8 @@ export class ClientSession {
         this.cancelPendingQuestions();
         // 同理关闭挂起的页面调用（以失败解析：对面是扩展，没有答可等）。
         this.cancelPendingPageCalls();
+        // 挂起的工具审批一并清掉（以「拒绝」解析，防 Promise/runtime 泄漏）。
+        this.cancelPendingApprovals();
         this.bg.stop();
         for (const conv of this.convs.values()) {
             this.clearAllToolWatchdogs(conv);
@@ -10192,6 +10825,11 @@ export class AgentService {
         // 伪客户端常驻一个 noop sink（chatFromScheduler 的 attach），所以不能按
         // sinkCount 判断「有没有浏览器」—— 它永远为 1。这里就是它的回收点。
         this.clients.delete(clientId);
+        // 先摘出 map 再异步 dispose：只删 map 的话，对话的 runtime/终端/看门狗
+        // 计时器全都留在内存里（泄漏），转录还挂着活 writer（同文件双写者风险）。
+        void cs.dispose().catch(() => {
+            // 回收失败不拦主流程：尽力而为，进程退出时 OS 兜底
+        });
         // 通知其他客户端刷新 elsewhere 列表。
         this.pokeExternalRunning(clientId);
     }
@@ -10570,9 +11208,9 @@ export class AgentService {
         }
         const moveIds = [convId, ...collectSubagentDescendantIds(briefs, convId)];
         const moveSet = new Set(moveIds);
-        // 容量：与 switchSession 同口径（目标项目非子代理 8 个）。
-        const movedMains = briefs.filter((b) => moveSet.has(b.id) && !b.isSubagent).length;
-        const openInProject = target.takeoverBriefs().filter((b) => b.cwd === main.cwd && !b.isSubagent).length + movedMains;
+        // 容量：与 switchSession 同口径（目标项目非子代理且非临时会话 8 个）。
+        const movedMains = briefs.filter((b) => moveSet.has(b.id) && !b.isSubagent && !b.isEphemeral).length;
+        const openInProject = target.takeoverBriefs().filter((b) => b.cwd === main.cwd && !b.isSubagent && !b.isEphemeral).length + movedMains;
         if (openInProject > MAX_OPEN_CONVERSATIONS) {
             fail(`目标项目运行的对话已达上限（${MAX_OPEN_CONVERSATIONS} 个），请先打开某个对话并离开（不继续对话）以移出列表`, `This project already has the max open conversations (${MAX_OPEN_CONVERSATIONS}). Open one and leave it (without continuing) to remove it from the list.`);
             return;
@@ -10676,7 +11314,9 @@ export class AgentService {
                 // 流式增量经尾部 attachSink 直接推给新 socket）。
                 // 有其他在线标签时不认领（issue #10 隔离优先）；quiesce 排空期也放行
                 // （这是重连既有工作，不是新工作）。本段无 await，并发 attach 原子。
-                const orphan = this.findAdoptableOrphan(clientId);
+                // 伪客户端（scheduler:/plugin:，定时任务/插件的无头调用）绝不认领：
+                // 否则无头会话会改键劫持用户关浏览器留下的残会话。
+                const orphan = AgentService.isPseudoClientId(clientId) ? null : this.findAdoptableOrphan(clientId);
                 if (orphan) {
                     this.clients.delete(orphan.oldId);
                     this.clients.set(clientId, orphan.cs);