cc-viewer 1.6.274 → 1.6.276

package/server/routes/team.js

@@ -0,0 +1,169 @@
+// Concept docs + CCV process management + team-status routes (moved verbatim from server.js).
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { platform } from 'node:os';
+import { CONCEPTS_DIR } from '../_paths.js';
+import { buildTeamStatusResponse } from '../lib/team-runtime.js';
+
+// GET /api/concept?lang=zh&doc=Tool-Bash
+function concept(req, res, parsedUrl, isLocal, deps) {
+  const lang = parsedUrl.searchParams.get('lang') || 'zh';
+  const doc = parsedUrl.searchParams.get('doc') || '';
+  // 安全校验：只允许字母、数字、连字符
+  if (!/^[a-zA-Z0-9-]+$/.test(doc) || !/^[a-z]{2}(-[a-zA-Z]{2,})?$/.test(lang)) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid parameters' }));
+    return;
+  }
+  let mdPath = join(CONCEPTS_DIR, lang, `${doc}.md`);
+  if (!existsSync(mdPath) && lang !== 'zh') {
+    mdPath = join(CONCEPTS_DIR, 'zh', `${doc}.md`);
+  }
+  if (existsSync(mdPath)) {
+    const content = readFileSync(mdPath, 'utf-8');
+    res.writeHead(200, { 'Content-Type': 'text/markdown; charset=utf-8' });
+    res.end(content);
+  } else {
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found' }));
+  }
+}
+
+// CCV 进程列表
+async function ccvProcesses(req, res, parsedUrl, isLocal, deps) {
+  if (platform() === 'win32') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ processes: [] }));
+    return;
+  }
+  try {
+    const { stdout } = await deps.execAsync('lsof -iTCP:7008-7099 -sTCP:LISTEN -P -n', { timeout: 5000 }).catch(() => ({ stdout: '' }));
+    const lines = stdout.trim().split('\n').filter(Boolean);
+    // Parse lsof output: skip header, filter node processes, dedupe by PID:port
+    const seen = new Map(); // pid -> port
+    for (const line of lines.slice(1)) {
+      const parts = line.trim().split(/\s+/);
+      const cmd = parts[0];
+      if (cmd !== 'node') continue;
+      const pid = parseInt(parts[1], 10);
+      if (!pid) continue;
+      // lsof 输出: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME (STATE)
+      // 端口在 NAME 列（倒数第二列），如 *:7008，最后一列是 (LISTEN)
+      const nameField = parts[parts.length - 2] || '';
+      const portMatch = nameField.match(/:(\d+)$/);
+      if (!portMatch) continue;
+      const port = portMatch[1];
+      if (!seen.has(pid)) seen.set(pid, port);
+    }
+    // 获取所有候选进程的 PPID，过滤掉 PPID 也在 CCV 进程集合中的子进程（即 ccv -c/-d 启动的 claude 子进程）
+    const ccvPids = new Set(seen.keys());
+    const filteredPids = [];
+    for (const [pid] of seen) {
+      try {
+        const { stdout: ppidOut } = await deps.execAsync(`ps -o ppid= -p ${pid}`, { timeout: 2000 }).catch(() => ({ stdout: '' }));
+        const ppid = parseInt(ppidOut.trim(), 10);
+        if (ppid && ccvPids.has(ppid)) continue; // 是某个 CCV 进程的子进程，跳过
+      } catch {}
+      filteredPids.push(pid);
+    }
+    const processes = [];
+    for (const pid of filteredPids) {
+      const port = seen.get(pid);
+      let startTime = '';
+      let command = '';
+      try {
+        const { stdout: psOut } = await deps.execAsync(`ps -p ${pid} -o lstart=,command=`, { timeout: 3000 }).catch(() => ({ stdout: '' }));
+        const psLine = psOut.trim();
+        // lstart format: "Day Mon DD HH:MM:SS YYYY rest..."
