cc-viewer 1.6.302 → 1.6.304

package/server/routes/files-content.js

@@ -7,6 +7,21 @@ import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
 
+// file-raw 扩展名 → MIME 映射。图片走 <img> 预览;html 走 iframe 预览(带下方 CSP sandbox);
+// 其余为 HTML 预览的同目录子资源(c8/nyc/lcov-genhtml 等静态报告):CSP sandbox 使文档
+// 处于 opaque origin,对一切子资源都是跨源——跨源样式表受浏览器严格 MIME 校验,
+// octet-stream 的 CSS 会被直接拒用(报告渲染成裸 HTML)。js 虽为 classic script 不受
+// MIME 门禁,配正确类型属卫生项 + 为未来 nosniff 铺路。
+// 注意:值不带 charset 后缀——fileRaw 内 CSP 判等依赖 mime === 'text/html'。
+const FILE_RAW_MIME = {
+  '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif', '.svg': 'image/svg+xml', '.ico': 'image/x-icon',
+  '.webp': 'image/webp', '.html': 'text/html', '.htm': 'text/html',
+  '.css': 'text/css', '.js': 'text/javascript', '.mjs': 'text/javascript',
+  '.json': 'application/json', '.map': 'application/json', '.txt': 'text/plain',
+  '.woff': 'font/woff', '.woff2': 'font/woff2', '.ttf': 'font/ttf',
+};
+
 function planFile(req, res, parsedUrl) {
   try {
     const raw = parsedUrl.searchParams.get('path') || '';
@@ -290,13 +305,8 @@ function fileRaw(req, res, parsedUrl) {
       res.end(JSON.stringify({ error: 'File too large' }));
       return;
     }
-    const extMime = {
-      '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
-      '.gif': 'image/gif', '.svg': 'image/svg+xml', '.ico': 'image/x-icon',
-      '.webp': 'image/webp', '.html': 'text/html', '.htm': 'text/html',
-    };
     const ext = (targetFile.match(/\.[^.]+$/) || [''])[0].toLowerCase();
-    const mime = extMime[ext] || 'application/octet-stream';
+    const mime = FILE_RAW_MIME[ext] || 'application/octet-stream';
     const data = method === 'HEAD' ? null : readFileSync(targetFile);
     const size = method === 'HEAD' ? stat.size : data.length;
     const headers = { 'Content-Type': mime, 'Content-Length': size };

package/server/routes/workflow-journal.js

@@ -0,0 +1,78 @@
+// Workflow run journal route: serve normalized panel data + arm live watch.
+// 完成后读权威快照 <runId>.json；运行中（快照未落盘）回退到 subagents/workflows/<runId>
+// 的逐帧推导，并武装运行中目录监视，使面板逐帧实时刷新。
+import { resolveJournalPath, resolveWorkflowsDir, readNormalizedJournal } from '../lib/workflow-journal.js';
+import { resolveRunDir, deriveLiveJournal } from '../lib/workflow-live.js';
+import { armWorkflowWatch, armWorkflowLiveWatch } from '../lib/workflow-watcher.js';
+
+// session 会进入 findTranscriptPath 的路径拼接（<root>/<dir>/<session>.jsonl），
+// 限制为无路径分隔符/`..` 的安全字符集，纵深防御穿越（底层 realpath 容器校验之外的早拒）。
+const SESSION_RE = /^[A-Za-z0-9_-]+$/;
+
+function workflowJournal(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const session = parsedUrl.searchParams.get('session') || '';
+    const runId = parsedUrl.searchParams.get('runId') || '';
+    const taskId = parsedUrl.searchParams.get('taskId') || '';
+    const project = parsedUrl.searchParams.get('project') || undefined;
+
+    if (!session) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'missing session' }));
+      return;
+    }
+    if (!SESSION_RE.test(session)) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'invalid session' }));
+      return;
+    }
+    if (!runId && !taskId) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'missing runId or taskId' }));
+      return;
+    }
+
+    // 惰性 arm：只监视真有人在看的 session workflows 目录，后续 journal 覆写经 SSE 实时推送。
+    const wfDir = resolveWorkflowsDir(session, project);
+    if (wfDir && deps && Array.isArray(deps.clients)) {
+      try {
+        armWorkflowWatch({ workflowsDir: wfDir, sessionId: session, project, clients: deps.clients });
+      } catch {}
+    }
+
+    // 1) 完成快照优先（权威，含 phase 分组）
+    const journalPath = resolveJournalPath({ sessionId: session, projectHint: project, runId, taskId });
+    if (journalPath) {
+      const data = readNormalizedJournal(journalPath);
+      if (data) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, data }));
+        return;
+      }
+    }
+
+    // 2) 运行中逐帧推导（快照尚未落盘）+ 武装运行中目录监视
+    if (runId) {
+      const runDir = resolveRunDir(session, project, runId);
+      const live = runDir ? deriveLiveJournal(runDir, runId) : null;
+      if (live) {
+        if (deps && Array.isArray(deps.clients)) {
+          try { armWorkflowLiveWatch({ runDir, runId, sessionId: session, project, clients: deps.clients }); } catch {}
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, data: live }));
+        return;
+      }
+    }
+
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: 'not found' }));
+  } catch (e) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: String(e?.message || e) }));
+  }
+}
+
+export const workflowJournalRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/workflow-journal', handler: workflowJournal },
+];

package/server/routes/workspaces.js

@@ -3,6 +3,7 @@ import { existsSync, statSync } from 'node:fs';
 import { basename } from 'node:path';
 import { LOG_FILE, initForWorkspace, resetWorkspace } from '../interceptor.js';
 import { watchLogFile, unwatchAll } from '../lib/log-watcher.js';
+import { unwatchAllWorkflows } from '../lib/workflow-watcher.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';
 import { countLogEntries, streamRawEntriesAsync } from '../lib/log-stream.js';
 
