cc-viewer 1.6.271 → 1.6.273

package/{lib → server/lib}/approval-modal-prefs.js

@@ -1,10 +1,11 @@
+// CLIENT-SAFE: no node deps. Imported by src/ — do not add fs/process/node: imports.
 // Approval-modal preferences merge logic.
 //
 // Lives here (not in voice-pack-manager) because it merges *generic* approvalModal
 // fields (modalEnabled, soundEnabled, notifyOnlyWhenHidden) plus the voicePack subtree.
 // voice-pack-manager.js stays focused on the file/audio backing store.
 //
-// Both server.js (handles POST /api/preferences) and src/AppBase.jsx (hydrate +
+// Both server/server.js (handles POST /api/preferences) and src/AppBase.jsx (hydrate +
 // handleVoicePackChange) use this so the merge contract is single-sourced.
 
 import { EVENT_KEYS } from './voice-pack-events.js';

package/{lib → server/lib}/ask-store.js

@@ -9,11 +9,11 @@
 // - 启动时 hydrate 出的 entry 的 res 字段为 null（旧连接已死），
 //   等待新的 ask-bridge 重新 POST 同 toolUseId 时复用（已在 server.js:2727 实现）
 //   或浏览器通过 /api/pending-asks 拉取展示。
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, openSync, closeSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, writeSync, existsSync, mkdirSync, statSync, openSync, closeSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { renameSyncWithRetry } from './file-api.js';
-import { LOG_DIR } from '../findcc.js';
+import { LOG_DIR } from '../../findcc.js';
 
 const SCHEMA_VERSION = 1;
 
@@ -28,6 +28,46 @@ function sleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 
+// Lock body 含 owner pid，让其它进程精确判断 owner 是否仍活着 —— 避免 mtime-only stale
+// 判定在 Electron 多 Tab + 慢盘场景下误删活跃锁（持锁方 fn 跑 >5s 时旧实现会被偷锁）。
+// Body 不可读（老格式 / openSync 与 writeSync 之间的瞬间 race）时退回 mtime 阈值兜底。
+function readLockOwnerPid(path) {
+  try {
+    const raw = readFileSync(path, 'utf-8');
+    if (!raw) return null;
+    const obj = JSON.parse(raw);
+    if (obj && Number.isInteger(obj.pid)) return obj.pid;
+  } catch {}
+  return null;
+}
+
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // ESRCH = 进程不存在；EPERM = 存在但不同 user（仍算活）
+    return err && err.code === 'EPERM';
+  }
+}
+
+function isLockStale(path, mtimeFallbackMs) {
+  const pid = readLockOwnerPid(path);
+  if (pid !== null) {
+    // 自己 pid 见到 = 必然 stale（理论不可能：try/finally 保证 unlink；
+    // 若发生 → 视作可回收，避免 2 秒死锁）
+    if (pid === process.pid) return true;
+    return !isPidAlive(pid);
+  }
+  try {
+    const stats = statSync(path);
+    return Date.now() - stats.mtimeMs > mtimeFallbackMs;
+  } catch {
+    return false;
+  }
+}
+
 function withLock(fn) {
   mkdirSync(LOG_DIR, { recursive: true });
   const deadline = Date.now() + 2000;
@@ -35,18 +75,19 @@ function withLock(fn) {
   while (true) {
     try {
       const fd = openSync(getLockFile(), 'wx');
-      closeSync(fd);
+      try {
+        writeSync(fd, JSON.stringify({ pid: process.pid, ts: Date.now() }));
+      } finally {
+        closeSync(fd);
+      }
       break;
     } catch (err) {
       if (err?.code === 'EEXIST') {
         if (Date.now() < deadline) {
-          try {
-            const stats = statSync(getLockFile());
-            if (Date.now() - stats.mtimeMs > STALE_THRESHOLD) {
-              try { unlinkSync(getLockFile()); } catch {}
-              continue;
-            }
-          } catch {}
+          if (isLockStale(getLockFile(), STALE_THRESHOLD)) {
+            try { unlinkSync(getLockFile()); } catch {}
+            continue;
+          }
           sleep(25);
           continue;
         }