+        const lsMatch = psLine.match(/^\w+\s+(\w+)\s+(\d+)\s+([\d:]+)\s+(\d{4})\s+(.*)/);
+        if (lsMatch) {
+          const months = { Jan:1,Feb:2,Mar:3,Apr:4,May:5,Jun:6,Jul:7,Aug:8,Sep:9,Oct:10,Nov:11,Dec:12 };
+          const mon = String(months[lsMatch[1]] || 1).padStart(2, '0');
+          const day = String(lsMatch[2]).padStart(2, '0');
+          const time = lsMatch[3];
+          const year = lsMatch[4];
+          startTime = `${year}年${mon}月${day}日 ${time}`;
+          const rawCmd = lsMatch[5];
+          // Extract path after lib/ (e.g. node_modules/cc-viewer/cli.js -d → cc-viewer/cli.js -d)
+          const libMatch = rawCmd.match(/lib\/(.+)/);
+          command = libMatch ? libMatch[1] : rawCmd;
+        }
+      } catch {}
+      const isCurrent = pid === process.pid;
+      processes.push({ port, pid, command, startTime, isCurrent });
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ processes }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+// CCV 进程关闭
+function ccvProcessesKill(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const { pid } = JSON.parse(body);
+      if (!Number.isInteger(pid) || pid <= 0) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid PID' }));
+        return;
+      }
+      if (pid === process.pid) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Cannot kill current process' }));
+        return;
+      }
+      // 安全检查：确认是监听 CCV 端口范围 (7008-7099) 的 node 进程
+      const { stdout: lsofOut } = await deps.execAsync(`lsof -iTCP:7008-7099 -sTCP:LISTEN -P -n -p ${pid}`, { timeout: 5000 }).catch(() => ({ stdout: '' }));
+      const lsofLines = lsofOut.trim().split('\n').filter(Boolean).slice(1);
+      const isNodeOnCcvPort = lsofLines.some(line => line.trim().split(/\s+/)[0] === 'node');
+      if (!isNodeOnCcvPort) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Not a CCV process' }));
+        return;
+      }
+      process.kill(pid, 'SIGTERM');
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true }));
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+// Team 运行时状态检测（fs-only：目录存在性 + inbox mtime）
+function teamStatus(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    let parsed;
+    try {
+      parsed = JSON.parse(body || '{}');
+    } catch {
+      // 固定文案避免把 JSON.parse 的原始 err.message 回显给客户端
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'invalid_json' }));
+      return;
+    }
+    try {
+      const result = await buildTeamStatusResponse(parsed);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+export const teamRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/concept', handler: concept },
+  { method: 'GET', match: 'exact', path: '/api/ccv-processes', handler: ccvProcesses },
+  { method: 'POST', match: 'exact', path: '/api/ccv-processes/kill', handler: ccvProcessesKill },
+  { method: 'POST', match: 'exact', path: '/api/team-status', handler: teamStatus },
+];

package/server/routes/voice-pack.js

@@ -0,0 +1,235 @@
+// Voice-pack routes (moved verbatim from server.js handleRequest).
+// Manages user-uploaded audio + serves the bundled "皇上系列" default pack.
+// Uploads are loopback-only — LAN clients can play but not write.
