pi-web-ui 0.96.0 → 0.97.0

package/dist/server/plan-mode.js

@@ -0,0 +1,376 @@
+/**
+ * server/plan-mode.ts
+ *
+ * 计划模式（Plan Mode）：**只规划不实施** 的纯函数闸门与判定。
+ *
+ * 形态：会话级开关（`set_plan_mode`）→ 打开后本对话只允许「只读调研」，
+ * 产出走 `plan_update` 步骤看板 + 计划正文，实施由用户确认后另起一轮。
+ *
+ * 为什么要硬闸门而不只靠提示词：模型不遵守软约束是常态（尤其长任务里
+ * 「顺手改一下」）。所以计划模式在**工具执行前**再挡一道：写类工具直接拒、
+ * bash 只放行只读命令，拒了就把原因当工具结果回给模型，让它换只读路径。
+ *
+ * 判定全部是纯函数（无 IO），单测见 tests/unit/plan-mode.test.ts。
+ */
+/** 计划模式下确定禁止的工具：写文件 / 改文件 / 建删 / 版本控制写。 */
+const BLOCKED_TOOLS = new Set([
+    // 文件写入与编辑（第一方 + SDK 内置 + 编辑器类扩展的常见名）
+    "write",
+    "create",
+    "create_file",
+    "write_file",
+    "edit",
+    "edit_file",
+    "edit_soft",
+    "apply_patch",
+    "patch",
+    "patch_tool",
+    "str_replace",
+    "str_replace_editor",
+    "multi_edit",
+    "notebook_edit",
+    // 文件系统增删改
+    "mv",
+    "move",
+    "cp",
+    "copy",
+    "mkdir",
+    "rm",
+    "rmdir",
+    "delete",
+    "delete_file",
+    "touch",
+    "chmod",
+    "chown",
+    "truncate",
+    "rename",
+    // 版本控制写（git add/commit/checkout/reset…；git 的只读子命令走 bash 白名单）
+    "git",
+    // 形态变换（会重写整个文件树）
+    "format",
+    "prettier",
+    "lint_fix",
+    "autofix",
+]);
+/**
+ * 计划模式下也禁掉的「旁路工具」：它们能在**别的会话**里干活，而闸门是
+ * 会话级的 —— 子代理/排程对话的 planMode 是 false，等于绕过只读约束。
+ * 调研靠本对话的 read/grep/只读 bash 足够，需要并行调研时先退出计划模式。
+ */
+const BYPASS_TOOLS = new Set([
+    "spawn",
+    "spawn_agent",
+    "subagent_spawn",
+    "delegate_task",
+    "schedule_agent",
+    "host_schedule",
+    "create_goal",
+    "set_goal",
+    "start_goal_wizard",
+    "create_conversation",
+    "fork_conversation",
+]);
+/** 计划模式下从模型视野中彻底隐藏的写类工具与旁路工具全集。 */
+export const PLAN_MODE_BLOCKED_TOOL_NAMES = new Set([...BLOCKED_TOOLS, ...BYPASS_TOOLS, "subagent"]);
+/** bash 类工具名（terminalBash 开关分流后可能是这几个）。 */
+const BASH_TOOLS = new Set(["bash", "bash_execute", "run_command", "shell", "terminal", "terminal_exec"]);
+/** 计划模式放行的只读命令（basename，无参数）。刻意保守：宁可拒一次让模型换命令。 */
+const READ_ONLY_COMMANDS = new Set([
+    // 目录 / 文件查看
+    "ls",
+    "ll",
+    "pwd",
+    "cat",
+    "bat",
+    "head",
+    "tail",
+    "wc",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "tree",
+    "find",
+    "fd",
+    "realpath",
+    "readlink",
+    "basename",
+    "dirname",
+    "which",
+    "type",
+    // 检索与文本处理（只读变体；sed 的 -i 在段内另行拒绝）
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "ag",
+    "ack",
+    "sed",
+    "awk",
+    "cut",
+    "tr",
+    "sort",
+    "uniq",
+    "jq",
+    "yq",
+    "diff",
+    "cmp",
+    // 环境 / 版本
+    "env",
+    "printenv",
+    "date",
+    "uname",
+    "whoami",
+    "node",
+    "npm",
+    "python",
+    "python3",
+    // 校验和（只读）
+    "md5sum",
+    "sha256sum",
+]);
+/** git 的只读子命令（写子命令一律禁）。 */
+const READ_ONLY_GIT_SUBCOMMANDS = new Set([
+    "status",
+    "diff",
+    "log",
+    "show",
+    "blame",
+    "rev-parse",
+    "rev-list",
+    "ls-files",
+    "ls-tree",
+    "describe",
+    "shortlog",
+    "grep",
+    "cat-file",
+    "whatchanged",
+]);
+/** 解释器的「只读例外」：只有这些参数组合放行，其余（-e/--eval/run script/子命令）拒。 */
+const INTERPRETER_SAFE_ARGS = new Set(["--version", "-v", "-V", "--help", "-h", "--revision"]);
