cc-viewer 1.6.322 → 1.6.324

package/server/lib/project-prefs.js

@@ -0,0 +1,94 @@
+// Per-project preference forks — pure helpers around the `prefsByProject` map inside
+// preferences.json. Mirrors the per-project scheme already used by lib/auth.js
+// (authByProject): keyed by the FULL project directory so two projects that share a
+// basename ("~/work/app" vs "~/play/app") never collapse into one fork.
+//
+//   preferences.json:
+//     prefsByProject: { "<projectDir>": { ...forkedPrefs } }
+//
+// A project "has a fork" iff a key exists for it (hasOwnProperty). Removing a fork
+// (toggle off) deletes the key so the project inherits global again.
+import { basename } from 'node:path';
+import { mergeApprovalModalPrefs } from './approval-modal-prefs.js';
+import { listPlatforms } from './im-config.js';
+import { _projectName } from '../interceptor.js';
+
+// SINGLE SOURCE of "what must never live inside a fork": secrets (auth password + IM creds),
+// machine-level paths (logDir/claudeConfigDir), and the internal forks map. snapshotForFork /
+// cleanPatch / the admin list read all funnel through stripSensitive so the rule can't drift.
+const STRIP_KEYS = ['auth', 'authByProject', 'prefsByProject', 'logDir', 'claudeConfigDir'];
+
+/** Strip secrets + IM credentials + machine-level keys from a prefs-shaped object in place. */
+export function stripSensitive(obj) {
+  if (!obj || typeof obj !== 'object') return obj;
+  for (const k of STRIP_KEYS) delete obj[k];
+  for (const id of listPlatforms()) delete obj[id];
+  return obj;
+}
+
+/** Full project dir used as the fork key — same scheme as server.js AUTH_PROJECT. */
+export function getCurrentProjectKey() {
+  return process.env.CCV_PROJECT_DIR || process.cwd();
+}
+
+/** Human-readable project name for display (interceptor's sanitized basename). */
+export function getCurrentProjectName() {
+  return _projectName || basename(getCurrentProjectKey());
+}
+
+/**
+ * Whether the server is currently serving a concrete project. In workspace mode the
+ * project is unknown until a workspace is launched (interceptor _projectName / env are
+ * empty) — refuse to fork under the server's own cwd in that window.
+ */
+export function hasActiveProject() {
+  if (process.env.CCV_WORKSPACE_MODE === '1') {
+    return !!(process.env.CCV_PROJECT_DIR || _projectName);
+  }
+  return true;
+}
+
+/** Does `key` have a fork? (key present, regardless of contents) — mirror auth.hasOverride. */
+export function hasFork(prefs, key) {
+  return !!(key && prefs && prefs.prefsByProject &&
+    Object.prototype.hasOwnProperty.call(prefs.prefsByProject, key));
+}
+
+/** List of project dirs that currently have a fork. */
+export function listForks(prefs) {
+  return (prefs && prefs.prefsByProject && typeof prefs.prefsByProject === 'object')
+    ? Object.keys(prefs.prefsByProject)
+    : [];
+}
+
+/**
+ * Curated snapshot of the current GLOBAL prefs to seed a new fork. Deep-copied from the
+ * RAW file object (not a GET payload — avoids baking the resumeAutoChoice='continue'
+ * virtual default), with secrets / machine-level / internal / `_`-meta keys removed.
+ */
+export function snapshotForFork(prefsRaw) {
+  const copy = JSON.parse(JSON.stringify(prefsRaw || {}));
+  for (const k of Object.keys(copy)) if (k[0] === '_') delete copy[k]; // 元字段
+  return stripSensitive(copy); // 密码/IM/机器级/forks 单一来源剥离
+}
+
+/**
+ * Build the effective prefs a scoped (non-loopback) client should see: fork values win
+ * over global for scalars, approvalModal deep-merged (fork over global). Keys absent from
+ * the fork fall through to global so newly-added global settings stay forward-compatible.
+ * Machine-level fields (logDir/claudeConfigDir) are NOT handled here — the GET handler
+ * stamps them after this runs.
+ */
+export function resolveScoped(globalPrefs, fork) {
+  const { approvalModal: gAM, ...gRest } = globalPrefs || {};
+  const { approvalModal: fAM, ...fRest } = fork || {};
+  const merged = { ...gRest, ...fRest };
+  if (gAM || fAM) {
+    // 防引用别名：fork 无 approvalModal 时也返回浅拷贝，避免调用方（preferencesGet 的
+    // voicePack reconcile）回写到解析出的全局对象（当前每请求新解析虽无害，仍保持"绝不外泄内部引用"）。
+    merged.approvalModal = fAM
+      ? mergeApprovalModalPrefs(gAM, fAM, {})
+      : { ...gAM };
+  }
+  return merged;
+}

