cc-viewer 1.7.22 → 1.8.0

package/server/lib/updater.js

@@ -42,6 +42,51 @@ export function detectHomebrewInstall(dirOverride, realpathImpl = realpathSync)
   return normalized.slice(0, idx); // 返回 brew prefix
 }
 
+// Detect whether cc-viewer was installed via a pnpm global install (`pnpm add -g`).
+// pnpm's global layout: <root>/global/<id>/node_modules/.pnpm/cc-viewer@<version>/node_modules/cc-viewer/
+//   - macOS default root:    ~/Library/pnpm (PNPM_HOME)
+//   - Linux default root:    ~/.local/share/pnpm
+//   - Windows default root:  %LOCALAPPDATA%\pnpm
+//   - custom PNPM_HOME / global-dir: any path, but the `.pnpm` virtual-store segment stays fixed.
+// Detection key: the `/.pnpm/cc-viewer@` virtual-store segment. npm never creates a `.pnpm`
+// directory and the `pkg@<version>`-style segment only occurs inside pnpm-managed trees, so this
+// is reliable regardless of where PNPM_HOME lives — a plain `/pnpm/` segment check would misfire
+// on `npm i -g --prefix ~/Library/pnpm` installs. The marker covers `pnpm add -g` installs,
+// `pnpm dlx` caches, and pnpm projects running cc-viewer from their own node_modules — all of
+// them must NOT be upgraded via `npm install -g` (dual-channel pollution). The module's own
+// realpath always flows through the virtual store (bin-shim symlinks resolve there too), so no
+// PNPM_HOME env read is needed.
+// dirOverride is for unit-test injection; realpathImpl likewise.
+// Fail-safe: realpath throwing / path mismatch -> null (upstream falls back to the default npm
+// path, never an unintended upgrade).
+export function detectPnpmGlobalInstall(dirOverride, realpathImpl = realpathSync) {
+  const dir = dirOverride || __dirname;
+  let real;
+  try {
+    real = realpathImpl(dir);
+  } catch {
+    real = dir;
+  }
+  // Normalize Windows backslashes (forward slashes keep indexOf portable)
+  const normalized = real.replace(/\\/g, '/');
+  const marker = '/.pnpm/cc-viewer@';
+  const idx = normalized.indexOf(marker);
+  if (idx === -1) return null;
+  // The segment after `cc-viewer@` must be version-shaped (same regex as the brew detector):
+  // rejects dev-clone / backup paths that merely contain the literal marker text, and tag-style
+  // segments like `cc-viewer@nightly` (pnpm tag installs — same caveat as the brew HEAD comment).
+  const after = normalized.slice(idx + marker.length);
+  if (!/^\d[\w.\-+]*\//.test(after)) return null;
+  // Return the pnpm root (PNPM_HOME / custom global-dir): the path up to the first `/global/`
+  // segment; without one (e.g. a dlx cache) strip the trailing `/node_modules` and return that.
+  const globalIdx = normalized.indexOf('/global/');
+  if (globalIdx !== -1) return normalized.slice(0, globalIdx);
+  const preMarker = normalized.slice(0, idx);
+  return preMarker.endsWith('/node_modules')
+    ? preMarker.slice(0, -'/node_modules'.length)
+    : preMarker;
+}
+
 const CHECK_INTERVAL = 4 * 60 * 60 * 1000; // 4 hours
 const CACHE_DIR = join(getClaudeConfigDir(), 'cc-viewer');
 const CACHE_FILE = join(CACHE_DIR, 'update-check.json');
@@ -138,10 +183,12 @@ export function isAnyCcvBusy({ currentPid, busy, portRange, lsofImpl } = {}) {
 //                       undefined 或不传 = 走真探测。改用 !== undefined 比 hasOwnProperty 更稳，
 //                       避免 caller 用 `{ ...opts, brewPrefix: maybe }` 时 maybe 为 undefined
 //                       却被当显式传值，从而绕过自动检测，让 brew 用户被错误地走 npm 路径升级。
+//   pnpmRoot         -- 测试注入。语义与 brewPrefix 完全相同：非 undefined = 显式覆盖（含 null/''），
+//                       undefined = 走真探测 detectPnpmGlobalInstall()。
 //
 // 返回 status:
 //   disabled | skipped | skipped_test_context | latest | major_available | deferred_busy
-//   | brew_managed | upgrading_in_background | error
+//   | brew_managed | pnpm_managed | upgrading_in_background | error
 export async function checkAndUpdate(options = {}) {
   const fetchImpl = options.fetchImpl || fetch;
   const spawnImpl = options.spawnImpl || realSpawn;
@@ -153,6 +200,11 @@ export async function checkAndUpdate(options = {}) {
   const brewPrefix = options.brewPrefix !== undefined
     ? options.brewPrefix
     : detectHomebrewInstall();
+  // pnpm 全局安装（pnpm add -g）→ 同样不能 npm install -g：会在 npm 全局前缀残留第二份
+  // cc-viewer（双渠道污染），改建议 pnpm add -g cc-viewer@<version>
+  const pnpmRoot = options.pnpmRoot !== undefined
+    ? options.pnpmRoot
+    : detectPnpmGlobalInstall();
   const currentVersion = getCurrentVersion();
 