+/** 段内出现即判写：重定向、命令替换、后台、heredoc。 */
+const WRITE_SHELL_TOKENS = /[><`]|&\s*$/;
+/** 引号感知的命令切分：把一条命令按 ; && || | 换行 拆成独立段。 */
+function splitShellSegments(cmd) {
+    const out = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < cmd.length; i++) {
+        const ch = cmd[i];
+        if (quote) {
+            cur += ch;
+            if (ch === quote && cmd[i - 1] !== "\\")
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            cur += ch;
+            continue;
+        }
+        // 命令替换 $( … ) 一律视为写（能跑任意代码），整条拒。
+        if (ch === "$" && cmd[i + 1] === "(")
+            return [""];
+        if (ch === ";" || ch === "\n") {
+            out.push(cur);
+            cur = "";
+            continue;
+        }
+        if ((ch === "&" || ch === "|") && cmd[i + 1] === (ch === "&" ? "&" : "|")) {
+            out.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (ch === "|") {
+            out.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    out.push(cur);
+    return out.map((s) => s.trim()).filter((s) => s !== "");
+}
+/** 取一段里的命令 token：跳过 `FOO=bar` 前缀、`/usr/bin/env`、路径前缀。 */
+function commandToken(segment) {
+    const tokens = segment.split(/\s+/);
+    let i = 0;
+    while (i < tokens.length) {
+        const tok = tokens[i];
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tok)) {
+            i++;
+            continue;
+        }
+        if (tok === "env" || tok === "command" || tok === "nohup" || tok === "time") {
+            i++;
+            continue;
+        }
+        return tok;
+    }
+    return "";
+}
+function basenameOf(token) {
+    const idx = token.lastIndexOf("/");
+    return idx >= 0 ? token.slice(idx + 1) : token;
+}
+/** 单段是否只读（不含管道/重定向/命令替换，命令在白名单内）。 */
+function segmentIsReadOnly(segment) {
+    if (WRITE_SHELL_TOKENS.test(segment))
+        return false;
+    // `>` 重定向在别处已覆盖；这里补 `2>&1` 之外的 fd 复制与 `<<<`/`2>`。
+    if (/<<|&\s*\d|\d\s*>/.test(segment))
+        return false;
+    const cmd = commandToken(segment);
+    if (!cmd)
+        return false;
+    const name = basenameOf(cmd);
+    const rest = segment.slice(segment.indexOf(cmd) + cmd.length).trim();
+    const args = rest.split(/\s+/).filter(Boolean);
+    if (name === "git") {
+        const sub = args.find((a) => !a.startsWith("-"));
+        return sub !== undefined && READ_ONLY_GIT_SUBCOMMANDS.has(sub);
+    }
+    if (!READ_ONLY_COMMANDS.has(name))
+        return false;
+    // sed -i / awk 的 system() 之类写路径。
+    if (name === "sed" && args.some((a) => /^-[a-z]*i/.test(a) || a === "--in-place"))
+        return false;
+    if (name === "awk" && /system\s*\(/.test(rest))
+        return false;
+    // 解释器：只放行 --version/--help 这类无副作用调用。
+    if (name === "node" || name === "python" || name === "python3" || name === "npm") {
+        return args.length > 0 && args.every((a) => INTERPRETER_SAFE_ARGS.has(a));
+    }
+    return true;
+}
+/**
+ * bash 命令是否只读（纯函数）。规则：按 `;` `&&` `||` `|` 切段，**每段**都要
+ * 只读；段内禁重定向 / 命令替换 / 后台 / heredoc；命令在白名单内，
+ * git 只放只读子命令，解释器只放行 --version/--help。
+ */
+export function bashCommandIsReadOnly(cmd) {
+    const text = (cmd ?? "").trim();
+    if (!text)
+        return false;
+    const segments = splitShellSegments(text);
