cc-viewer 1.6.322 → 1.6.324

package/server/i18n.js

@@ -223,8 +223,8 @@ const i18nData = {
     "uk": "\nДля видалення виконайте: ccv --uninstall"
   },
   "cli.help": {
-    "zh": "CC Viewer CLI — Claude Code 的 Web Viewer 前端\n\n用法: ccv [选项] [命令] [提示词]\n\n默认启动交互式会话 + Web Viewer，所有参数透传给 claude。\n\n参数:\n  prompt                                    你的提示词\n\nCCV 专属选项:\n  -SDK, --sdk                               使用 Agent SDK 模式（无终端，结构化交互）\n  -logger                                   安装/修复 Claude Code Hook\n  --uninstall                               移除 CC Viewer 集成\n  --d                                       --dangerously-skip-permissions 的快捷方式\n  --ad                                      --allow-dangerously-skip-permissions 的快捷方式\n  --log-dir <path>                          自定义 JSONL 日志存储目录\n  --no-open                                 启动时不自动打开浏览器\n  --user-name <name>                        自定义显示名称\n  --user-avatar <path|url>                  自定义头像图片（文件路径或 URL）\n  --usePassword[=<pwd>]                     启用密码登录（远程访问需密码或 token；不带值则随机生成 6 位（2 字母 + 4 数字））\n\nClaude 选项（透传）:\n  -c, --continue                            继续当前目录最近的对话\n  -r, --resume [value]                      通过会话 ID 恢复对话，或打开交互式选择器\n  -p, --print                               打印响应后退出（适用于管道）\n  -d, --debug [filter]                      启用调试模式\n  -w, --worktree [name]                     为此会话创建新的 git worktree\n  --model <model>                           当前会话使用的模型\n  --effort <level>                          努力级别 (low, medium, high, max)\n  --dangerously-skip-permissions            跳过所有权限检查\n  --allowedTools <tools...>                 允许的工具列表\n  --disallowedTools <tools...>              禁止的工具列表\n  --system-prompt <prompt>                  会话系统提示词\n  --append-system-prompt <prompt>           追加系统提示词\n  --mcp-config <configs...>                 加载 MCP 服务器配置\n  --permission-mode <mode>                  权限模式\n  --add-dir <directories...>                额外允许访问的目录\n  --max-budget-usd <amount>                 API 调用最大预算（仅 --print）\n  --output-format <format>                  输出格式（仅 --print）: text, json, stream-json\n  --json-schema <schema>                    结构化输出的 JSON Schema\n  --verbose                                 详细模式\n  -h, --help                                显示帮助\n  -v, --version                             显示版本\n\n  更多选项请参考: claude --help\n\n示例:\n  ccv                                       启动交互模式\n  ccv -c                                    继续上次对话\n  ccv -r                                    恢复对话\n  ccv -p \"hello\"                             打印模式\n  ccv --model opus                          指定模型\n  ccv --d                                   跳过权限确认（快捷方式）\n  ccv --ad                                  允许跳过权限（不立即启用，可通过 Shift+Tab 切换）\n  ccv -c --model sonnet --effort max        组合使用\n  ccv -SDK                                  Agent SDK 模式（无终端）\n  ccv -SDK --d                              SDK 模式 + 跳过权限\n  ccv -logger                               安装/修复 Hook\n  ccv --log-dir ~/my-logs                   使用自定义日志目录\n  ccv --no-open                             启动时不打开浏览器\n  ccv --user-name \"Alice\" --user-avatar ./avatar.png  自定义用户身份\n  ccv --log-dir /tmp/test --no-open         组合 CCV 选项",
-    "en": "CC Viewer CLI — Web Viewer frontend for Claude Code\n\nUsage: ccv [options] [command] [prompt]\n\nStarts an interactive session with Web Viewer by default. All args are passed\nthrough to claude.\n\nArguments:\n  prompt                                    Your prompt\n\nCCV Options:\n  -SDK, --sdk                               Use Agent SDK mode (no terminal, structured interaction)\n  -logger                                   Install/repair Claude Code hook\n  --uninstall                               Remove CC Viewer integration\n  --d                                       Shortcut for --dangerously-skip-permissions\n  --ad                                      Shortcut for --allow-dangerously-skip-permissions\n  --log-dir <path>                          Custom JSONL log storage directory\n  --no-open                                 Don't auto-open browser on startup\n  --user-name <name>                        Custom display name for this session\n  --user-avatar <path|url>                  Custom avatar image (file path or URL)\n  --usePassword[=<pwd>]                     Enable password login (remote needs password or token; bare flag → random 6-char: 2 letters + 4 digits)\n\nClaude Options (passed through):\n  -c, --continue                            Continue the most recent conversation\n  -r, --resume [value]                      Resume a conversation by session ID, or open picker\n  -p, --print                               Print response and exit (useful for pipes)\n  -d, --debug [filter]                      Enable debug mode\n  -w, --worktree [name]                     Create a new git worktree for this session\n  --model <model>                           Model for the current session\n  --effort <level>                          Effort level (low, medium, high, max)\n  --dangerously-skip-permissions            Bypass all permission checks\n  --allowedTools <tools...>                 Allowed tool names\n  --disallowedTools <tools...>              Disallowed tool names\n  --system-prompt <prompt>                  System prompt for the session\n  --append-system-prompt <prompt>           Append to default system prompt\n  --mcp-config <configs...>                 Load MCP servers from JSON files or strings\n  --permission-mode <mode>                  Permission mode for the session\n  --add-dir <directories...>                Additional directories to allow access to\n  --max-budget-usd <amount>                 Max dollar amount for API calls (--print only)\n  --output-format <format>                  Output format (--print only): text, json, stream-json\n  --json-schema <schema>                    JSON Schema for structured output\n  --verbose                                 Enable verbose mode\n  -h, --help                                Show help\n  -v, --version                             Show version\n\n  For all options, see: claude --help\n\nExamples:\n  ccv                                       Start interactive mode\n  ccv -c                                    Continue last conversation\n  ccv -r                                    Resume a conversation\n  ccv -p \"hello\"                             Print mode\n  ccv --model opus                          Specify model\n  ccv --d                                   Skip permission prompts (shortcut)\n  ccv --ad                                  Allow bypass mode (not active, toggle via Shift+Tab)\n  ccv -c --model sonnet --effort max        Combine options\n  ccv -SDK                                  Agent SDK mode (no terminal)\n  ccv -SDK --d                              SDK mode + bypass permissions\n  ccv -logger                               Install/repair hook\n  ccv --log-dir ~/my-logs                   Use custom log directory\n  ccv --no-open                             Start without opening browser\n  ccv --user-name \"Alice\" --user-avatar ./avatar.png  Custom user profile\n  ccv --log-dir /tmp/test --no-open         Combine CCV options",
