cc-viewer 1.6.333 → 1.6.335

package/server/routes/ask-perm.js

@@ -1,5 +1,5 @@
 // Ask / permission hook bridge routes (moved verbatim from server.js handleRequest).
-import { loadAskStore, consumeIfFinal as askStoreConsumeIfFinal } from '../lib/ask-store.js';
+import { loadAskStore, consumeIfFinal as askStoreConsumeIfFinal, markCancelled as askStoreMarkCancelled } from '../lib/ask-store.js';
 import { runWaterfallHook, runParallelHook } from '../lib/plugin-loader.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 
@@ -128,6 +128,9 @@ function askHook(req, res, parsedUrl, isLocal, deps) {
       const _placeholderEntry = { questions, res, timer: null, createdAt: Date.now(), shortPoll: shortPollMode };
       deps.pendingAskHooks.set(id, _placeholderEntry);
       deps.persistAskEntry(id, _placeholderEntry);
+      // Seed waiter liveness for the reaper (ask-reaper.js). Optional chaining:
+      // older deps stubs and third-party callers may not provide the map.
+      if (shortPollMode) deps.askWaiterLastPoll?.set(id, Date.now());
 
       // res.on('close') 提前注册：handler 用 entry.timer 守卫（占位期 timer:null → 仅 delete Map）
       // Phase 3: short-poll 模式下 res 主动 end，close 不视为 client cancel；entry 由 24h timer 兜底清理。
@@ -237,6 +240,10 @@ async function askHookResult(req, res, parsedUrl, isLocal, deps) {
     }
     const qs = new URLSearchParams(m[2] || '');
     const wait = Math.max(1000, Math.min(60000, parseInt(qs.get('wait') || '30000', 10)));
+    // Refresh waiter liveness on every poll arrival (see ask-reaper.js). Unconditional:
+    // even a poll that ends in 404/final proves the waiter process is alive; the reaper
+    // GCs records for ids that are no longer pending.
+    deps.askWaiterLastPoll?.set(id, Date.now());
 
     // 1) disk 命中 answered/cancelled：浏览器答得早过 GET 到达 → 立即返并消费（一次性）
     // 用 consumeIfFinal 单次 withLock 内判 status 决定是否 delete —— 旧设计的
@@ -289,6 +296,81 @@ async function askHookResult(req, res, parsedUrl, isLocal, deps) {
   }
 }
 
