cc-viewer 1.6.246 → 1.6.248

package/lib/claude-md-discovery.js

@@ -0,0 +1,181 @@
+/**
+ * CLAUDE.md 候选发现 + 安全读取。
+ *
+ * 用途：为 /api/claude-md 端点提供 (1) 候选清单计算 (2) 通过稳定 id 取回某条候选的内容。
+ *
+ * 策略：
+ *   - 项目候选：从 cwd 实际路径（realpath 后）向上走，每层若 <dir>/CLAUDE.md 存在且为文件，收一条。
+ *     终止条件：dir === dirname(dir)（fs root） / dir === homedir() / <dir>/.git 存在 / depth 达 8（任一即停）。
+ *     hit homedir 与 hit .git 时仍包含当前层再停，hit fs root 立即停。
+ *   - 全局候选：~/.claude/CLAUDE.md（以参数 claudeConfigDir 为准，由调用方传入，便于沙箱测试）。
+ *   - 排序：项目候选按"靠近 cwd"在前，全局总是最后一条。
+ *   - 去重：基于 realpath 去重；同一物理文件被多入口指向只留一条（保留先入者）。
+ *   - id：sha1(realPath).slice(0,12)。FS 不变 → 两次 list 结果一致；候选被换成不同物理文件 → id 变化（防 swap）。
+ *   - Windows：跳过父链遍历，只返回全局候选（POSIX 父链语义在 win 上需要单独验证，留给 v2）。
+ */
+
+import { existsSync, statSync, realpathSync, openSync, fstatSync, readSync, closeSync } from 'node:fs';
+import { dirname, join, basename, relative } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+
+const MAX_DEPTH = 8;
+
+function safeRealpath(p) {
+  try { return realpathSync(p); } catch { return null; }
+}
+
+function isFileSafe(p) {
+  try {
+    const st = statSync(p);
+    return st.isFile();
+  } catch {
+    return false;
+  }
+}
+
+function makeId(realPath) {
+  return createHash('sha1').update(realPath).digest('hex').slice(0, 12);
+}
+
+/**
+ * @param {object} opts
+ * @param {string} opts.cwd            起始目录(将被 realpath 化)。
+ * @param {string} opts.claudeConfigDir ~/.claude 目录(由 findcc.getClaudeConfigDir() 提供)。
+ * @param {(p:string) => {ok:boolean, real?:string}} [opts.isReadAllowedFn] 可选预过滤闸:
+ *        若提供, 候选必须 isReadAllowed(realPath).ok 才进列表 —— 避免父链祖先目录
+ *        因不在 file-access-policy allowlist 而点击必返回 403 的 UX 坑。测试可省略。
+ * @returns {Array<{id:string, scope:'project'|'global', realPath:string, tail:string, mtimeMs:number}>}
+ */
+export function discoverClaudeMdCandidates({ cwd, claudeConfigDir, isReadAllowedFn }) {
+  const out = [];
+  const seenReal = new Set();
+  const home = homedir();
+
+  const pushIfFile = (path, scope, tail) => {
+    // path 可能是 dir/CLAUDE.md, 也可能是 ~/.claude/CLAUDE.md
+    if (!existsSync(path)) return;
+    const real = safeRealpath(path);
+    if (!real) return;
+    if (basename(real) !== 'CLAUDE.md') return; // 防 symlink-name swap
+    if (!isFileSafe(real)) return;
+    if (seenReal.has(real)) return;
+    // 预过滤: 若注入了 policy gate, 不在 allowlist 内的祖先候选直接剔除 ——
+    // 这样 UI chip 不会渲染出"看得见点不开"的 403 项 (defensive review P1-A)。
+    if (typeof isReadAllowedFn === 'function') {
+      const policy = isReadAllowedFn(real);
+      if (!policy || !policy.ok) return;
+    }
+    seenReal.add(real);
+    let mtimeMs = 0;
+    try { mtimeMs = statSync(real).mtimeMs; } catch {}
+    out.push({ id: makeId(real), scope, realPath: real, tail, mtimeMs });
+  };
+
+  // ── 项目链遍历 ─────────────────────────────────────────────────────────────
+  if (process.platform !== 'win32') {
+    const startReal = safeRealpath(cwd) || cwd;
+    let dir = startReal;
+    let depth = 0;
+    while (depth < MAX_DEPTH) {
+      const candidatePath = join(dir, 'CLAUDE.md');
+      // tail：相对 startReal 的路径；若就是 startReal，tail = "CLAUDE.md"；
+      // 父级则 tail = "../../CLAUDE.md"。UI 只用 tail 做信息提示（title=fullPath）。