package/server/lib/session-pin-store.js

@@ -0,0 +1,67 @@
+// Server-side "current session" pin store, per project (+ optional instance id).
+//
+// The "仅展示当前会话" view filter needs a single "current session pointer". It used to
+// live in the browser's localStorage (keyed by project name) — so two devices hitting the
+// SAME ccv process diverged. We move it server-side: one tiny JSON per project, optionally
+// suffixed by an instance id (`--pid`) so multiple ccv processes of one project can isolate.
+//
+// `logDir` here is the PER-PROJECT directory (interceptor._logDir = LOG_DIR/<projectName>);
+// '' means no active project (workspace mode not yet launched) → read = null / write = no-op.
+// Writes are atomic (tmp + rename) so a torn read can't happen when several writers race
+// (mirrors server/lib/prefs-store.js).
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { renameSyncWithRetry } from './file-api.js';
+
+// Sanitize an instance id into a filesystem-safe token (same charset as projectName).
+// Returns '' for empty/falsy → caller treats it as the no-instance (shared) key.
+export function sanitizeInstanceId(instanceId) {
+  if (!instanceId || typeof instanceId !== 'string') return '';
+  return instanceId.replace(/[^a-zA-Z0-9_\-.]/g, '_');
+}
+
+/** Pin file path inside the project dir: `.session-pin.json` or `.session-pin.<id>.json`. */
+export function pinFilePath(logDir, instanceId) {
+  const id = sanitizeInstanceId(instanceId);
+  return join(logDir, id ? `.session-pin.${id}.json` : '.session-pin.json');
+}
+
+/** Read the pinned session id. No project / missing file / corrupt → null. */
+export function readPin(logDir, instanceId) {
+  if (!logDir) return null;
+  try {
+    const file = pinFilePath(logDir, instanceId);
+    if (!existsSync(file)) return null;
+    const obj = JSON.parse(readFileSync(file, 'utf-8'));
+    const v = obj && typeof obj === 'object' ? obj.pinnedSessionId : null;
+    return (typeof v === 'string' && v) ? v : null;
+  } catch { return null; }
+}
+
+/**
+ * Write (or clear) the pinned session id. No project (logDir = '') → no-op, returns false.
+ * A null/empty pinnedSessionId deletes the file (back to "show latest"). Atomic tmp+rename.
+ * Returns true on success, false on no-project / write failure (view state is best-effort).
+ */
+export function writePin(logDir, instanceId, pinnedSessionId) {
+  if (!logDir) return false;
+  const file = pinFilePath(logDir, instanceId);
+  const id = (typeof pinnedSessionId === 'string' && pinnedSessionId) ? pinnedSessionId : null;
+  try {
+    if (id == null) {
+      try { unlinkSync(file); } catch { /* already absent */ }
+      return true;
+    }
+    mkdirSync(logDir, { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+    try {
+      writeFileSync(tmp, JSON.stringify({ pinnedSessionId: id }));
+      renameSyncWithRetry(tmp, file);
+    } catch (err) {
+      try { unlinkSync(tmp); } catch {}
+      throw err;
+    }
+    return true;
+  } catch { return false; }
+}

package/server/routes/logs.js

@@ -6,9 +6,12 @@ import { _projectName } from '../interceptor.js';
 import { listLocalLogs, deleteLogFiles, mergeLogFiles, archiveLogFiles, validateLogPath } from '../lib/log-management.js';
 import { countLogEntries, streamRawEntriesAsync, readTailEntries } from '../lib/log-stream.js';
 
