cc-viewer 1.7.22 → 1.8.0

package/server/lib/adapters/discord-adapter.js

@@ -1,5 +1,5 @@
 // Discord adapter — the platform-specific half of the Discord bridge. The generic orchestration
-// (dedup, access control, queue, inject, chunk, turn-end reply) lives in server/lib/im-bridge-core.js;
+// (dedup, access control, queue, inject, chunk, turn-end reply) lives in server/lib/im/im-bridge-core.js;
 // this module only knows discord.js's Gateway client, inbound message shape, and outbound send.
 //
 // Uses discord.js v14: the bot dials OUT to Discord's Gateway WebSocket (no public URL). Credential is
@@ -12,7 +12,7 @@
 // Console prerequisite (no code equivalent — surfaced in the UI help): in the Discord Developer Portal,
 // create an app + bot, ENABLE the Message Content Intent (else message.content is silently empty), copy
 // the bot token, and invite the bot with the `bot`+`applications.commands` scopes and View/Send perms.
-import { registerAdapter } from '../im-bridge-core.js';
+import { registerAdapter } from '../im/im-bridge-core.js';
 
 // ─── test seam: a fake discord.js factory (zero real gateway / socket) ───
 let sdkFactory = null;

package/server/lib/adapters/feishu-adapter.js

@@ -1,6 +1,6 @@
 // Feishu/Lark adapter — the platform-specific half of the Feishu bridge. The generic
 // orchestration (dedup, access control, queue, inject, chunk, turn-end reply) lives in
-// server/lib/im-bridge-core.js; this module only knows Feishu's WebSocket long-connection event
+// server/lib/im/im-bridge-core.js; this module only knows Feishu's WebSocket long-connection event
 // client, inbound payload shape, and outbound send.
 //
 // Inbound uses the official SDK's WSClient long-connection (NOT a webhook) so it works on
@@ -11,7 +11,7 @@
 // Console prerequisite (no code equivalent — surfaced to the user in the UI/README): the custom
 // app must set Event Subscription to "long connection", subscribe `im.message.receive_v1`, grant
 // the `im:message` send scope, and be published.
-import { registerAdapter } from '../im-bridge-core.js';
+import { registerAdapter } from '../im/im-bridge-core.js';
 
 // ─── test seam: a fake SDK factory ({ Client, WSClient, EventDispatcher, Domain, LoggerLevel })
 // so unit tests never import the real SDK or open a socket. ───

package/server/lib/adapters/wecom-adapter.js

@@ -1,6 +1,6 @@
 // 企业微信 (WeCom) adapter — the platform-specific half of the WeCom bridge. The generic
 // orchestration (dedup, access control, queue, inject, chunk, turn-end reply) lives in
-// server/lib/im-bridge-core.js; this module only knows WeCom's smart-robot long-connection client,
+// server/lib/im/im-bridge-core.js; this module only knows WeCom's smart-robot long-connection client,
 // inbound frame shape, and outbound send.
 //
 // Uses the 企业微信智能机器人长连接 (Smart Robot long-connection) mode via @wecom/aibot-node-sdk:
@@ -12,7 +12,7 @@
 // Console prerequisite (no code equivalent — surfaced in the UI help/README): create a 智能机器人,
 // set its API 接收模式 to 长连接, copy the botId + secret, and add the bot to a chat.
 import { randomUUID } from 'node:crypto';
-import { registerAdapter } from '../im-bridge-core.js';
+import { registerAdapter } from '../im/im-bridge-core.js';
 
 // ─── test seam: a fake SDK factory (zero real SDK / socket) ───
 let sdkFactory = null;

