cc-viewer 1.6.345 → 1.6.348

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-CfPXhStV.js"></script>
+  <script type="module" crossorigin src="./assets/index-DCo650PG.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-D5HmSDSg.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-C5yuj7ze.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-BcEooTvb.js">

package/findcc.js

@@ -1,4 +1,4 @@
-import { resolve, join } from 'node:path';
+import { resolve, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, realpathSync, readFileSync } from 'node:fs';
 import { homedir, tmpdir, arch } from 'node:os';
@@ -22,11 +22,42 @@ const NODE_MODULES = resolve(__dirname, '..');
  * Claude Code's config from ~/.claude/ to a custom location.
  * @returns {string} absolute path to the Claude config directory
  */
+// ████████ Test isolation barrier L1c helper — DO NOT REMOVE (2026-07-12 data loss) ████████
+// A ccv-hosted shell exports CCV_LOG_DIR=<real user data dir> (and possibly CLAUDE_CONFIG_DIR)
+// into every child process — the claude pty, its Bash tool, any nested shell. A direct
+// `node --test <file>` run there inherits those vars and sails through the explicit-value fast
+// paths below, handing the test process the REAL user directories; test fixtures/cleanup then
+// delete real user data (confirmed 2026-07-12: a pty-manager fixture's finally-rmSync wiped the
+// user's global system_prompt/ model prompts). Policy: a test process may only ever target
+// disposable temp directories. This helper decides whether an explicit dir qualifies.
+function isDisposableTmpPath(p) {
+  const roots = new Set();
+  const t = resolve(tmpdir());
+  roots.add(t);
+  try { roots.add(realpathSync(t)); } catch { /* keep the unresolved form */ }
+  if (process.platform !== 'win32') { roots.add('/tmp'); roots.add('/private/tmp'); }
+  const forms = new Set([resolve(p)]);
+  try { forms.add(realpathSync(resolve(p))); } catch { /* path may not exist yet */ }
+  for (const f of forms) {
+    for (const r of roots) {
+      if (f === r || f.startsWith(r + sep)) return true;
+    }
+  }
+  return false;
+}
+
 export function getClaudeConfigDir() {
   const envDir = process.env.CLAUDE_CONFIG_DIR;
   if (envDir && typeof envDir === 'string' && envDir.trim()) {
     const raw = envDir.trim();
-    return raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : resolve(raw);
+    const resolved = raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : resolve(raw);
+    // ████ L1d: in test context an explicit CLAUDE_CONFIG_DIR must still be a throwaway dir —
+    // an inherited real config dir would re-open the 2026-06-06 updater CACHE_DIR hole. ████
+    if (process.env.NODE_TEST_CONTEXT && !isDisposableTmpPath(resolved)) {
+      console.warn(`[findcc] L1d test-isolation barrier: CLAUDE_CONFIG_DIR="${raw}" is not under the OS temp dir — forcing a private guard config dir (tests may only target disposable temp dirs)`);
+      return join(tmpdir(), 'cc-viewer-test', `guard-cfg-${process.pid}-${threadId}`);
+    }
+    return resolved;
   }
   // ████████ Test isolation barrier L1b — DO NOT REMOVE (prevents data-loss regressions, 2026-06-06) ████████
   // CCV_LOG_DIR=tmp only redirects LOG_DIR; it does not cover this function: updater.js's
@@ -69,7 +100,21 @@ function resolveLogDir() {
       return join(tmpdir(), 'cc-viewer-test', `${process.pid}-${threadId}`);
     }
     const expanded = raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : raw;
-    return resolve(expanded);
+    const resolved = resolve(expanded);
+    // ████████ Test isolation barrier L1c — DO NOT REMOVE (2026-07-12 data loss) ████████
+    // The NODE_TEST_CONTEXT guard below only covers the no-CCV_LOG_DIR case; this explicit-value
+    // fast path used to accept ANY inherited dir. Inside a ccv-hosted shell CCV_LOG_DIR points at
+    // the real ~/.claude/cc-viewer, so a direct `node --test <file>` there resolved LOG_DIR to
+    // real user data — test cleanup then deleted it (2026-07-12: the user's global system_prompt/
+    // entries were wiped this way, twice). Tests may only target disposable temp dirs: anything
+    // outside the OS temp root is forced to the private guard dir. Use CCV_LOG_DIR=tmp or a
+    // mkdtemp path in tests. Unit test: test/logdir-test-guard.test.js.
+    if (process.env.NODE_TEST_CONTEXT && !isDisposableTmpPath(resolved)) {
+      console.warn(`[findcc] L1c test-isolation barrier: CCV_LOG_DIR="${raw}" is not under the OS temp dir — forcing a private guard LOG_DIR (tests may only target disposable temp dirs; use CCV_LOG_DIR=tmp or a mkdtemp path)`);
+      return join(tmpdir(), 'cc-viewer-test', `guard-${process.pid}-${threadId}`);
+    }
+    // ████████████████████████████████████████████████████████████████████████████
+    return resolved;
   }
   // Test isolation barrier: in node:test environment (NODE_TEST_CONTEXT is auto-injected by the
   // test runner and inherited by spawned child processes via spread env), if CCV_LOG_DIR is not
@@ -234,10 +279,16 @@ export function resolveNpmClaudePath() {
             const match = normReal.match(/(.*node_modules\/@[^/]+\/[^/]+)\//);
             if (match) {
               const packageDir = match[1];
+              // Claude Code 1.x: cli.js (injected with interceptor)
               const cliPath = join(packageDir, CLI_ENTRY);
               if (existsSync(cliPath)) {
                 return cliPath;
               }
+              // Claude Code 2.x layout ships no cli.js — the package's bin/ binary IS
+              // the entry point; without this fallback the resolver returns null and
+              // the launch dies with no claude at all.
+              const binPath = findNpmBinFallback(packageDir);
+              if (binPath) return binPath;
             }
           }
         } catch { }
@@ -255,16 +306,36 @@ export function resolveNpmClaudePath() {
   const globalRoot = getGlobalNodeModulesDir();
   if (globalRoot) {
     for (const packageName of PACKAGES) {
-      const cliPath = join(globalRoot, packageName, CLI_ENTRY);
+      const pkgDir = join(globalRoot, packageName);
+      // Claude Code 1.x: cli.js
+      const cliPath = join(pkgDir, CLI_ENTRY);
       if (existsSync(cliPath)) {
         return cliPath;
       }
+      // Claude Code 2.x: no cli.js, fall back to the package's bin/ entry.
+      const binPath = findNpmBinFallback(pkgDir);
+      if (binPath) return binPath;
     }
   }
 