+    if (segments.length === 0)
+        return false;
+    return segments.every(segmentIsReadOnly);
+}
+/** 从工具参数里取命令文本（各工具字段名不同）。 */
+function commandOf(params) {
+    if (!params || typeof params !== "object")
+        return "";
+    const p = params;
+    for (const key of ["command", "cmd", "script", "input"]) {
+        const v = p[key];
+        if (typeof v === "string" && v.trim() !== "")
+            return v;
+    }
+    return "";
+}
+/**
+ * 计划模式闸门（纯函数）：命中即拒绝，并把可操作的替代路径告诉模型。
+ * - 写类工具 → 拒（提示：把要做的事写进计划，用户确认后另起一轮实施）
+ * - bash 非常规命令 → 拒（提示：用 read/grep/只读 git，或给出计划）
+ * - 旁路工具（spawn/delegate/目标模式/排程）→ 拒（会绕过本会话只读约束）
+ */
+export function planModeDenial(toolName, params) {
+    const name = (toolName ?? "").trim();
+    if (!name)
+        return undefined;
+    if (name === "subagent") {
+        const action = typeof params === "object" && params !== null ? params.action : undefined;
+        const act = typeof action === "string" ? action.trim().toLowerCase() : "";
+        if (!act || act === "spawn") {
+            return {
+                kind: "bypass-tool",
+                reason: `计划模式：不能调用 subagent(action="spawn")（它会在别的会话里执行，绕过本会话的只读约束）。请在本对话内用只读工具完成调研。`,
+                reasonEn: `Plan mode: subagent(action="spawn") is unavailable (it runs outside this conversation and would bypass the read-only constraint). Research with read-only tools here.`,
+            };
+        }
+    }
+    if (BYPASS_TOOLS.has(name)) {
+        return {
+            kind: "bypass-tool",
+            reason: `计划模式：不能调用 ${name}（它会在别的会话里执行，绕过本会话的只读约束）。请在本对话内用只读工具完成调研。`,
+            reasonEn: `Plan mode: ${name} is unavailable (it runs outside this conversation and would bypass the read-only constraint). Research with read-only tools here.`,
+        };
+    }
+    if (BASH_TOOLS.has(name)) {
+        const cmd = commandOf(params);
+        if (cmd.trim() === "") {
+            return {
+                kind: "bash",
+                reason: "计划模式：终端命令不可用。请用 read/grep/只读 git 完成调研。",
+                reasonEn: "Plan mode: shell commands are unavailable. Use read/grep and read-only git instead.",
+            };
+        }
+        if (bashCommandIsReadOnly(cmd))
+            return undefined;
+        return {
+            kind: "bash",
+            reason: `计划模式：只允许只读命令，命令被拒：\`${cmd.slice(0, 200)}\`。请改用 read/grep/git status|diff|log 等只读手段；需要做的改动写进计划，等用户确认后实施。`,
+            reasonEn: `Plan mode: only read-only commands are allowed; rejected: \`${cmd.slice(0, 200)}\`. Use read/grep or read-only git (status/diff/log). Put proposed changes in the plan and wait for the user's go-ahead.`,
+        };
+    }
+    if (BLOCKED_TOOLS.has(name)) {
+        return {
+            kind: "write-tool",
+            reason: `计划模式：只规划不实施，${name} 被拒。请把这一步写进计划（plan_update 步骤 + 计划正文），等用户确认后在新一轮里实施。`,
+            reasonEn: `Plan mode: planning only, no implementation — ${name} was rejected. Record it as a plan step (plan_update) and wait for the user to approve before implementing.`,
+        };
+    }
+    return undefined;
+}
+/**
+ * 计划模式系统提示词段（英文：进入模型上下文，按工具提示词卫生口径只写英文）。
+ *
+ * 头两条是这份提示词真正的载荷：**禁代码倾倒**（模型在本模式下写不出文件，
+ * 于是会把整份实现当正文吐出来 —— 那既烧 token 又没落地，是计划模式最大的