+    "zh": "CC Viewer CLI — Claude Code 的 Web Viewer 前端\n\n用法: ccv [选项] [命令] [提示词]\n\n默认启动交互式会话 + Web Viewer，所有参数透传给 claude。\n\n参数:\n  prompt                                    你的提示词\n\nCCV 专属选项:\n  -SDK, --sdk                               使用 Agent SDK 模式（无终端，结构化交互）\n  -logger                                   安装/修复 Claude Code Hook\n  --uninstall                               移除 CC Viewer 集成\n  --d                                       --dangerously-skip-permissions 的快捷方式\n  --ad                                      --allow-dangerously-skip-permissions 的快捷方式\n  --log-dir <path>                          自定义 JSONL 日志存储目录\n  --no-open                                 启动时不自动打开浏览器\n  --user-name <name>                        自定义显示名称\n  --user-avatar <path|url>                  自定义头像图片（文件路径或 URL）\n  --usePassword[=<pwd>]                     启用密码登录（远程访问需密码或 token；不带值则随机生成 6 位（2 字母 + 4 数字））\n  --pid[=<name>]                            锁定实例 id：让本 ccv 的「仅展示当前会话」视图按实例隔离（下次用同一 id 复用）\n\nClaude 选项（透传）:\n  -c, --continue                            继续当前目录最近的对话\n  -r, --resume [value]                      通过会话 ID 恢复对话，或打开交互式选择器\n  -p, --print                               打印响应后退出（适用于管道）\n  -d, --debug [filter]                      启用调试模式\n  -w, --worktree [name]                     为此会话创建新的 git worktree\n  --model <model>                           当前会话使用的模型\n  --effort <level>                          努力级别 (low, medium, high, max)\n  --dangerously-skip-permissions            跳过所有权限检查\n  --allowedTools <tools...>                 允许的工具列表\n  --disallowedTools <tools...>              禁止的工具列表\n  --system-prompt <prompt>                  会话系统提示词\n  --append-system-prompt <prompt>           追加系统提示词\n  --mcp-config <configs...>                 加载 MCP 服务器配置\n  --permission-mode <mode>                  权限模式\n  --add-dir <directories...>                额外允许访问的目录\n  --max-budget-usd <amount>                 API 调用最大预算（仅 --print）\n  --output-format <format>                  输出格式（仅 --print）: text, json, stream-json\n  --json-schema <schema>                    结构化输出的 JSON Schema\n  --verbose                                 详细模式\n  -h, --help                                显示帮助\n  -v, --version                             显示版本\n\n  更多选项请参考: claude --help\n\n示例:\n  ccv                                       启动交互模式\n  ccv -c                                    继续上次对话\n  ccv -r                                    恢复对话\n  ccv -p \"hello\"                             打印模式\n  ccv --model opus                          指定模型\n  ccv --d                                   跳过权限确认（快捷方式）\n  ccv --ad                                  允许跳过权限（不立即启用，可通过 Shift+Tab 切换）\n  ccv -c --model sonnet --effort max        组合使用\n  ccv -SDK                                  Agent SDK 模式（无终端）\n  ccv -SDK --d                              SDK 模式 + 跳过权限\n  ccv -logger                               安装/修复 Hook\n  ccv --log-dir ~/my-logs                   使用自定义日志目录\n  ccv --no-open                             启动时不打开浏览器\n  ccv --user-name \"Alice\" --user-avatar ./avatar.png  自定义用户身份\n  ccv --log-dir /tmp/test --no-open         组合 CCV 选项",
+    "en": "CC Viewer CLI — Web Viewer frontend for Claude Code\n\nUsage: ccv [options] [command] [prompt]\n\nStarts an interactive session with Web Viewer by default. All args are passed\nthrough to claude.\n\nArguments:\n  prompt                                    Your prompt\n\nCCV Options:\n  -SDK, --sdk                               Use Agent SDK mode (no terminal, structured interaction)\n  -logger                                   Install/repair Claude Code hook\n  --uninstall                               Remove CC Viewer integration\n  --d                                       Shortcut for --dangerously-skip-permissions\n  --ad                                      Shortcut for --allow-dangerously-skip-permissions\n  --log-dir <path>                          Custom JSONL log storage directory\n  --no-open                                 Don't auto-open browser on startup\n  --user-name <name>                        Custom display name for this session\n  --user-avatar <path|url>                  Custom avatar image (file path or URL)\n  --usePassword[=<pwd>]                     Enable password login (remote needs password or token; bare flag → random 6-char: 2 letters + 4 digits)\n  --pid[=<name>]                            Lock an instance id so this ccv's current-session view is isolated per instance (reuse the same id next run)\n\nClaude Options (passed through):\n  -c, --continue                            Continue the most recent conversation\n  -r, --resume [value]                      Resume a conversation by session ID, or open picker\n  -p, --print                               Print response and exit (useful for pipes)\n  -d, --debug [filter]                      Enable debug mode\n  -w, --worktree [name]                     Create a new git worktree for this session\n  --model <model>                           Model for the current session\n  --effort <level>                          Effort level (low, medium, high, max)\n  --dangerously-skip-permissions            Bypass all permission checks\n  --allowedTools <tools...>                 Allowed tool names\n  --disallowedTools <tools...>              Disallowed tool names\n  --system-prompt <prompt>                  System prompt for the session\n  --append-system-prompt <prompt>           Append to default system prompt\n  --mcp-config <configs...>                 Load MCP servers from JSON files or strings\n  --permission-mode <mode>                  Permission mode for the session\n  --add-dir <directories...>                Additional directories to allow access to\n  --max-budget-usd <amount>                 Max dollar amount for API calls (--print only)\n  --output-format <format>                  Output format (--print only): text, json, stream-json\n  --json-schema <schema>                    JSON Schema for structured output\n  --verbose                                 Enable verbose mode\n  -h, --help                                Show help\n  -v, --version                             Show version\n\n  For all options, see: claude --help\n\nExamples:\n  ccv                                       Start interactive mode\n  ccv -c                                    Continue last conversation\n  ccv -r                                    Resume a conversation\n  ccv -p \"hello\"                             Print mode\n  ccv --model opus                          Specify model\n  ccv --d                                   Skip permission prompts (shortcut)\n  ccv --ad                                  Allow bypass mode (not active, toggle via Shift+Tab)\n  ccv -c --model sonnet --effort max        Combine options\n  ccv -SDK                                  Agent SDK mode (no terminal)\n  ccv -SDK --d                              SDK mode + bypass permissions\n  ccv -logger                               Install/repair hook\n  ccv --log-dir ~/my-logs                   Use custom log directory\n  ccv --no-open                             Start without opening browser\n  ccv --user-name \"Alice\" --user-avatar ./avatar.png  Custom user profile\n  ccv --log-dir /tmp/test --no-open         Combine CCV options",