   return null;
 }
 
+// Claude Code 2.x npm packages ship no cli.js — bin/claude(.exe) is the entry point.
+// `claude.exe` is checked FIRST even on POSIX: 2.1.x's package.json maps
+// `bin: {"claude": "bin/claude.exe"}` on every platform (verified on macOS 2.1.207,
+// where bin/claude.exe is the platform-native binary hard-linked into bin/).
+// Returns the first existing bin candidate under `<pkgDir>/bin`, or null (1.x layout).
+function findNpmBinFallback(pkgDir) {
+  const binDir = join(pkgDir, 'bin');
+  const names = process.platform === 'win32' ? ['claude.exe', 'claude.cmd'] : ['claude.exe', 'claude'];
+  for (const name of names) {
+    const binPath = join(binDir, name);
+    if (existsSync(binPath)) return binPath;
+  }
+  return null;
+}
+
 /**
  * 从 which/where 的原始输出中挑出能直接 CreateProcess/exec 的候选行。
  * Windows 的 `where` 会列出 PATH 中全部同名匹配——npm 全局安装时第一行往往是给

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.6.345",
+  "version": "1.6.348",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/adapters/dingtalk-adapter.js

@@ -179,21 +179,35 @@ const dingtalkAdapter = {
 
   async connect(cfg, hooks) {
     let client;
+    // keepAlive is required for silent-drop detection: without it the SDK never pings, so a
+    // network loss with no FIN leaves the socket "open" and `client.connected` true forever.
+    // Known SDK quirk: dingtalk-stream arms a new heartbeat interval on every socket 'open'
+    // without clearing the previous one, so each reconnect leaks one 8s interval (bounded by
+    // reconnect count; disconnect() clears the last). Accepted — detection matters more.
+    const opts = { clientId: cfg.appKey, clientSecret: cfg.appSecret, keepAlive: true };
     if (clientFactory) {
-      client = clientFactory({ clientId: cfg.appKey, clientSecret: cfg.appSecret });
+      client = clientFactory(opts);
       if (typeof client.registerCallbackListener === 'function') {
         client.registerCallbackListener('__test__', (res) => hooks.onInbound(normalizeInbound(res), res));
       }
     } else {
       const mod = await import('dingtalk-stream');
       const { DWClient, TOPIC_ROBOT } = mod;
-      client = new DWClient({ clientId: cfg.appKey, clientSecret: cfg.appSecret });
+      client = new DWClient(opts);
       client.registerCallbackListener(TOPIC_ROBOT, (res) => hooks.onInbound(normalizeInbound(res), res));
     }
     await client.connect?.();
     return client;
   },
 