+import { lstatSync, statSync, createReadStream } from 'node:fs';
+import { LOG_DIR } from '../../findcc.js';
+import {
+  saveAudio as vpSaveAudio,
+  listUserAudio as vpListUserAudio,
+  deleteUserAudio as vpDeleteUserAudio,
+  getUserAudioPath as vpGetUserAudioPath,
+  getBundledPackPath as vpGetBundledPackPath,
+  listDefaultPack as vpListDefaultPack,
+  listBundledPacks as vpListBundledPacks,
+  isDefaultPackPlaceholder as vpIsDefaultPackPlaceholder,
+  mimeForFormat as vpMime,
+  isValidId as vpIsValidId,
+  BUNDLED_PACK_IDS as VP_BUNDLED_PACK_IDS,
+  EVENT_KEYS as VP_EVENT_KEYS,
+  MAX_AUDIO_BYTES as VP_MAX_BYTES,
+} from '../lib/voice-pack-manager.js';
+
+function voicePackList(req, res) {
+  try {
+    const userAudio = vpListUserAudio(LOG_DIR);
+    const bundledPacks = vpListBundledPacks();
+    // SUNSET-MARKER: ccv-voice-pack-defaultPack-flat-shape
+    // Legacy defaultPack / defaultPackPlaceholder fields kept alongside the
+    // new bundledPacks[] for one release so any out-of-tree consumer (mobile
+    // app shell, third-party fork) doesn't break on the shape change.
+    // Drop after 1.6.273+. New code should iterate bundledPacks.
+    const defaultPack = vpListDefaultPack();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+      userAudio,
+      bundledPacks,
+      defaultPack,
+      defaultPackPlaceholder: vpIsDefaultPackPlaceholder(),
+      eventKeys: VP_EVENT_KEYS,
+      maxBytes: VP_MAX_BYTES,
+    }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'list failed', detail: err?.message }));
+  }
+}
+
+function voicePackUpload(req, res, parsedUrl, isLocal) {
+  // Loopback-only — refuse LAN clients even if they hold a valid token.
+  // The token already gates LAN access but voice-pack writes touch the local FS
+  // and end up reachable from every client; keep the write side strictly local.
+  if (!isLocal) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Upload allowed from loopback only' }));
+    return;
+  }
+  const contentType = req.headers['content-type'] || '';
+  const boundaryMatch = contentType.match(/boundary=(.+)/);
+  if (!boundaryMatch) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Missing boundary' }));
+    return;
+  }
+  const contentLength = parseInt(req.headers['content-length'] || '0', 10);
+  if (contentLength > VP_MAX_BYTES + 4096) {
+    res.writeHead(413, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: `File too large (max ${VP_MAX_BYTES} bytes)` }));
+    return;
+  }
+  const boundary = boundaryMatch[1];
+  const chunks = [];
+  let totalSize = 0;
+  let aborted = false;
+  req.on('data', chunk => {
+    totalSize += chunk.length;
+    if (totalSize > VP_MAX_BYTES + 4096) {
+      aborted = true;
+      res.writeHead(413, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: `File too large (max ${VP_MAX_BYTES} bytes)` }));
+      req.destroy();
+      return;
+    }
+    chunks.push(chunk);
+  });
+  req.on('end', () => {
+    if (aborted) return;
+    try {
+      const buf = Buffer.concat(chunks);
+      const headerEnd = buf.indexOf('\r\n\r\n');
+      if (headerEnd === -1) throw new Error('Malformed multipart');
+      const headerStr = buf.slice(0, headerEnd).toString();
+      const nameMatch = headerStr.match(/filename="([^"]+)"/);
+      const originalName = nameMatch ? nameMatch[1].replace(/[\x00-\x1f/\\]/g, '_') : 'upload';
+      const bodyStart = headerEnd + 4;
+      const closingBoundary = Buffer.from('\r\n--' + boundary);
+      const bodyEnd = buf.indexOf(closingBoundary, bodyStart);
+      const fileData = bodyEnd !== -1 ? buf.slice(bodyStart, bodyEnd) : buf.slice(bodyStart);
+      const result = vpSaveAudio(LOG_DIR, originalName, fileData, { isLoopback: true });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, ...result }));
+    } catch (err) {
+      const status = err?.code === 'TOO_LARGE' ? 413 : err?.code === 'BAD_FORMAT' ? 415 : 400;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err?.message || 'Upload failed' }));
+    }
+  });
+}
+
+function voicePackDelete(req, res, parsedUrl, isLocal) {
+  if (!isLocal) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Delete allowed from loopback only' }));
+    return;
+  }
+  const url = parsedUrl.pathname;
+  const id = url.slice('/api/voice-pack/delete/'.length);
+  if (!vpIsValidId(id)) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid id' }));
+    return;
+  }
+  const ok = vpDeleteUserAudio(LOG_DIR, id);
+  res.writeHead(ok ? 200 : 404, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ ok }));
+}
+
+// Serve audio — supports HTTP Range so iOS Safari / mobile players can seek mp3
+// (Safari refuses to start playback when the server returns 200 without Accept-Ranges).