+      let tail;
+      if (dir === startReal) {
+        tail = 'CLAUDE.md';
+      } else {
+        const rel = relative(startReal, dir);
+        tail = (rel ? rel + '/' : '') + 'CLAUDE.md';
+      }
+      pushIfFile(candidatePath, 'project', tail);
+
+      // 终止判定：homedir / .git / fs root
+      const isHome = dir === home;
+      const hasGit = existsSync(join(dir, '.git'));
+      const parent = dirname(dir);
+      const atRoot = parent === dir;
+      if (isHome || hasGit || atRoot) break;
+
+      dir = parent;
+      depth++;
+    }
+  }
+
+  // ── 全局候选 ───────────────────────────────────────────────────────────────
+  if (claudeConfigDir) {
+    pushIfFile(join(claudeConfigDir, 'CLAUDE.md'), 'global', '.claude/CLAUDE.md');
+  }
+
+  return out;
+}
+
+/**
+ * 通过稳定 id 取候选内容。调用方应：
+ *   1) 先 discoverClaudeMdCandidates 得到 candidates;
+ *   2) 用本函数按 id 取内容并做最终安全闸 (basename + isReadAllowed);
+ *
+ * 安全闸由 isReadAllowedFn 注入(默认 file-access-policy.isReadAllowed),便于测试 mock。
+ *
+ * @param {Array} candidates  discoverClaudeMdCandidates 的返回。
+ * @param {string} id         12-hex 字符 id。
+ * @param {object} opts
+ * @param {number} opts.maxBytes               文件大小上限(字节)。
+ * @param {(p:string) => {ok:boolean, real?:string, reason?:string}} opts.isReadAllowedFn 安全闸。
+ * @returns {{ok:true, scope, tail, content, real} | {ok:false, status:number, error:string}}
+ */
+export function readCandidateById(candidates, id, { maxBytes, isReadAllowedFn }) {
+  if (typeof id !== 'string' || !/^[0-9a-f]{12}$/i.test(id)) {
+    return { ok: false, status: 400, error: 'Invalid id' };
+  }
+  const entry = candidates.find(c => c.id === id);
+  if (!entry) return { ok: false, status: 404, error: 'Candidate not found' };
+
+  // 二次校验：basename 仍是 CLAUDE.md (防 discovery 与 read 之间的 FS 变更)
+  if (basename(entry.realPath) !== 'CLAUDE.md') {
+    return { ok: false, status: 404, error: 'Candidate basename mismatch' };
+  }
+
+  const policy = isReadAllowedFn(entry.realPath);
+  if (!policy.ok) {
+    // 复用 file-access-policy.reasonToStatus 的语义：caller 决定状态码映射；
+    // 这里给 403 作为默认，调用方可按 reason 重写。
+    return { ok: false, status: 403, error: 'Forbidden', reason: policy.reason };
+  }
+
+  // 用 policy.real（已 realpath 过）做 size + read，避免再次 realpath 引入新的 TOCTOU 窗口。
+  const real = policy.real;
+  let size = 0;
+  let fd = null;
+  try {
+    fd = openSync(real, 'r');
+    const st = fstatSync(fd);
+    if (!st.isFile()) {
+      return { ok: false, status: 400, error: 'Not a file' };
+    }
+    size = st.size;
+    if (size > maxBytes) {
+      return { ok: false, status: 413, error: 'File too large' };
+    }
+    const buf = Buffer.alloc(size);
+    let read = 0;
+    while (read < size) {
+      const n = readSync(fd, buf, read, size - read, read);
+      if (n === 0) break;
+      read += n;
+    }
+    return {
+      ok: true,
+      scope: entry.scope,
+      tail: entry.tail,
+      content: buf.toString('utf-8'),
+      real,
+    };
+  } catch (e) {
+    return { ok: false, status: 500, error: e && e.code ? e.code : 'read-failed' };
+  } finally {
+    if (fd != null) {
+      try { closeSync(fd); } catch {}
+    }
+  }
+}