+  // dingtalk-stream emits no client-level lifecycle events (open/close/error live on an internal
+  // ws that is replaced on every reconnect), so the core polls this instead. `userDisconnect` is
+  // TS-private but a plain runtime field; it flips true only on manual disconnect().
+  connectionProbe(client) {
+    if (!client || client.userDisconnect) return 'disconnected';
+    return client.connected ? 'connected' : 'reconnecting';
+  },
+
   async disconnect(client) {
     try { await client?.disconnect?.(); } catch { /* best-effort */ }
   },

package/server/lib/adapters/discord-adapter.js

@@ -80,10 +80,21 @@ const discordAdapter = {
     });
     ctx.store.client = client;
     // Persistent error listener for the life of the client: a Node EventEmitter that emits 'error'
-    // with NO listener throws and crashes the process. The connect-window once('error') below is
-    // consumed on resolve, so without this a later gateway 'error' would be fatal. Swallow (the
-    // gateway auto-reconnects; connection state surfaces via the bridge status).
-    client.on('error', () => { /* swallowed — see comment */ });
+    // with NO listener throws and crashes the process. NOTE: the connect-window once('error') below
+    // is NOT consumed by a successful ClientReady resolve — it survives and must therefore be a
+    // settled-guarded no-op post-connect (see below). Record errors as lastError here (state flips
+    // come from the shard lifecycle events below; the gateway auto-reconnects).
+    client.on('error', (e) => hooks.onConnectionChange?.(null, e));
+    // Shard lifecycle → core tri-state. Single unsharded gateway = one shard, so no per-shard map.
+    // Events?.X ?? 'literal' keeps test fakes (whose Events map lacks shard constants) working.
+    client.on(Events?.ShardReconnecting ?? 'shardReconnecting', () => hooks.onConnectionChange?.('reconnecting'));
+    client.on(Events?.ShardResume ?? 'shardResume', () => hooks.onConnectionChange?.('connected'));
+    client.on(Events?.ShardReady ?? 'shardReady', () => hooks.onConnectionChange?.('connected'));
+    client.on(Events?.ShardDisconnect ?? 'shardDisconnect', (ev) =>
+      hooks.onConnectionChange?.('disconnected', new Error(`gateway closed (code ${ev?.code ?? 'unknown'})`)));
+    client.on(Events?.Invalidated ?? 'invalidated', () =>
+      hooks.onConnectionChange?.('disconnected', new Error('session invalidated')));
+    client.on(Events?.ShardError ?? 'shardError', (e) => hooks.onConnectionChange?.(null, e));
     client.on(Events.MessageCreate, (message) => {
       // Loop-guard: ignore the bot's own messages (Discord redelivers our send as a new event) and
       // all other bots. author.bot covers self; the id check is belt-and-suspenders.
@@ -98,8 +109,19 @@ const discordAdapter = {
       const timer = setTimeout(() => { try { client.destroy(); } catch { /* best-effort */ } finish(reject, new Error('connect timeout')); }, CONNECT_PROBE_MS);
       if (typeof timer.unref === 'function') timer.unref();
       client.once(Events.ClientReady, () => finish(resolve, client));
-      client.once('error', (e) => { try { client.destroy(); } catch { /* best-effort */ } finish(reject, new Error(String(e?.message || e))); });
-      client.login(cfg.botToken).catch((e) => { try { client.destroy(); } catch { /* best-effort */ } finish(reject, new Error(String(e?.message || e))); });
+      // Guard the destroy behind `settled`: this once-listener is NOT consumed by ClientReady, so
+      // an unguarded destroy would kill the LIVE client on the first post-connect 'error' event
+      // (freezing the bridge with no reconnect — the exact stale-status bug this adapter fixes).
+      client.once('error', (e) => {
+        if (settled) return; // post-connect errors are handled by the persistent listener above
+        try { client.destroy(); } catch { /* best-effort */ }
+        finish(reject, new Error(String(e?.message || e)));
+      });
+      client.login(cfg.botToken).catch((e) => {
+        if (settled) return;
+        try { client.destroy(); } catch { /* best-effort */ }
+        finish(reject, new Error(String(e?.message || e)));
+      });
     });
   },
 

package/server/lib/adapters/feishu-adapter.js

@@ -18,6 +18,10 @@ import { registerAdapter } from '../im-bridge-core.js';
 let sdkFactory = null;
 export function __setClientFactory(fn) { sdkFactory = fn; }
 