     "zh-TW": "CC Viewer CLI — Claude Code 的 Web Viewer 前端\n\n用法: ccv [選項] [命令] [提示詞]\n\n預設啟動互動式會話 + Web Viewer，所有參數透傳給 claude。\n\n參數:\n  prompt                                    你的提示詞\n\nCCV 專屬選項:\n  -SDK, --sdk                               使用 Agent SDK 模式（無終端，結構化互動）\n  -logger                                   安裝/修復 Claude Code Hook\n  --uninstall                               移除 CC Viewer 整合\n  --d                                       --dangerously-skip-permissions 的快捷方式\n  --ad                                      --allow-dangerously-skip-permissions 的快捷方式\n  --log-dir <path>                          自訂 JSONL 日誌儲存目錄\n  --no-open                                 啟動時不自動開啟瀏覽器\n  --user-name <name>                        自訂顯示名稱\n  --user-avatar <path|url>                  自訂頭像圖片（檔案路徑或 URL）\n\nClaude 選項（透傳）:\n  -c, --continue                            繼續當前目錄最近的對話\n  -r, --resume [value]                      透過會話 ID 恢復對話，或開啟互動式選擇器\n  -p, --print                               列印回應後退出（適用於管道）\n  -d, --debug [filter]                      啟用除錯模式\n  -w, --worktree [name]                     為此會話建立新的 git worktree\n  --model <model>                           當前會話使用的模型\n  --effort <level>                          努力級別 (low, medium, high, max)\n  --dangerously-skip-permissions            跳過所有權限檢查\n  --allowedTools <tools...>                 允許的工具列表\n  --disallowedTools <tools...>              禁止的工具列表\n  --system-prompt <prompt>                  會話系統提示詞\n  --append-system-prompt <prompt>           追加系統提示詞\n  --mcp-config <configs...>                 載入 MCP 伺服器設定\n  --permission-mode <mode>                  權限模式\n  --add-dir <directories...>                額外允許存取的目錄\n  --max-budget-usd <amount>                 API 呼叫最大預算（僅 --print）\n  --output-format <format>                  輸出格式（僅 --print）: text, json, stream-json\n  --json-schema <schema>                    結構化輸出的 JSON Schema\n  --verbose                                 詳細模式\n  -h, --help                                顯示說明\n  -v, --version                             顯示版本\n\n  更多選項請參考: claude --help\n\n範例:\n  ccv                                       啟動互動模式\n  ccv -c                                    繼續上次對話\n  ccv -r                                    恢復對話\n  ccv -p \"hello\"                             列印模式\n  ccv --model opus                          指定模型\n  ccv --d                                   跳過權限確認（快捷方式）\n  ccv --ad                                  允許跳過權限（不立即啟用，可透過 Shift+Tab 切換）\n  ccv -c --model sonnet --effort max        組合使用\n  ccv -SDK                                  Agent SDK 模式（無終端）\n  ccv -SDK --d                              SDK 模式 + 跳過權限\n  ccv -logger                               安裝/修復 Hook\n  ccv --log-dir ~/my-logs                   使用自訂日誌目錄\n  ccv --no-open                             啟動時不開啟瀏覽器\n  ccv --user-name \"Alice\" --user-avatar ./avatar.png  自訂使用者身份\n  ccv --log-dir /tmp/test --no-open         組合 CCV 選項"
   },
   "cli.cMode.notFound": {
@@ -2935,6 +2935,66 @@ const i18nData = {
     "tr": "Hata: --im bir platform kimliği gerektirir (örn. dingtalk)",
     "uk": "Помилка: --im потребує id платформи (напр. dingtalk)"
   },
+  "cli.pidInvalid": {
+    "zh": "错误: --pid 需要一个非空的实例名（如 --pid=alpha）",
+    "en": "Error: --pid requires a non-empty instance name (e.g. --pid=alpha)",
+    "zh-TW": "錯誤: --pid 需要一個非空的實例名稱（如 --pid=alpha）",
+    "ko": "오류: --pid에는 비어 있지 않은 인스턴스 이름이 필요합니다 (예: --pid=alpha)",
+    "ja": "エラー: --pid には空でないインスタンス名が必要です (例: --pid=alpha)",
+    "de": "Fehler: --pid erfordert einen nicht leeren Instanznamen (z. B. --pid=alpha)",
+    "es": "Error: --pid requiere un nombre de instancia no vacío (p. ej. --pid=alpha)",
+    "fr": "Erreur : --pid nécessite un nom d'instance non vide (p. ex. --pid=alpha)",
+    "it": "Errore: --pid richiede un nome di istanza non vuoto (es. --pid=alpha)",
+    "da": "Fejl: --pid kræver et ikke-tomt instansnavn (f.eks. --pid=alpha)",
+    "pl": "Błąd: --pid wymaga niepustej nazwy instancji (np. --pid=alpha)",
+    "ru": "Ошибка: --pid требует непустого имени экземпляра (например, --pid=alpha)",
+    "ar": "خطأ: --pid يتطلب اسم نسخة غير فارغ (مثل --pid=alpha)",
+    "no": "Feil: --pid krever et ikke-tomt instansnavn (f.eks. --pid=alpha)",
+    "pt-BR": "Erro: --pid requer um nome de instância não vazio (ex.: --pid=alpha)",
+    "th": "ข้อผิดพลาด: --pid ต้องการชื่ออินสแตนซ์ที่ไม่ว่าง (เช่น --pid=alpha)",
+    "tr": "Hata: --pid boş olmayan bir örnek adı gerektirir (örn. --pid=alpha)",
+    "uk": "Помилка: --pid потребує непорожнього імені екземпляра (напр. --pid=alpha)"
+  },
+  "cli.instanceId": {
+    "zh": "实例 PID: {id}",
+    "en": "Instance PID: {id}",
+    "zh-TW": "實例 PID: {id}",
+    "ko": "인스턴스 PID: {id}",
+    "ja": "インスタンス PID: {id}",
+    "de": "Instanz-PID: {id}",
+    "es": "PID de instancia: {id}",
+    "fr": "PID d'instance : {id}",
+    "it": "PID istanza: {id}",
+    "da": "Instans-PID: {id}",
+    "pl": "PID instancji: {id}",
+    "ru": "PID экземпляра: {id}",
+    "ar": "PID النسخة: {id}",
+    "no": "Instans-PID: {id}",
+    "pt-BR": "PID da instância: {id}",
+    "th": "PID อินสแตนซ์: {id}",
+    "tr": "Örnek PID: {id}",
+    "uk": "PID екземпляра: {id}"
+  },
+  "cli.instanceHistory": {
+    "zh": "该项目历史 PID: {ids}",
+    "en": "Past PIDs for this project: {ids}",
+    "zh-TW": "此專案歷史 PID: {ids}",
+    "ko": "이 프로젝트의 이전 PID: {ids}",
+    "ja": "このプロジェクトの過去の PID: {ids}",
+    "de": "Frühere PIDs für dieses Projekt: {ids}",
+    "es": "PIDs anteriores de este proyecto: {ids}",
+    "fr": "PID précédents pour ce projet : {ids}",
+    "it": "PID precedenti per questo progetto: {ids}",
+    "da": "Tidligere PID'er for dette projekt: {ids}",
+    "pl": "Poprzednie PID-y tego projektu: {ids}",
+    "ru": "Прежние PID этого проекта: {ids}",
+    "ar": "معرّفات PID السابقة لهذا المشروع: {ids}",
+    "no": "Tidligere PID-er for dette prosjektet: {ids}",
+    "pt-BR": "PIDs anteriores deste projeto: {ids}",
+    "th": "PID ก่อนหน้าของโปรเจกต์นี้: {ids}",
+    "tr": "Bu projenin önceki PID'leri: {ids}",
+    "uk": "Попередні PID цього проєкту: {ids}"
+  },
   "cli.imUnknownPlatform": {
     "zh": "错误: 未知的 IM 平台: {id}",
     "en": "Error: unknown IM platform: {id}",

