cc-viewer 1.6.269 → 1.6.271

package/lib/ask-bridge.js

@@ -85,7 +85,33 @@ for (const q of questions) {
 // 缺失时 server 会 fallback 到自生成 ask_${ts}_${rand}（向后兼容老 Claude Code 版本）。
 const toolUseId = payload?.tool_use_id || null;
 
-const TIMEOUT_MS = 60 * 60 * 1000; // 60 minutes（与 server.js HOOK_TIMEOUT 同源）
+// 故意不设客户端 req.setTimeout：cc-viewer 走 127.0.0.1 长连接，
+// 无反代/CDN 介入，由 server 端 entry res.on('close') + ASK_HOOK_TIMEOUT
+// 主动结束响应。用户在 GUI 里的等待时长不再受 ask-bridge 60min 硬上限限制。
+//
+// 新协议（Phase 3 短轮询）：
+//   POST /api/ask-hook with `X-Ask-Poll-Mode: short`
+//     新 server → 立即返 { id, capability: 'short-poll' }；client 转 GET 循环
+//     旧 server → 忽略 header 仍走 long-poll，最终返 { answers } 或 { cancelled }
+//   GET /api/ask-hook/:id/result?wait=30000
+//     200 + { answers } → 完成
+//     200 + { cancelled, reason } → server 通知 cancel
+//     204 → 重发 GET
+//     404 → entry 真消失（disk 也丢了）→ 重试 POST 一次（重建 entry）
+//     5xx / 网络错误 → 指数退避重试
+//
+// 这样 server 重启 + 网络抖动场景下 ask-bridge 不再直接 fallback terminal，
+// 而是续 GET 等回答（最长 24h，与 server 端 ASK_HOOK_TIMEOUT 同步）。
+// 25s 给反代留 5s buffer：nginx proxy_read_timeout 默认 60s / CloudFlare 100s /
+// AWS ALB 60s — 30s 是边界值激进配置会切。25s 在常见配置下安全且效率仍接近 30s。
+const POLL_WAIT_MS = 25000;
+const MAX_NETWORK_RETRIES = 60; // ~5 min of exponential backoff before giving up
+// 5xx 持久故障（server 真坏）不应该被当作"网络抖动"等 5 分钟 —— hook 进程挂死 5min 会
+// 阻塞 Claude Code 主进程（ensure-hooks 注的 24h timeout 在外侧）。给 5xx 一个独立的小重试
+// 上限：3 次 + 短退避（500ms / 1s / 2s），失败后立即 fallback 让用户走 TUI 而不是干等。
+const MAX_SERVER_5XX_RETRIES = 3;
+
+function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
 
 function postToViewer() {
   return new Promise((resolve, reject) => {
@@ -95,10 +121,11 @@ function postToViewer() {
       port: Number(port),
       path: '/api/ask-hook',
       method: 'POST',
-      rejectUnauthorized: false, // allow self-signed certs
+      rejectUnauthorized: false,
       headers: {
         'Content-Type': 'application/json',
         'Content-Length': Buffer.byteLength(body),
+        'X-Ask-Poll-Mode': 'short',
       },
     }, (res) => {
       let data = '';
@@ -118,17 +145,111 @@ function postToViewer() {
       });
     });
     req.on('error', reject);
-    req.setTimeout(TIMEOUT_MS, () => {
-      req.destroy();
-      reject(new Error('Timeout'));
-    });
     req.write(body);
     req.end();
   });
 }
 