   // 跟随 Claude Code 全局配置
@@ -188,8 +240,8 @@ export async function checkAndUpdate(options = {}) {
     const remoteVersion = data['dist-tags']?.latest;
 
     // saveCheckTime 在所有分支前统一记录：4h 节流既避免 npm fetch 频繁，
-    // 也覆盖 brew_managed banner 的提示频率（stderr 一行 + SSE 一次足够，4h 后再提）。
-    // 故意不为 brew_managed 单独提速：banner 刷屏比慢提示更扰人，stderr 仍是侧通道。
+    // 也覆盖 brew_managed / pnpm_managed banner 的提示频率（stderr 一行 + SSE 一次足够，4h 后再提）。
+    // 故意不为 brew_managed / pnpm_managed 单独提速：banner 刷屏比慢提示更扰人，stderr 仍是侧通道。
     saveCheckTime();
 
     if (!remoteVersion) {
@@ -212,6 +264,14 @@ export async function checkAndUpdate(options = {}) {
       return { status: 'brew_managed', currentVersion, remoteVersion, brewPrefix };
     }
 
+    // pnpm 全局安装：不能 npm install -g（会在 npm 全局前缀造出第二份，双渠道污染）
+    // → 提示 pnpm add -g cc-viewer@<version>。同样必须放在 major_available 之前，
+    // 否则 pnpm 用户跨大版本时会被引导跑 npm i -g，触发我们正想杜绝的双渠道污染。
+    if (pnpmRoot) {
+      console.error(`[CC Viewer] ${t('update.pnpmManaged', { version: remoteVersion })}`);
+      return { status: 'pnpm_managed', currentVersion, remoteVersion, pnpmRoot };
+    }
+
     // 跨大版本：仅提示
     if (remote.major !== current.major) {
       console.error(`[CC Viewer] ${t('update.majorAvailable', { version: remoteVersion })}`);

package/server/lib/user-prompt-extract.js

@@ -6,17 +6,17 @@
 //
 // NOTE: this is a deliberate server-side SUBSET of the frontend classifier.
 // The full classification (synthetic prompts, secondary recycling, …) lives in
-// src/utils/contentFilter.js:isSystemText — frontend (dist) and server are two
+// @ccv/core/contentFilter:isSystemText — frontend (dist) and server are two
 // separate bundles that cannot share a module, so only the rules that would
 // LEAK into previews are mirrored here: system tags + cross-session teammate
 // notifications.
 import { openSync, readSync, closeSync } from 'node:fs';
 
 // Cross-session / teammate protocol notification `type` whitelist (must match
-// src/utils/contentFilter.js INTER_SESSION_NOTIFICATION_TYPES; add new types in
+// @ccv/core/contentFilter INTER_SESSION_NOTIFICATION_TYPES; add new types in
 // BOTH places). One array derives the Set (brace scan) + the RegExp
 // (isSystemText) so this file cannot drift internally.
-// test/stats-worker-notification-filter.test.js guards frontend↔server sync.
+// packages/app/test/stats-worker-notification-filter.test.js guards frontend↔server sync.
 export const INTER_SESSION_TYPES = [
   'idle_notification', 'shutdown_request', 'shutdown_response', 'shutdown_approved',
   'teammate_terminated', 'plan_approval_request', 'plan_approval_response',
@@ -25,7 +25,7 @@ const INTER_SESSION_TYPES_SET = new Set(INTER_SESSION_TYPES);
 const INTER_SESSION_TYPES_RE = new RegExp(`"type"\\s*:\\s*"(?:${INTER_SESSION_TYPES.join('|')})"`);
 
 // CLI-synthesized prompts (HTTP role=user but not typed by a human): Recap /
-// Title / Compact / Topic / Summary. Must match src/utils/contentFilter.js
+// Title / Compact / Topic / Summary. Must match @ccv/core/contentFilter
 // SYNTHETIC_PROMPTS (KEEP IN SYNC — same rule set, `^`-anchored on trimmed
 // text so quoted user text is never swallowed). Without this filter they leak
 // into the "all user prompts" preview (observed on real data: "The user
@@ -112,7 +112,7 @@ export function stripSystemTags(text) {
 