package/server/lib/cli-inject.js

@@ -0,0 +1,81 @@
+// claude-code cli.js 注入/卸载逻辑 — 抽自 cc-viewer 根 cli.js 以便单元测试。
+//
+// 注入语义：在 @anthropic-ai/claude-code/cli.js 顶部插一段
+//   // >>> Start CC Viewer Web Service >>>
+//   <INJECT_IMPORT>
+//   // <<< Start CC Viewer Web Service <<<
+// 让 claude 启动时先 evaluate cc-viewer 的 interceptor。
+//
+// 升级路径：INJECT_IMPORT 形态本身允许演进（如 relative path → bare specifier）。
+// `LEGACY_INJECT_IMPORTS` 记录历史值；任何旧 marker block 在下次 `ccv -logger`
+// 时会被重写为当前 INJECT_BLOCK。
+//
+// EOL 策略（务必保持，否则 Windows cli.js 注入后 git/编辑器抱怨混合行尾）：
+// - 注入：检测**原文件主导 EOL**（CRLF/LF），用同种 EOL `join` lines 写回。
+// - INJECT_BLOCK **内部** 行分隔硬编码 `\n` —— 不参数化也不跟随原文件 EOL：
+//   * buildInjectBlockRegex 用 `\r?\n` 匹配，可同时识别两种形式的历史 marker；
+//   * 改成参数化 EOL 会破坏 LEGACY 形式的回归匹配（老 marker 是 `\n` 写入的）。
+// - 因此注入后 CRLF 文件**会含混合 EOL**（块内 LF + 块外 CRLF），这是已知的、
+//   被 test/cli-inject.test.js 'CRLF 文件注入后原 CRLF 部分被保留' 用例固化的行为。
+
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+
+export const INJECT_START = '// >>> Start CC Viewer Web Service >>>';
+export const INJECT_END = '// <<< Start CC Viewer Web Service <<<';
+
+export function buildInjectBlock(injectImport) {
+  return `${INJECT_START}\n${injectImport}\n${INJECT_END}`;
+}
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// 匹配 inject block（任意 INJECT_IMPORT 形式 —— 当前的 + 历史的）。
+export function buildInjectBlockRegex(injectImport, legacyInjectImports) {
+  const allImports = [injectImport, ...legacyInjectImports];
+  const alt = allImports.map(escapeRegex).join('|');
+  return new RegExp(`${escapeRegex(INJECT_START)}\\r?\\n(?:${alt})\\r?\\n${escapeRegex(INJECT_END)}\\r?\\n?`, 'g');
+}
+
+// 注入 / 升级 cli.js。
+// 返回值:
+//   - 'injected'   首次注入
+//   - 'exists'     已注入且与当前 INJECT_BLOCK 完全一致（幂等）
+//   - 'updated'    含 INJECT_START 但 marker 不一致 → 重写为新 INJECT_BLOCK（升级路径）
+export function injectCliJsAt(cliPath, injectImport, legacyInjectImports) {
+  const injectBlock = buildInjectBlock(injectImport);
+  const content = readFileSync(cliPath, 'utf-8');
+  if (content.includes(INJECT_START)) {
+    if (content.includes(injectBlock)) return 'exists';
+    const regex = buildInjectBlockRegex(injectImport, legacyInjectImports);
+    const eol = content.includes('\r\n') ? '\r\n' : '\n';
+    const updated = content.replace(regex, injectBlock + eol);
+    if (updated !== content) {
+      writeFileSync(cliPath, updated);
+      return 'updated';
+    }
+    return 'exists';
+  }
+  // 保留主导 EOL：若原文件 CRLF，注入完仍 CRLF（否则 split('\n')+join('\n') 会把 Win 文件
+  // 一次性转 LF，git/编辑器抱怨混合行尾且对哈希签名敏感的脚本可能失效）。
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const lines = content.split(/\r?\n/);
+  lines.splice(2, 0, injectBlock);
+  writeFileSync(cliPath, lines.join(eol));
+  return 'injected';
+}
+
+// 卸载 cli.js 注入。返回 'removed' | 'clean' | 'not_found' | 'error'.
+export function removeCliJsInjectionAt(cliPath, injectImport, legacyInjectImports) {
+  try {
+    if (!existsSync(cliPath)) return 'not_found';
+    const content = readFileSync(cliPath, 'utf-8');
+    if (!content.includes(INJECT_START)) return 'clean';
+    const regex = buildInjectBlockRegex(injectImport, legacyInjectImports);
+    writeFileSync(cliPath, content.replace(regex, ''));
+    return 'removed';
+  } catch {
+    return 'error';
+  }
+}