package/server/lib/approval-policy.js

@@ -0,0 +1,29 @@
+/**
+ * approval-policy.js — Shared approval-policy predicates for the two approval paths.
+ *
+ * Single source of truth for:
+ *   - APPROVAL_TOOLS: the six mutating/external tools that require explicit user
+ *     approval (previously duplicated literally at ask/perm-bridge.js and
+ *     sdk-manager.js).
+ *   - isPublishCommand: the npm-publish hard gate. `npm publish` is the one
+ *     irreversible outward-facing command (commits can be rewritten, pushes
+ *     force-pushed back) — it must NEVER be auto-allowed, even under
+ *     --dangerously-skip-permissions. Both consumers force it through the Web UI
+ *     approval modal: perm-bridge.js exempts it from the CCV_BYPASS_PERMISSIONS
+ *     auto-allow; sdk-manager.js routes it into the perm approval branch even in
+ *     bypassPermissions mode.
+ *
+ * Pure leaf module (L1-lib): no imports, no I/O — importable from both L1-lib
+ * (sdk-manager.js) and L1-sub (ask/perm-bridge.js) without boundary-gate edges.
+ */
+
+export const APPROVAL_TOOLS = new Set(['Bash', 'Edit', 'Write', 'NotebookEdit', 'WebFetch', 'WebSearch']);
+
+/**
+ * @param {string} toolName
+ * @param {object} [input] — tool input ({ command } for Bash)
+ * @returns {boolean} true when the call is an `npm publish` invocation
+ */
+export function isPublishCommand(toolName, input) {
+  return toolName === 'Bash' && typeof input?.command === 'string' && /npm\s+publish/i.test(input.command);
+}

package/server/lib/{ask-store.js → ask/ask-store.js}

@@ -12,9 +12,9 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { renameSyncWithRetry } from './file-api.js';
-import { withFileLockAsync } from './async-file-lock.js';
-import { LOG_DIR } from '../../findcc.js';
+import { renameSyncWithRetry } from '../file-api.js';
+import { withFileLockAsync } from '../async-file-lock.js';
+import { LOG_DIR } from '../../../findcc.js';
 
 const SCHEMA_VERSION = 1;
 

package/server/lib/{perm-bridge.js → ask/perm-bridge.js}

@@ -14,7 +14,8 @@
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
-import { evaluateImDeny } from './im-deny.js';
+import { evaluateImDeny } from '../im-deny.js';
+import { APPROVAL_TOOLS, isPublishCommand } from '../approval-policy.js';
 
 const port = process.env.CCVIEWER_PORT;
 const rawProtocol = process.env.CCVIEWER_PROTOCOL;
@@ -59,9 +60,8 @@ if (!toolName || !toolInput) {
 // 硬拦截：npm publish 即使在 --d (bypass) 模式下也强制走 Web UI 审批
 // 这是安全底线，不受 --dangerously-skip-permissions 影响
 // 注：git commit / git push 不在硬拦截范围内 —— 提交可重写、push 可 force-push 回退,
-// 真正不可撤销的对外发布(npm publish)才走硬闸
-const isPublishCmd = toolName === 'Bash' && toolInput.command &&
-  /npm\s+publish/i.test(toolInput.command);
+// 真正不可撤销的对外发布(npm publish)才走硬闸。谓词共享自 approval-policy.js(SDK 链路同用)。
+const isPublishCmd = isPublishCommand(toolName, toolInput);
 
 // IM worker (skip-permissions) 硬拦截 —— 必须在下面的 bypass auto-allow 之前求值，
 // 否则 CCV_BYPASS_PERMISSIONS=1 会把一切先放行（见 plan §安全 2）。仅对 IM worker 生效。
@@ -95,7 +95,7 @@ if (toolName === 'AskUserQuestion') {
 }
 
 // These tools need explicit user approval via Web UI (mutating or external access).
-const APPROVAL_TOOLS = new Set(['Bash', 'Edit', 'Write', 'NotebookEdit', 'WebFetch', 'WebSearch']);
+// The six-tool set is shared with the SDK canUseTool path via approval-policy.js.
 if (!APPROVAL_TOOLS.has(toolName)) {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },

package/server/lib/chat-queue.js

@@ -0,0 +1,341 @@
+/**
+ * chat-queue.js — Server-side busy queue for chat-composer messages (PTY / terminal-hidden mode).
+ *
+ * When Claude is mid-run and the user presses Enter in the web chat composer, the message is
+ * held here instead of being typed into the TUI immediately. The server broadcasts the queue
+ * (`queue-state`) so every client can render floating bubbles above the composer, and drains
+ * the queue into the PTY (bracketed paste + Enter) once the turn really ends.
+ *
+ * Per-bubble actions:
+ * - "Send now" (queue-send-now) interrupts the running turn (focus-in + ESC, same bytes as the
+ *   web Stop button) and injects that message as soon as the TUI is observably idle.
+ * - "Remove" (queue-remove) drops it.
+ * Stop keeps the queue parked (product decision): `suppressNextDrain()` blocks the automatic
+ * turn-end drain until a NEW turn starts (streaming rising edge) or a message is sent now.
+ *
+ * Design notes:
+ * - This module NEVER imports pty-manager / server.js. All PTY access + state probes are
+ *   injected via initChatQueue(deps), so unit tests run without node-pty (im-bridge-core
+ *   convention).
+ * - Injection is single-flight (`_injecting`) and mutually exclusive with the IM bridge's
+ *   own injection slot via the injected `hasExternalInjection` probe (im-bridge-core's
+ *   anyActiveInjection).
+ * - Known limitation: keystrokes typed directly into a VISIBLE terminal are not serialized
+ *   against an in-flight inject (same accepted risk class as the IM bridge today).
+ */
+
+import { reportSwallowed } from '@ccv/core/error-report';
+import { bracketPasteSubmit, sanitizeInbound } from './im/im-bridge-core.js';
+
+const MAX_ITEMS = 50;             // im-bridge-core MAX_QUEUE parity
+const STOP_ESC_DELAY_MS = 50;     // focus-in → ESC gap, mirrors ChatView's STOP_FOCUS_IN_ESC_DELAY_MS
+const INJECT_POLL_MS = 100;       // idle poll cadence before injecting
+const INJECT_POLL_MAX_MS = 2000;  // give up polling after this; NEVER inject unconditionally
+const RESCUE_AFTER_MS = 3000;     // stale-busy rescue: frontend guessed busy while the turn already ended
+
+// Injected deps (see initChatQueue). Null until wired; every public entry no-ops safely then.
+let _deps = null;
+let _items = [];            // [{ id, text, ts }] FIFO
+let _injecting = false;     // single-flight guard around one bracket-paste inject sequence
+let _rescueTimer = null;    // stale-busy rescue timer
+let _pollTimer = null;      // active idle-poll interval (single slot — see _pollUntilSafe)
+let _escTimer = null;       // sendNow's focus-in → ESC gap timer
+let _suppressDrain = false; // Stop pressed → park the queue until a new turn starts
+let _gen = 0;               // generation counter: clear()/stop() invalidate in-flight injects
+
+/**
+ * @param {object} deps
+ * @param {function} deps.writeToPty — (data:string) => void
+ * @param {function} deps.writeToPtySequential — (chunks:string[], onComplete:(ok:boolean)=>void, opts?) => void
+ * @param {function} deps.getPtyKind — () => 'claude' | 'shell' | null
+ * @param {function} deps.isStreaming — () => boolean (per-API-call streaming flag; flickers between tool calls)
+ * @param {function} deps.hasPendingApproval — () => boolean (web-visible ask/perm modal open)
+ * @param {function} [deps.hasExternalInjection] — () => boolean (IM bridge injection slot busy)
+ * @param {function} deps.broadcastWs — (msg:object) => void
+ */
+export function initChatQueue(deps) {
+  _deps = deps;
+}
+
+export function getSnapshot() {
+  return _items.map(({ id, text, ts }) => ({ id, text, ts }));
+}
+
+function _broadcast() {