+function getPollResult(id, waitMs) {
+  return new Promise((resolve, reject) => {
+    const req = httpClient.request({
+      hostname: '127.0.0.1',
+      port: Number(port),
+      path: `/api/ask-hook/${encodeURIComponent(id)}/result?wait=${waitMs}`,
+      method: 'GET',
+      rejectUnauthorized: false,
+    }, (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => {
+        if (res.statusCode === 200) {
+          try { resolve({ status: 200, body: JSON.parse(data) }); }
+          catch { reject(new Error('Invalid GET response JSON')); }
+        } else if (res.statusCode === 204) {
+          resolve({ status: 204, body: null });
+        } else if (res.statusCode === 404) {
+          resolve({ status: 404, body: null });
+        } else {
+          const err = new Error(`HTTP ${res.statusCode}`);
+          err.statusCode = res.statusCode;
+          reject(err);
+        }
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+function fatal(message) {
+  const e = new Error(message);
+  e.fatal = true; // 标记不可恢复，catch 不走任何重试逻辑直接 fallback terminal
+  return e;
+}
+
+async function pollUntilAnswered(askId) {
+  let networkRetries = 0;
+  let server5xxRetries = 0;
+  let postRetried = false;
+  while (true) {
+    try {
+      const { status, body } = await getPollResult(askId, POLL_WAIT_MS);
+      if (status === 200) return body;                  // { answers } 或 { cancelled }
+      if (status === 204) {                              // 无答案，立即重发
+        networkRetries = 0;
+        server5xxRetries = 0;
+        continue;
+      }
+      if (status === 404) {
+        // entry 真消失（server 重启 + disk pruned）→ 重 POST 一次重建
+        if (postRetried) throw fatal('Ask entry gone (404 after retry)');
+        postRetried = true;
+        const originalId = askId;
+        const reInit = await postToViewer();
+        if (reInit?.capability === 'short-poll' && reInit?.id) {
+          // server fallback id（toolUseId 校验失败时自生成）会让浏览器持有的 askId 与 hook 端
+          // 持有的 askId 分裂 —— 浏览器答的 ws ask-hook-answer 找不到对应 entry，UX 上等同失联。
+          // 不一致直接 fallback TUI 比绕一圈安全。fatal flag 跳过外层重试逻辑。
+          if (reInit.id !== originalId) {
+            throw fatal(`Re-init id mismatch (${originalId} → ${reInit.id})`);
+          }
+          askId = reInit.id;
+          networkRetries = 0;
+          server5xxRetries = 0;
+          continue;
+        }
+        if (reInit?.answers || reInit?.cancelled) {
+          // 重 POST 时 server 已经把答案带回来（罕见但合法 long-poll 路径）
+          return reInit;
+        }
+        throw fatal('Re-init returned unexpected payload');
+      }
+      throw new Error(`Unexpected status ${status}`);
+    } catch (err) {
+      // 不可恢复错误（id mismatch / postRetried 后再 404 / 异常 payload）→ 立即放弃。
+      // 否则会被下方网络重试逻辑反复重 GET，每次还是同样错误，60 次后才退出 ~5min。
+      if (err?.fatal) throw err;
+      // 5xx 走独立短重试上限，不与网络抖动共用 60 次配额。
+      const is5xx = typeof err?.statusCode === 'number' && err.statusCode >= 500 && err.statusCode < 600;
+      if (is5xx) {
+        if (++server5xxRetries > MAX_SERVER_5XX_RETRIES) throw err;
+        await sleep(Math.min(2000, 500 * Math.pow(2, server5xxRetries - 1)));
+        continue;
+      }
+      if (++networkRetries > MAX_NETWORK_RETRIES) throw err;
+      // 指数退避：100ms → 200 → 400 → ... 上限 5s
+      await sleep(Math.min(5000, 100 * Math.pow(2, networkRetries - 1)));
+    }
+  }
+}
+
 try {
-  const data = await postToViewer();
+  let data = await postToViewer();
+  // Phase 3: server 看到 X-Ask-Poll-Mode 立即返 ack；旧 server 忽略 header 仍走 long-poll。
+  // capability='short-poll' → 进入 GET 循环；否则按 long-poll 返回值（answers / cancelled）直接处理。
+  if (data?.capability === 'short-poll' && data?.id) {
+    data = await pollUntilAnswered(data.id);
+  }
   // 用户在 cc-viewer web UI 主动取消（点 Cancel 按钮 / 在输入框打字打断 pending ask）。
   // server.js 的 ask-cancel handler 会给 hook res 回 200 + { cancelled: true, reason }。
   // 输出 PreToolUse hook deny 让 Claude Code 走兜底链：toolExecution.ts 把 deny.message 包装