+// Internal connect guard (< core CONNECT_TIMEOUT_MS): bounds the onReady wait on hook-capable SDK
+// builds so a misconfigured app fails with lastError instead of leaking a background retry loop.
+const CONNECT_PROBE_MS = 12_000;
+
 const TOKEN_PATH = '/open-apis/auth/v3/tenant_access_token/internal';
 function tokenHost(region) {
   return region === 'lark' ? 'https://open.larksuite.com' : 'https://open.feishu.cn';
@@ -90,17 +94,59 @@ const feishuAdapter = {
     const base = { appId: cfg.appId, appSecret: cfg.appSecret, domain };
     // Outbound client (auto-manages the tenant_access_token cache).
     ctx.store.sendClient = new Lark.Client(base);
-    // Inbound long-connection event client. wsConfig is REQUIRED — omitting PingInterval/PingTimeout
-    // makes start() throw or hang on some SDK builds.
+    let settled = false;
+    let resolveReady, rejectReady;
+    const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+    ready.catch(() => {}); // detached guard: a pre-await rejection must not raise unhandledRejection
+    // Inbound long-connection event client. wsConfig keys per SDK build: 1.66.0 reads ONLY the
+    // lowercase `pingTimeout` (seconds) — it arms the pong/liveness watchdog that terminates a
+    // zombie socket after a SILENT network drop (NAT idle, sleep, no FIN) and triggers reconnect;
+    // without it such drops are never detected. The capitalized PingInterval/PingTimeout keys are
+    // kept for older builds that read them (1.66.0 ignores unknown keys, so both are safe).
     const ws = new Lark.WSClient({
       ...base,
       loggerLevel: Lark.LoggerLevel ? Lark.LoggerLevel.warn : undefined, // warn: avoid noisy info-level stdout
-      wsConfig: { PingInterval: 30, PingTimeout: 5 },
+      wsConfig: { PingInterval: 30, PingTimeout: 5, pingTimeout: 5 },
+      // Lifecycle hooks ship with newer SDK builds (present in the installed 1.66.0); an older
+      // build silently ignores unknown ctor options, so wiring them is always safe.
+      onReady: () => {
+        if (settled) { hooks.onConnectionChange?.('connected'); return; }
+        settled = true; resolveReady();
+      },
+      onReconnecting: () => hooks.onConnectionChange?.('reconnecting'),
+      onReconnected: () => hooks.onConnectionChange?.('connected'),
+      onError: (err) => {
+        if (settled) { hooks.onConnectionChange?.('disconnected', err); return; }
+        settled = true; rejectReady(err instanceof Error ? err : new Error(String(err?.message || err)));
+      },
     });
     const dispatcher = new Lark.EventDispatcher({}).register({
       'im.message.receive_v1': async (data) => hooks.onInbound(normalizeInbound(data), null),
     });
-    await ws.start({ eventDispatcher: dispatcher });
+    if (typeof ws.getConnectionStatus === 'function') {
+      // Hook-capable build (feature-detected): start() resolves before the handshake completes,
+      // so gate on onReady/onError; bound with an internal timeout below the core's connect race.
+      const timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        rejectReady(new Error('connect timeout'));
+      }, CONNECT_PROBE_MS);
+      if (typeof timer.unref === 'function') timer.unref();
+      try {
+        await ws.start({ eventDispatcher: dispatcher });
+        await ready;
+      } catch (e) {
+        // Stop the SDK's background retry loop so a failed connect doesn't leak.
+        try { await ws.close?.({}); } catch { /* best-effort */ }
+        throw e;
+      } finally {
+        clearTimeout(timer);
+      }
+    } else {
+      // Older SDK (and legacy test fakes): original behavior — start() is trusted, no
+      // lifecycle hooks fire, connection state stays start/stop-driven.
+      await ws.start({ eventDispatcher: dispatcher });
+    }
     return ws;
   },
 