-async function localLogs(req, res) {
+async function localLogs(req, res, parsedUrl, isLocal, deps) {
   try {
-    const result = await listLocalLogs(LOG_DIR, _projectName);
+    // 按当前实例 pid 硬隔离日志列表；`?all=1` 越过过滤看全部实例（顶部「显示全部」开关）。
+    const instanceId = (deps && deps.instanceId) || null;
+    const showAll = parsedUrl?.searchParams?.get('all') === '1';
+    const result = await listLocalLogs(LOG_DIR, _projectName, { instanceId, showAll });
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(result));
   } catch (err) {

package/server/routes/preferences.js

@@ -1,15 +1,18 @@
 // Preferences, Claude settings, and proxy-profile routes (moved verbatim from server.js).
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { LOG_DIR, setLogDir, getClaudeConfigDir } from '../../findcc.js';
 import { PROFILE_PATH, _defaultConfig, getActiveProfileId, setActiveProfileForWorkspace, _loadProxyProfile } from '../interceptor.js';
 import { setLang } from '../i18n.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
-import { mergeApprovalModalPrefs as vpMergeAM } from '../lib/approval-modal-prefs.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im-config.js';
+import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import {
+  getCurrentProjectKey, getCurrentProjectName, hasFork, listForks, resolveScoped,
+} from '../lib/project-prefs.js';
 