package/{lib → server/lib}/context-watcher.js

@@ -1,9 +1,13 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { getClaudeConfigDir } from '../findcc.js';
+import { homedir } from 'node:os';
+import { getClaudeConfigDir } from '../../findcc.js';
 
 export const CONTEXT_WINDOW_FILE = join(getClaudeConfigDir(), 'context-window.json');
 export const CLAUDE_SETTINGS_FILE = join(getClaudeConfigDir(), 'settings.json');
+// ~/.claude.json 是 claude code 的主配置（非 settings.json），存 projects[cwd].lastModelUsage
+// 等。两者命名相似但层级和内容完全不同，不要混用。
+export const CLAUDE_USER_CONFIG_FILE = join(homedir(), '.claude.json');
 
 // Startup cache: read once, never re-read unless model changes
 let _startupModelBase = null;   // e.g. 'opus-4-6'
@@ -62,6 +66,42 @@ export function getContextSizeForModel(apiModelName) {
   return 200000;
 }
 
+/**
+ * 读 ~/.claude.json 里 projects[cwd].lastModelUsage，挑出 cwd 下"用得最多/最显式"的模型。
+ * 给 cc-viewer UI 血条 calibration 在启动期(lastMainAgent 仅有 haiku init ping 时)
+ * 提供一个比"auto → 200K"更贴合 claude 自己默认行为的兜底。
+ *
+ * lastModelUsage 结构：{ [modelId]: { costUSD, inputTokens, outputTokens, ... } }
+ * 没有 timestamp 字段（claude code 只累加 usage 不打时间戳），所以"最近"用以下代理：
+ *   1) 去掉 haiku-*（辅助模型，从来不是主 model）
+ *   2) 任一带 [1m] 后缀 → 直接返回（用户显式 opt-in 1M context 的强信号）
+ *   3) 否则按 costUSD 倒序，取第一（用得最多 ≈ 当前主用）
+ *
+ * 任何 IO / 解析异常返回 null；调用方应当作"没找到偏好"处理（auto 走冷启动 1M）。
+ *
+ * @param {string} cwd - 绝对路径，必须与 claude 写入 ~/.claude.json projects key 完全一致
+ * @param {string} [filePath] - 可选注入文件路径，默认 CLAUDE_USER_CONFIG_FILE；单测用
+ * @returns {string|null} model id（含 [1m] 后缀，例 "claude-opus-4-7[1m]"）或 null
+ */
+export function readClaudeProjectModel(cwd, filePath = CLAUDE_USER_CONFIG_FILE) {
+  try {
+    if (!cwd || typeof cwd !== 'string') return null;
+    if (!existsSync(filePath)) return null;
+    const raw = readFileSync(filePath, 'utf-8');
+    const data = JSON.parse(raw);
+    const lmu = data?.projects?.[cwd]?.lastModelUsage;
+    if (!lmu || typeof lmu !== 'object') return null;
+    const entries = Object.entries(lmu).filter(([k]) => typeof k === 'string' && !/haiku/i.test(k));
+    if (!entries.length) return null;
+    const withOneM = entries.find(([k]) => /\[1m\]/i.test(k));
+    if (withOneM) return withOneM[0];
+    entries.sort((a, b) => (b[1]?.costUSD || 0) - (a[1]?.costUSD || 0));
+    return entries[0][0];
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Build a context_window SSE event payload from API usage data.
  * @param {object} usage - API response usage object

package/{lib → server/lib}/delta-reconstructor.js

@@ -1,3 +1,4 @@
+// CLIENT-SAFE: no node deps. Imported by src/ — do not add fs/process/node: imports.
 /**
  * Delta Reconstructor — 增量日志重建模块
  *