+// Path forms:
+//   /api/voice-pack/audio/<packId>/<eventKey>  — bundled pack (default, sanguo, …)
+//   /api/voice-pack/audio/<uuid>               — user-uploaded file
+function voicePackAudio(req, res, parsedUrl) {
+  const url = parsedUrl.pathname;
+  const tail = url.slice('/api/voice-pack/audio/'.length);
+  let resolved = null;
+  let isBundled = false;
+  // Iterate the explicit BUNDLED_PACK_IDS list so an unknown prefix can never
+  // accidentally hit the bundled branch — falls through to the uuid lookup,
+  // which is whitelisted by isValidId.
+  for (const packId of VP_BUNDLED_PACK_IDS) {
+    const prefix = `${packId}/`;
+    if (tail.startsWith(prefix)) {
+      const eventKey = tail.slice(prefix.length);
+      resolved = vpGetBundledPackPath(packId, eventKey);
+      isBundled = true;
+      break;
+    }
+  }
+  if (!isBundled) {
+    resolved = vpGetUserAudioPath(LOG_DIR, tail);
+  }
+  if (!resolved) {
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found' }));
+    return;
+  }
+  // Cache strategy:
+  //   - default-pack: short max-age + must-revalidate, no `immutable` — the on-disk
+  //     file *can* change when a placeholder is replaced by a real recording at the
+  //     same path. `must-revalidate` keeps the file out of the stale bucket once
+  //     max-age expires. Paired with the ETag below, this lets browsers
+  //     conditional-request and pick up regenerated audio after a `gen-default-voicepack`
+  //     run — without an ETag they'd silently serve cached stale content.
+  //   - user audio: content-addressed by UUID (delete + re-upload always mints a
+  //     new id), so safe to mark immutable for a full day. Loopback-only writes,
+  //     so the LAN audience cannot mutate.
+  const cacheControl = isBundled
+    ? 'public, max-age=300, must-revalidate'
+    : 'private, max-age=86400, immutable';
+  try {
+    // Symlink hardening: refuse to serve symlinks even though the routing layer
+    // already enforces the id whitelist. A local attacker who can write to
+    // LOG_DIR/voice-packs/ could otherwise drop `<uuid>.mp3 → /etc/passwd` and
+    // have it streamed over LAN. Same family as the file-access-policy realpath
+    // check used elsewhere in server.js for /api/read-file.
+    const ls = lstatSync(resolved.path);
+    if (ls.isSymbolicLink()) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Not found' }));
+      return;
+    }
+    const stat = statSync(resolved.path);
+    const fileSize = stat.size;
+    // ETag = "<size>-<mtime ms>" — cheap, stable across restarts, changes whenever
+    // the file is rewritten. Honors If-None-Match → 304 so a regenerated default
+    // pack actually reaches the browser instead of being silently served stale.