 /**
  * Extract the list of user prompt texts from a wire `messages` array.
- * (Kept in sync with src/utils/contentFilter.js:classifyUserContent.)
+ * (Kept in sync with @ccv/core/contentFilter:classifyUserContent.)
  */
 export function extractUserTexts(messages) {
   const texts = [];

package/server/lib/v2/adapter.js

@@ -29,12 +29,12 @@
 
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, dirname, basename } from 'node:path';
-import { reportSwallowed } from '../error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 import { isMainAgentRequest } from '../interceptor-core.js';
 import { readSession } from './replay.js';
 import { iterateJsonlLines } from './jsonl-read.js';
 import { isDiscardableSession } from './session-select.js';
-import { LIVE_SESSION_MTIME_MS } from '../log-management.js';
+import { LIVE_SESSION_MTIME_MS } from '../log-file-utils.js';
 import { blobPath, isSupportedWireFormat } from './layout.js';
 import { SingleFlight } from './singleflight.js';
 import { listV2Sessions } from './session-list.js';
@@ -834,7 +834,7 @@ export async function scanV2Descriptors(sessionDir) {
     // the old substring filter (`"mainAgent":true` && !`"teammate"`) also
     // admitted sub/misc entries whose backfilled body LOOKED main-agent; the
     // isMain ring drops those — intentional, more-correct behavior (pinned in
-    // test/v2-window-two-pass.test.js). Teammate-session main entries are
+    // packages/app/test/v2-window-two-pass.test.js). Teammate-session main entries are
     // excluded by both (they carry the teammate tag / isMain=false).
     if (d.isMain) {
       ring.push(d);

package/server/lib/v2/conversation-store.js

@@ -17,7 +17,7 @@
 // append order is completion order, semantic order is seq.
 
 import { readdirSync } from 'node:fs';
-import { isPostClearCheckpoint, isCompactContinuation, normalizeMsgForEquality } from '../session-boundary.js';
+import { isPostClearCheckpoint, isCompactContinuation, normalizeMsgForEquality } from '@ccv/core/session-boundary';
 import { fingerprintMsg } from '../interceptor-core.js';
 import { ensureConvDirSync, convEpochPath, convDir } from './layout.js';
 

package/server/lib/v2/convert.js

@@ -26,9 +26,9 @@
 import { readdirSync, existsSync, statSync, statfsSync, renameSync, rmSync, readFileSync, mkdirSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { iterateRawEntriesAsync } from '../log-stream.js';
-import { createIncrementalReconstructor } from '../delta-reconstructor.js';
-import { isLogFileName, parseLogTs } from '../log-management.js';
-import { reportSwallowed } from '../error-report.js';
+import { createIncrementalReconstructor } from '@ccv/core/delta-reconstructor';
+import { isLogFileName, parseLogTs } from '../log-file-utils.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 import { V2Writer } from './v2-writer.js';
 import { verifyV1File } from './verify.js';
 import { parseUserId } from './identity.js';

package/server/lib/v2/jsonl-read.js

@@ -14,7 +14,7 @@
 // mirroring readJsonlTolerant's torn-tail tolerance (spec §14).
 
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
-import { reportSwallowed } from '../error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 const DEFAULT_CHUNK_BYTES = 8 * 1024 * 1024;
 // Node's max string length is 0x1fffffe8 (~512MiB) — a line this long can

package/server/lib/v2/live-feed.js

@@ -24,15 +24,15 @@
 
 import { watch, existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
-import { reportSwallowed } from '../error-report.js';
-import { createIncrementalReconstructor } from '../delta-reconstructor.js';
+import { reportSwallowed } from '@ccv/core/error-report';
+import { createIncrementalReconstructor } from '@ccv/core/delta-reconstructor';
 import { processWatchedEntry, sendEventToClients, sendEventRawToClients } from '../log-watcher.js';
 import { SessionSynthesizer } from './adapter.js';
 import { isDiscardableSession } from './session-select.js';
 import { isForeignLiveOwned } from './session-owner.js';
 import { isConvertRunning } from './convert-manager.js';
 import { computeCacheLoss } from './meta-rows.js';
-import { classifyRequest, withAgentNameSubType } from '../../../src/utils/requestType.js';
+import { classifyRequest, withAgentNameSubType } from '@ccv/core/requestType';
 