package/server/lib/adapters/wecom-adapter.js

@@ -75,6 +75,30 @@ const wecomAdapter = {
     const client = new WSClient({ botId: cfg.botId, secret: cfg.secret });
     ctx.store.client = client; // single client for inbound + outbound (sendOne reads it)
     client.on('message.text', (frame) => hooks.onInbound(normalizeInbound(frame), null));
+    // Persistent lifecycle listeners → core tri-state. Registered up front (pre-connect emits are
+    // ignored by the core while not running); removed by disconnect()'s removeAllListeners.
+    // NOTE: one connection per bot — running testConnection against the SAME bot kicks the live
+    // bridge via disconnected_event, which the SDK treats as TERMINAL (isManualClose, no
+    // reconnect). The status will correctly show Disconnected until the bridge is restarted;
+    // auto-restart-after-test is a deliberate non-goal for now (backlog).
+    let kicked = false;
+    client.on('event.disconnected_event', () => {
+      // Server kicked this connection (a new one took over): the SDK sets isManualClose and will
+      // NOT reconnect, so this is terminal; the 'disconnected' emit that follows must not
+      // downgrade it to reconnecting.
+      kicked = true;
+      hooks.onConnectionChange?.('disconnected', new Error('kicked: new connection established'));
+    });
+    client.on('disconnected', (reason) => {
+      if (!kicked) hooks.onConnectionChange?.('reconnecting', reason ? new Error(String(reason)) : null);
+    });
+    client.on('reconnecting', () => hooks.onConnectionChange?.('reconnecting'));
+    client.on('authenticated', () => { kicked = false; hooks.onConnectionChange?.('connected'); });
+    client.on('error', (e) => {
+      const terminal = e?.name === 'WSReconnectExhaustedError' || e?.name === 'WSAuthFailureError'
+        || e?.code === 'WS_RECONNECT_EXHAUSTED';
+      hooks.onConnectionChange?.(terminal ? 'disconnected' : null, e);
+    });
     // connect() is synchronous; resolve once the WS handshake authenticates so the core's
     // `connected` flag and CONNECT_TIMEOUT_MS race are meaningful (bad creds → lastError, not a
     // false "connected"). Reject (and tear down) on error or an internal timeout.

package/server/lib/create_system_prompt.js

@@ -7,7 +7,7 @@
 //   node server/lib/create_system_prompt.js deepseek-v4-pro # a named preset
 //   node server/lib/create_system_prompt.js --list          # list presets
 
-import { execFileSync } from 'node:child_process'
+import { spawnSync } from 'node:child_process'
 import { readFileSync, statSync } from 'node:fs'
 import os from 'node:os'
 import { delimiter, join, sep } from 'node:path'
@@ -54,13 +54,16 @@ function envString(name) {
 }
 
 function commandOutput(command, args, cwd) {
-  return stringOrEmpty(() =>
-    execFileSync(command, args, {
+  return stringOrEmpty(() => {
+    const result = spawnSync(command, args, {
       cwd,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim(),
-  )
+      timeout: 15000, // 15s hard cap: hanging git (NFS / huge repo / broken index) must not block spawn
+    })
+    if (result.error || result.status !== 0) return ''
+    return result.stdout.trim()
+  })
 }
 
 function firstNonEmpty(...values) {
@@ -130,8 +133,11 @@ function resolveMemory(home, cwd) {
   return { dir, index, enabled: enabled ? 'true' : 'false' }
 }
 
-export function createSystemPromptVariables(overrides = {}) {
-  const cwd = stringOrEmpty(() => process.cwd())
+export function createSystemPromptVariables(overrides = {}, opts = {}) {
+  // opts.cwd: resolve cwd-dependent variables (environment.cwd, git.*, memory.dir) against a
+  // caller-supplied directory instead of process.cwd() — the spawn-time renderer passes the
+  // workspace being launched, which is not necessarily where the ccv server itself runs.
+  const cwd = (typeof opts.cwd === 'string' && opts.cwd) ? opts.cwd : stringOrEmpty(() => process.cwd())
   const now = new Date()
   const timeZone = stringOrEmpty(
     () => Intl.DateTimeFormat().resolvedOptions().timeZone,

package/server/lib/im-bridge-core.js

@@ -43,6 +43,10 @@ const STREAM_MIN_DELTA = 20;             // 累计增长达 20 字才推一帧
 const STREAM_MAX_FRAMES = 25;            // 每回合中途流式帧硬上限；超限停推，finalize 仍落全文
 const STREAM_MAX_CHARS = 20_000;         // 卡片内容字符上限，超出截断
 