package/lib/perm-bridge.js

@@ -55,10 +55,12 @@ if (!toolName || !toolInput) {
   process.exit(1);
 }
 
-// 硬拦截：git commit/push 和 npm publish 即使在 --d (bypass) 模式下也强制走 Web UI 审批
+// 硬拦截：npm publish 即使在 --d (bypass) 模式下也强制走 Web UI 审批
 // 这是安全底线，不受 --dangerously-skip-permissions 影响
+// 注：git commit / git push 不在硬拦截范围内 —— 提交可重写、push 可 force-push 回退,
+// 真正不可撤销的对外发布(npm publish)才走硬闸
 const isPublishCmd = toolName === 'Bash' && toolInput.command &&
-  /git\s+(commit|push)|npm\s+publish/i.test(toolInput.command);
+  /npm\s+publish/i.test(toolInput.command);
 
 // Bypass mode: auto-allow all tools except publish commands
 // 使用显式 allow 而非 exit(1) fallback，避免 Claude Code 记录 hook error 日志

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.6.246",
+  "version": "1.6.248",
   "description": "Claude Code Logger visualization management tool",
   "license": "MIT",
   "main": "server.js",

package/server.js

@@ -51,6 +51,7 @@ import { countLogEntries, streamRawEntriesAsync, readPagedEntries } from './lib/
 import { awaitDrainOrClose } from './lib/sse-backpressure.js';
 import { enrichRawIfNeeded } from './lib/enrich-plan-input.js';
 import { buildTeamStatusResponse } from './lib/team-runtime.js';
+import { discoverClaudeMdCandidates, readCandidateById } from './lib/claude-md-discovery.js';
 
 
 // 动态获取 getPrefsFile()（LOG_DIR 可能在运行时被 setLogDir 修改）
@@ -118,8 +119,10 @@ let _workspaceIsNpmVersion = false;
 let _workspaceLaunched = false; // 工作区是否已经启动了会话
 
 // Ask hook bridge state (for PreToolUse AskUserQuestion hook)
-// At most one pending request at a time (Claude Code is single-threaded)
-let pendingAskHook = null; // { questions, res, timer, createdAt }
+// Map supports concurrent ask requests (sub-agents / teammates) so a stale unanswered
+// ask never blocks the next one. Keyed by server-generated id.
+const pendingAskHooks = new Map(); // Map<id, { questions, res, timer, createdAt }>
+const ASK_HOOK_MAP_MAX = 50;
 
 // Permission hook bridge state (for PreToolUse permission approval)
 // Map supports concurrent sub-agent/teammate requests (keyed by request id)
@@ -2303,40 +2306,111 @@ async function handleRequest(req, res) {
   // Ask hook bridge: long-poll endpoint for PreToolUse AskUserQuestion hook
   if (url === '/api/ask-hook' && method === 'POST') {
     let body = '';
+    let bodyTooLarge = false;
     req.on('data', (chunk) => {
       body += chunk;
       if (body.length > 1000000) { // 1MB limit (questions may contain large previews)
-        res.writeHead(413, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Request body too large' }));
-        return;
+        bodyTooLarge = true;
+        req.destroy();
       }
     });
     req.on('end', async () => {
+      if (bodyTooLarge) {
+        try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+        return;
+      }
       try {
-        const { questions } = JSON.parse(body);
+        const { questions, toolUseId } = JSON.parse(body);
         if (!Array.isArray(questions) || questions.length === 0) {
           res.writeHead(400, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ error: 'Missing questions' }));
           return;
         }
+        // 镜像 ask-bridge 的 normalize：覆盖 plugin/SDK 等非 ask-bridge 的 client。
+        // 缺失 description 补 ""，前端按 hasOptionDescription 判断走非渲染分支。
+        for (const q of questions) {
+          if (!q || typeof q !== 'object' || !Array.isArray(q.options)) continue;
+          for (const opt of q.options) {
+            if (opt && typeof opt === 'object' && opt.description === undefined) {
+              opt.description = '';
+            }
+          }
+        }
 