package/server/interceptor.js

@@ -16,7 +16,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { dirname, join, basename } from 'node:path';
 import { LOG_DIR } from '../findcc.js';
-import { assembleStreamMessage, createStreamAssembler, cleanupTempFiles, findRecentLog, isAnthropicApiPath, isMainAgentRequest, rotateLogFile, fingerprintMsg, replaceTopLevelModel } from './lib/interceptor-core.js';
+import { assembleStreamMessage, createStreamAssembler, cleanupTempFiles, findRecentLog, claimUntaggedLog, logFilePrefix, isAnthropicApiPath, isMainAgentRequest, rotateLogFile, fingerprintMsg, replaceTopLevelModel } from './lib/interceptor-core.js';
 
 
 
@@ -195,7 +195,11 @@ function generateNewLogFilePath() {
   const projectName = basename(cwd).replace(/[^a-zA-Z0-9_\-\.]/g, '_');
   const dir = join(LOG_DIR, projectName);
   try { mkdirSync(dir, { recursive: true }); } catch { }
-  return { filePath: join(dir, `${projectName}_${ts}.jsonl`), dir, projectName };
+  // `--pid`(CCV_INSTANCE_ID) 实例：文件名前缀 `<pid>__`，让每个实例只读/续自己的日志血脉（多进程隔离）。
+  // 内部读 env（与上面内部读 cwd 同理）→ 轮转/workspace 等所有 caller 自动带前缀，无需逐处传参。
+  // 前缀走单一来源 logFilePrefix（与 matcher 共用，防漂移）。
+  const instanceId = process.env.CCV_INSTANCE_ID || '';
+  return { filePath: join(dir, `${logFilePrefix(projectName, instanceId)}${ts}.jsonl`), dir, projectName };
 }
 
 // Resume 状态（供 server.js 使用）
@@ -310,6 +314,10 @@ let _teamName = null;
   if (teamIdx !== -1 && teamIdx + 1 < args.length) _teamName = args[teamIdx + 1];
 }
 
+// `--pid` 实例 id（cli.js 在 import server 前已设 env，时序安全）。null = 默认模式（不分实例）。
+// 只用于日志文件名的分实例隔离（findRecentLog/cleanupTempFiles/claim）；不影响 claude 自己的 -c。
+const INSTANCE_ID = process.env.CCV_INSTANCE_ID || null;
+
 // 初始化日志文件路径（异步，支持用户交互）
 // 工作区模式下延迟到选择工作区后再初始化
 let _newLogFile, _logDir, _projectName;
@@ -323,12 +331,13 @@ if (process.env.CCV_WORKSPACE_MODE === '1') {
   try { cwd = process.cwd(); } catch { cwd = homedir(); }
   _projectName = basename(cwd).replace(/[^a-zA-Z0-9_\-\.]/g, '_');
   _logDir = join(LOG_DIR, _projectName);
-  const _leaderLog = findRecentLog(_logDir, _projectName);
+  // teammate 子进程继承同一 env（含 CCV_INSTANCE_ID）→ 命中 leader 的 pid 日志；无 env 时为 null = 现状。
+  const _leaderLog = findRecentLog(_logDir, _projectName, INSTANCE_ID);
   _newLogFile = _leaderLog || ''; // 没有 leader 日志时不写入
 } else {
   ({ filePath: _newLogFile, dir: _logDir, projectName: _projectName } = generateNewLogFilePath());
-  // 启动时清理残留临时文件
-  cleanupTempFiles(_logDir, _projectName);
+  // 启动时清理残留临时文件（按本实例收窄，避免多进程下 rename 掉别的实例正在写的 _temp）
+  cleanupTempFiles(_logDir, _projectName, INSTANCE_ID);
 }
 let LOG_FILE = _newLogFile;
 