+// Poll interval for adapters that expose connectionProbe() instead of lifecycle events
+// (dingtalk-stream replaces its internal ws on every reconnect, so no listener survives).
+let CONN_POLL_MS = 5_000;
+
 // ─── registry + core-global single-flight ───
 const instances = new Map();             // platformId → instance
 let activeInjection = null;              // { platformId, since, target } — the one in-flight turn
@@ -61,6 +65,9 @@ function newInstance(adapter) {
     client: null,
     running: false,
     connected: false,
+    connectionState: 'disconnected',      // 'connected' | 'reconnecting' | 'disconnected'; invariant: connected === (connectionState === 'connected')
+    startGen: 0,                          // generation counter; stale adapter listeners from a previous start are ignored
+    connPollTimer: null,                  // fallback poll timer for adapters exposing connectionProbe()
     lastError: null,
     bridgeDeps: null,
     boundConversation: null,
@@ -88,9 +95,15 @@ function newInstance(adapter) {
  * @property {Object}  [capabilities]  Informational flags ({inboundAck, sdkManagesToken}); not read by the core.
  * @property {(cfg:Object)=>boolean}  hasCreds        True when cfg carries enough creds to connect.
  * @property {(cfg:Object)=>Object}   [statusFields]  Extra non-secret status fields for the admin API.
- * @property {(cfg:Object, hooks:{onInbound:(normalized:Object, ackCtx:*)=>void}, ctx:{fetch,store})=>Promise<*>} connect
+ * @property {(cfg:Object, hooks:{onInbound:(normalized:Object, ackCtx:*)=>void, onConnectionChange?:(state:?string, err?:*)=>void}, ctx:{fetch,store})=>Promise<*>} connect
  *           Open the long connection; return the live client. Call hooks.onInbound(normalized, ackCtx)
  *           per inbound message, where normalized = {text, conversationId, senderId, msgId, target}.
+ *           Optionally call hooks.onConnectionChange?.(state, err) on transport lifecycle changes,
+ *           where state ∈ 'connected'|'reconnecting'|'disconnected', or null to record err only.
+ *           Always invoke it with optional chaining — callers (tests) may pass onInbound alone.
+ * @property {(client:*)=>('connected'|'reconnecting'|'disconnected')} [connectionProbe]
+ *           For SDKs without usable lifecycle events: derive the live connection state from the
+ *           client's fields. When present, the core polls it every CONN_POLL_MS while running.
  * @property {(client:*, ctx:{fetch,store})=>Promise<void>} [disconnect]  Tear down the client (best-effort).
  * @property {(ackCtx:*, client:*)=>void} [ack]  Ack an inbound msg (platforms that redeliver if not acked).
  * @property {(cfg:Object, target:Object, content:string, ctx:{fetch,store})=>Promise<void>} sendOne  Send one chunk.
@@ -320,6 +333,26 @@ function armActiveInjection(inst, target, since) {
   }
 }
 
+/**
+ * Transition the tri-state connection status. `gen` binds the caller to one startBridge lifetime,
+ * so a stale adapter listener firing after stopBridge/reloadBridge can never flip the state.
+ * state === null records the error only; identical consecutive states are no-ops (collapses
+ * SDK error/reconnect storms into single audited transitions).
+ */
+function setConnectionState(inst, gen, state, err) {
+  if (gen !== inst.startGen || !inst.running) return;
+  const errStr = err != null ? String(err?.message || err) : null;
+  if (errStr) inst.lastError = errStr;
+  if (state == null || state === inst.connectionState) return;
+  inst.connectionState = state;
+  inst.connected = state === 'connected';
+  // Recovery clears the retained disconnect cause — the UI ranks lastError above connected, so
+  // keeping it would leave the status stuck on "Error" after every transient drop. Deduped
+  // repeats and null-state calls don't clear, preserving send-failure diagnostics while healthy.
+  if (state === 'connected' && !errStr) inst.lastError = null;
+  audit(inst, 'connection', { state, ...(errStr ? { error: errStr } : {}) });
+}
+
 // ─── small helpers ───
 function audit(inst, event, data) {
   try {
@@ -711,21 +744,45 @@ export async function startBridge(id, deps) {
   if (!inst.bridgeDeps || typeof inst.bridgeDeps.getConfig !== 'function') { audit(inst, 'start-skipped', { reason: 'no-deps' }); return; }
   const cfg = inst.bridgeDeps.getConfig();
   if (!cfg || !cfg.enabled || !inst.adapter.hasCreds(cfg)) return; // off / incomplete → no-op
+  // Bump AFTER the early-return guards: startBridge on an already-running instance is a legal
+  // no-op, and bumping there would orphan the live adapter's listeners (state frozen forever).
+  const gen = ++inst.startGen;
   try {
-    const hooks = { onInbound: (normalized, ackCtx) => handleInbound(inst, normalized, ackCtx) };
+    const hooks = {
+      onInbound: (normalized, ackCtx) => handleInbound(inst, normalized, ackCtx),
+      onConnectionChange: (state, err) => setConnectionState(inst, gen, state, err),
+    };
     // Bound the connect so a hung adapter (e.g. Feishu WSClient.start() on a misconfigured app)
     // becomes a lastError instead of blocking the whole startup chain.
-    inst.client = await Promise.race([
+    const client = await Promise.race([
       inst.adapter.connect(cfg, hooks, ctxFor(inst)),
       new Promise((_, reject) => { const tm = setTimeout(() => reject(new Error('connect timeout')), CONNECT_TIMEOUT_MS); if (typeof tm.unref === 'function') tm.unref(); }),
     ]);
+    if (gen !== inst.startGen) {
+      // stopBridge / reload ran while the connect was in flight: this start lost the race. Don't
+      // resurrect the instance — tear down the late-arriving client so it doesn't leak.
+      try { await inst.adapter.disconnect?.(client, ctxFor(inst)); } catch { /* best-effort */ }
+      audit(inst, 'start-superseded', {});
+      return;
+    }
+    inst.client = client;
     inst.running = true;
     inst.connected = true;
+    inst.connectionState = 'connected';
     inst.lastError = null;
+    if (typeof inst.adapter.connectionProbe === 'function') {
+      inst.connPollTimer = setInterval(() => {
+        try { setConnectionState(inst, gen, inst.adapter.connectionProbe(inst.client), null); }
+        catch { /* best-effort: a probe throw must not kill the interval */ }
+      }, CONN_POLL_MS);
+      if (typeof inst.connPollTimer.unref === 'function') inst.connPollTimer.unref();
+    }
     audit(inst, 'start', inst.adapter.statusFields ? inst.adapter.statusFields(cfg) : {});
   } catch (e) {
+    if (gen !== inst.startGen) return; // superseded by stop/reload — don't overwrite their state
     inst.lastError = String(e?.message || e);
     inst.connected = false;
+    inst.connectionState = 'disconnected';
     audit(inst, 'start-error', { error: inst.lastError });
   }
 }
@@ -733,6 +790,9 @@ export async function startBridge(id, deps) {
 export async function stopBridge(id) {
   const inst = instances.get(id);
   if (!inst) return;
+  // Invalidate connection hooks up front so anything the adapter teardown fires can't flip state.
+  inst.startGen++;
+  if (inst.connPollTimer) { clearInterval(inst.connPollTimer); inst.connPollTimer = null; }
   if (inst.ackCardPromise && activeInjection?.platformId === id) {
     await finalizeAckCard(inst, activeInjection.target, tr(inst, 'noSession'), 'error');
   } else {
@@ -743,6 +803,7 @@ export async function stopBridge(id) {
   inst.client = null;
   inst.running = false;
   inst.connected = false;
+  inst.connectionState = 'disconnected';
   inst.boundConversation = null;
   if (activeInjection && activeInjection.platformId === id) clearActiveInjection();
   inst.queue.length = 0;
@@ -760,10 +821,11 @@ export function isBridgeRunning(id) {
 