-        // Cancel any previous pending hook request
-        if (pendingAskHook) {
-          try {
-            if (!pendingAskHook.res.headersSent) {
-              pendingAskHook.res.writeHead(409, { 'Content-Type': 'application/json' });
-              pendingAskHook.res.end(JSON.stringify({ error: 'Superseded' }));
+        // Evict oldest if Map is full (prevent memory leak from pathological concurrency).
+        // Mirrors perm-hook eviction; an evicted bridge process gets HTTP 429 and falls back
+        // to its own terminal UI rather than leaking long-poll state.
+        if (pendingAskHooks.size >= ASK_HOOK_MAP_MAX) {
+          const oldestId = pendingAskHooks.keys().next().value;
+          const oldest = pendingAskHooks.get(oldestId);
+          if (oldest) {
+            clearTimeout(oldest.timer);
+            try { if (!oldest.res.headersSent) { oldest.res.writeHead(429, { 'Content-Type': 'application/json' }); oldest.res.end(JSON.stringify({ error: 'Too many concurrent requests' })); } } catch {}
+            pendingAskHooks.delete(oldestId);
+            if (terminalWss) {
+              const tmsg = JSON.stringify({ type: 'ask-hook-timeout', id: oldestId });
+              terminalWss.clients.forEach((c) => {
+                if (c.readyState === 1) try { c.send(tmsg); } catch {}
+              });
             }
-          } catch {}
-          clearTimeout(pendingAskHook.timer);
+            _notifyParentPending({ type: 'ask-hook-timeout', id: oldestId });
+          }
         }
 
         const HOOK_TIMEOUT = 5 * 60 * 1000; // 5 minutes
+        // toolUseId 路由策略：
+        //  - char whitelist + ≤256 长度 防恶意 1MB key 撑大 Map
+        //  - 已存在同 id 但旧 res 已断（writableEnded/destroyed）→ 复用槽位（ask-bridge 重试场景）
+        //  - 已存在同 id 且旧 res 活 → 返 409 Conflict（真重复）而非走 fallback id 让前端 portal 失效
+        //  - 缺 toolUseId 或非法 → fallback 自生成 id
+        const wantsToolUseId = toolUseId && typeof toolUseId === 'string'
+          && toolUseId.length > 0 && toolUseId.length <= 256
+          && /^[a-zA-Z0-9_-]+$/.test(toolUseId);
+        let id;
+        if (wantsToolUseId) {
+          const existing = pendingAskHooks.get(toolUseId);
+          if (!existing) {
+            id = toolUseId;
+          } else if (!existing.res || existing.res.writableEnded || existing.res.destroyed) {
+            // 旧 res 已断（包含占位 res:null 残留）— ask-bridge 重试同 toolUseId 合理，复用槽位
+            if (existing.timer) clearTimeout(existing.timer);
+            pendingAskHooks.delete(toolUseId);
+            id = toolUseId;
+          } else {
+            res.writeHead(409, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Duplicate toolUseId, previous request still pending' }));
+            return;
+          }
+        } else {
+          do { id = `ask_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`; } while (pendingAskHooks.has(id));
+        }
+
+        // TOCTOU 防御：占位 id 之前先注册 res.on('close')，否则 await runWaterfallHook 期间 client
+        // abort 的 close 事件落空 → entry 残 5min。占位 set 提前到 await 之前防两条同 ms 并发
+        // POST 的 do-while 都通过 collision check 后 set 互相覆盖（first res 永泄漏到 5min）。
+        pendingAskHooks.set(id, { questions, res, timer: null, createdAt: Date.now() });
+
+        // res.on('close') 提前注册：handler 用 entry.timer 守卫（占位期 timer:null → 仅 delete Map）
+        res.on('close', () => {
+          const entry = pendingAskHooks.get(id);
+          if (entry) {
+            if (entry.timer) clearTimeout(entry.timer);
+            pendingAskHooks.delete(id);
+            if (terminalWss) {
+              const tmsg = JSON.stringify({ type: 'ask-hook-timeout', id });
+              terminalWss.clients.forEach((c) => {
+                if (c.readyState === 1) try { c.send(tmsg); } catch {}
+              });
+            }
+            _notifyParentPending({ type: 'ask-hook-timeout', id });
+          }
+        });
 
         // Plugin hook: let plugins answer questions directly
         try {
-          const hookResult = await runWaterfallHook('onAskRequest', { id: `ask_${Date.now()}`, questions, mode: 'hook' });
+          const hookResult = await runWaterfallHook('onAskRequest', { id, questions, mode: 'hook' });
           if (hookResult.answers) {
+            pendingAskHooks.delete(id); // 释放占位 — plugin 直接答了
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ answers: hookResult.answers }));
             return;
@@ -2344,52 +2418,38 @@ async function handleRequest(req, res) {
         } catch {}
 