@@ -344,7 +353,14 @@ const _initPromise = (async () => {
   if (!_logDir || !_projectName) return; // 工作区模式下跳过
   if (_isTeammate) return; // Teammate 已在上方同步初始化，跳过 async resume 流程
   try {
-    const recentLog = findRecentLog(_logDir, _projectName);
+    let recentLog = findRecentLog(_logDir, _projectName, INSTANCE_ID);
+    // 首启接管（仅 --pid 实例）：本 pid 还没有自己的日志时，可接管项目里最近的【无标签】日志
+    // （原子 rename 成 `<pid>__…`），从此并入该 pid 血脉。claim 必须在 build _resumeState 之前，
+    // 这样 _resumeState.recentFile 指向 rename 后的新路径（否则会指向已被移走的旧名）。
+    if (!recentLog && INSTANCE_ID) {
+      const claimed = claimUntaggedLog(_logDir, _projectName, INSTANCE_ID);
+      if (claimed) recentLog = claimed;
+    }
     if (recentLog) {
       // IM worker：无人值守、无 UI 可应答 resume 交互。直接 continue 最近会话日志（保留记忆、
       // 让记录弹窗读到同一份持续增长的文件），不进入 resume 交互状态（否则会一直写 *_temp.jsonl，
@@ -374,11 +390,17 @@ export function initForWorkspace(projectPath, { forceNew = false } = {}) {
   const dir = join(LOG_DIR, projectName);
   try { mkdirSync(dir, { recursive: true }); } catch {}
 
-  cleanupTempFiles(dir, projectName);
+  cleanupTempFiles(dir, projectName, INSTANCE_ID);
 
   // 检查是否有最近的日志文件可以复用（始终复用最新日志）
   // forceNew: Electron multi-tab 模式下强制创建新文件，避免与已有 ccv 实例共享日志
-  const recentLog = !forceNew && findRecentLog(dir, projectName);
+  let recentLog = !forceNew && findRecentLog(dir, projectName, INSTANCE_ID);
+  // 首启接管（与单项目模式 _initPromise 一致）：本 pid 在该 workspace 还没有自己的日志时，
+  // 接管最近的无标签日志，避免 workspace 模式下 --pid 首启不接管的不一致。forceNew 时显式不接管。
+  if (!recentLog && INSTANCE_ID && !forceNew) {
+    const claimed = claimUntaggedLog(dir, projectName, INSTANCE_ID);
+    if (claimed) recentLog = claimed;
+  }
   if (recentLog) {
     _projectName = projectName;
     _logDir = dir;
@@ -398,7 +420,8 @@ export function initForWorkspace(projectPath, { forceNew = false } = {}) {
     + String(now.getMinutes()).padStart(2, '0')
     + String(now.getSeconds()).padStart(2, '0');
 
-  const filePath = join(dir, `${projectName}_${ts}.jsonl`);
+  // 与 generateNewLogFilePath 同款命名（共用 logFilePrefix）：`--pid` 实例带 `<pid>__` 前缀。
+  const filePath = join(dir, `${logFilePrefix(projectName, INSTANCE_ID)}${ts}.jsonl`);
 
   _projectName = projectName;
   _logDir = dir;

package/server/lib/auth.js

@@ -9,8 +9,9 @@
 // unit-tested directly (loopback HTTP tests always look local, so they cannot
 // exercise the remote branch — `decideAuth` covers it as a pure function).
 import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { renameSyncWithRetry } from './file-api.js';
 import { LOG_DIR } from '../../findcc.js';
 import { tFor, localeFromAcceptLanguage } from '../i18n.js';
 
@@ -141,10 +142,24 @@ function writePrefs(prefs) {
   const p = getPrefsPath();
   const dir = dirname(p);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
-  writeFileSync(p, JSON.stringify(prefs, null, 2), { mode: 0o600 });
-  // writeFileSync's mode only applies on creation; a pre-existing file keeps its old
-  // perms. Re-assert 0600 — preferences.json now carries the (base64) password.
-  try { chmodSync(p, 0o600); } catch { /* best-effort; non-POSIX or race */ }
+  // Atomic tmp→rename so a crash mid-write can't truncate the password-bearing file
+  // (preferences.json also holds UI prefs + per-project forks). Mirrors prefs-store.js.
+  // TODO(prefs-lock): this path does NOT take the prefs-store lock (writePrefs is sync, its
+  // callers are sync) — auth writes are rare/admin-initiated, so the residual lost-update
+  // window vs a concurrent locked prefs write is accepted; atomicity rules out corruption.
+  // Dormant only while every mutatePrefs mutator stays synchronous (no await between its
+  // locked read and write); route auth writes through prefs-store.mutatePrefs if that changes.
+  const tmp = `${p}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  try {
+    writeFileSync(tmp, JSON.stringify(prefs, null, 2), { mode: 0o600 });
+    renameSyncWithRetry(tmp, p);
+    // writeFileSync's mode only applies on creation; a pre-existing file keeps its old
+    // perms. Re-assert 0600 — preferences.json now carries the (base64) password.
+    try { chmodSync(p, 0o600); } catch { /* best-effort; non-POSIX or race */ }
+  } catch (err) {
+    try { unlinkSync(tmp); } catch {}
+    throw err;
+  }
 }
 