+  if (!_deps || !_deps.broadcastWs) return;
+  try { _deps.broadcastWs({ type: 'queue-state', items: getSnapshot() }); }
+  catch (err) { reportSwallowed('chat-queue.broadcast', err); }
+}
+
+function _makeItem(text) {
+  return {
+    id: 'q_' + Date.now().toString(36) + '_' + Math.random().toString(36).slice(2, 8),
+    text,
+    ts: Date.now(),
+  };
+}
+
+function _clearRescueTimer() {
+  if (_rescueTimer) { clearTimeout(_rescueTimer); _rescueTimer = null; }
+}
+
+function _clearPollTimer() {
+  if (_pollTimer) { clearInterval(_pollTimer); _pollTimer = null; }
+}
+
+function _clearEscTimer() {
+  if (_escTimer) { clearTimeout(_escTimer); _escTimer = null; }
+}
+
+/**
+ * True only when injecting is observably safe: claude TUI (not a bare shell), no API call in
+ * flight, no web-visible approval modal, no external (IM) injection holding the PTY.
+ * NOTE: a TUI-native fallback question (ask-bridge terminal fallback) is invisible to
+ * hasPendingApproval — which is why poll timeouts must NEVER fall through to an inject.
+ * NOTE 2: `isStreaming` (streamingState.active) flickers false between tool calls mid-turn;
+ * injecting into that gap is harmless (the TUI natively queues the paste) but it means an
+ * "immediate" inject can land inside the current turn's chain — accepted risk class.
+ */
+function _safeToInject() {
+  if (!_deps) return false;
+  if (_injecting) return false;
+  // A throwing probe means the wiring regressed — fail safe (no inject) but never silently:
+  // an untagged swallow here would wedge the whole queue with no diagnostic.
+  try { if (_deps.getPtyKind && _deps.getPtyKind() !== 'claude') return false; }
+  catch (err) { reportSwallowed('chat-queue.probe', err); return false; }
+  try { if (_deps.isStreaming && _deps.isStreaming()) return false; }
+  catch (err) { reportSwallowed('chat-queue.probe', err); return false; }
+  try { if (_deps.hasPendingApproval && _deps.hasPendingApproval()) return false; }
+  catch (err) { reportSwallowed('chat-queue.probe', err); return false; }
+  try { if (_deps.hasExternalInjection && _deps.hasExternalInjection()) return false; }
+  catch (err) { reportSwallowed('chat-queue.probe', err); return false; }
+  return true;
+}
+
+/**
+ * Inject the head item. Caller must have verified _safeToInject() first (except the internal
+ * re-checks here, which keep this self-guarding for direct calls).
+ * Broadcasts on shift (so the bubble disappears the moment the message starts typing into the
+ * TUI) and again if the write fails and the item returns to the head.
+ */
+function _injectHead() {
+  if (!_safeToInject()) return false;
+  const item = _items.shift();
+  if (!item) return false;
+  _broadcast();
+  _injecting = true;
+  const gen = _gen; // invalidate on clear()/stop(): a stale completion must not re-park
+  try {
+    _deps.writeToPtySequential(bracketPasteSubmit(item.text), (ok) => {
+      _injecting = false;
+      if (gen !== _gen) return;
+      if (!ok) {
+        // Dead PTY / write failure — never lose the message silently; put it back.
+        _items.unshift(item);
+        _broadcast();
+      }
+    }, { settleMs: 250 });
+  } catch (err) {
+    _injecting = false;
+    if (gen === _gen) {
+      _items.unshift(item);
+      _broadcast();
+    }
+    reportSwallowed('chat-queue.inject', err);
+  }
+  return true;
+}
+
+/**
+ * Poll (≤ INJECT_POLL_MAX_MS) until _safeToInject(), then run fn. On timeout: do NOT inject —
+ * invoke onTimeout instead (caller decides: keep queued / restore item). A timed-out blind
+ * write could land in a TUI-native question prompt and be submitted as its answer.