         const timer = setTimeout(() => {
-          if (pendingAskHook && pendingAskHook.res === res) {
-            pendingAskHook = null;
+          const entry = pendingAskHooks.get(id);
+          if (entry) {
+            pendingAskHooks.delete(id);
             try {
-              if (!res.headersSent) {
-                res.writeHead(408, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Timeout' }));
+              // null guard：plugin throw + outer body-parse race 极端下占位残留时 fire 防 TypeError
+              if (entry.res && !entry.res.headersSent) {
+                entry.res.writeHead(408, { 'Content-Type': 'application/json' });
+                entry.res.end(JSON.stringify({ error: 'Timeout' }));
               }
             } catch {}
-            // Broadcast timeout to clients
             if (terminalWss) {
-              const tmsg = JSON.stringify({ type: 'ask-hook-timeout' });
+              const tmsg = JSON.stringify({ type: 'ask-hook-timeout', id });
               terminalWss.clients.forEach((c) => {
                 if (c.readyState === 1) try { c.send(tmsg); } catch {}
               });
             }
-            _notifyParentPending({ type: 'ask-hook-timeout' });
+            _notifyParentPending({ type: 'ask-hook-timeout', id });
           }
         }, HOOK_TIMEOUT);
 
-        pendingAskHook = { questions, res, timer, createdAt: Date.now() };
+        pendingAskHooks.set(id, { questions, res, timer, createdAt: Date.now() });
 
         // Broadcast to all terminal WS clients
         if (terminalWss) {
-          const pmsg = JSON.stringify({ type: 'ask-hook-pending', questions });
+          const pmsg = JSON.stringify({ type: 'ask-hook-pending', id, questions });
           terminalWss.clients.forEach((client) => {
             if (client.readyState === 1) {
               try { client.send(pmsg); } catch {}
             }
           });
         }
-        _notifyParentPending({ type: 'ask-hook-pending', questions });
-
-        // Handle ask-bridge.js disconnection (use res instead of req — Node.js v24+ fires req 'close' immediately after body is read)
-        res.on('close', () => {
-          if (pendingAskHook && pendingAskHook.res === res) {
-            clearTimeout(pendingAskHook.timer);
-            pendingAskHook = null;
-            if (terminalWss) {
-              const tmsg = JSON.stringify({ type: 'ask-hook-timeout' });
-              terminalWss.clients.forEach((c) => {
-                if (c.readyState === 1) try { c.send(tmsg); } catch {}
-              });
-            }
-            _notifyParentPending({ type: 'ask-hook-timeout' });
-          }
-        });
+        _notifyParentPending({ type: 'ask-hook-pending', id, questions });
       } catch {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Invalid request body' }));
@@ -2681,6 +2741,62 @@ async function handleRequest(req, res) {
     return;
   }
 