+ * 失败模式）与 **小需求走短计划**（一句话需求不必先跑一轮 plan_update 看板）。
+ */
+export const PLAN_MODE_SYSTEM_PROMPT = [
+    "# Plan mode (planning only — do NOT implement)",
+    "The user turned on plan mode for this conversation. Your job in this mode is to produce a concrete, executable plan — never to make the changes.",
+    "## Hard rules",
+    "- Read-only research only: read, grep/rg, ls, and read-only bash (git status/diff/log/show, cat, wc, head, tail, jq). Anything that writes is blocked by the server and the rejection comes back as a tool error.",
+    "- Do not create, edit, move or delete files, do not run installs, builds, tests that write artifacts, and do not spawn subagents or start goal mode (those run outside this conversation).",
+    "## Output shape (this is the part that matters most)",
+    '- NEVER write the implementation. No full file bodies, no complete functions, no "here is the finished code", no working version of anything — it cannot be applied from this conversation and it wastes the user\'s tokens.',
+    "- Describe the work instead: which files to create or change, the structure (modules / functions / state), the key decisions and their reasons, the risks and unknowns, how it is verified, and the first concrete step.",
+    "- Code is allowed only as short illustrative snippets (about 20 lines each, at most two per plan) for genuinely tricky parts — a non-obvious algorithm or an API signature. No file dumps.",
+    "- Keep the whole plan short: a screen or two. Depth beats length; if a decision is still open, list it as a question instead of exploring it in prose.",
+    "## Plan board",
+    '- For work with 3+ steps or real unknowns, call plan_update early with decision-ready steps (all status "pending") and refine it as you learn more.',
+    '- For a small, unambiguous, greenfield request (e.g. "write a single-page snake game", "add a settings toggle", "rename this helper"), skip plan_update entirely and answer with the short plan: files to touch, structure, acceptance checks, first step.',
+    "## Finishing",
+    "- End with the plan and stop. Ask the user to confirm; implementation happens in the next turn after they turn plan mode off (or press the plan board's start-implementing action).",
+    "- If the request is too ambiguous to plan, ask 1-3 targeted questions instead of guessing.",
+].join("\n");
+/**
+ * 按设置面板偏好拼出生效的计划模式提示词（契约同 buildCommitMsgPrompt）：
+ * append 把自定义文字接在内置默认之后（空自定义 = 纯默认）；replace 用自定义
+ * 文字整体替换，但空自定义仍回落内置默认（绝不发空提示词）。
+ */
+export function buildPlanModePrompt(mode, custom) {
+    const text = custom?.trim() ?? "";
+    if (mode === "replace" && text)
+        return text;
+    if (text)
+        return `${PLAN_MODE_SYSTEM_PROMPT}\n\n${text}`;
+    return PLAN_MODE_SYSTEM_PROMPT;
+}
+/** 拒给用户的界面文案（notice，zh + en 成对）。 */
+export function planModeNoticeText(enabled) {
+    return enabled
+        ? {
+            text: "📋 计划模式：只调研与出计划，不实施（写操作会被服务端拒绝）",
+            textEn: "📋 Plan mode on: research and plan only — writes are blocked by the server",
+        }
+        : {
+            text: "计划模式已关闭：恢复正常对话",
+            textEn: "Plan mode off: back to normal",
+        };
+}