 // IM bridge configs (dingtalk, feishu, …) carry base64 app secrets and are only exposed via the
 // admin-only /api/dingtalk/* and /api/im/* surfaces (with secrets masked). Strip every platform's
@@ -35,6 +38,22 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   delete prefs.auth;
   delete prefs.authByProject;
   stripImConfigs(prefs); // dingtalk / feishu / … — admin-only, never to a LAN client
+  // 项目独立配置（多人共用一台 server 时按项目隔离偏好）：非本机(LAN)客户端若当前项目有 fork，
+  // 解析出该项目的有效偏好；本机(admin)始终看全局。forks blob 绝不下发，仅以 _projectPrefsKeys
+  // 元信息告知本机管理入口该不该出现。元字段以 _ 前缀标记，POST 侧会剥离不落盘。
+  const _projectKey = getCurrentProjectKey();
+  const _scoped = !isLocal && hasFork(prefs, _projectKey);
+  const _forkKeys = isLocal ? listForks(prefs) : null; // 计算需早于 delete prefsByProject
+  const _fork = _scoped ? prefs.prefsByProject[_projectKey] : null;
+  delete prefs.prefsByProject;
+  if (_scoped) {
+    prefs = resolveScoped(prefs, _fork);
+    // 防御性二次剥离：fork 按构造已不含密码/IM（写入侧已剥），但这是唯一把 fork 内容下发给远程
+    // 客户端的读路径，与 admin 列表口保持对称——手改 preferences.json 注入的脏 fork 也不会泄露。
+    delete prefs.auth;
+    delete prefs.authByProject;
+    stripImConfigs(prefs);
+  }
   prefs.logDir = LOG_DIR; // 始终返回当前运行时的日志目录
   // 日志设置出厂默认"继承"：键缺失（从未设置过）才注入；显式关闭持久化的是 null（键存在），不覆盖。
   // 虚拟默认 —— 仅注入回包不落盘（GET 不写文件），直接读 preferences.json 的代码看不到该默认。
@@ -48,6 +67,12 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   if (prefs.approvalModal?.voicePack) {
     prefs.approvalModal.voicePack = vpReconcile(LOG_DIR, prefs.approvalModal.voicePack);
   }
+  // 项目独立配置元信息（_ 前缀 = 仅回包、不落盘；POST 侧统一剥离）：前端据此决定
+  // 非本机显示"启动项目独立配置"开关、本机在有 fork 时显示"配置管理"入口。
+  prefs._isLocal = isLocal;
+  prefs._projectName = getCurrentProjectName();
+  prefs._projectScoped = _scoped;
+  if (isLocal) prefs._projectPrefsKeys = _forkKeys;
   res.writeHead(200, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(prefs));
 }
@@ -55,43 +80,50 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
 function preferencesPost(req, res, parsedUrl, isLocal, deps) {
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
-  req.on('end', () => {
+  req.on('end', async () => {
+    // 解析与持久化分两段 try：JSON 坏 → 400 'Invalid JSON'；写盘/取锁失败 → 500/503（不再被误报成
+    // 400 让客户端以为是请求体问题、也不重试瞬时锁超时）。
+    let incoming;
+    try { incoming = JSON.parse(body); }
+    catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid JSON' }));
+      return;
+    }
     try {
-      const incoming = JSON.parse(body);
       // auth 只能经 admin-only 的 /api/auth/config 修改;剥掉 incoming.auth 与 incoming.authByProject
       // 防止任意已授权客户端(含远程密码登录用户)借 /api/preferences 改开关/密码、或植入/篡改
       // 任意项目的覆盖,绕过 admin 门禁。
       delete incoming.auth;
       delete incoming.authByProject;
+      // prefsByProject(项目独立配置 fork)只能经 admin-only 的 /api/project-prefs/* 修改；元字段
+      // (_isLocal/_projectScoped/…)仅 GET 回包，绝不让它们经 /api/preferences 落盘污染。
+      delete incoming.prefsByProject;
+      for (const k of Object.keys(incoming)) if (k[0] === '_') delete incoming[k];
       // IM bridge configs 同理：只能经 admin-only 的 /api/dingtalk/config、/api/im/* 修改，禁止借
       // /api/preferences 植入凭据。
       stripImConfigs(incoming);
-      // 如果修改了日志目录，先切换再保存到新位置（新目录下生成 preferences.json）
+      // 切日志目录：把旧文件的完整内容（含 auth 密码 / prefsByProject forks / 其它偏好）带到新位置，