+  // CLAUDE.md 入口：列出 cwd 父链 + ~/.claude/CLAUDE.md，按 sha1(realpath).slice(0,12) 给稳定 id；
+  // 不带参 → 返回候选清单(无 content)；?id=<hex12> → 二次校验 basename + isReadAllowed 后吐内容。
+  // 设计要点：客户端永远只传 id，path resolution 由 server 独占；id 由 realpath 派生 → swap 即变 id。
+  if (url === '/api/claude-md' && method === 'GET') {
+    const respondJson = (status, body) => {
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(body));
+    };
+    try {
+      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const claudeConfigDir = getClaudeConfigDir();
+      // 注入 isReadAllowed 做发现阶段预过滤: 不在 allowlist 内的祖先候选不进列表 ——
+      // 否则 UI 会渲染出点击必 403 的"看得见点不开"chip。
+      const candidates = discoverClaudeMdCandidates({
+        cwd,
+        claudeConfigDir,
+        isReadAllowedFn: isReadAllowed,
+      });
+      const idParam = parsedUrl.searchParams.get('id');
+      const MAX_BYTES = 512 * 1024;
+
+      if (!idParam) {
+        // 列表: 不暴露 realPath / mtimeMs, 仅返回 {id, scope, tail}。mtimeMs 前端未使用,
+        // 去掉以收敛信息泄露面 (perf-sec review P2-C)。
+        return respondJson(200, {
+          entries: candidates.map(c => ({
+            id: c.id,
+            scope: c.scope,
+            tail: c.tail,
+          })),
+        });
+      }
+
+      const r = readCandidateById(candidates, idParam, {
+        maxBytes: MAX_BYTES,
+        isReadAllowedFn: isReadAllowed,
+      });
+      if (!r.ok) {
+        // policy 失败时让 reasonToStatus 统一映射，与 /api/project-memory 一致
+        const status = r.reason ? reasonToStatus(r.reason) : r.status;
+        return respondJson(status, { error: r.error, reason: r.reason });
+      }
+      return respondJson(200, {
+        id: idParam,
+        scope: r.scope,
+        tail: r.tail,
+        content: r.content,
+      });
+    } catch (err) {
+      const status = ERROR_STATUS_MAP[err.code] || 500;
+      const message = status === 500 ? 'Internal error' : err.message;
+      respondJson(status, { error: message });
+    }
+    return;
+  }
+
   // 返回文件原始二进制内容（用于图片预览等）—— 走 file-access-policy 统一校验
   // 历史 isEditorSession 后门 + uploadPrefix/persistPrefix 硬编码豁免已收敛:
   // policy 的 allowlist 已含 /tmp/cc-viewer-uploads/、tmpdir()/cc-viewer-uploads/、
@@ -3644,12 +3760,13 @@ export async function startViewer() {
                 }
                 return true;
               },
-              getPendingAsk: () => pendingAskHook ? { questions: pendingAskHook.questions, createdAt: pendingAskHook.createdAt } : null,
-              resolveAsk: (answers) => {
-                if (!pendingAskHook) return false;
-                const { res: hookRes, timer } = pendingAskHook;
+              getPendingAsks: () => [...pendingAskHooks.entries()].map(([id, e]) => ({ id, questions: e.questions, createdAt: e.createdAt })),
+              resolveAsk: (id, answers) => {
+                const entry = pendingAskHooks.get(id);
+                if (!entry) return false;
+                const { res: hookRes, timer } = entry;
                 clearTimeout(timer);
-                pendingAskHook = null;
+                pendingAskHooks.delete(id);
                 try {
                   if (!hookRes.headersSent) {
                     hookRes.writeHead(200, { 'Content-Type': 'application/json' });
@@ -3657,10 +3774,10 @@ export async function startViewer() {
                   }
                 } catch {}
                 if (terminalWss) {
-                  const rmsg = JSON.stringify({ type: 'ask-hook-resolved' });
+                  const rmsg = JSON.stringify({ type: 'ask-hook-resolved', id });
                   terminalWss.clients.forEach((c) => { if (c.readyState === 1) try { c.send(rmsg); } catch {} });
                 }
-                _notifyParentPending({ type: 'ask-hook-resolved' });
+                _notifyParentPending({ type: 'ask-hook-resolved', id });
                 return true;
               },
               resolveSdkApproval: (...args) => _sdkResolveApproval?.(...args),
@@ -3910,12 +4027,25 @@ async function setupTerminalWebSocket(httpServer) {
               }, { settleMs: msg.settleMs || 150 });
             }
           } else if (msg.type === 'ask-hook-answer') {
-            // Client answered AskUserQuestion via hook bridge
+            // Client answered AskUserQuestion via hook bridge.
+            // New protocol: msg.id required to address one of multiple pending asks.
+            // Legacy fallback: no id → resolve the oldest pending ask (preserves pre-Map client behavior).
             let askAnswered = false;
-            if (pendingAskHook) {
-              const { res: hookRes, timer } = pendingAskHook;
+            let askId = msg.id;
+            let askEntry = null;
+            if (askId) {
+              askEntry = pendingAskHooks.get(askId);
+            } else {
+              const firstId = pendingAskHooks.keys().next().value;
+              if (firstId) {
+                askId = firstId;
+                askEntry = pendingAskHooks.get(firstId);
+              }
+            }
+            if (askEntry) {
+              const { res: hookRes, timer } = askEntry;
               clearTimeout(timer);
-              pendingAskHook = null;
+              pendingAskHooks.delete(askId);
               askAnswered = true;
               try {
                 if (!hookRes.headersSent) {
@@ -3926,12 +4056,12 @@ async function setupTerminalWebSocket(httpServer) {
             }
             // Broadcast resolved to other clients so they clear their ask panel
             if (askAnswered && terminalWss) {
-              const rmsg = JSON.stringify({ type: 'ask-hook-resolved' });
+              const rmsg = JSON.stringify({ type: 'ask-hook-resolved', id: askId });
               terminalWss.clients.forEach((c) => {
                 if (c !== ws && c.readyState === 1) try { c.send(rmsg); } catch {}
               });
             }
-            if (askAnswered) _notifyParentPending({ type: 'ask-hook-resolved' });
+            if (askAnswered) _notifyParentPending({ type: 'ask-hook-resolved', id: askId });
           } else if (msg.type === 'perm-hook-answer') {
             // Permission approval — SDK mode (canUseTool) or PTY mode (hook bridge)
             let permAnswered = false;