package/{lib → server/lib}/enrich-plan-input.js

@@ -47,7 +47,7 @@ function findEmptyExitPlanModeBlocks(content, out) {
  * - Header 名规范：interceptor 走 fetch Headers.entries() 全小写（WHATWG 规范），
  *   只查小写键即可。
  * - In-place mutation by design：用 Object.assign(blk.input, patch) 而非
- *   `blk.input = {...}`。增量重建器 (lib/delta-reconstructor.js) 会让同一 tool_use
+ *   `blk.input = {...}`。增量重建器 (server/lib/delta-reconstructor.js) 会让同一 tool_use
  *   block 在多个 entry 间共享对象引用；in-place mutate 让后续 entry 的「Object.keys
  *   (inp).length === 0」预检自动跳过——正是我们想要的 (相同 plan，不重新查盘)。
  *   注意：此优化仅在 SSE / live 路径（共享对象）生效；REST 路径 raw → JSON.parse
@@ -93,7 +93,7 @@ export function enrichEntry(entry) {
 /**
  * 服务端三处接入点共用：raw 字符串预过滤 → 命中才 parse + enrich + stringify。
  *
- * 设计原则：保持 lib/log-stream.js 的「原始字符串透传」哲学，只对真正需要补全的
+ * 设计原则：保持 server/lib/log-stream.js 的「原始字符串透传」哲学，只对真正需要补全的
  * 条目做 parse / stringify，其它一律按 raw 透传。
  *
  * @param {string} raw - 一条日志条目的原始 JSON 字符串

package/{lib → server/lib}/ensure-hooks.js

@@ -2,15 +2,12 @@
  * Register AskUserQuestion and permission approval hooks into ~/.claude/settings.json.
  * Shared between cli.js and electron/tab-worker.js.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, unlinkSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { getClaudeConfigDir } from '../findcc.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const rootDir = resolve(__dirname, '..');
+import { getClaudeConfigDir } from '../../findcc.js';
+import { SERVER_LIB } from '../_paths.js';
+import { renameSyncWithRetry } from './file-api.js';
 
 // Marker stamped on hook command strings so a future `cc-viewer cleanup-hooks`
 // CLI (or the user manually) can identify entries owned by cc-viewer and remove
@@ -58,6 +55,67 @@ function _mergeHookObj(existing, desired) {
   return merged;
 }
 
+// 从 cc-viewer-managed command 字符串里抽出 `node "<path>"` 的目标 path。
+// 用于 stale 检测 + uninstall 清理。返回 null 表示格式不匹配（保守不动）。
+function _extractNodeTargetPath(cmd) {
+  if (typeof cmd !== 'string') return null;
+  const m = cmd.match(/node\s+"([^"]+)"/);
+  return m ? m[1] : null;
+}
+
+// 识别那些含 cc-viewer-managed marker 但 command 路径已经 stale 的 entry —
+// 用于升级路径（lib/ → server/lib/ 等）一次性主动清除老条目，避免 _hookObjEqual
+// 字段级 merge 留下「半新半旧」状态。同 marker 的新 desired 会在主流程里重新插入。
+//
+// 策略：通用 existsSync(parsed path)。比硬编码 regex 鲁棒 —— 未来 server-side 再
+// 怎么重组目录，只要老条目里的 path 不在了，就识别为 stale。无法解析 path 时保守跳过。
+function _looksStaleManagedCommand(cmd) {
+  if (typeof cmd !== 'string' || !cmd.includes(CCV_HOOK_MARKER)) return false;
+  const target = _extractNodeTargetPath(cmd);
+  if (!target) return false;
+  return !existsSync(target);
+}
+
+function _purgeStaleManagedHooks(settings) {
+  let removed = 0;
+  for (const sectionKey of ['PreToolUse', 'Stop']) {
+    const arr = settings.hooks?.[sectionKey];
+    if (!Array.isArray(arr)) continue;
+    for (let i = arr.length - 1; i >= 0; i--) {
+      const entry = arr[i];
+      const hooks = entry?.hooks;
+      if (!Array.isArray(hooks)) continue;
+      const stale = hooks.some(h => _looksStaleManagedCommand(h?.command));
+      if (stale) {
+        arr.splice(i, 1);
+        removed += 1;
+      }
+    }
+  }
+  return removed;
+}
+
+// uninstall 专用：清除所有 cc-viewer-managed entry，不论 path 是否还存在。
+// 调用方负责 atomic write-back。返回 removed 数量。
+export function removeAllManagedHooks(settings) {
+  let removed = 0;
+  for (const sectionKey of ['PreToolUse', 'Stop']) {
+    const arr = settings.hooks?.[sectionKey];
+    if (!Array.isArray(arr)) continue;
+    for (let i = arr.length - 1; i >= 0; i--) {
+      const entry = arr[i];
+      const hooks = entry?.hooks;
+      if (!Array.isArray(hooks)) continue;
+      const managed = hooks.some(h => typeof h?.command === 'string' && h.command.includes(CCV_HOOK_MARKER));
+      if (managed) {
+        arr.splice(i, 1);
+        removed += 1;
+      }
+    }
+  }
+  return removed;
+}
+
 export function ensureHooks() {
   try {
     const claudeDir = getClaudeConfigDir();
@@ -73,10 +131,13 @@ export function ensureHooks() {
     if (!Array.isArray(settings.hooks.Stop)) settings.hooks.Stop = [];
 