+ * Tick-counted (not Date-based) so mock.timers without Date mocking can drive it in tests.
+ */
+function _pollUntilSafe(fn, onTimeout) {
+  _clearPollTimer();
+  const maxTicks = Math.ceil(INJECT_POLL_MAX_MS / INJECT_POLL_MS);
+  let ticks = 0;
+  _pollTimer = setInterval(() => {
+    ticks += 1;
+    if (ticks > maxTicks) {
+      _clearPollTimer();
+      if (onTimeout) onTimeout();
+      return;
+    }
+    if (!_safeToInject()) return;
+    _clearPollTimer();
+    fn();
+  }, INJECT_POLL_MS);
+  if (typeof _pollTimer.unref === 'function') _pollTimer.unref();
+}
+
+/**
+ * Enqueue a chat-composer message (Claude believed busy). Sanitizes control bytes (a crafted
+ * `\x1b[201~` would otherwise break the paste frame), broadcasts, and arms a rescue timer for
+ * the stale-busy case (frontend's isStreaming lags the real turn end by up to its debounce).
+ */
+export function enqueue(text) {
+  if (!_deps) return null;
+  const clean = sanitizeInbound(text == null ? '' : String(text)).trim();
+  if (!clean) return null;
+  if (_items.length >= MAX_ITEMS) {
+    // Negative ack: the frontend cleared the composer optimistically — never fail silently.
+    console.warn('[chat-queue] queue full, rejecting message');
+    try { _deps.broadcastWs({ type: 'queue-rejected', reason: 'full' }); }
+    catch (err) { reportSwallowed('chat-queue.reject-broadcast', err); }
+    return null;
+  }
+  const item = _makeItem(clean);
+  _items.push(item);
+  _clearRescueTimer();
+  _broadcast();
+  let streaming = false;
+  try { streaming = !!(_deps.isStreaming && _deps.isStreaming()); } catch { streaming = false; }
+  if (!streaming) {
+    // Frontend guessed busy but the server sees no API call in flight: the turn may have ended
+    // just before enqueue and its turn-end hook already ran. Rescue after a short settle —
+    // falling back to the idle poll (not a single shot) so a transient busy/approval state
+    // retries within the poll budget instead of stranding the item.
+    _rescueTimer = setTimeout(() => {
+      _rescueTimer = null;
+      if (_suppressDrain || _pollTimer) return; // parked, or a drain/send-now poll already owns it
+      if (_safeToInject()) { _injectHead(); return; }
+      _pollUntilSafe(() => { if (!_suppressDrain) _injectHead(); }, () => { /* keep queued */ });
+    }, RESCUE_AFTER_MS);
+    if (typeof _rescueTimer.unref === 'function') _rescueTimer.unref();
+  }
+  return item;
+}
+
+/** Remove one queued item by id. Returns true when found. */
+export function remove(id) {
+  const idx = _items.findIndex((it) => it.id === id);
+  if (idx < 0) return false;
+  _items.splice(idx, 1);
+  _broadcast();
+  return true;
+}
+
+/** Drop all queued items (session switch). Also cancels pending timers and invalidates any
+ *  in-flight inject (gen bump) so an old-session message can never land in a fresh PTY.
+ *  Cannot cancel bytes already written to the PTY (best-effort, ~330ms window). */
+export function clear() {
+  _gen++;
+  _clearRescueTimer();
+  _clearPollTimer();
+  _clearEscTimer();
+  if (_items.length === 0) return;
+  _items = [];
+  _broadcast();
+}
+
+/**
+ * Send-now: interrupt the running turn and inject this item immediately.
+ * Guard order matters (review P0): refuse BEFORE touching the queue when an inject is in
+ * flight, so a double-action can never strand a removed-but-unsent message.
+ */
+export function sendNow(id) {
+  if (!_deps) return false;
+  // Guard order matters (review P0): refuse BEFORE touching the queue. `_injecting` covers an
+  // in-flight paste; `_pollTimer` covers a prior send-now still in its ESC/idle-poll phase —
+  // a second poll would clobber the first one's timer and strand its already-removed item.