+// POST /api/ask-hook/:id/cancel — best-effort cancel from a dying hook process
+// (ask-bridge SIGTERM/SIGINT handler) or any client that wants to durably resolve
+// a pending ask. Mirrors the WS ask-cancel handler in server.js for the hook path.
+// Auth: standard request prelude (loopback-exempt), same as the sibling ask-hook routes.
+function askHookCancel(req, res, parsedUrl, isLocal, deps) {
+  const m = parsedUrl.pathname.match(/^\/api\/ask-hook\/([^/?]+)\/cancel$/);
+  const id = m ? decodeURIComponent(m[1]) : '';
+  if (!id || id.length > 256 || !/^[a-zA-Z0-9_-]+$/.test(id)) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'invalid id' }));
+    return;
+  }
+  let body = '';
+  let bodyTooLarge = false;
+  req.on('data', (chunk) => {
+    if (bodyTooLarge) return;
+    body += chunk;
+    if (body.length > 4096) {
+      // Respond here, not in 'end': req.destroy() never emits 'end' in real Node,
+      // so a deferred 413 would be dead code (mirrors permHook's in-data rejection).
+      bodyTooLarge = true;
+      try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+      req.destroy();
+    }
+  });
+  req.on('end', async () => {
+    if (bodyTooLarge) return;
+    let reason = 'hook process exited';
+    try {
+      const parsed = body ? JSON.parse(body) : {};
+      if (typeof parsed.reason === 'string' && parsed.reason) reason = parsed.reason.slice(0, 500);
+    } catch {}
+    // Respond fast: the caller may be a process that is about to die.
+    try { if (!res.headersSent) { res.writeHead(204); res.end(); } } catch {}
+    try {
+      let handled = false;
+      const entry = deps.pendingAskHooks.get(id);
+      if (entry) {
+        if (entry.timer) clearTimeout(entry.timer);
+        deps.pendingAskHooks.delete(id);
+        deps.askWaiterLastPoll?.delete(id);
+        if (entry.shortPoll) {
+          const wrote = await askStoreMarkCancelled(id, reason);
+          if (wrote) deps.notifyShortPollCancel?.(id, reason);
+          handled = wrote;
+        } else {
+          // Long-poll: end the hanging hook response so the bridge unblocks.
+          try {
+            if (entry.res && !entry.res.headersSent) {
+              entry.res.writeHead(200, { 'Content-Type': 'application/json' });
+              entry.res.end(JSON.stringify({ cancelled: true, reason }));
+            }
+          } catch {}
+          deps.persistAskDelete(id);
+          handled = true;
+        }
+      } else {
+        // Disk-only (e.g. entry orphaned by a previous server process). Wake any
+        // hanging poll listeners too — parity with the WS ask-cancel handler.
+        handled = await askStoreMarkCancelled(id, reason);
+        if (handled) deps.notifyShortPollCancel?.(id, reason);
+      }
+      if (handled) {
+        if (deps.terminalWss) {
+          const cmsg = JSON.stringify({ type: 'ask-hook-cancelled', id, reason });
+          deps.terminalWss.clients.forEach((c) => {
+            if (c.readyState === 1) try { c.send(cmsg); } catch {}
+          });
+        }
+        deps.notifyParentPending({ type: 'ask-hook-cancelled', id });
+      }
+    } catch {}
+  });
+}
+
 // Permission hook bridge: receive tool permission request from perm-bridge.js, long-poll for user decision
 function permHook(req, res, parsedUrl, isLocal, deps) {
   let body = '';
@@ -447,6 +529,7 @@ export const askPermRoutes = [
   { method: 'GET', match: 'exact', path: '/api/pending-asks', handler: pendingAsks },
   { method: 'POST', match: 'exact', path: '/api/ask-hook', handler: askHook },
   { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/result') && method === 'GET', handler: askHookResult },
+  { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/cancel') && method === 'POST', handler: askHookCancel },
   { method: 'POST', match: 'exact', path: '/api/perm-hook', handler: permHook },
   { method: 'POST', match: 'exact', path: '/api/stream-chunk', handler: streamChunk },
 ];

package/server/routes/expert.js

@@ -2,8 +2,17 @@
 // (CC_SYSTEM.md / CC_APPEND_SYSTEM.md)，对应偏好设置 → 专家设置 → 系统文本修改。
 // 这两个文件由 pty-manager._spawnClaudeImpl 在启动 claude 时自动注入为
 // --system-prompt-file / --append-system-prompt-file（见 server/lib/system-prompt-files.js）。
+// 另有「按模型定制」条目(/api/expert/model-prompts)：工作区 <ws>/system_prompt/ 与
+// 全局 <LOG_DIR>/system_prompt/ 两套目录，见 server/lib/model-system-prompts.js。
 // 鉴权沿用 dispatch 之前的全局鉴权（与 files-fs 写操作一致，不额外 gate isLocal）。
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
 import { readWorkspaceSystemText, writeWorkspaceSystemText } from '../lib/system-prompt-files.js';
+import {
+  MODEL_PROMPT_DIR, normalizeModelName, listModelPrompts,
+  writeModelPrompt, deleteModelPrompt,
+} from '../lib/model-system-prompts.js';
+import { LOG_DIR } from '../../findcc.js';
 