     let changed = false;
+    // 先一次性清掉「path 已 stale 但还带 cc-viewer-managed marker」的老条目，
+    // 让下面的 push 流程直接插新条目，而不是走 _mergeHookObj 半新半旧的合并。
+    if (_purgeStaleManagedHooks(settings) > 0) changed = true;
 
     // AskUserQuestion hook → ask-bridge.js
     // Guard: only execute when CCVIEWER_PORT is set (i.e. launched by cc-viewer)
-    const askBridgePath = resolve(rootDir, 'lib', 'ask-bridge.js');
+    const askBridgePath = resolve(SERVER_LIB, 'ask-bridge.js');
     const askCmd = `[ -n "$CCVIEWER_PORT" ] && node "${askBridgePath}" || true ${CCV_HOOK_MARKER}`;
     const askDesired = _buildHookObj(askCmd);
     const askExisting = settings.hooks.PreToolUse.find(h => h.matcher === 'AskUserQuestion');
@@ -95,7 +156,7 @@ export function ensureHooks() {
 
     // Permission approval hook → perm-bridge.js (matcher: "" = match all tools)
     // Guard: only execute when CCVIEWER_PORT is set (i.e. launched by cc-viewer)
-    const permBridgePath = resolve(rootDir, 'lib', 'perm-bridge.js');
+    const permBridgePath = resolve(SERVER_LIB, 'perm-bridge.js');
     const permCmd = `[ -n "$CCVIEWER_PORT" ] && node "${permBridgePath}" || true ${CCV_HOOK_MARKER}`;
     const permMatcher = '';
     // Clean up legacy entries
@@ -132,7 +193,7 @@ export function ensureHooks() {
     // end of a user-prompt turn), so the voice-pack `turnEnd` event can play at the
     // right moment — not after every individual API call like the SSE streaming
     // signal would. Same `CCVIEWER_PORT` guard pattern as the other bridges.
-    const turnEndBridgePath = resolve(rootDir, 'lib', 'turn-end-bridge.js');
+    const turnEndBridgePath = resolve(SERVER_LIB, 'turn-end-bridge.js');
     const turnEndCmd = `[ -n "$CCVIEWER_PORT" ] && node "${turnEndBridgePath}" || true ${CCV_HOOK_MARKER}`;
     // Stop hooks use matcher: '' (or unset) since there's no tool name to scope by.
     // Find any existing entry that already points at our bridge to update-in-place.
@@ -163,7 +224,10 @@ export function ensureHooks() {
       const tmpPath = `${settingsPath}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
       try {
         writeFileSync(tmpPath, JSON.stringify(settings, null, 2));
-        renameSync(tmpPath, settingsPath);
+        // renameSyncWithRetry 而非裸 renameSync：Windows 上 claude.exe / 编辑器
+        // 持 settings.json reader handle 时 rename 会抛 EBUSY 被 outer catch 吞掉
+        // 静默丢失更新；retry 后再失败再 throw。
+        renameSyncWithRetry(tmpPath, settingsPath);
         // 透明声明：修改用户全局 settings.json 是高风险操作，启动日志可见让用户能审计
         console.log(`[cc-viewer] updated ${settingsPath} (hook timeout=${HOOK_TIMEOUT_S}s)`);
       } catch (err) {