+  if (_injecting || _pollTimer) return false;
+  try { if (_deps.hasExternalInjection && _deps.hasExternalInjection()) return false; } catch { return false; }
+  const idx = _items.findIndex((it) => it.id === id);
+  if (idx < 0) return false;
+  const [item] = _items.splice(idx, 1);
+  _clearRescueTimer();
+  _broadcast();
+
+  const gen = _gen; // a clear()/stop() mid-flight invalidates the completion handler below
+  const inject = () => {
+    _injecting = true;
+    try {
+      _deps.writeToPtySequential(bracketPasteSubmit(item.text), (ok) => {
+        _injecting = false;
+        if (gen !== _gen) return;
+        if (!ok) { _items.unshift(item); _broadcast(); }
+      }, { settleMs: 250 });
+    } catch (err) {
+      _injecting = false;
+      if (gen === _gen) {
+        _items.unshift(item);
+        _broadcast();
+      }
+      reportSwallowed('chat-queue.send-now.inject', err);
+    }
+  };
+  const restore = () => {
+    // Never blind-inject (see _pollUntilSafe). Park the item back at the head.
+    if (gen !== _gen) return;
+    if (!_items.some((it) => it.id === item.id)) {
+      _items.unshift(item);
+      _broadcast();
+    }
+  };
+
+  let streaming = false;
+  try { streaming = !!(_deps.isStreaming && _deps.isStreaming()); } catch { streaming = false; }
+  if (streaming) {
+    // Interrupt first: focus-in (a hidden xterm is unfocused; Ink ignores ESC then) then ESC —
+    // byte-identical to the web Stop button (ChatView handleInputStop). The gap timer is
+    // tracked so stop()/clear() can cancel it before it lands in a fresh PTY.
+    try { _deps.writeToPty('\x1b[I'); } catch (err) { reportSwallowed('chat-queue.send-now.focus', err); }
+    _escTimer = setTimeout(() => {
+      _escTimer = null;
+      try { _deps.writeToPty('\x1b'); } catch (err) { reportSwallowed('chat-queue.send-now.esc', err); }
+      _pollUntilSafe(inject, restore);
+    }, STOP_ESC_DELAY_MS);
+    if (typeof _escTimer.unref === 'function') _escTimer.unref();
+  } else if (_safeToInject()) {
+    // Idle / parked queue (e.g. after Stop): no interrupt needed — inject right away.
+    inject();
+  } else {
+    _pollUntilSafe(inject, restore);
+  }
+  return true;
+}
+
+/**
+ * Turn-end hook (Stop-hook POST arrival + debounced emit; idempotent). Drains the head item
+ * once the TUI is observably idle. Suppressed after a user Stop until a new turn starts.
+ */
+export function onTurnEnd() {
+  if (!_deps || _items.length === 0 || _injecting) return;
+  // A send-now poll is already pending — it owns the next inject; let it finish rather than
+  // clear its timer out from under it (clearing would strand the removed item).
+  if (_pollTimer) return;
+  _clearRescueTimer();
+  if (_suppressDrain) return;
+  if (_safeToInject()) { _injectHead(); return; }
+  _pollUntilSafe(() => { if (!_suppressDrain) _injectHead(); }, () => { /* keep queued; next turn-end retries */ });
+}
+
+/** Park the queue: the next turn-end(s) must not auto-drain (user pressed Stop). */
+export function suppressNextDrain() {
+  _suppressDrain = true;
+  _clearRescueTimer();
+}
+
+/** A new turn started (streaming rising edge): re-arm automatic draining. */
+export function onStreamingActivated() {
+  _suppressDrain = false;
+}
+
+/** Server shutdown: drop timers AND queue state — parked items belong to the dying session
+ *  and must not drain into the fresh PTY after a stop/start cycle. */
+export function stop() {
+  _clearRescueTimer();
+  _clearPollTimer();
+  _clearEscTimer();
+  _injecting = false;
+  _items = [];
+  _suppressDrain = false;
+  _gen++;
+}
+
+export function __resetForTests() {
+  stop();
+  _deps = null;
+}