+      // 避免切目录后密码与各项目 fork 凭空消失；并把写目标在 setLogDir 前后固定为"新文件"，让本次
+      // 合并只跑在一个文件 / 一把锁上（不再因 LOG_DIR 中途漂移而劈裂进程内锁队列）。
+      let targetFile = deps.getPrefsFile();
+      let carried = null;
       if (incoming.logDir && typeof incoming.logDir === 'string') {
+        carried = readPrefsRaw(targetFile); // 旧文件全量（锁外读，迁移属罕见 admin 操作）
         setLogDir(incoming.logDir);
+        targetFile = deps.getPrefsFile();
       }
-      let prefs = {};
-      try { if (existsSync(deps.getPrefsFile())) prefs = JSON.parse(readFileSync(deps.getPrefsFile(), 'utf-8')); } catch { }
-      // Deep-merge approvalModal so partial updates (e.g. `{ voicePack: { events: { askQuestion: id } } }`)
-      // don't blow away unrelated approval prefs. Shallow Object.assign for everything else.
-      const { approvalModal: incAM, ...incRest } = incoming;
-      Object.assign(prefs, incRest);
-      if (incAM && typeof incAM === 'object') {
-        prefs.approvalModal = vpMergeAM(prefs.approvalModal, incAM, {
-          reconcile: (vp) => vpReconcile(LOG_DIR, vp),
-        });
-      }
-      // 确保目录存在
-      const prefsFile = deps.getPrefsFile();
-      const prefsDir = dirname(prefsFile);
-      if (!existsSync(prefsDir)) mkdirSync(prefsDir, { recursive: true });
-      writeFileSync(prefsFile, JSON.stringify(prefs, null, 2));
+      // 全局写入：locked + atomic（prefs-store），与 fork 写共用同一把锁，避免并发写互相覆盖含密码的
+      // preferences.json。Deep-merge approvalModal 的逻辑下沉到 applyPrefsPatch，与 /api/project-prefs
+      // 的 fork 写共用一份合并实现，防止两路漂移。
+      const prefs = await mutatePrefs((p) => {
+        // 迁移：把旧文件里新文件尚无的键（auth/forks/其它偏好）带过来，再应用本次补丁
+        if (carried) for (const k of Object.keys(carried)) if (!(k in p)) p[k] = carried[k];
+        applyPrefsPatch(p, incoming, { logDir: LOG_DIR });
+      }, targetFile);
       // UI 切语言时同步服务端 i18n currentLang，让 DingTalk 桥接等服务端 t() 立即跟随。
       // setLang 自带 locale 校验，非法值回落 en。
       if (incoming.lang) setLang(incoming.lang);
-      // preferences.json 可能携带 auth 的 base64 密码 —— 与 lib/auth.js writePrefs 一致地
-      // 重申 0600,避免该路径(无 mode/不 chmod)把密码文件留成默认 umask 的可读权限。
-      try { chmodSync(prefsFile, 0o600); } catch { /* best-effort; non-POSIX or race */ }
       // 主题切换时同步到 Claude Code CLI：发 /theme，监听输出验证结果。
       // 现代 CLI（≥2.x）的 /theme 是交互式选择器（args 被忽略），注入后对话框可能
       // 残留在终端：
@@ -132,15 +164,18 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       // 已授权的远程客户端。磁盘上的值已在上面写入,这里只清内存对象供响应用。
       delete prefs.auth;
       delete prefs.authByProject;
+      delete prefs.prefsByProject; // fork blob 绝不回显（与 GET 一致）
       stripImConfigs(prefs);
       prefs.logDir = LOG_DIR;
       // 与 GET 一致：回显里补齐 resumeAutoChoice 虚拟默认（已在上方落盘，文件不含该默认值）
       if (!('resumeAutoChoice' in prefs)) prefs.resumeAutoChoice = 'continue';
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(prefs));
-    } catch {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid JSON' }));
+    } catch (err) {
+      // 写盘/取锁失败：锁超时 → 503（瞬时，客户端可重试）；其余持久化错误 → 500。绝不再用 400。
+      const isLockTimeout = /Lock acquisition timeout/.test(err?.message || '');
+      res.writeHead(isLockTimeout ? 503 : 500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Failed to save preferences' }));
     }
   });
 }