package/lib/ask-constants.js

@@ -0,0 +1,13 @@
+// AskUserQuestion 超时常量的单一来源。
+//
+// server.js 的 hook 路径（ask-bridge → /api/ask-hook）和 sdk-manager.js 的 SDK 路径
+// (canUseTool → _waitForApproval) 都从这里取 ASK_TIMEOUT_MS，保证两条路径行为一致：
+// 用户视角上 "GUI 实质无超时（与 TUI 对齐）"。
+//
+// 前端 AskTimeoutCountdown.NO_TIMEOUT_THRESHOLD_MS（12h）是渲染阈值，本身不需要等于
+// ASK_TIMEOUT_MS —— 只要超过它就 return null 不渲染倒计时。但如果改这里把 ASK_TIMEOUT_MS
+// 降到 12h 以下，必须同步降前端阈值，否则倒计时又会显示出来。
+//
+// 纯常量模块：无任何 node-only 依赖，前端 webpack / 后端 ESM 都能 import。
+
+export const ASK_TIMEOUT_MS = 24 * 60 * 60 * 1000;

package/lib/ask-store.js

@@ -0,0 +1,319 @@
+// AskUserQuestion 持久化存储：让 server 重启后仍能恢复 pending 状态。
+//
+// 设计原则：
+// - 与 workspace-registry 同款 wx-lockfile + tmp-rename 原子写策略；无新依赖。
+// - 单文件 JSON，schema 简单（pending 数极少，几乎不会有性能压力）；
+//   未来需要换 SQLite 时只换实现，API 稳定。
+// - load/save 在 server 持有内存 Map 的"边缘"调用：set/delete 后同步落盘，
+//   保证内存 Map 是权威源、磁盘是镜像。crash 时只丢"未落盘窗口"内的变更。
+// - 启动时 hydrate 出的 entry 的 res 字段为 null（旧连接已死），
+//   等待新的 ask-bridge 重新 POST 同 toolUseId 时复用（已在 server.js:2727 实现）
+//   或浏览器通过 /api/pending-asks 拉取展示。
+import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, openSync, closeSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { renameSyncWithRetry } from './file-api.js';
+import { LOG_DIR } from '../findcc.js';
+
+const SCHEMA_VERSION = 1;
+
+// 进程级一次性 warn 标志：磁盘满 / 权限错误 / SIGPIPE 等持久故障会让每次 ask 都打 warn 刷屏；
+// 限制只 log 第一次，让用户能注意到但不至于淹没日志。reset 不暴露 —— 进程重启自然清零。
+let _loggedPersistError = false;
+
+function getStoreFile() { return join(LOG_DIR, 'ask-store.json'); }
+function getLockFile() { return join(LOG_DIR, 'ask-store.lock'); }
+
+function sleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function withLock(fn) {
+  mkdirSync(LOG_DIR, { recursive: true });
+  const deadline = Date.now() + 2000;
+  const STALE_THRESHOLD = 5000;
+  while (true) {
+    try {
+      const fd = openSync(getLockFile(), 'wx');
+      closeSync(fd);
+      break;
+    } catch (err) {
+      if (err?.code === 'EEXIST') {
+        if (Date.now() < deadline) {
+          try {
+            const stats = statSync(getLockFile());
+            if (Date.now() - stats.mtimeMs > STALE_THRESHOLD) {
+              try { unlinkSync(getLockFile()); } catch {}
+              continue;
+            }
+          } catch {}
+          sleep(25);
+          continue;
+        }
+      }
+      throw err;
+    }
+  }
+  try { return fn(); } finally {
+    try { unlinkSync(getLockFile()); } catch {}
+  }
+}
+
+/**
+ * Load all persisted entries from disk.
+ * 返回 { [id]: { id, questions, createdAt, status, answers, answeredAt, cancelReason } }
+ * status: 'pending' | 'answered' | 'cancelled'
+ * 缺文件 / 解析失败均返空对象（容错）。
+ */
+export function loadAskStore() {
+  try {
+    if (!existsSync(getStoreFile())) return {};
+    const raw = readFileSync(getStoreFile(), 'utf-8');
+    if (!raw.trim()) return {};
+    const data = JSON.parse(raw);
+    if (!data || typeof data !== 'object') return {};
+    if (data.version !== SCHEMA_VERSION) return {};
+    const out = {};
+    for (const [id, entry] of Object.entries(data.entries || {})) {
+      if (!entry || typeof entry !== 'object') continue;
+      if (typeof id !== 'string' || id.length === 0) continue;
+      if (!Array.isArray(entry.questions)) continue;
+      const status = entry.status === 'answered' || entry.status === 'cancelled' ? entry.status : 'pending';
+      out[id] = {
+        id,
+        questions: entry.questions,
+        createdAt: Number(entry.createdAt) || Date.now(),
+        status,
+        answers: (status === 'answered' && entry.answers && typeof entry.answers === 'object') ? entry.answers : null,
+        answeredAt: Number(entry.answeredAt) || null,