 /**

package/server/lib/instance-registry.js

@@ -0,0 +1,57 @@
+// Passive registry of instance ids (`--pid`) used per project — a memory aid only.
+//
+// On startup with `--pid X`, the server appends X to `{projectDir}/.instances.json` so the
+// CLI banner can remind the user which ids they've used ("history: alpha, beta") next time.
+// This is NOT a liveness / auto-numbering registry: entries are never probed or auto-assigned,
+// just remembered (deduped, most-recent-last, capped). `logDir` is the per-project dir;
+// '' (no active project) → record no-ops / list returns [].
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { renameSyncWithRetry } from './file-api.js';
+import { withFileLockAsync } from './async-file-lock.js';
+import { sanitizeInstanceId } from './session-pin-store.js';
+
+const MAX_INSTANCES = 50; // cap the list; oldest entries drop off (memory aid, not an audit log)
+
+function instancesFile(logDir) { return join(logDir, '.instances.json'); }
+
+function readListRaw(logDir) {
+  try {
+    const file = instancesFile(logDir);
+    if (!existsSync(file)) return [];
+    const arr = JSON.parse(readFileSync(file, 'utf-8'));
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string' && x) : [];
+  } catch { return []; }
+}
+
+/** Previously-used instance ids for this project, oldest → newest. No project → []. */
+export function listInstances(logDir) {
+  if (!logDir) return [];
+  return readListRaw(logDir);
+}
+
+/**
+ * Record an instance id: dedupe (move-to-end so "most recent" wins), cap at MAX_INSTANCES.
+ * Cross-process safe via the shared async file lock + atomic tmp→rename. No project /
+ * empty id → no-op.
+ */
+export async function recordInstance(logDir, instanceId) {
+  if (!logDir) return;
+  const id = sanitizeInstanceId(instanceId);
+  if (!id) return;
+  await withFileLockAsync(join(logDir, '.instances.lock'), () => {
+    const list = readListRaw(logDir).filter((x) => x !== id);
+    list.push(id);
+    while (list.length > MAX_INSTANCES) list.shift();
+    const file = instancesFile(logDir);
+    const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+    try {
+      writeFileSync(tmp, JSON.stringify(list));
+      renameSyncWithRetry(tmp, file);
+    } catch (err) {
+      try { unlinkSync(tmp); } catch {}
+      throw err;
+    }
+  }, { ensureDir: logDir });
+}

package/server/lib/interceptor-core.js

@@ -1,6 +1,6 @@
 import { appendFileSync, existsSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { renameSyncWithRetry } from './file-api.js';
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 
 const SUBAGENT_SYSTEM_RE = /(?:command execution|file search|planning) specialist|general-purpose agent|security monitor|performing a web search/i;
 
@@ -251,12 +251,33 @@ export function createStreamAssembler() {
   };
 }
 
-export function findRecentLog(dir, projectName) {
+// 日志文件名前缀【单一来源】：writer（generateNewLogFilePath / initForWorkspace）与 matcher 共用，
+// 防止两侧命名漂移。默认 `<project>_`；`--pid` 实例 `<pid>__<project>_`。完整文件名 = `${prefix}${ts}.jsonl`。
+export function logFilePrefix(projectName, instanceId) {
+  return instanceId ? `${instanceId}__${projectName}_` : `${projectName}_`;
+}
+
+// 日志文件名归属判定（实例隔离）。`--pid` 实例文件名为 `<pid>__<project>_<ts>…`，无 pid 为 `<project>_<ts>…`。
+//  - instanceId 非空：必须精确以 `<pid>__<project>_` 开头（只认本实例）。
+//  - instanceId 空（默认）：以 `<project>_` 开头【且】不含 pid 分隔特征 `__<project>_`。后一条堵住前缀碰撞——
+//    若用户把 --pid 取成项目名或 `<项目>_…`（如项目 proj 用 --pid=proj → `proj__proj_…` 也会 startsWith `proj_`），
+//    仅靠前缀无法排除；而任何 pid 文件按构造必含 `__<project>_`，无标签文件绝不含（即便项目名自身带 `__`），据此精确排除。
+export function logFileMatcher(projectName, instanceId) {
+  const p = logFilePrefix(projectName, instanceId);
+  if (instanceId) return (f) => f.startsWith(p);
+  const pidMark = `__${projectName}_`;
+  return (f) => f.startsWith(p) && !f.includes(pidMark);
+}
+
+// instanceId 为可选第 3 参（默认 null = 现状）：非空时只在本实例自己的日志里找（多进程隔离），
+// 现有 2 参调用方与单测零改动。
+export function findRecentLog(dir, projectName, instanceId = null) {
   try {
+    const owns = logFileMatcher(projectName, instanceId);
     const files = readdirSync(dir)
       // 排除 *_temp.jsonl：临时文件是未完成的写入态（resume 流程中途产物），
       // 不应被当作"最近完整日志"（否则 _temp 因 sort 排在正式文件之后会被误选）。
-      .filter(f => f.startsWith(projectName + '_') && f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl'))
+      .filter(f => owns(f) && f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl'))
       .sort()
       .reverse();
     if (files.length === 0) return null;
@@ -265,10 +286,37 @@ export function findRecentLog(dir, projectName) {
   return null;
 }
 