+    const etag = `"${fileSize.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
+    if (req.headers['if-none-match'] === etag) {
+      res.writeHead(304, { ETag: etag, 'Cache-Control': cacheControl });
+      res.end();
+      return;
+    }
+    const mime = vpMime(resolved.format);
+    const range = req.headers.range;
+    if (range) {
+      const m = range.match(/bytes=(\d+)-(\d*)/);
+      if (m) {
+        const start = parseInt(m[1], 10);
+        const end = m[2] ? parseInt(m[2], 10) : fileSize - 1;
+        if (Number.isFinite(start) && Number.isFinite(end) && start >= 0 && end < fileSize && start <= end) {
+          res.writeHead(206, {
+            'Content-Range': `bytes ${start}-${end}/${fileSize}`,
+            'Accept-Ranges': 'bytes',
+            'Content-Length': end - start + 1,
+            'Content-Type': mime,
+            'Cache-Control': cacheControl,
+            ETag: etag,
+          });
+          createReadStream(resolved.path, { start, end }).pipe(res);
+          return;
+        }
+      }
+      res.writeHead(416, { 'Content-Range': `bytes */${fileSize}` });
+      res.end();
+      return;
+    }
+    res.writeHead(200, {
+      'Content-Length': fileSize,
+      'Content-Type': mime,
+      'Accept-Ranges': 'bytes',
+      'Cache-Control': cacheControl,
+      ETag: etag,
+    });
+    createReadStream(resolved.path).pipe(res);
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Read failed', detail: err?.message }));
+  }
+}
+
+export const voicePackRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/voice-pack/list', handler: voicePackList },
+  { method: 'POST', match: 'exact', path: '/api/voice-pack/upload', handler: voicePackUpload },
+  { method: 'DELETE', match: 'prefix', path: '/api/voice-pack/delete/', handler: voicePackDelete },
+  { method: 'GET', match: 'prefix', path: '/api/voice-pack/audio/', handler: voicePackAudio },
+];

package/server/routes/workspaces.js

@@ -0,0 +1,171 @@
+// Workspace routes (moved verbatim from server.js handleRequest).
+import { existsSync, statSync, unwatchFile } from 'node:fs';
+import { basename } from 'node:path';
+import { LOG_FILE, initForWorkspace, resetWorkspace } from '../interceptor.js';
+import { watchLogFile, getWatchedFiles } from '../lib/log-watcher.js';
+import { readClaudeProjectModel } from '../lib/context-watcher.js';
+import { countLogEntries, streamRawEntriesAsync } from '../lib/log-stream.js';
+
+function workspacesList(req, res, parsedUrl, isLocal, deps) {
+  import('../workspace-registry.js').then(({ getWorkspaces }) => {
+    const workspaces = getWorkspaces();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ workspaces, workspaceMode: deps.isWorkspaceMode && !deps.workspaceLaunched }));
+  }).catch(err => {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  });
+}
+
+function workspacesLaunch(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const { path: wsPath, extraArgs: launchExtraArgs } = JSON.parse(body);
+      if (!wsPath || !existsSync(wsPath) || !statSync(wsPath).isDirectory()) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid directory path' }));
+        return;
+      }
+
+      const { registerWorkspace } = await import('../workspace-registry.js');
+      registerWorkspace(wsPath);
+
+      // Electron multi-tab 模式：管理 server 只触发 callback，不做日志初始化
+      // 所有日志相关操作（initForWorkspace、watchLogFile、spawnClaude）由 tab-worker 子进程负责
+      if (process.env.CCV_ELECTRON_MULTITAB === '1') {
+        if (deps.launchCallback) {
+          deps.launchCallback(wsPath, Array.isArray(launchExtraArgs) ? launchExtraArgs : []);
+        }
+        deps.setWorkspaceLaunched(true);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, projectName: basename(wsPath) }));
+        return;
+      }
+
+      // 非 Electron 模式（web / CLI）：完整逻辑
+      const result = initForWorkspace(wsPath);
+      process.env.CCV_PROJECT_DIR = wsPath;
+
+      // 启动日志监听
+      watchLogFile(deps.logWatcherOpts(LOG_FILE));
+