package/dist/server/plugin-facilities.js

@@ -303,14 +303,47 @@ export function depName(spec) {
 function str(v) {
     return typeof v === "string" ? v.trim() : "";
 }
-/** 从插件目录出发能否解析到这个模块（模拟插件自身 import() 的查找链）。 */
+/** 纯包名（`foo` / `@scope/foo`）：能按 `node_modules/<name>/package.json` 判盘。
+ *  `node:path`、URL、相对/绝对路径、git spec 一律 false（交给 resolve 判）。 */
+function isPlainPackageName(name) {
+    return /^(?:@[a-z\d](?:[a-z\d._-]*[a-z\d])?\/)?[a-z\d](?:[a-z\d._-]*[a-z\d])?$/i.test(name);
+}
+/** 从 fromDir 沿目录树向上找 `node_modules/<name>/package.json` 是否已落盘。 */
+function depOnDisk(fromDir, name) {
+    let dir = fromDir;
+    for (;;) {
+        try {
+            if (existsSync(join(dir, "node_modules", ...name.split("/"), "package.json")))
+                return true;
+        }
+        catch {
+            /* 权限/坏路径：当作这一层没有，继续往上找 */
+        }
+        const up = dirname(dir);
+        if (!up || up === dir)
+            return false;
+        dir = up;
+    }
+}
+/** 从插件目录出发能否解析到这个模块（模拟插件自身 import() 的查找链）。
+ *
+ *  resolve 失败后再看一眼「文件是否已落盘」，这不是冗余判据而是**修 bug**（issue #383）：
+ *  Node 的 CJS 解析会把 `node_modules/<pkg>/package.json` 不存在的**负结果**缓存在
+ *  进程内存里（packageJsonReader 的路径缓存）。于是「探测缺失 → npm install 成功 →
+ *  复查」这组三连里，最后一次复查永远命中那条负缓存，恒抛
+ *  `Cannot find module`，用户看到的是「装成功了却报 npm install 没跑通」，
+ *  且非重启整个进程不能恢复。落盘判据不碰 CJS 缓存，天然免疫。
+ *
+ *  顺序保持「先 resolve 后判盘」：解析成功仍然是最强的信号（含 exports 映射等
+ *  盘上判据覆盖不到的形状），判盘只是给解析的假阴性兜底，不会放宽真缺失。 */
 export function isDepAvailable(pluginDir, spec) {
+    const name = depName(spec);
     try {
-        createRequire(join(pluginDir, "index.mjs")).resolve(depName(spec));
+        createRequire(join(pluginDir, "index.mjs")).resolve(name);
         return true;
     }
     catch {
-        return false;
+        return isPlainPackageName(name) && depOnDisk(pluginDir, name);
     }
 }
 const depInstallLocks = new Map();

package/dist/server/plugin-installer.js

@@ -315,3 +315,33 @@ export class PluginInstaller {
         this.currentJobId = null;
     }
 }
+/**
+ * 插件安装的用户确认门（P0）：plugin_catalog_sync 的 install:true 与 plugin_job
+ * 的 install/update 在真正动安装器之前必须拿到用户确认。
+ *
+ * 用户若选择「记住并允许」，授权存入 plugin-permissions.json（后续同类操作自动放行，
+ * 设置面板「能力授权」页可审计与撤销）。拒绝 / 超时 / 未接弹窗设施（无头 DSH）一律 fail-closed。
+ */
+export async function confirmPluginInstall(items, deps) {
+    if (deps.permGrants?.has("plugin-installer", "net", { host: "github.com" })) {
+        return true;
+    }
+    const ask = deps.permissionRequester;
+    if (!ask)
+        return false;
+    const list = items.map((x) => `${x.id} ← ${x.source}`).join("\n");
+    const ans = await ask("plugin-installer", {
+        family: "net",
+        hosts: ["github.com"],
+        reason: `安装确认：将安装/更新以下插件（id ← source）：\n${list}\n拒绝或 120 秒未确认则不安装。`,
+    });
+    if (ans.ok && ans.remember && deps.permGrants) {
+        deps.permGrants.grant("plugin-installer", "net", {
+            hosts: ["github.com"],
+            reason: "插件安装/更新确认",
+            remember: true,
+        });
+        deps.onGrantsChanged?.();
+    }
+    return ans.ok === true;
+}