package/server/routes/project-meta.js

@@ -22,9 +22,10 @@ export function getInstallMethod({
   return 'npm';
 }
 
-function projectName(req, res) {
+function projectName(req, res, parsedUrl, isLocal, deps) {
   res.writeHead(200, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify({ projectName: _projectName || '' }));
+  // instanceId (`--pid`) lets the client scope its session-pin requests + show 项目(id) in the title.
+  res.end(JSON.stringify({ projectName: _projectName || '', instanceId: (deps && deps.instanceId) || null }));
 }
 
 function projectDir(req, res) {

package/server/routes/project-prefs.js

@@ -0,0 +1,132 @@
+// Per-project independent-preferences routes.
+//
+// Lets a project keep its own forked copy of the preferences (so several developers
+// sharing one ccv over the LAN don't stomp each other's global prefs):
+//   - POST /api/project-prefs/toggle  {enabled}        — fork/unfork the CURRENT project
+//   - POST /api/project-prefs/update  {project?, patch} — edit a fork (current, or any project from loopback)
+//   - POST /api/project-prefs/delete  {project}         — delete a fork (loopback admin only)
+//   - GET  /api/project-prefs                           — list every fork + contents (loopback admin only)
+//
+// Forks never carry secrets (auth / IM creds are stripped on snapshot AND on read). All
+// writes go through prefs-store.mutatePrefs (locked + atomic). Admin operations on an
+// arbitrary project are loopback-gated server-side regardless of the client UI.
+import { basename } from 'node:path';
+import { LOG_DIR } from '../../findcc.js';
+import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
+import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import {
+  getCurrentProjectKey, hasActiveProject, snapshotForFork, stripSensitive,
+} from '../lib/project-prefs.js';
+
+function sendJson(res, code, obj) {
+  res.writeHead(code, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(obj));
+}
+
+function readBody(req, deps) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+    req.on('end', () => { try { resolve(body ? JSON.parse(body) : {}); } catch { reject(new Error('bad-json')); } });
+    req.on('error', reject);
+  });
+}
+
+/** Sanitize an incoming patch: no secrets, no machine-level paths, no internal/meta keys. */
+function cleanPatch(patch) {
+  if (!patch || typeof patch !== 'object') return {};
+  const out = { ...patch };
+  for (const k of Object.keys(out)) if (k[0] === '_') delete out[k];
+  stripSensitive(out); // 含 auth/IM + logDir/claudeConfigDir + prefsByProject（单一来源）
+  return out;
+}
+
+// POST /api/project-prefs/toggle — fork (snapshot global) or unfork the current project.
+// Scoped to the current project only (no privilege escalation), so allowed from any client.
+async function toggleHandler(req, res, parsedUrl, isLocal, deps) {
+  let body;
+  try { body = await readBody(req, deps); } catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
+  if (!hasActiveProject()) return sendJson(res, 409, { error: 'no-active-project' });
+  const key = getCurrentProjectKey();
+  const enabled = !!body.enabled;
+  await mutatePrefs((p) => {
+    if (!p.prefsByProject || typeof p.prefsByProject !== 'object') p.prefsByProject = {};
+    if (enabled) {
+      if (!Object.prototype.hasOwnProperty.call(p.prefsByProject, key)) {
+        p.prefsByProject[key] = snapshotForFork(p);
+      }
+    } else if (Object.prototype.hasOwnProperty.call(p.prefsByProject, key)) {
+      delete p.prefsByProject[key];
+    }
+    if (Object.keys(p.prefsByProject).length === 0) delete p.prefsByProject;
+  });
+  sendJson(res, 200, { ok: true, projectScoped: enabled });
+}
+
+// POST /api/project-prefs/update — merge a patch into a fork. project omitted ⇒ current
+// (any client, requires an existing fork); project given ⇒ loopback admin only.
+async function updateHandler(req, res, parsedUrl, isLocal, deps) {
+  let body;
+  try { body = await readBody(req, deps); } catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
+  // 指定 project（改任意项目 fork）仅限本机；按"存在且为非空字符串"判定，避免 {project:""}/{project:{}}
+  // 绕过门禁或误入当前项目分支（与 deleteHandler 的类型校验对齐）。鉴权早于 cleanPatch。
+  const hasProject = typeof body.project === 'string' && body.project;
+  let key;
+  if (hasProject) {
+    if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+    key = body.project;
+  } else {
+    if (!hasActiveProject()) return sendJson(res, 409, { error: 'no-active-project' });
+    key = getCurrentProjectKey();
+  }
+  const patch = cleanPatch(body.patch);
+  let found = false;
+  await mutatePrefs((p) => {
+    if (p.prefsByProject && Object.prototype.hasOwnProperty.call(p.prefsByProject, key)) {
+      applyPrefsPatch(p.prefsByProject[key], patch, { logDir: LOG_DIR });
+      found = true;
+    }
+  });
+  if (!found) return sendJson(res, 404, { error: 'no-fork' });
+  sendJson(res, 200, { ok: true });
+}
+
+// POST /api/project-prefs/delete — remove a fork. Loopback admin only.
+async function deleteHandler(req, res, parsedUrl, isLocal, deps) {
+  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  let body;
+  try { body = await readBody(req, deps); } catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
+  const key = body.project;
+  if (!key || typeof key !== 'string') return sendJson(res, 400, { error: 'project-required' });
+  await mutatePrefs((p) => {
+    if (p.prefsByProject && Object.prototype.hasOwnProperty.call(p.prefsByProject, key)) {
+      delete p.prefsByProject[key];
+      if (Object.keys(p.prefsByProject).length === 0) delete p.prefsByProject;
+    }
+  });
+  sendJson(res, 200, { ok: true });
+}
+
+// GET /api/project-prefs — every fork + contents (for the loopback management modal).
+function listHandler(req, res, parsedUrl, isLocal, deps) {
+  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  const prefs = readPrefsRaw();
+  const forks = (prefs && prefs.prefsByProject && typeof prefs.prefsByProject === 'object') ? prefs.prefsByProject : {};
+  const currentKey = getCurrentProjectKey();
+  const projects = {};
+  for (const [dir, fork] of Object.entries(forks)) {
+    const clean = stripSensitive(JSON.parse(JSON.stringify(fork || {})));
+    if (clean.approvalModal?.voicePack) {
+      clean.approvalModal.voicePack = vpReconcile(LOG_DIR, clean.approvalModal.voicePack);
+    }
+    projects[dir] = { name: basename(dir), dir, prefs: clean, isCurrent: dir === currentKey };
+  }
+  sendJson(res, 200, { projects });
+}
+
+export const projectPrefsRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/project-prefs', handler: listHandler },
+  { method: 'POST', match: 'exact', path: '/api/project-prefs/toggle', handler: toggleHandler },
+  { method: 'POST', match: 'exact', path: '/api/project-prefs/update', handler: updateHandler },
+  { method: 'POST', match: 'exact', path: '/api/project-prefs/delete', handler: deleteHandler },
+];