-export function cleanupTempFiles(dir, projectName) {
+// 首启接管（仅 --pid 实例）：本 pid 还没有自己的日志时，把项目里最近的【无标签】日志原子 rename 成
+// `<pid>__<project>_<ts>.jsonl`，并入该 pid 血脉（move 而非 copy：不双计入统计）。返回接管后的新路径，或 null。
+//
+// 这是 best-effort 便利特性，不是核心隔离（核心隔离=各 pid 读自己的日志，不依赖接管）。为不误抢一个仍存活的
+// 无 pid 实例（评审标记的 live-writer / 卡在 resume 的窄边角），双重守卫：① 项目里若存在任何无标签 `*_temp.jsonl`
+// （某个无 pid 实例正卡在 resume / 在写）→ 放弃；② 无标签日志 mtime 必须早于 freshnessMs(默认 5min)。仍有理论窄缝
+// （进程挂起 >5min 且无 temp），属可接受的便利取舍。并发下原子 rename 只一个赢、输者 throw→吞→null（回退全新）。
+export function claimUntaggedLog(dir, projectName, instanceId, { freshnessMs = 300000 } = {}) {
+  if (!instanceId) return null;
+  try {
+    const untagged = findRecentLog(dir, projectName, null); // 最近无标签日志（已排除 pid 文件 + temp）
+    if (!untagged) return null;
+    // ① 存在无标签 temp ⇒ 有无 pid 实例正活动/卡在 resume → 不接管。
+    const owns = logFileMatcher(projectName, null);
+    const hasUntaggedTemp = readdirSync(dir).some(f => owns(f) && f.endsWith('_temp.jsonl'));
+    if (hasUntaggedTemp) return null;
+    let st;
+    try { st = statSync(untagged); } catch { return null; }
+    if (Date.now() - st.mtimeMs < freshnessMs) return null; // ② 可能是活动写者 → 不碰
+    const claimed = join(dir, `${instanceId}__${basename(untagged)}`);
+    if (existsSync(claimed)) return null;                   // 极端撞名 → 放弃
+    renameSyncWithRetry(untagged, claimed);
+    return claimed;
+  } catch { return null; }
+}
+
+export function cleanupTempFiles(dir, projectName, instanceId = null) {
   try {
+    const owns = logFileMatcher(projectName, instanceId);
     const tempFiles = readdirSync(dir)
-      .filter(f => f.startsWith(projectName + '_') && f.endsWith('_temp.jsonl'));
+      .filter(f => owns(f) && f.endsWith('_temp.jsonl'));
     for (const f of tempFiles) {
       try {
         const tempPath = join(dir, f);

package/server/lib/log-management.js

@@ -6,6 +6,7 @@ import { join, sep } from 'node:path';
 import { reconstructEntries } from './delta-reconstructor.js';
 import { streamReconstructedEntriesAsync } from './log-stream.js';
 import { archiveJsonl, resolveJsonlPath } from './jsonl-archive.js';
+import { logFileMatcher } from './interceptor-core.js';
 
 export function validateLogPath(logDir, file) {
   const filePath = join(logDir, file);
@@ -28,7 +29,20 @@ function isLogFileName(name) {
   return name.endsWith('.jsonl') || name.endsWith('.jsonl.zip');
 }
 
-export async function listLocalLogs(logDir, currentProjectName) {
+// 解析日志文件名里的时间戳 `YYYYMMDD_HHMMSS`（带不带 `<pid>__` 前缀、归档与否都适用）。
+// 用于「按时间排序 / 判最新」——文件名整串排序会把 `<pid>__` 前缀（'1' < 'c'）的最新文件排到最底，
+// 必须按时间戳排。无法解析时返回 ''（排到最后）。listLocalLogs 与 archiveLogFiles 共用，防漂移。
+function parseLogTs(name) {
+  const m = name.match(/_(\d{8}_\d{6})\.jsonl(\.zip)?$/);
+  return m ? m[1] : '';
+}
+
+// instanceId / showAll 为可选项（默认 null / false = 现状的反面：硬隔离）：
+//  - instanceId 非空：只列本实例 `<pid>__<project>_…` 的日志；
+//  - instanceId 空：只列无标签 `<project>_…` 日志（排除任何 `<pid>__` 文件）；
+//  - showAll=true：越过上面的归属过滤，列出目录下全部日志（顶部「显示全部」开关用）。
+// 复用 interceptor-core 的 logFileMatcher（与写入端共用，防命名漂移）。第 3 参可选 → 旧 2 参调用零改动。
+export async function listLocalLogs(logDir, currentProjectName, { instanceId = null, showAll = false } = {}) {
   const grouped = {};
   if (!existsSync(logDir)) return { ...grouped, _currentProject: currentProjectName || '' };
 
@@ -37,30 +51,47 @@ export async function listLocalLogs(logDir, currentProjectName) {
     if (!entry.isDirectory()) continue;
     const project = entry.name;
     const projectDir = join(logDir, project);
-    const files = (await readdir(projectDir))
-      .filter(isLogFileName)
-      .sort()
-      .reverse();
-    let statsFiles = null;
+    // 单个项目目录读失败（权限 / 被并发删除 / EMFILE 等）只跳过该项目，不拖垮整个列表。
     try {
-      const statsFile = join(projectDir, `${project}.json`);
-      if (existsSync(statsFile)) {
-        statsFiles = JSON.parse(await readFile(statsFile, 'utf-8')).files;
+      const owns = logFileMatcher(project, instanceId);
+      const files = (await readdir(projectDir)).filter(isLogFileName);
+      let statsFiles = null;
+      try {
+        const statsFile = join(projectDir, `${project}.json`);
+        if (existsSync(statsFile)) {
+          statsFiles = JSON.parse(await readFile(statsFile, 'utf-8')).files;
+        }
+      } catch { }
+      for (const f of files) {
+        if (!showAll && !owns(f)) continue;
+        const match = f.match(/^(.+?)_(\d{8}_\d{6})\.jsonl(\.zip)?$/);
+        if (!match) continue;
+        const ts = match[2];
+        const archived = !!match[3];
+        // 从前缀解析归属实例 id 用于行内 badge：`<pid>__<project>` → pid；`<project>` → 无（null）。
+        // 项目名自身可含下划线，故用 endsWith('__'+project) 精确剥离，而非按 '__' split。
+        const g1 = match[1];
+        const fileInstanceId = (g1 !== project && g1.endsWith('__' + project))
+          ? g1.slice(0, -(project.length + 2))
+          : null;
+        const filePath = join(projectDir, f);
+        let size;
+        try { size = (await stat(filePath)).size; } catch { continue; }
+        if (size === 0) continue;
+        const stats = statsFiles?.[f] || (archived ? statsFiles?.[f.slice(0, -4)] : null);
+        const turns = stats?.summary?.sessionCount || 0;
+        if (!grouped[project]) grouped[project] = [];
+        grouped[project].push({ file: `${project}/${f}`, timestamp: ts, size, turns, preview: stats?.preview || [], archived, instanceId: fileInstanceId });
       }
-    } catch { }
-    for (const f of files) {
-      const match = f.match(/^(.+?)_(\d{8}_\d{6})\.jsonl(\.zip)?$/);
-      if (!match) continue;
-      const ts = match[2];
-      const archived = !!match[3];
-      const filePath = join(projectDir, f);
-      let size;
-      try { size = (await stat(filePath)).size; } catch { continue; }
-      if (size === 0) continue;
-      const stats = statsFiles?.[f] || (archived ? statsFiles?.[f.slice(0, -4)] : null);
-      const turns = stats?.summary?.sessionCount || 0;
-      if (!grouped[project]) grouped[project] = [];
-      grouped[project].push({ file: `${project}/${f}`, timestamp: ts, size, turns, preview: stats?.preview || [], archived });
+      // 按时间戳降序（文件名降序兜底，处理同秒 tie，保证确定性）。
+      // 不能再依赖文件名整串排序：`<pid>__` 前缀会把最新日志排到最底。
+      if (grouped[project]) {
+        grouped[project].sort((a, b) =>
+          b.timestamp.localeCompare(a.timestamp) || b.file.localeCompare(a.file));
+      }
+    } catch (err) {
+      console.error(`[CC Viewer] listLocalLogs: 跳过无法读取的项目 ${project}:`, err?.message || err);
+      continue;
     }
   }
   return { ...grouped, _currentProject: currentProjectName || '' };
@@ -242,10 +273,11 @@ export function archiveLogFiles(logDir, files) {
     const projectDir = join(logDir, project);
     let latest = null;
     try {
+      // 「最新文件不允许归档」——按时间戳判最新（与 listLocalLogs 同口径），
+      // 否则文件名整串排序会把 `<pid>__` 前缀的最新活跃日志误判成非最新而放行归档。
       const projectEntries = readdirSync(projectDir)
         .filter(isLogFileName)
-        .sort()
-        .reverse();
+        .sort((a, b) => parseLogTs(b).localeCompare(parseLogTs(a)) || b.localeCompare(a));
       latest = projectEntries[0] || null;
     } catch {}
 