package/server/lib/cli-inject.js

@@ -16,7 +16,7 @@
 //   * buildInjectBlockRegex 用 `\r?\n` 匹配，可同时识别两种形式的历史 marker；
 //   * 改成参数化 EOL 会破坏 LEGACY 形式的回归匹配（老 marker 是 `\n` 写入的）。
 // - 因此注入后 CRLF 文件**会含混合 EOL**（块内 LF + 块外 CRLF），这是已知的、
-//   被 test/cli-inject.test.js 'CRLF 文件注入后原 CRLF 部分被保留' 用例固化的行为。
+//   被 packages/app/test/cli-inject.test.js 'CRLF 文件注入后原 CRLF 部分被保留' 用例固化的行为。
 
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 

package/server/lib/context-watcher.js

@@ -2,7 +2,7 @@ import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { getClaudeConfigDir } from '../../findcc.js';
-import { getModelMaxTokens, adaptContextWindow, sumUsageInputTokens, sumUsageContextTokens, getCalibrationModel } from './context-rules.js';
+import { getModelMaxTokens, adaptContextWindow, sumUsageInputTokens, sumUsageContextTokens, getCalibrationModel } from '@ccv/core/context-rules';
 
 export const CONTEXT_WINDOW_FILE = join(getClaudeConfigDir(), 'context-window.json');
 export const CLAUDE_SETTINGS_FILE = join(getClaudeConfigDir(), 'settings.json');
@@ -27,7 +27,7 @@ export function readModelContextSize() {
     const modelId = data?.model?.id || null;
     let contextSize = 200000;
     if (modelId) {
-      // [Nk]/[Nm] 后缀与家族档位统一走共享规则表(server/lib/context-rules.js)
+      // [Nk]/[Nm] 后缀与家族档位统一走共享规则表(@ccv/core/context-rules)
       contextSize = getModelMaxTokens(modelId);
       // Cache the base name → size mapping
       const base = modelId.toLowerCase().replace(/^claude-/i, '').replace(/\[.*\]/, '').trim();
@@ -70,7 +70,7 @@ export function getContextSizeForModel(modelOrEntry) {
   if (_startupModelBase && base === _startupModelBase) {
     return _startupContextSize;
   }
-  // 完整档位表见 server/lib/context-rules.js(与前端同源;含 haiku/旧 opus/3-opus 200K、
+  // 完整档位表见 @ccv/core/context-rules(与前端同源;含 haiku/旧 opus/3-opus 200K、
   // deepseek-v4 1M、kimi/moonshot 256K、gpt/deepseek 等三方档位,默认 200K)
   return getModelMaxTokens(apiModelName);
 }

package/server/lib/create_system_prompt.js

@@ -181,9 +181,6 @@ export function createSystemPromptVariables(overrides = {}, opts = {}) {
       userName: isGitRepository
         ? commandOutput('git', ['config', 'user.name'], cwd)
         : '',
-      status: isGitRepository
-        ? commandOutput('git', ['status', '--short'], cwd)
-        : '',
       recentCommits: isGitRepository
         ? commandOutput('git', ['log', '--oneline', '-5'], cwd)
         : '',
@@ -198,8 +195,6 @@ export function createSystemPromptVariables(overrides = {}, opts = {}) {
       hostname: stringOrEmpty(() => os.hostname()),
       availableParallelism: numberOrEmpty(() => os.availableParallelism()),
       totalMemory: numberOrEmpty(() => os.totalmem()),
-      freeMemory: numberOrEmpty(() => os.freemem()),
-      uptime: numberOrEmpty(() => os.uptime()),
     },
     runtime: {
       nodeVersion: stringOrEmpty(() => process.version),
@@ -208,8 +203,6 @@ export function createSystemPromptVariables(overrides = {}, opts = {}) {
       ppid: numberOrEmpty(() => process.ppid),
     },
     time: {
-      current: stringOrEmpty(() => now.toString()),
-      iso: stringOrEmpty(() => now.toISOString()),
       date: currentDate(timeZone, now),
       timezone: timeZone,
     },
@@ -234,8 +227,6 @@ export function createSystemPromptVariables(overrides = {}, opts = {}) {
     terminal: {
       term: envString('TERM'),
       colorTerm: envString('COLORTERM'),
-      columns: numberOrEmpty(() => process.stdout.columns),
-      rows: numberOrEmpty(() => process.stdout.rows),
     },
     filesystem: {
       tmpdir: stringOrEmpty(() => os.tmpdir()),

package/server/lib/enrich-plan-input.js

@@ -48,7 +48,7 @@ function findEmptyExitPlanModeBlocks(content, out) {
  * - Header 名规范：interceptor 走 fetch Headers.entries() 全小写（WHATWG 规范），
  *   只查小写键即可。
  * - In-place mutation by design：用 Object.assign(blk.input, patch) 而非
- *   `blk.input = {...}`。增量重建器 (server/lib/delta-reconstructor.js) 会让同一 tool_use
+ *   `blk.input = {...}`。增量重建器 (@ccv/core/delta-reconstructor) 会让同一 tool_use
  *   block 在多个 entry 间共享对象引用；in-place mutate 让后续 entry 的「Object.keys
  *   (inp).length === 0」预检自动跳过——正是我们想要的 (相同 plan，不重新查盘)。
  *   注意：此优化仅在 SSE / live 路径（共享对象）生效；REST 路径 raw → JSON.parse