package/server/routes/session-pin.js

@@ -0,0 +1,41 @@
+// Server-side "current session" pin — replaces the old per-browser localStorage pin so a
+// project's "仅展示当前会话" pointer is shared across every device hitting THIS ccv process,
+// and (with `--pid`) isolated between processes. View state only → no loopback gating.
+//   - GET  /api/session-pin                                  → { pinnedSessionId, instanceId }
+//   - POST /api/session-pin {pinnedSessionId: string|null}   → persist + SSE-broadcast
+// `_logDir` is the live per-project dir ('' = no active project → GET null / POST no-op).
+import { _logDir } from '../interceptor.js';
+import { readPin, writePin } from '../lib/session-pin-store.js';
+import { sendEventToClients } from '../lib/log-watcher.js';
+
+function sendJson(res, code, obj) {
+  res.writeHead(code, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(obj));
+}
+
+function getHandler(req, res, parsedUrl, isLocal, deps) {
+  const instanceId = deps.instanceId || null;
+  sendJson(res, 200, { pinnedSessionId: readPin(_logDir, instanceId), instanceId });
+}
+
+function postHandler(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', (chunk) => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    let incoming;
+    try { incoming = body ? JSON.parse(body) : {}; }
+    catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
+    const raw = incoming.pinnedSessionId;
+    const pinnedSessionId = (typeof raw === 'string' && raw) ? raw : null;
+    writePin(_logDir, deps.instanceId || null, pinnedSessionId);
+    // Broadcast to THIS process's SSE clients so every device on this instance stays in sync.
+    sendEventToClients(deps.clients, 'session_pin', { pinnedSessionId });
+    sendJson(res, 200, { ok: true, pinnedSessionId });
+  });
+  req.on('error', () => { try { sendJson(res, 400, { error: 'read-error' }); } catch {} });
+}
+
+export const sessionPinRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/session-pin', handler: getHandler },
+  { method: 'POST', match: 'exact', path: '/api/session-pin', handler: postHandler },
+];