 // 当前工作区目录全部由服务端解析（绝不接收客户端路径 → 无遍历面）：
 //   运行中/最近一次 claude 的 cwd > CCV_PROJECT_DIR > （仅非工作区模式才回退 process.cwd()）
@@ -66,7 +75,82 @@ function postSystemText(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// 列出某目录全部模型条目并内联文本(条目数很小，一次返回免去 N 次跟进请求)。
+// 直接读 listModelPrompts 给出的生效文件，避免 readModelPrompt 每条目重扫目录(N+1)。
+function collectModelEntries(dir) {
+  if (!dir) return [];
+  return listModelPrompts(dir)
+    .map((e) => {
+      try {
+        return { name: e.name, mode: e.mode, text: readFileSync(join(dir, e.fileName), 'utf-8') };
+      } catch {
+        return null; // 列表后被并发删除等：跳过该条目
+      }
+    })
+    .filter(Boolean);
+}
+
+async function getModelPrompts(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const dir = await resolveDir(deps);
+    const globalDir = join(LOG_DIR, MODEL_PROMPT_DIR);
+    sendJson(res, 200, {
+      workspaceDir: dir || null,
+      workspaceActive: !!dir,
+      globalDir,
+      workspace: dir ? collectModelEntries(join(dir, MODEL_PROMPT_DIR)) : [],
+      global: collectModelEntries(globalDir),
+    });
+  } catch (e) {
+    console.error('[CC Viewer] expert model-prompts GET failed:', e.message);
+    sendJson(res, 500, { error: 'read_failed' });
+  }
+}
+
+function postModelPrompts(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  let truncated = false;
+  req.on('data', (chunk) => {
+    body += chunk;
+    if (body.length > deps.MAX_POST_BODY) { truncated = true; req.destroy(); }
+  });
+  req.on('end', async () => {
+    if (truncated) return; // 超限已 destroy，socket 关闭，勿再解析/回包(对齐 postSystemText)
+    try {
+      const { scope, name, mode, text } = JSON.parse(body || '{}');
+      if (scope !== 'workspace' && scope !== 'global') {
+        sendJson(res, 400, { error: 'bad_scope' });
+        return;
+      }
+      const canonical = normalizeModelName(name);
+      if (!canonical) { sendJson(res, 400, { error: 'bad_model_name' }); return; }
+      let targetDir;
+      if (scope === 'global') {
+        targetDir = join(LOG_DIR, MODEL_PROMPT_DIR);
+      } else {
+        const dir = await resolveDir(deps);
+        if (!dir) { sendJson(res, 400, { error: 'no_active_workspace' }); return; }
+        targetDir = join(dir, MODEL_PROMPT_DIR);
+      }
+      const raw = typeof text === 'string' ? text : '';
+      if (raw.trim().length === 0) {
+        // 空文本 = 删除条目(对齐 system-text 的「存空即禁用」约定；此时 mode 可缺省)。
+        deleteModelPrompt(targetDir, canonical);
+        sendJson(res, 200, { ok: true, name: canonical, scope, cleared: true });
+        return;
+      }
+      const result = writeModelPrompt(targetDir, canonical, mode === 'override' ? 'override' : 'append', raw);
+      sendJson(res, 200, { ok: true, scope, ...result });
+    } catch (e) {
+      console.error('[CC Viewer] expert model-prompts POST failed:', e.message);
+      sendJson(res, 500, { error: 'write_failed' });
+    }
+  });
+}
+
 export const expertRoutes = [
   { method: 'GET', match: 'exact', path: '/api/expert/system-text', handler: getSystemText },
   { method: 'POST', match: 'exact', path: '/api/expert/system-text', handler: postSystemText },
+  { method: 'GET', match: 'exact', path: '/api/expert/model-prompts', handler: getModelPrompts },
+  { method: 'POST', match: 'exact', path: '/api/expert/model-prompts', handler: postModelPrompts },
 ];