package/{lib → server/lib}/extract-plugin-name.mjs

@@ -1,6 +1,6 @@
 /**
  * 在隔离子进程中提取插件 name，避免不安全的插件代码影响主进程。
- * 用法: node lib/extract-plugin-name.mjs <file-path>
+ * 用法: node server/lib/extract-plugin-name.mjs <file-path>
  * 输出: JSON { name: string } 到 stdout
  */
 import { pathToFileURL } from 'node:url';

package/{lib → server/lib}/file-access-policy.js

@@ -8,12 +8,12 @@
  *
  * 关键合同:返回 `real`(realpath 解析后),调用方 MUST 用 real 读文件,杜绝 TOCTOU。
  *
- * 不替代写路径的业务校验(见 lib/file-api.js writeFileContent),但同样会被 endpoint 用作首道关卡。
+ * 不替代写路径的业务校验(见 server/lib/file-api.js writeFileContent),但同样会被 endpoint 用作首道关卡。
  */
 import { realpathSync } from 'node:fs';
 import { resolve, basename, sep, join } from 'node:path';
 import { homedir, platform, tmpdir } from 'node:os';
-import { getClaudeConfigDir } from '../findcc.js';
+import { getClaudeConfigDir } from '../../findcc.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 
 const osPlatform = platform();

package/{lib → server/lib}/jsonl-archive.js

@@ -15,7 +15,7 @@ const CACHE_ROOT_NAME = 'ccv-extract';
 const RENAME_RETRY = 3;
 const RENAME_DELAY_MS = 50;
 const CACHE_TTL_MS = 7 * 24 * 3600 * 1000;
-// 与 lib/log-management.js 的 MAX_MERGE_SIZE 对齐：merge 上限 400MB，归档 / 读回 zip
+// 与 server/lib/log-management.js 的 MAX_MERGE_SIZE 对齐：merge 上限 400MB，归档 / 读回 zip
 // 必须容纳这一规模，否则自家产物会被 zip-safety 默认 50MB 阈值拦住造成永久不可读。
 const ARCHIVE_MAX_BYTES = 400 * 1024 * 1024;
 

package/{lib → server/lib}/plugin-loader.js

@@ -1,7 +1,8 @@
 import { readdirSync, existsSync, readFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { LOG_DIR } from '../findcc.js';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { LOG_DIR } from '../../findcc.js';
+import { PLUGINS_DIR } from '../_paths.js';
 
 // 动态获取（LOG_DIR 可能在运行时被 setLogDir 修改）
 export function getPluginsDir() { return join(LOG_DIR, 'plugins'); }
@@ -77,7 +78,7 @@ export async function loadPlugins() {
   }
 
   // Load bundled plugins from package's plugins/ directory (user plugins take priority)
-  const bundledDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'plugins');
+  const bundledDir = PLUGINS_DIR;
   if (existsSync(bundledDir)) {
     let bundledFiles;
     try {

package/{lib → server/lib}/plugin-manager.js

@@ -37,7 +37,7 @@ export function uploadPlugins(pluginsDir, fileList) {
  * Install a plugin by downloading from a URL.
  * @param {string} pluginsDir - path to plugins directory
  * @param {string} fileUrl - URL to download from
- * @param {string} extractNameScript - path to lib/extract-plugin-name.mjs
+ * @param {string} extractNameScript - path to server/lib/extract-plugin-name.mjs
  * @returns {Promise<{filename: string}>} the saved filename
  * @throws {Error} on validation or download failure
  */

package/{lib → server/lib}/sdk-manager.js

@@ -397,7 +397,7 @@ async function _handleCanUseTool(toolName, input, options) {
       } catch {}
     }
     // 24h — 与 hook 路径（server.js ASK_HOOK_TIMEOUT_MS）同源，履行"GUI 实质无超时"承诺。
-    // 实际常量定义在 lib/ask-constants.js。
+    // 实际常量定义在 server/lib/ask-constants.js。
     const askTimeoutMs = ASK_TIMEOUT_MS;
     const askStartedAt = Date.now();
     if (_broadcastWs) {