+        cancelReason: (status === 'cancelled' && typeof entry.cancelReason === 'string') ? entry.cancelReason : null,
+      };
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Save the full entries map (atomic).
+ * Callers should pass the same shape returned by loadAskStore — extra fields are stripped.
+ */
+export function saveAskStore(entries) {
+  const cleaned = {};
+  for (const [id, entry] of Object.entries(entries || {})) {
+    if (!entry || typeof id !== 'string') continue;
+    if (!Array.isArray(entry.questions)) continue;
+    const status = entry.status === 'answered' || entry.status === 'cancelled' ? entry.status : 'pending';
+    cleaned[id] = {
+      id,
+      questions: entry.questions,
+      createdAt: Number(entry.createdAt) || Date.now(),
+      status,
+      answers: status === 'answered' ? (entry.answers || null) : null,
+      answeredAt: status === 'answered' ? (Number(entry.answeredAt) || Date.now()) : null,
+      cancelReason: status === 'cancelled' ? (entry.cancelReason || '') : null,
+    };
+  }
+  const tmpFile = `${getStoreFile()}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  try {
+    mkdirSync(LOG_DIR, { recursive: true });
+    const body = JSON.stringify({ version: SCHEMA_VERSION, entries: cleaned });
+    writeFileSync(tmpFile, body);
+    renameSyncWithRetry(tmpFile, getStoreFile());
+  } catch (err) {
+    try { unlinkSync(tmpFile); } catch {}
+    // 持久化失败 ≠ 业务失败：server 主流程不能因此卡住。
+    // 调用方（server.js setEntry/deleteEntry）会吞这个错（落盘是 best-effort）。
+    // 但用户视角 server 重启后 /api/pending-asks 永远空 → 找不到原因。
+    // 进程级首次失败 console.warn 一次方便排查（磁盘满 / 权限 / SIGPIPE）。
+    if (!_loggedPersistError) {
+      _loggedPersistError = true;
+      try {
+        console.warn(`[cc-viewer] ask-store persistence failed (will retry silently): ${err?.message || err}`);
+      } catch {}
+    }
+    throw err;
+  }
+}
+
+/**
+ * Mark an entry as answered. If the entry doesn't exist on disk yet, create it with
+ * minimal shape (questions=[]) so ask-bridge short-poll can still pick it up after
+ * a server restart that lost the in-memory placeholder.
+ *
+ * First-write-wins: 若 disk 已 answered/cancelled，本调用 noop —— 防止两浏览器同答时
+ * last-write-wins 覆盖错乱（A 选 X 落盘 → B 选 Y 又落 → ask-bridge 最终拿 Y 而 A UI 显 X）。
+ * Returns true if this call wrote, false if noop'd by existing terminal state.
+ */
+export function markAnswered(id, answers) {
+  if (!id || typeof id !== 'string') return false;
+  if (!answers || typeof answers !== 'object') return false;
+  try {
+    return withLock(() => {
+      const all = loadAskStore();
+      const existing = all[id];
+      if (existing && (existing.status === 'answered' || existing.status === 'cancelled')) {
+        return false;
+      }
+      const base = existing || { id, questions: [], createdAt: Date.now() };
+      all[id] = {
+        ...base,
+        status: 'answered',
+        answers,
+        answeredAt: Date.now(),
+        cancelReason: null,
+      };
+      saveAskStore(all);
+      return true;
+    });
+  } catch { return false; }
+}
+
+export function markCancelled(id, reason) {
+  if (!id || typeof id !== 'string') return false;
+  try {
+    return withLock(() => {
+      const all = loadAskStore();
+      const existing = all[id];
+      if (existing && (existing.status === 'answered' || existing.status === 'cancelled')) {
+        return false;
+      }
+      const base = existing || { id, questions: [], createdAt: Date.now() };
+      all[id] = {
+        ...base,
+        status: 'cancelled',
+        answers: null,
+        answeredAt: null,
+        cancelReason: typeof reason === 'string' ? reason : '',
+      };
+      saveAskStore(all);
+      return true;
+    });
+  } catch { return false; }