package/server/server.js

@@ -9,8 +9,9 @@ import { execFile, exec, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { Worker } from 'node:worker_threads';
 import { isPathContained } from './lib/file-api.js';
-import { setEntry as askStoreSetEntry, deleteEntry as askStoreDeleteEntry, pruneStale as askStorePruneStale, markAnswered as askStoreMarkAnswered, markCancelled as askStoreMarkCancelled } from './lib/ask-store.js';
-import { ASK_TIMEOUT_MS } from './lib/ask-constants.js';
+import { setEntry as askStoreSetEntry, deleteEntry as askStoreDeleteEntry, pruneStale as askStorePruneStale, markAnswered as askStoreMarkAnswered, markCancelled as askStoreMarkCancelled, loadAskStore as askStoreLoad } from './lib/ask-store.js';
+import { ASK_TIMEOUT_MS, ASK_WAITER_REAP_INTERVAL_MS, ASK_WAITER_LIVENESS_MS } from './lib/ask-constants.js';
+import { reapDeadAskWaiters, sweepOrphanedDiskAsks } from './lib/ask-reaper.js';
 import { sdkApprovalCloseType } from './lib/sdk-adapter.js';
 import { DIST_DIR, NODE_MODULES } from './_paths.js';
 import { createDispatcher } from './routes/_dispatch.js';
@@ -74,7 +75,7 @@ function execWithStdin(cmd, args, input, options) {
 }
 import { LOG_FILE, _initPromise, _resumeState, _projectName, _logDir, streamingState, resetStreamingState, PROFILE_PATH, setLivePort, getImLiveText, resetImLiveText } from './interceptor.js';
 import { recordInstance, listInstances } from './lib/instance-registry.js';
-import { LOG_DIR, setLogDir, getClaudeConfigDir } from '../findcc.js';
+import { LOG_DIR, setLogDir, getClaudeConfigDir, isBrowserOpenSuppressed } from '../findcc.js';
 import { t, getLang, setLang } from './i18n.js';
 import { loadAuthConfig, loadAuthState, saveAuthConfig, clearProjectOverride, generatePassword, decideAuth, parseCookies, renderLoginPage, localeFromAcceptLanguage } from './lib/auth.js';
 import { checkAndUpdate } from './lib/updater.js';
@@ -195,6 +196,11 @@ function _persistAskDelete(id) {
 // until either an answer/cancel arrives or wait ms elapses (then 204).
 const shortPollListeners = new Map(); // id -> Set<{ res, tid, finished }>
 
+// Waiter-liveness tracking for short-poll asks (see server/lib/ask-reaper.js).
+// Memory-only BY DESIGN: persisting it would bump the ask-store SCHEMA_VERSION;
+// the reaper's boot-time orphan sweep covers restarts instead.
+const askWaiterLastPoll = new Map(); // id -> ms of last POST create / GET result poll
+
 function _notifyShortPollAnswer(id, answers) {
   const set = shortPollListeners.get(id);
   if (!set) return;
@@ -493,6 +499,8 @@ const deps = {
   pendingAskHooks,
   pendingPermHooks,
   shortPollListeners,
+  askWaiterLastPoll,
+  notifyShortPollCancel: _notifyShortPollCancel,
   editorSessions,
   gitRestoreLocks,
   liveStreamLastSeq: _liveStreamLastSeq,
@@ -864,6 +872,56 @@ export async function startViewer() {
   }, 60 * 60 * 1000);
   _pruneAskStoreInterval.unref();
 