@@ -139,6 +140,7 @@ function workspacesStop(req, res, parsedUrl, isLocal, deps) {
 
     // 停止日志监听
     unwatchAll();
+    unwatchAllWorkflows();
 
     // 重置 interceptor 状态
     resetWorkspace();

package/server/server.js

@@ -24,6 +24,7 @@ import { voicePackRoutes } from './routes/voice-pack.js';
 import { skillsRoutes } from './routes/skills.js';
 import { ultraAgentsRoutes } from './routes/ultra-agents.js';
 import { filesContentRoutes } from './routes/files-content.js';
+import { workflowJournalRoutes } from './routes/workflow-journal.js';
 import { filesFsRoutes } from './routes/files-fs.js';
 import { workspacesRoutes } from './routes/workspaces.js';
 import { eventsRoutes } from './routes/events.js';
@@ -76,12 +77,14 @@ import { checkAndUpdate } from './lib/updater.js';
 import { loadPlugins, runWaterfallHook, runParallelHook } from './lib/plugin-loader.js';
 import { CONTEXT_WINDOW_FILE, readModelContextSize } from './lib/context-watcher.js';
 import { watchLogFile, startWatching, unwatchAll, sendEventToClients, sendToClients } from './lib/log-watcher.js';
+import { unwatchAllWorkflows } from './lib/workflow-watcher.js';
 import { cleanupExtractCache } from './lib/jsonl-archive.js';
 import { backupConfigs } from './lib/config-backup.js';
 import { normalizeBasePath, validateBasePath, stripBasePath } from './lib/base-path.js';
 import { createHardenedCleanup } from './lib/term-signals.js';
 import { createBackpressureGate } from './lib/ws-backpressure.js';
-import { createFloodCoalescer } from './lib/pty-flood-coalescer.js';
+import { createFloodCoalescer, envIntAllowZero } from './lib/pty-flood-coalescer.js';
+import { createResyncNudgeGate } from './lib/resync-nudge-gate.js';
 
 
 // 动态获取 getPrefsFile()（LOG_DIR 可能在运行时被 setLogDir 修改）
@@ -555,6 +558,7 @@ const _routes = [
   ...skillsRoutes,
   ...ultraAgentsRoutes,
   ...filesContentRoutes,
+  ...workflowJournalRoutes,
   ...filesFsRoutes,
   ...workspacesRoutes,
   ...eventsRoutes,
@@ -1121,20 +1125,30 @@ async function setupTerminalWebSocket(httpServer) {
 
     // 反压状态转换日志（observability：线上排"页面卡"时可直接判断是否触发过反压、几次、积压量）。
     // behind/resume 在持续洪泛下以亚秒级周期振荡，5s 节流防刷屏；timeout 是终态必记。
+    // resyncTotal/nudgeSkipped 判别 resync 循环：resync 涨 + skipped 同涨 = nudge 冷却在救；
+    // resync 涨 + skipped≈0 = resume 间隔超过冷却期的慢振荡，需更激进策略（如洪泛期禁 nudge）。
     const makeBpLogger = (label, ws) => {
       let behindCount = 0;
+      let resyncCount = 0;
+      let nudgeSkipped = 0;
       let lastLogAt = 0;
       return (event, buffered) => {
         if (event === 'behind') behindCount++;
+        if (event === 'resume') resyncCount++;
+        if (event === 'nudge-skip') { nudgeSkipped++; return; }   // 只计数，随下一条节流日志带出
         const now = Date.now();
         if (event !== 'timeout' && now - lastLogAt < 5000) return;
         lastLogAt = now;
-        console.warn(`[${label}] ws backpressure ${event}: client=${ws._socket?.remoteAddress || '?'} bufferedAmount=${buffered} behindTotal=${behindCount}`);
+        console.warn(`[${label}] ws backpressure ${event}: client=${ws._socket?.remoteAddress || '?'} bufferedAmount=${buffered} behindTotal=${behindCount} resyncTotal=${resyncCount} nudgeSkipped=${nudgeSkipped}`);
       };
     };
 