+}
+
+/**
+ * Atomic conditional consume: read entry; if status === 'answered' or 'cancelled',
+ * delete and return it (one-shot consumption); otherwise return the entry without
+ * deleting (caller can decide to wait/retry).
+ *
+ * 替代旧的 "无条件 consume + setEntry 写回" 双 withLock 模式 —— 那种模式的两次锁
+ * 中间窗口会被 markAnswered 命中 → setEntry 把答案覆盖回 pending。
+ */
+export function consumeIfFinal(id) {
+  if (!id || typeof id !== 'string') return null;
+  try {
+    return withLock(() => {
+      const all = loadAskStore();
+      const entry = all[id];
+      if (!entry) return null;
+      if (entry.status === 'answered' || entry.status === 'cancelled') {
+        delete all[id];
+        saveAskStore(all);
+      }
+      return entry;
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Legacy unconditional consume (kept for backward compat with callers that
+ * truly want "read + delete regardless of status"). New short-poll GET handler
+ * uses consumeIfFinal instead — see server.js GET /api/ask-hook/:id/result.
+ */
+export function consume(id) {
+  if (!id || typeof id !== 'string') return null;
+  try {
+    return withLock(() => {
+      const all = loadAskStore();
+      const entry = all[id];
+      if (!entry) return null;
+      delete all[id];
+      saveAskStore(all);
+      return entry;
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Atomic upsert: load → mutate → save under file lock.
+ * fields 必须含 questions: []；其余字段（status、createdAt）由本函数兜底。
+ *
+ * Status guard: 若 disk 已 answered/cancelled（markAnswered/markCancelled 落过），
+ * setEntry 不能把 status 倒回 pending —— 否则 setImmediate 排队的延迟 _persistAskEntry
+ * 或重 POST 的 placeholder 会覆盖真实终态，导致 ask-bridge 短轮询永远拿不到答案。
+ */
+export function setEntry(id, fields) {
+  if (!id || typeof id !== 'string') return;
+  if (!fields || !Array.isArray(fields.questions)) return;
+  try {
+    withLock(() => {
+      const all = loadAskStore();
+      const existing = all[id];
+      if (existing && (existing.status === 'answered' || existing.status === 'cancelled')) {
+        return; // 已是终态，setEntry 视作 noop（幂等）
+      }
+      all[id] = {
+        id,
+        questions: fields.questions,
+        createdAt: Number(fields.createdAt) || Date.now(),
+        status: 'pending',
+      };
+      saveAskStore(all);
+    });
+  } catch {
+    // best-effort：磁盘失败不影响内存 Map 主流程
+  }
+}
+
+export function deleteEntry(id) {
+  if (!id || typeof id !== 'string') return;
+  try {
+    withLock(() => {
+      const all = loadAskStore();
+      if (!(id in all)) return;
+      delete all[id];
+      saveAskStore(all);
+    });
+  } catch {}
+}
+
+/**
+ * Replace the entire store atomically. Used on server startup to drop entries
+ * older than maxAgeMs (24h-class staleness sweep) without N round-trips.
+ */
+export function replaceAll(entries) {
+  try {
+    withLock(() => saveAskStore(entries));
+  } catch {}
+}
+
+/**
+ * Clean up entries older than maxAgeMs. Returns the surviving entries.
+ * Called at server startup to drop truly stale entries (>24h, equivalent to old HOOK_TIMEOUT).
+ *
+ * Stale 判定用 max(createdAt, answeredAt)：刚 answered 的老 entry（createdAt 旧但
+ * answeredAt 新）必须保留，否则 ask-bridge 短轮询拿不到答案。
+ */
+export function pruneStale(maxAgeMs = 24 * 60 * 60 * 1000) {
+  try {
+    return withLock(() => {
+      const all = loadAskStore();
+      const cutoff = Date.now() - maxAgeMs;
+      const survivors = {};
+      for (const [id, entry] of Object.entries(all)) {
+        const lastTouched = Math.max(Number(entry.createdAt) || 0, Number(entry.answeredAt) || 0);
+        if (lastTouched >= cutoff) survivors[id] = entry;
+      }
+      saveAskStore(survivors);
+      return survivors;
+    });
+  } catch {
+    return {};
+  }
+}