package/{lib → server/lib}/session-transcript-reader.js

@@ -20,7 +20,7 @@
 
 import { existsSync, statSync, openSync, readSync, closeSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { getClaudeConfigDir } from '../findcc.js';
+import { getClaudeConfigDir } from '../../findcc.js';
 
 function projectsDir() {
   return process.env.CCV_PROJECTS_DIR || join(getClaudeConfigDir(), 'projects');

package/{lib → server/lib}/terminal-env.js

@@ -1,7 +1,7 @@
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { homedir } from 'node:os';
-import { getClaudeConfigDir } from '../findcc.js';
+import { getClaudeConfigDir } from '../../findcc.js';
 
 export const KEEP_CLAUDE_NO_FLICKER_ENV = 'CCV_KEEP_CLAUDE_CODE_NO_FLICKER';
 

package/{lib → server/lib}/tools-xml-formatter.js

@@ -1,3 +1,4 @@
+// CLIENT-SAFE: no node deps. Imported by src/ — do not add fs/process/node: imports.
 /**
  * Serialize an Anthropic tool definition (name / description / input_schema)
  * into the XML-shaped text format the model sees on the server side.
@@ -7,7 +8,7 @@
  * approximation useful for inspection, not a canonical wire format.
  *
  * Single source of truth: src/utils/toolsXmlFormatter.js re-exports from here,
- * lib/kv-cache-analyzer.js imports from here.
+ * server/lib/kv-cache-analyzer.js imports from here.
  *
  * Note: free-text fields (name / description / enum) are NOT XML-escaped.
  * parseCachedTools relies on first-match semantics — the tool-level <name>

package/{lib → server/lib}/updater.js

@@ -4,7 +4,8 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 import { t } from '../i18n.js';
-import { getClaudeConfigDir } from '../findcc.js';
+import { getClaudeConfigDir } from '../../findcc.js';
+import { PACKAGE_JSON } from '../_paths.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -47,7 +48,7 @@ const CACHE_FILE = join(CACHE_DIR, 'update-check.json');
 const CC_SETTINGS_FILE = join(getClaudeConfigDir(), 'settings.json');
 
 function getCurrentVersion() {
-  const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
+  const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf-8'));
   return pkg.version;
 }
 

package/{lib → server/lib}/voice-pack-events.js

@@ -1,8 +1,9 @@
+// CLIENT-SAFE: no node deps. Imported by src/ — do not add fs/process/node: imports.
 // Single source of truth for voice-pack event keys + their default bindings.
 //
 // Why a shared module: this list was previously duplicated across
-//   - lib/voice-pack-manager.js (EVENT_KEYS for whitelist + reconcile)
-//   - server.js (preferences merge / reconcile)
+//   - server/lib/voice-pack-manager.js (EVENT_KEYS for whitelist + reconcile)
+//   - server/server.js (preferences merge / reconcile)
 //   - src/AppBase.jsx (initial state default)
 //   - src/components/VoicePackSettings.jsx (UI rows + reset handler)
 //   - scripts/gen-placeholder-voicepack.js (pattern table keys)
@@ -12,7 +13,7 @@
 
 // 注：timeoutWarning5min / timeoutWarning60s 已删除。AskUserQuestion 实质 24h 无超时后
 // 倒计时不再渲染（AskTimeoutCountdown.jsx isInfiniteTimeout → null），剩余时间预警事件失去意义。
-// 老用户 preferences.json 含这两个 key 由 lib/approval-modal-prefs.js _filterEvents 白名单
+// 老用户 preferences.json 含这两个 key 由 server/lib/approval-modal-prefs.js _filterEvents 白名单
 // 自动 strip，零迁移工作量。孤儿 audio 文件留待 cleanup CLI（backlog）。
 export const EVENT_KEYS = [
   'planApproval',

package/{lib → server/lib}/voice-pack-manager.js

@@ -11,12 +11,8 @@
 import { existsSync, mkdirSync, writeFileSync, unlinkSync, readdirSync, statSync, readFileSync, lstatSync } from 'node:fs';
 import { join, extname } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-import { dirname } from 'node:path';
 import { EVENT_KEYS, DEFAULT_BINDINGS, BUNDLED_PACK_IDS } from './voice-pack-events.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
+import { DIST_DIR, PUBLIC_DIR } from '../_paths.js';
 