package/server/lib/ensure-hooks.js

@@ -138,7 +138,7 @@ export function ensureHooks() {
 
     // AskUserQuestion hook → ask-bridge.js
     // Guard: only execute when CCVIEWER_PORT is set (i.e. launched by cc-viewer)
-    const askBridgePath = resolve(SERVER_LIB, 'ask-bridge.js');
+    const askBridgePath = resolve(SERVER_LIB, 'ask', 'ask-bridge.js');
     const askCmd = `[ -n "$CCVIEWER_PORT" ] && node "${askBridgePath}" || true ${CCV_HOOK_MARKER}`;
     const askDesired = _buildHookObj(askCmd);
     const askExisting = settings.hooks.PreToolUse.find(h => h.matcher === 'AskUserQuestion');
@@ -157,7 +157,7 @@ export function ensureHooks() {
 
     // Permission approval hook → perm-bridge.js (matcher: "" = match all tools)
     // Guard: only execute when CCVIEWER_PORT is set (i.e. launched by cc-viewer)
-    const permBridgePath = resolve(SERVER_LIB, 'perm-bridge.js');
+    const permBridgePath = resolve(SERVER_LIB, 'ask', 'perm-bridge.js');
     const permCmd = `[ -n "$CCVIEWER_PORT" ] && node "${permBridgePath}" || true ${CCV_HOOK_MARKER}`;
     const permMatcher = '';
     // Clean up legacy entries

package/server/lib/file-access-policy.js

@@ -13,7 +13,7 @@
 import { realpathSync } from 'node:fs';
 import { resolve, basename, sep, join } from 'node:path';
 import { homedir, platform, tmpdir } from 'node:os';
-import { getClaudeConfigDir } from '../../findcc.js';
+import { getClaudeConfigDir, onLogDirChange } from '../../findcc.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 
 const osPlatform = platform();
@@ -105,6 +105,11 @@ export function bumpWorkspacesVersion() {
   _rootsCache = null;
 }
 
+// LOG_DIR changes relocate the workspace registry file — the allowlist cache
+// (including registered workspaces) must be invalidated. Registered at module
+// load so findcc (a leaf) never imports this module.
+onLogDirChange(() => bumpWorkspacesVersion());
+
 /**
  * 测试 / 多 process 场景显式重置 —— 测试可在更换 HOME env 后调,policy 重新解析。
  */

package/server/lib/file-api.js

@@ -5,6 +5,22 @@
 import { resolve, join, sep, isAbsolute } from 'node:path';
 import { realpathSync, existsSync, statSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
 
+/**
+ * A path counts as a non-empty file only if it exists, is a regular file, and
+ * has size > 0 (an empty file would blank the system prompt — skipping is safer).
+ * Bad symlinks / missing paths / directories → statSync throws or isFile()=false → false.
+ * Shared leaf home (moved from system-prompt-files.js to break the
+ * model-system-prompts.js ↔ system-prompt-files.js static cycle).
+ */
+export function isNonEmptyFile(p) {
+  try {
+    const st = statSync(p);
+    return st.isFile() && st.size > 0;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Check whether targetPath is contained within the project root directory.
  * Resolves symlinks via realpathSync. Returns false on any error.
@@ -31,7 +47,7 @@ class FileApiError extends Error {
 /**
  * Resolve and validate a file path. No production callers (readFileContent does its own inline
  * path validation); kept as a standalone, path-traversal-defending helper covered by
- * test/file-api-gap.test.js — don't delete as "dead code" without removing that test.
+ * packages/app/test/file-api-gap.test.js — don't delete as "dead code" without removing that test.
  * @param {string} cwd - project working directory
  * @param {string} reqPath - requested path (relative or absolute)
  * @param {boolean} isEditorSession - whether this is an editor session

package/server/lib/{dingtalk-bridge.js → im/dingtalk-bridge.js}

@@ -6,7 +6,7 @@
 // and the existing dingtalk-bridge tests keep working unchanged. Importing it registers the
 // DingTalk adapter with the core.
 import * as core from './im-bridge-core.js';
-import { __setClientFactory } from './adapters/dingtalk-adapter.js';
+import { __setClientFactory } from '../adapters/dingtalk-adapter.js';
 
 const ID = 'dingtalk';