package/lib/ensure-hooks.js

@@ -18,6 +18,46 @@ const rootDir = resolve(__dirname, '..');
 // "npm uninstall leaves zombie paths" footgun — README documents the cleanup recipe.
 const CCV_HOOK_MARKER = '# cc-viewer-managed';
 
+// Claude Code 默认 PreToolUse hook 10min (TOOL_HOOK_EXECUTION_TIMEOUT_MS = 600_000)
+// 强制 abort → ask-bridge 被 SIGTERM → 主进程走 canUseTool → TUI 接管 AskUserQuestion
+// → GUI 端答案失效。Claude Code 单 hook 的 timeout (秒) 优先级最高，本地写 24h 等同无超时。
+// 紧急回退：CCV_HOOK_TIMEOUT_S=0 不写 timeout 字段，恢复 10min 默认行为。
+const HOOK_TIMEOUT_DEFAULT_S = 86400;
+// 7 天硬上限：大值经过 hook.timeout * 1000 后超 Node setTimeout 2^31ms 会立即触发
+// → 反而失效。整数 guard 防 0.5 → 500ms 这种半秒超时的反直觉失败。
+const HOOK_TIMEOUT_MAX_S = 7 * 86400;
+export const HOOK_TIMEOUT_S = (() => {
+  const raw = process.env.CCV_HOOK_TIMEOUT_S;
+  if (raw === undefined || raw === '') return HOOK_TIMEOUT_DEFAULT_S;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) return HOOK_TIMEOUT_DEFAULT_S;
+  return Math.min(n, HOOK_TIMEOUT_MAX_S);
+})();
+const HOOK_TIMEOUT_FIELD = HOOK_TIMEOUT_S > 0 ? { timeout: HOOK_TIMEOUT_S } : {};
+
+// 构造与对比两件事必须同源，否则升级路径会漏字段。
+// merge 而非 replace：用户/第三方给同一 hook 追加 if/shell/once/async/asyncRewake 等
+// schema 合法字段时，rewrite 不能整对象覆盖把它们吞掉。
+export function _buildHookObj(command) {
+  return { type: 'command', command, ...HOOK_TIMEOUT_FIELD };
+}
+export function _hookObjEqual(existing, desired) {
+  if (!existing) return false;
+  if (existing.type !== desired.type) return false;
+  if (existing.command !== desired.command) return false;
+  // timeout 字段：未声明 = 视为 0；HOOK_TIMEOUT_S=0 时 desired 也无字段 → 都视为 0
+  const a = Number(existing.timeout) || 0;
+  const b = Number(desired.timeout) || 0;
+  return a === b;
+}
+function _mergeHookObj(existing, desired) {
+  // 保留 existing 中的非冲突字段（if/shell/once/...），desired 字段优先；
+  // desired 不含 timeout 时（CCV_HOOK_TIMEOUT_S=0）必须显式 delete existing.timeout 让它消失。
+  const merged = { ...(existing || {}), ...desired };
+  if (!('timeout' in desired)) delete merged.timeout;
+  return merged;
+}
+
 export function ensureHooks() {
   try {
     const claudeDir = getClaudeConfigDir();
@@ -38,16 +78,17 @@ export function ensureHooks() {
     // Guard: only execute when CCVIEWER_PORT is set (i.e. launched by cc-viewer)
     const askBridgePath = resolve(rootDir, 'lib', 'ask-bridge.js');
     const askCmd = `[ -n "$CCVIEWER_PORT" ] && node "${askBridgePath}" || true ${CCV_HOOK_MARKER}`;
+    const askDesired = _buildHookObj(askCmd);
     const askExisting = settings.hooks.PreToolUse.find(h => h.matcher === 'AskUserQuestion');
     if (askExisting) {
-      if ((askExisting.hooks?.[0]?.command || '') !== askCmd) {
-        askExisting.hooks = [{ type: 'command', command: askCmd }];
+      if (!_hookObjEqual(askExisting.hooks?.[0], askDesired)) {
+        askExisting.hooks = [_mergeHookObj(askExisting.hooks?.[0], askDesired)];
         changed = true;
       }
     } else {
       settings.hooks.PreToolUse.push({
         matcher: 'AskUserQuestion',
-        hooks: [{ type: 'command', command: askCmd }]
+        hooks: [askDesired]
       });
       changed = true;
     }