package/dist/server/plugins.js

@@ -1763,11 +1763,14 @@ export class PluginManager {
         }
         return out;
     }
-    /** 当前全部插件注册的 AI 工具（扁平化，按插件 id 稳定排序）。 */
+    /** 当前全部插件注册的 AI 工具（扁平化，按插件 id 稳定排序，附带所属 pluginId）。 */
     getAgentTools() {
         const out = [];
-        for (const table of [...this.agentTools.values()].sort())
-            out.push(...table.values());
+        for (const [pid, table] of [...this.agentTools.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+            for (const tool of table.values()) {
+                out.push({ ...tool, pluginId: pid });
+            }
+        }
         return out;
     }
     /** 注册一个供 AI 调用的工具；重名拒绝并返回空操作注销函数。

package/dist/server/protocol-version.js

@@ -8,4 +8,4 @@
  * its own copy in web/src/protocol-version.ts; scripts/check-protocol-sync.mjs
  * verifies the two never drift.
  */
-export const PROTOCOL_VERSION = 20;
+export const PROTOCOL_VERSION = 21;

package/dist/server/serialize.js

@@ -177,6 +177,17 @@ export function findEntryByUiId(entries, messageId, seqOf) {
             if (uiMessageId(m, seqOf(m)) === messageId)
                 return entry;
         }
+        else if (entry.type === "compaction") {
+            const ts = entry.timestamp ? new Date(entry.timestamp).getTime() : 0;
+            const m = {
+                role: "compactionSummary",
+                summary: entry.summary ?? "",
+                tokensBefore: entry.tokensBefore,
+                timestamp: ts,
+            };
+            if (uiMessageId(m, seqOf(m)) === messageId)
+                return entry;
+        }
     }
     return null;
 }