package/server/server.js

@@ -17,6 +17,8 @@ import { createDispatcher } from './routes/_dispatch.js';
 import { projectMetaRoutes } from './routes/project-meta.js';
 import { miscRoutes } from './routes/misc.js';
 import { preferencesRoutes } from './routes/preferences.js';
+import { projectPrefsRoutes } from './routes/project-prefs.js';
+import { sessionPinRoutes } from './routes/session-pin.js';
 import { gitRoutes } from './routes/git.js';
 import { pluginsRoutes } from './routes/plugins.js';
 import { logsRoutes } from './routes/logs.js';
@@ -70,6 +72,7 @@ function execWithStdin(cmd, args, input, options) {
   });
 }
 import { LOG_FILE, _initPromise, _resumeState, _projectName, _logDir, streamingState, resetStreamingState, PROFILE_PATH, setLivePort } from './interceptor.js';
+import { recordInstance, listInstances } from './lib/instance-registry.js';
 import { LOG_DIR, setLogDir, getClaudeConfigDir } from '../findcc.js';
 import { t, getLang, setLang } from './i18n.js';
 import { loadAuthConfig, loadAuthState, saveAuthConfig, clearProjectOverride, generatePassword, decideAuth, parseCookies, renderLoginPage, localeFromAcceptLanguage } from './lib/auth.js';
@@ -105,6 +108,12 @@ try {
 const isCliMode = process.env.CCV_CLI_MODE === '1';
 const isSdkMode = process.env.CCV_SDK_MODE === '1';
 const isWorkspaceMode = process.env.CCV_WORKSPACE_MODE === '1';
+// Instance id from `ccv --pid <name>` (sanitized in cli.js). null = default mode (no
+// per-instance isolation): the session-pin file falls back to the project-shared key.
+const INSTANCE_ID = process.env.CCV_INSTANCE_ID || null;
+// Remember this id under the project so the CLI banner can list past ids next run (memory
+// aid only). Fire-and-forget; no-ops when there's no active project (e.g. workspace mode).
+if (INSTANCE_ID && _logDir) recordInstance(_logDir, INSTANCE_ID).catch(() => {});
 const _defaultProxyProfiles = { active: 'max', profiles: [{ id: 'max', name: 'Default' }] };
 const _maskApiKey = (k) => k && typeof k === 'string' && k.length > 4 ? '****' + k.slice(-4) : k ? '****' : '';
 const _maskProfiles = (data) => {
@@ -559,6 +568,7 @@ const deps = {
   isCliMode,
   isSdkMode,
   isWorkspaceMode,
+  instanceId: INSTANCE_ID,
   defaultProxyProfiles: _defaultProxyProfiles,
 };
 
@@ -572,6 +582,8 @@ const _routes = [
   ...projectMetaRoutes,
   ...miscRoutes,
   ...preferencesRoutes,
+  ...projectPrefsRoutes,
+  ...sessionPinRoutes,
   ...gitRoutes,
   ...pluginsRoutes,
   ...logsRoutes,
@@ -1909,6 +1921,15 @@ export function getAuthConfig() {
   return authConfig;
 }
 
+// Instance id (`--pid`) + the project's previously-used ids — printed by cli.js in the
+// CLI-mode startup banner so the user can recall which id to reuse with `-c` next time.
+export function getInstanceId() {
+  return INSTANCE_ID;
+}
+export function getKnownInstances() {
+  try { return listInstances(_logDir); } catch { return []; }
+}
+
 // In-process broadcast helper for the `turn_end` SSE event. Two callers:
 //   1. /api/turn-end-notify POST handler (PTY/CLI mode via Stop hook bridge)
 //   2. cli.js runSdkMode → sdkManager.initSdkSession({ onTurnEnd }) (SDK mode —