+  // Waiter-liveness reaper: resolves short-poll asks whose hook process (ask-bridge)
+  // died without notifying us (e.g. AskUserQuestion declined at the CLI → SIGTERM).
+  // Keys on waiter liveness, never on wall-clock ask age — the "GUI effectively
+  // no-timeout" contract is untouched. See server/lib/ask-reaper.js.
+  const _reaperDeps = {
+    pendingAskHooks,
+    shortPollListeners,
+    askWaiterLastPoll,
+    markCancelled: askStoreMarkCancelled,
+    loadAskStore: askStoreLoad,
+    notifyShortPollCancel: _notifyShortPollCancel,
+    // terminalWss is assigned later in startServer — resolve at call time via closure.
+    broadcastCancelled: (id, reason) => {
+      if (!terminalWss) return;
+      const cmsg = JSON.stringify({ type: 'ask-hook-cancelled', id, reason });
+      terminalWss.clients.forEach((c) => {
+        if (c.readyState === 1) try { c.send(cmsg); } catch {}
+      });
+    },
+    notifyParentPending: _notifyParentPending,
+  };
+  const _reaperState = { lastSweepAt: Date.now() };
+  _askReaperTimer = setInterval(() => {
+    reapDeadAskWaiters(_reaperDeps, _reaperState).catch(() => {});
+  }, ASK_WAITER_REAP_INTERVAL_MS);
+  _askReaperTimer.unref();
+  // One-shot boot sweep for disk-only orphans left by a previous server process.
+  // Delayed one liveness window so a bridge that survived our restart can re-poll
+  // and prove ownership first; skipped when another cc-viewer instance is running.
+  // Also skipped entirely under custom CCV_START_PORT/CCV_MAX_PORT: the lsof scan
+  // covers only OUR range, so an instance on a different custom range would be
+  // invisible and its live asks could be falsely swept. The memory-owned reaper
+  // and the ApprovalModal fallback UI still cover orphans in that setup.
+  const _customPortRange = !!(process.env.CCV_START_PORT || process.env.CCV_MAX_PORT);
+  const _bootTime = Date.now();
+  if (!_customPortRange) {
+    _askOrphanSweepTimer = setTimeout(() => {
+      sweepOrphanedDiskAsks({
+        ..._reaperDeps,
+        bootTime: _bootTime,
+        ownPid: process.pid,
+        portRange: [START_PORT, MAX_PORT],
+        // Async on purpose: a wedged lsof would otherwise block the event loop
+        // (and every in-flight request) for up to the full timeout.
+        lsofImpl: async (cmd) => (await execAsync(cmd, { timeout: 2000, encoding: 'utf-8' })).stdout,
+      }).catch(() => {});
+    }, ASK_WAITER_LIVENESS_MS);
+    _askOrphanSweepTimer.unref();
+  }
+
   // 通过插件 hook 获取 HTTPS 证书选项
   let httpsOptions = null;
   try {
@@ -946,11 +1004,12 @@ export async function startViewer() {
             }
           }
           // v2.0.69 之前的版本会清空控制台，自动打开浏览器确保用户能看到界面
+          // L7 sandbox: suppressed under tests / CCV_NO_OPEN=1 (see findcc.js).
           try {
             const ccPkgPath = join(NODE_MODULES, '@anthropic-ai', 'claude-code', 'package.json');
             const ccVer = JSON.parse(readFileSync(ccPkgPath, 'utf-8')).version;
             const [maj, min, pat] = ccVer.split('.').map(Number);
-            if (maj < 2 || (maj === 2 && min === 0 && pat < 69)) {
+            if ((maj < 2 || (maj === 2 && min === 0 && pat < 69)) && !isBrowserOpenSuppressed()) {
               const cmd = platform() === 'darwin' ? 'open' : platform() === 'win32' ? 'start' : 'xdg-open';
               execAsync(`${cmd} ${url}`, { timeout: 5000 }).catch(() => {});
             }
@@ -2108,6 +2167,9 @@ export function broadcastTurnEnd(sessionId = null, ts = Date.now()) {
 // 流式状态 SSE 推送定时器：检测 streamingState 变化并广播给所有客户端。
 // rising-edge → turn_end cancel（丢弃 pending，不 flush）由 _observeStreamingTick 统一处理。
 let _streamingStatusTimer = null;
+// Waiter-liveness reaper timers (armed in startServer, cleared in the stop path).
+let _askReaperTimer = null;
+let _askOrphanSweepTimer = null;
 // 启动后 30s 的更新检查 timer 句柄。必须可清理:
 //  - .unref() 防止它把事件循环 keep-alive 30s(测试进程靠 --test-force-exit 兜底是时序侥幸);
 //  - _doStop 里 clearTimeout 防止 stop/start 循环(Electron tab / 测试)泄漏多个 pending 检查。
@@ -2199,6 +2261,14 @@ async function _doStop() {
     clearInterval(_streamingStatusTimer);
     _streamingStatusTimer = null;
   }
+  if (_askReaperTimer) {
+    clearInterval(_askReaperTimer);
+    _askReaperTimer = null;
+  }
+  if (_askOrphanSweepTimer) {
+    clearTimeout(_askOrphanSweepTimer);
+    _askOrphanSweepTimer = null;
+  }
   if (_updateCheckTimer) {
     clearTimeout(_updateCheckTimer);
     _updateCheckTimer = null;