package/server/lib/prefs-store.js

@@ -0,0 +1,83 @@
+// Single correct writer for {LOG_DIR}/preferences.json.
+//
+// preferences.json holds UI prefs AND the (base64) LAN password (auth) AND per-project
+// forks (prefsByProject). Multiple writers touch it — the global POST /api/preferences,
+// lib/auth.js, and the new project-prefs routes — so every write here goes through ONE
+// async file lock + atomic tmp→rename, mirroring server/lib/ask-store.js. Same-process
+// callers serialize via withFileLockAsync's per-lockPath Promise chain; cross-process
+// callers mutex on the lock file. This prevents a concurrent writer from clobbering the
+// password-bearing file or losing a fork update.
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { renameSyncWithRetry } from './file-api.js';
+import { withFileLockAsync } from './async-file-lock.js';
+import { mergeApprovalModalPrefs } from './approval-modal-prefs.js';
+import { reconcileVoicePackPrefs } from './voice-pack-manager.js';
+import { LOG_DIR } from '../../findcc.js';
+
+// Path is computed fresh each call: LOG_DIR is a live binding (setLogDir) and tests
+// redirect it via CCV_LOG_DIR before importing. Matches lib/auth.js getPrefsPath().
+// In production every caller resolves to this same canonical path; the optional `file`
+// override on the helpers below exists only so the preferences route can forward its
+// deps.getPrefsFile() seam (used by branch tests) and stay symmetric with the GET read.
+export function getPrefsFile() { return join(LOG_DIR, 'preferences.json'); }
+// Lock lives next to the file so every writer of the SAME preferences.json shares one lock
+// (global POST, fork ops, …). In prod all paths are canonical ⇒ one lock ⇒ serialized.
+function getPrefsLock(file) { return join(dirname(file), 'preferences.lock'); }
+
+/** Read the raw on-disk prefs object (no stripping, no virtual defaults). {} on miss/corrupt. */
+export function readPrefsRaw(file = getPrefsFile()) {
+  try {
+    if (!existsSync(file)) return {};
+    const obj = JSON.parse(readFileSync(file, 'utf-8'));
+    return obj && typeof obj === 'object' ? obj : {};
+  } catch { return {}; }
+}
+
+/** Atomic write (tmp + rename) with 0600 — the file may carry the base64 password. */
+function writePrefsAtomic(prefs, file) {
+  mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  try {
+    writeFileSync(tmp, JSON.stringify(prefs, null, 2), { mode: 0o600 });
+    renameSyncWithRetry(tmp, file);
+    // writeFileSync's mode only applies on creation; re-assert 0600 on a pre-existing file.
+    try { chmodSync(file, 0o600); } catch { /* best-effort; non-POSIX or race */ }
+  } catch (err) {
+    try { unlinkSync(tmp); } catch {}
+    throw err;
+  }
+}
+
+/**
+ * Locked read-modify-write. Reads the raw prefs inside the lock, runs mutator(prefs)
+ * (mutate in place; may be async), atomically writes, and returns the mutator's return
+ * value when defined, else the mutated prefs object. `file` defaults to the canonical path.
+ */
+export async function mutatePrefs(mutator, file = getPrefsFile()) {
+  return withFileLockAsync(getPrefsLock(file), async () => {
+    const prefs = readPrefsRaw(file);
+    const result = await mutator(prefs);
+    writePrefsAtomic(prefs, file);
+    return result !== undefined ? result : prefs;
+  }, { ensureDir: dirname(file) });
+}
+
+/**
+ * Apply a preferences patch onto `target` IN PLACE — the single-sourced merge used by
+ * both the global POST and per-project fork writes so the two paths can't drift.
+ * Scalars shallow-merge; approvalModal goes through mergeApprovalModalPrefs (with voice
+ * pack reconcile when a logDir is given).
+ */
+export function applyPrefsPatch(target, patch, { logDir = null } = {}) {
+  if (!patch || typeof patch !== 'object') return target;
+  const { approvalModal: incAM, ...rest } = patch;
+  Object.assign(target, rest);
+  if (incAM && typeof incAM === 'object') {
+    target.approvalModal = mergeApprovalModalPrefs(target.approvalModal, incAM, {
+      reconcile: logDir ? (vp) => reconcileVoicePackPrefs(logDir, vp) : null,
+    });
+  }
+  return target;
+}