@@ -72,16 +113,17 @@ export function ensureHooks() {
         changed = true;
       }
     }
+    const permDesired = _buildHookObj(permCmd);
     const permExisting = settings.hooks.PreToolUse.find(h => h.matcher === permMatcher);
     if (permExisting) {
-      if ((permExisting.hooks?.[0]?.command || '') !== permCmd) {
-        permExisting.hooks = [{ type: 'command', command: permCmd }];
+      if (!_hookObjEqual(permExisting.hooks?.[0], permDesired)) {
+        permExisting.hooks = [_mergeHookObj(permExisting.hooks?.[0], permDesired)];
         changed = true;
       }
     } else {
       settings.hooks.PreToolUse.push({
         matcher: permMatcher,
-        hooks: [{ type: 'command', command: permCmd }]
+        hooks: [permDesired]
       });
       changed = true;
     }
@@ -94,18 +136,19 @@ export function ensureHooks() {
     const turnEndCmd = `[ -n "$CCVIEWER_PORT" ] && node "${turnEndBridgePath}" || true ${CCV_HOOK_MARKER}`;
     // Stop hooks use matcher: '' (or unset) since there's no tool name to scope by.
     // Find any existing entry that already points at our bridge to update-in-place.
+    const turnEndDesired = _buildHookObj(turnEndCmd);
     const turnEndExisting = settings.hooks.Stop.find(h => {
       const cmd = h.hooks?.[0]?.command || '';
       return cmd.includes('turn-end-bridge.js');
     });
     if (turnEndExisting) {
-      if ((turnEndExisting.hooks?.[0]?.command || '') !== turnEndCmd) {
-        turnEndExisting.hooks = [{ type: 'command', command: turnEndCmd }];
+      if (!_hookObjEqual(turnEndExisting.hooks?.[0], turnEndDesired)) {
+        turnEndExisting.hooks = [_mergeHookObj(turnEndExisting.hooks?.[0], turnEndDesired)];
         changed = true;
       }
     } else {
       settings.hooks.Stop.push({
-        hooks: [{ type: 'command', command: turnEndCmd }],
+        hooks: [turnEndDesired],
       });
       changed = true;
     }
@@ -121,6 +164,8 @@ export function ensureHooks() {
       try {
         writeFileSync(tmpPath, JSON.stringify(settings, null, 2));
         renameSync(tmpPath, settingsPath);
+        // 透明声明：修改用户全局 settings.json 是高风险操作，启动日志可见让用户能审计
+        console.log(`[cc-viewer] updated ${settingsPath} (hook timeout=${HOOK_TIMEOUT_S}s)`);
       } catch (err) {
         try { if (existsSync(tmpPath)) unlinkSync(tmpPath); } catch { /* ignore */ }
         throw err;

package/lib/sdk-manager.js

@@ -9,6 +9,7 @@
  */
 
 import { sdkToJSONLEntry, buildStreamingStatus } from './sdk-adapter.js';
+import { ASK_TIMEOUT_MS } from './ask-constants.js';
 
 let _query;
 try {
@@ -395,7 +396,9 @@ async function _handleCanUseTool(toolName, input, options) {
         }
       } catch {}
     }
-    const askTimeoutMs = 60 * 60 * 1000; // 60min — 等价 terminal "无超时"，与 server.js HOOK_TIMEOUT 同源
+    // 24h — 与 hook 路径（server.js ASK_HOOK_TIMEOUT_MS）同源，履行"GUI 实质无超时"承诺。
+    // 实际常量定义在 lib/ask-constants.js。
+    const askTimeoutMs = ASK_TIMEOUT_MS;
     const askStartedAt = Date.now();
     if (_broadcastWs) {
       _broadcastWs({ type: 'sdk-ask-pending', id, questions: input.questions, startedAt: askStartedAt, timeoutMs: askTimeoutMs });