+      // 启动 stats worker（如果尚未启动）
+      if (!deps.statsWorker) deps.startStatsWorker();
+      deps.startStreamingStatusTimer();
+
+      // 启动 PTY
+      const proxyPort = process.env.CCV_PROXY_PORT;
+      if (proxyPort) {
+        const { spawnClaude } = await import('../pty-manager.js');
+        const mergedArgs = [...deps.workspaceClaudeArgs, ...(Array.isArray(launchExtraArgs) ? launchExtraArgs : [])];
+        await spawnClaude(parseInt(proxyPort), wsPath, mergedArgs, deps.workspaceClaudePath, deps.workspaceIsNpmVersion, deps.actualPort, deps.protocol, deps.INTERNAL_TOKEN);
+      }
+
+      deps.setWorkspaceLaunched(true);
+
+      // 通知所有 SSE 客户端
+      deps.clients.forEach(client => {
+        try {
+          client.write(`event: workspace_started\ndata: ${JSON.stringify({ projectName: result.projectName, path: wsPath, claudeProjectModel: readClaudeProjectModel(wsPath) })}\n\n`);
+        } catch {}
+      });
+
+      // 流式分段广播以刷新会话区域，避免全量加载 OOM
+      const wsReloadTotal = countLogEntries(LOG_FILE);
+      deps.clients.forEach(client => {
+        try { client.write(`event: load_start\ndata: ${JSON.stringify({ total: wsReloadTotal, incremental: false })}\n\n`); } catch {}
+      });
+      await streamRawEntriesAsync(LOG_FILE, (raw) => {
+        deps.clients.forEach(client => {
+          try { client.write('event: load_chunk\ndata: ['); client.write(raw.replace(/\n/g, '')); client.write(']\n\n'); } catch {}
+        });
+      });
+      deps.clients.forEach(client => {
+        try { client.write(`event: load_end\ndata: {}\n\n`); } catch {}
+      });
+
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, projectName: result.projectName }));
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+function workspacesAdd(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const { path: wsPath } = JSON.parse(body);
+      if (!wsPath || !existsSync(wsPath) || !statSync(wsPath).isDirectory()) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid directory path' }));
+        return;
+      }
+      const { registerWorkspace } = await import('../workspace-registry.js');
+      const entry = registerWorkspace(wsPath);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, workspace: entry }));
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+function workspacesDelete(req, res, parsedUrl) {
+  const url = parsedUrl.pathname;
+  const id = url.split('/').pop();
+  import('../workspace-registry.js').then(({ removeWorkspace }) => {
+    const removed = removeWorkspace(id);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: removed }));
+  }).catch(err => {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  });
+}
+
+function workspacesStop(req, res, parsedUrl, isLocal, deps) {
+  Promise.all([
+    import('../pty-manager.js').then(({ killPty }) => killPty()),
+    import('../scratch-pty-manager.js').then(({ killAllScratch }) => killAllScratch()).catch(() => {}),
+  ]).then(() => {
+    // 接续原有清理流程
+
+    // 停止日志监听
+    for (const logFile of getWatchedFiles().keys()) {
+      unwatchFile(logFile);
+    }
+    getWatchedFiles().clear();
+
+    // 重置 interceptor 状态
+    resetWorkspace();
+    deps.setWorkspaceLaunched(false);
+
+    // 通知所有 SSE 客户端
+    deps.clients.forEach(client => {
+      try {
+        client.write(`event: workspace_stopped\ndata: {}\n\n`);
+      } catch {}
+    });
+
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+  }).catch(err => {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  });
+}
+
+export const workspacesRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/workspaces', handler: workspacesList },
+  { method: 'POST', match: 'exact', path: '/api/workspaces/launch', handler: workspacesLaunch },
+  { method: 'POST', match: 'exact', path: '/api/workspaces/add', handler: workspacesAdd },
+  { method: 'DELETE', match: 'prefix', path: '/api/workspaces/', handler: workspacesDelete },
+  { method: 'POST', match: 'exact', path: '/api/workspaces/stop', handler: workspacesStop },
+];