 export function getBridgeStatus(id) {
   const inst = instances.get(id);
-  if (!inst) return { running: false, connected: false, lastError: null, boundConversationId: null };
+  if (!inst) return { running: false, connected: false, connectionState: 'disconnected', lastError: null, boundConversationId: null };
   const base = {
     running: inst.running,
     connected: inst.connected,
+    connectionState: inst.connectionState,
     lastError: inst.lastError,
     boundConversationId: inst.boundConversation?.conversationId || null,
   };
@@ -799,6 +861,8 @@ export async function stopAll() {
 // ─── test seams ───
 export function __setStreamTickMsForTests(ms) { STREAM_TICK_MS = (ms == null ? 300 : ms); }
 
+export function __setConnPollMsForTests(ms) { CONN_POLL_MS = (ms == null ? 5_000 : ms); }
+
 export function __setMaxQueueForTests(id, n) {
   const inst = instances.get(id);
   if (inst) inst.maxQueueOverride = n;
@@ -809,6 +873,9 @@ export function __resetForTests(id) {
   const inst = instances.get(id);
   if (!inst) return;
   inst.client = null; inst.running = false; inst.connected = false; inst.lastError = null;
+  inst.connectionState = 'disconnected';
+  inst.startGen++; // orphan any listeners still bound to a previous start
+  if (inst.connPollTimer) { clearInterval(inst.connPollTimer); inst.connPollTimer = null; }
   inst.bridgeDeps = null; inst.boundConversation = null; inst.lastRepliedTurnTs = null;
   inst.maxQueueOverride = null;
   inst.seenMsgIds.length = 0; inst.queue.length = 0; inst.sendTimes.length = 0;