+    // resync nudge 冷却（CCV_RESYNC_NUDGE_COOLDOWN_MS，0 = 不冷却；详见 lib/resync-nudge-gate.js）
+    const RESYNC_NUDGE_COOLDOWN_MS = envIntAllowZero('CCV_RESYNC_NUDGE_COOLDOWN_MS', 3000);
+
     // 洪泛限流器状态日志（与 makeBpLogger 同款 5s 节流，独立实例不共享计数）。
     // Windows 实机排"切主题/大流量卡死"时据此确认 ConPTY 洪泛是否触发、几次、量级。
+    // 'rate' 事件 = 直通态 ws 消息率告警（msgsPerSec，计数在 send 闭包），判别消息数风暴。
     const makeFloodLogger = (label, ws) => {
       let floodCount = 0;
       let lastLogAt = 0;
@@ -1143,7 +1157,23 @@ async function setupTerminalWebSocket(httpServer) {
         const now = Date.now();
         if (now - lastLogAt < 5000) return;
         lastLogAt = now;
-        console.warn(`[${label}] pty flood ${event}: client=${ws._socket?.remoteAddress || '?'} winBytes=${bytes} floodTotal=${floodCount}`);
+        const metric = event === 'rate' ? 'msgsPerSec' : 'winBytes';
+        console.warn(`[${label}] pty flood ${event}: client=${ws._socket?.remoteAddress || '?'} ${metric}=${bytes} floodTotal=${floodCount}`);
+      };
+    };
+
+    // 直通态消息率计数器工厂：1s 整数桶，桶滚动时超过阈值经 floodLog('rate') 告警（5s 节流兜底）。
+    const makeMsgRateCounter = (floodLog, warnAbove = 60) => {
+      let count = 0;
+      let winStart = 0;
+      return () => {
+        const now = Date.now();
+        if (now - winStart >= 1000) {
+          if (count > warnAbove) floodLog('rate', count);
+          count = 0;
+          winStart = now;
+        }
+        count++;
       };
     };
 
@@ -1196,10 +1226,12 @@ async function setupTerminalWebSocket(httpServer) {
       // 洪泛限流器：字节率超阈值时按窗口合并 + last-wins 截断（ConPTY 全屏重绘洪泛防卡死，
       // 与 bpGate 互补——bpGate 管慢网络写缓冲，floodGate 管快 LAN 字节率，详见 lib/pty-flood-coalescer.js）
       const _floodLog = makeFloodLogger('scratch-ws', ws);
+      const _countMsg = makeMsgRateCounter(_floodLog);
       floodGate = createFloodCoalescer({
         send: (data) => {
           if (ws.readyState === 1 && bpGate.offer()) {
             try { ws.send(JSON.stringify({ type: 'data', data })); } catch {}
+            _countMsg();
           }
         },
         findSafeSliceStart,
@@ -1293,6 +1325,10 @@ async function setupTerminalWebSocket(httpServer) {
       // floodGate 前向引用（构造顺序同 scratch 路径）：onBehind/onResume 必清 coalescer
       // pending——resync 快照是唯一真相源，旧 pending 回灌会导致画面回退。
       let floodGate = null;
+      // nudge 冷却门：快照每次 resume 无条件发（修复 behind 期间跳发的数据），但重绘 nudge
+      // 走冷却——nudge 让 ConPTY 再吐全屏重绘 = 新洪泛燃料，紧 behind→resume 循环里反复
+      // nudge 会自我维持（客户端每轮 reset+重放快照 = 永久冻结表象）。详见 lib/resync-nudge-gate.js。
+      const nudgeGate = createResyncNudgeGate({ cooldownMs: RESYNC_NUDGE_COOLDOWN_MS });
       const bpGate = createBackpressureGate({
         getBufferedAmount: () => ws.bufferedAmount,
         onBehind: (buffered) => {
@@ -1304,6 +1340,7 @@ async function setupTerminalWebSocket(httpServer) {
           floodGate?.reset();
           if (ws.readyState !== 1) return;
           try { ws.send(JSON.stringify({ type: 'data-resync', data: getOutputBuffer() })); } catch {}
+          if (!nudgeGate.shouldNudge()) { _bpLog('nudge-skip', buffered); return; }
           try {
             if (process.platform !== 'win32') {
               // POSIX：与下方 _needRedrawBootstrap 同款 SIGWINCH 兜底
@@ -1333,10 +1370,12 @@ async function setupTerminalWebSocket(httpServer) {
       // 洪泛限流器：字节率超阈值时按窗口合并 + last-wins 截断（ConPTY 全屏重绘洪泛防卡死，
       // 与 bpGate 互补——bpGate 管慢网络写缓冲，floodGate 管快 LAN 字节率，详见 lib/pty-flood-coalescer.js）
       const _floodLog = makeFloodLogger('terminal-ws', ws);
+      const _countMsg = makeMsgRateCounter(_floodLog);
       floodGate = createFloodCoalescer({
         send: (data) => {
           if (ws.readyState === 1 && bpGate.offer()) {
             try { ws.send(JSON.stringify({ type: 'data', data })); } catch {}
+            _countMsg();
           }
         },
         findSafeSliceStart,
@@ -2017,6 +2056,7 @@ async function _doStop() {
     } catch { }
   }
   unwatchAll();
+  unwatchAllWorkflows();
   unwatchFile(CONTEXT_WINDOW_FILE);
   clients.forEach(client => client.end());
   // Truncate in place (not `clients = []`) so the array reference stays stable across