package/dist/server/settings-service.js

@@ -13,6 +13,7 @@ import { extensionKey, normalizeDisabledPluginTools, normalizeRetryMaxAttempts,
 import { normalizeSoftCapByModel, normalizeSoftCapTokens } from "./soft-cap.js";
 import { findVisionModels, SYSTEM_PROMPT } from "./vision-bridge.js";
 import { COMMITMSG_SYSTEM_PROMPT } from "./scm-commitmsg.js";
+import { PLAN_MODE_SYSTEM_PROMPT } from "./plan-mode.js";
 import { DEFAULT_TEMPLATES } from "./subagent-templates.js";
 import { deriveLegacy, foldLegacyIntoDisabled, normalizeDisabledAgentTools } from "./tool-manager.js";
 export class SettingsService {
@@ -54,12 +55,6 @@ export class SettingsService {
         }
         return false;
     }
-    get reviewPrefs() {
-        return {
-            reviewPrompt: this.settings.reviewPrompt,
-            reviewDisabledSkills: this.settings.reviewDisabledSkills,
-        };
-    }
     hasPendingReload() {
         return this.pendingReload;
     }
@@ -314,6 +309,8 @@ export class SettingsService {
                 visionBridgePrompt: this.settings.visionBridgePrompt,
                 scmCommitMsgPromptMode: this.settings.scmCommitMsgPromptMode,
                 scmCommitMsgPrompt: this.settings.scmCommitMsgPrompt,
+                planModePromptMode: this.settings.planModePromptMode,
+                planModePrompt: this.settings.planModePrompt,
                 reviewPrompt: this.settings.reviewPrompt,
                 reviewDisabledSkills: [...this.settings.reviewDisabledSkills],
                 disabledPlugins: [...(this.settings.disabledPlugins ?? [])],
@@ -327,6 +324,7 @@ export class SettingsService {
                 toolsSchema: promptSnap.toolsSchema,
                 visionBridgeDefaultPrompt: SYSTEM_PROMPT,
                 scmCommitMsgDefaultPrompt: COMMITMSG_SYSTEM_PROMPT,
+                planModeDefaultPrompt: PLAN_MODE_SYSTEM_PROMPT,
                 visionModels: this.collectVisionModels(),
                 disabledSkills: [...this.settings.disabledSkills],
                 disabledExtensions: [...this.settings.disabledExtensions],
@@ -404,6 +402,7 @@ export class SettingsService {
         // 统一工具开关 live 生效（ActiveSet 加减，无需 reload），见末尾 applyToolGating。
         const toolGatingChanged = partial.disabledAgentTools !== undefined ||
             partial.disabledPluginTools !== undefined ||
+            partial.disabledPlugins !== undefined ||
             partial.terminalToolsEnabled !== undefined ||
             partial.editSoftEnabled !== undefined ||
             partial.questionnaireEnabled !== undefined;
@@ -484,8 +483,12 @@ export class SettingsService {
             this.settings.toolApprovalEnabled = partial.toolApprovalEnabled;
         }
         // 目标模式总开关：运行时无需重载（goal bar / 服务端入口实时读取）。
+        // on→off 时立即停掉在飞的目标/调研 —— 不停的话循环照跑照派，开关名存实亡。
         if (partial.goalModeEnabled !== undefined) {
+            const wasOn = this.settings.goalModeEnabled !== false;
             this.settings.goalModeEnabled = partial.goalModeEnabled;
+            if (wasOn && partial.goalModeEnabled === false)
+                this.host.onGoalModeDisabled?.();
         }
         // 同项目并行提醒开关：同上，发送入口逐轮实时读取，无需 reload。
         if (partial.parallelReminderEnabled !== undefined) {
@@ -529,6 +532,12 @@ export class SettingsService {
         if (partial.scmCommitMsgPrompt !== undefined) {
             this.settings.scmCommitMsgPrompt = partial.scmCommitMsgPrompt;
         }
+        if (partial.planModePromptMode !== undefined) {
+            this.settings.planModePromptMode = partial.planModePromptMode;
+        }
+        if (partial.planModePrompt !== undefined) {
+            this.settings.planModePrompt = partial.planModePrompt;
+        }
         if (partial.reviewPrompt !== undefined) {
             this.settings.reviewPrompt = partial.reviewPrompt;
         }
@@ -573,11 +582,11 @@ export class SettingsService {
         // 必须在 this.push() 前生效，保证 promptSnapshot 收集到的是最新的活跃工具集与完整提示词！
         if (toolGatingChanged)
             this.host.applyToolGating();
-        if (needsReload)
-            await this.applyRuntime();
         this.host.stateStore.saveSettings(this.host.clientId, this.settings);
         this.push();
         this.host.flushSnapshot();
+        if (needsReload)
+            await this.applyRuntime();
     }
     /** Save the CURRENT settings as a named preset (overwrites if exists). */
     async savePreset(name) {
@@ -693,6 +702,9 @@ export class SettingsService {
             // 「AI 提交信息」提示词同样不进预设——保留当前值。
             scmCommitMsgPromptMode: this.settings.scmCommitMsgPromptMode,
             scmCommitMsgPrompt: this.settings.scmCommitMsgPrompt,
+            // 计划模式提示词同样不进预设——保留当前值。
+            planModePromptMode: this.settings.planModePromptMode,
+            planModePrompt: this.settings.planModePrompt,
             // 子代理默认模型也不进预设——保留当前值。
             subagentDefaultModel: this.settings.subagentDefaultModel,
             // 快捷短语是纯 UI 偏好，不进预设——保留当前值。