package/server/lib/im-lock.js

@@ -135,7 +135,15 @@ export function defaultProbe(id, port, { timeoutMs = 400 } = {}) {
               const j = JSON.parse(body);
               // 身份：能对「该 id」返回 IM status 形状的 loopback 服务即视为我们的 worker
               if (j && (j.connection || typeof j.enabled === 'boolean')) {
-                finish({ ok: true, connected: !!(j.connection && j.connection.connected), pid: j.pid });
+                finish({
+                  ok: true,
+                  connected: !!(j.connection && j.connection.connected),
+                  // Old workers (pre-tri-state builds) omit connectionState → derive from connected.
+                  connectionState: j.connection?.connectionState
+                    ?? (j.connection?.connected ? 'connected' : 'disconnected'),
+                  lastError: j.connection?.lastError ?? null,
+                  pid: j.pid,
+                });
               } else finish(null);
             } catch { finish(null); }
           });
@@ -178,7 +186,13 @@ export async function getImLiveness(id, opts = {}) {
 
   const res = await probe(id, lock.port);
   if (res && res.ok && (res.pid == null || res.pid === lock.pid)) {
-    return { state: 'ready', lock, connected: !!res.connected };
+    return {
+      state: 'ready',
+      lock,
+      connected: !!res.connected,
+      connectionState: res.connectionState ?? (res.connected ? 'connected' : 'disconnected'),
+      lastError: res.lastError ?? null,
+    };
   }
   return { state: pidAlive(lock.pid) ? 'hung' : 'dead', lock };
 }

package/server/lib/im-process-manager.js

@@ -139,7 +139,7 @@ export async function stopImProcess(id, opts = {}) {
 
 /**
  * 查询某 IM 的进程状态（供 header chip / 路由）。
- * @returns {Promise<{state:string, running:boolean, connected:boolean, pid:number|null, port:number|null, startedAt:string|null}>}
+ * @returns {Promise<{state:string, running:boolean, connected:boolean, connectionState:string, lastError:string|null, pid:number|null, port:number|null, startedAt:string|null}>}
  */
 export async function getImProcessStatus(id, opts = {}) {
   const live = await getImLiveness(id, opts);
@@ -147,6 +147,12 @@ export async function getImProcessStatus(id, opts = {}) {
     state: live.state,
     running: live.state === 'ready' || live.state === 'booting' || live.state === 'hung',
     connected: live.state === 'ready' && !!live.connected,
+    // Tri-state IM link status from the worker's own report; a non-ready process cannot be
+    // connected or reconnecting, so it reads as disconnected.
+    connectionState: live.state === 'ready'
+      ? (live.connectionState || (live.connected ? 'connected' : 'disconnected'))
+      : 'disconnected',
+    lastError: live.lastError ?? null,
     pid: live.lock?.pid ?? null,
     port: live.lock?.port ?? null,
     startedAt: live.lock?.startedAt ?? null,

package/server/lib/model-system-prompts.js

@@ -4,18 +4,22 @@ import { isNonEmptyFile } from './system-prompt-files.js';
 
 // 「按模型定制 system prompt」的文件夹与文件名语法。
 // 全局目录 <LOG_DIR>/system_prompt/ 与工作区目录 <workspace>/system_prompt/ 各放一套；
-// 启动时用「上次启动所用模型 id」做不区分大小写的子串匹配(条目名 "OPUS" 命中
-// "claude-opus-4-8[1m]")，命中的文件整体取代工作区默认的 CC_SYSTEM.md / CC_APPEND_SYSTEM.md。
+// 启动时用「当前生效配置解析出的模型 id」(spawn-model-resolver.js：激活的三方 proxy profile
+// 模型映射 > env > settings.json；无配置信号则不注入)做不区分大小写的子串匹配(条目名
+// "OPUS" 命中 "claude-opus-4-8[1m]")，命中的文件整体取代工作区默认的 CC_SYSTEM.md /
+// CC_APPEND_SYSTEM.md。
 //
 // Model-specific system prompt files. Two scopes share the same folder name
 // (MODEL_PROMPT_DIR): global <LOG_DIR>/system_prompt/ and per-workspace
-// <workspace>/system_prompt/. At spawn the model id from the last launch is
+// <workspace>/system_prompt/. At spawn the model id resolved from the ACTIVE
+// configuration (spawn-model-resolver.js — never from past usage records) is
 // matched case-insensitively as a substring against entry names; a match fully
 // replaces the workspace Default sentinels for that launch.
 //
-// Known limitations (v1, by design):
-// - readClaudeProjectModel filters /haiku/i, so an entry named "haiku" never
-//   matches at spawn (haiku is the auxiliary model; see context-watcher.js).
+// Known limitations (by design):
+// - An entry named "haiku" only matches when haiku is explicitly configured as
+//   the main model (rare but legal); the old last-usage criterion filtered
+//   /haiku/i and could never match it.
 // - Opening ~/.claude/cc-viewer itself as the workspace makes both scopes the
 //   same directory; harmless — the workspace scope short-circuits first.
 export const MODEL_PROMPT_DIR = 'system_prompt';