 // Bundled pack lookup order, per packId:
 //   1. <repo>/dist/voice-packs/<packId>/   — production (Vite copies public/* into dist/, npm ships dist/ only)
@@ -25,8 +21,8 @@ const __dirname = dirname(__filename);
 // drop public/voice-packs/<id>/ with pack.json. No code path here needs editing.
 function bundledPackDirs(packId) {
   return [
-    join(__dirname, '..', 'dist', 'voice-packs', packId),
-    join(__dirname, '..', 'public', 'voice-packs', packId),
+    join(DIST_DIR, 'voice-packs', packId),
+    join(PUBLIC_DIR, 'voice-packs', packId),
   ];
 }
 
@@ -338,6 +334,6 @@ export function reconcileVoicePackPrefs(logDir, vp) {
 // Re-export shared defaults so consumers can pull everything from one module.
 export { DEFAULT_BINDINGS, BUNDLED_PACK_IDS };
 
-// mergeApprovalModalPrefs / mergeVoicePackInto moved to lib/approval-modal-prefs.js
+// mergeApprovalModalPrefs / mergeVoicePackInto moved to server/lib/approval-modal-prefs.js
 //( — merge logic isn't voice-pack-specific). Import from
 // './approval-modal-prefs.js' directly.

package/{proxy.js → server/proxy.js}

@@ -6,7 +6,7 @@ import { homedir } from 'node:os';
 import * as interceptor from './interceptor.js';
 import { setupInterceptor } from './interceptor.js';
 import { extractApiErrorMessage, formatProxyRequestError } from './lib/proxy-errors.js';
-import { getClaudeConfigDir } from './findcc.js';
+import { getClaudeConfigDir } from '../findcc.js';
 
 // Setup interceptor to patch fetch
 setupInterceptor();

package/{pty-manager.js → server/pty-manager.js}

@@ -1,8 +1,9 @@
-import { resolveNativePath, LOG_DIR } from './findcc.js';
+import { resolveNativePath, LOG_DIR } from '../findcc.js';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';
 import { chmodSync, statSync } from 'node:fs';
 import { platform, arch } from 'node:os';
+import { createRequire } from 'node:module';
 import { prepareEmbeddedShellSpawn, stripClaudeNoFlickerUnlessOptedIn } from './lib/terminal-env.js';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -83,16 +84,29 @@ function flushBatch() {
   }
 }
 
+// 走 createRequire().resolve 而非 join(__dirname, '..', 'node_modules', ...) ——
+// pnpm / yarn workspace 把 node-pty hoist 到上级 node_modules 时相对路径会找不到，
+// 静默 chmod 失败 → 运行 PTY 时 EACCES，且全程无 log 难排查。
 function fixSpawnHelperPermissions() {
+  const os = platform();
+  const cpu = arch();
+  const subPath = `node-pty/prebuilds/${os}-${cpu}/spawn-helper`;
+  let helperPath;
+  try {
+    const req = createRequire(import.meta.url);
+    helperPath = req.resolve(subPath);
+  } catch (err) {
+    // node-pty 没安装/没该平台 prebuild：放过，spawn 时会另报错
+    return;
+  }
   try {
-    const os = platform();
-    const cpu = arch();
-    const helperPath = join(__dirname, 'node_modules', 'node-pty', 'prebuilds', `${os}-${cpu}`, 'spawn-helper');
     const stat = statSync(helperPath);
     if (!(stat.mode & 0o111)) {
       chmodSync(helperPath, stat.mode | 0o755);
     }
-  } catch { }
+  } catch (err) {
+    console.warn('[cc-viewer] fixSpawnHelperPermissions failed:', helperPath, err?.message || err);
+  }
 }
 
 // Opus 4.7 默认不再返回 thinking；为所有非显式覆写的调用加上 summarized。