 const FSWATCH_DEBOUNCE_MS = 80;
 const SAFETY_POLL_MS = 5000;

package/server/lib/v2/meta-rows.js

@@ -7,7 +7,7 @@
  * dropped — the wire carries rows only (~1.3KB each vs full entries).
  *
  * Two DELIBERATE classification divergences from the legacy full-entry list
- * (both more correct; pinned in test/v2-meta-rows.test.js, declared in
+ * (both more correct; pinned in packages/app/test/v2-meta-rows.test.js, declared in
  * history.md):
  *  - membership is the journal fold — a SUPERSET of the synthesizer's output
  *    (conv-gapped crash-orphans get a row; their detail fetch answers 404 and
@@ -21,8 +21,8 @@ import { readJsonlTolerant } from './replay.js';
 import { iterateJsonlLines } from './jsonl-read.js';
 import { iterateV2Items, findTeammateSessionDirs } from './adapter.js';
 import { SingleFlight } from './singleflight.js';
-import { reportSwallowed } from '../error-report.js';
-import { classifyRequest, withAgentNameSubType } from '../../../src/utils/requestType.js';
+import { reportSwallowed } from '@ccv/core/error-report';
+import { classifyRequest, withAgentNameSubType } from '@ccv/core/requestType';
 
 // KEEP IN SYNC: server/lib/v2/adapter.js itemKey — (sessionId, seq) identity.
 const itemKey = (sessionId, seq) => `${sessionId}\x00${seq}`;

package/server/lib/v2/replay.js

@@ -12,7 +12,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
-import { messageFingerprint, normalizeMsgForEquality } from '../session-boundary.js';
+import { messageFingerprint, normalizeMsgForEquality } from '@ccv/core/session-boundary';
 import { isSupportedWireFormat } from './layout.js';
 import { iterateJsonlLines } from './jsonl-read.js';
 

package/server/lib/v2/session-list.js

@@ -26,7 +26,7 @@ import { listSessionIds, readJsonlTolerant } from './replay.js';
 import { readPromptsHead, collectPromptsFromEvents } from '../user-prompt-extract.js';
 import { isDiscardableSession } from './session-select.js';
 import { isSupportedWireFormat, dirSizeSync } from './layout.js';
-import { reportSwallowed } from '../error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 const MAX_PROJECTS = 32;
 

package/server/lib/v2/session-owner.js

@@ -26,7 +26,7 @@
 import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { isPidAlive } from '../pid-alive.js';
-import { reportSwallowed } from '../error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 export const OWNER_LOCK_NAME = 'owner.lock';
 

package/server/lib/v2/v2-writer.js

@@ -19,7 +19,7 @@
 import { statfsSync, existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { AsyncWriteQueue } from '../async-write-queue.js';
-import { reportSwallowed } from '../error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 import { ensureSessionDirSync, compactLocalTs14, sanitizePathComponent } from './layout.js';
 import { resolveSessionDirName, latestMainSession } from './session-select.js';
 import { acquireSessionClaim, releaseSessionClaim, isForeignLiveOwned } from './session-owner.js';
@@ -29,6 +29,7 @@ import { ConversationStore } from './conversation-store.js';
 import { parseUserId, classifyKind, ConvResolver } from './identity.js';
 import { parseAgentId, findHeader } from './agent-id.js';
 import { extractUserTexts, flattenPromptText, isSuggestionMode, readPromptsHead } from '../user-prompt-extract.js';
+import { consumePendingForWireByKey, writeSnapshotByKey, systemTextOfBody } from '../system-prompt-snapshots.js';
 
 // Below this many free bytes on the log volume, v2 skips writing and reports
 // once — logging must not be the thing that fills the disk (plan risk #9).
@@ -428,6 +429,30 @@ export class V2Writer {
       // (live ≈ now; convert = the historical first-entry ts).
       const s = this._session(sid, parsed && entry.body.metadata.user_id, parsed && parsed.encoding, project, entry.timestamp, adoptTarget);
 
+      // System-prompt snapshot, Bind A (wire): the FIRST main request of a session
+      // carries the launch's rendered injection in body.system — match it against the
+      // project's pending queue and key the snapshot to the wire sid (== transcript
+      // uuid for fresh sessions), so a later `-c`/`-r` can pin byte-identical content
+      // instead of re-rendering variables and busting the prompt-prefix cache.
+      // count_tokens/heartbeat probes wear main-agent shapes but aren't the user's
+      // turn (same gate as the resume-switch above); adopted (-c) sessions skip —
+      // their pendings are resumeExpected, reserved for the SessionStart-hook bind.
+      // First-main-only via the per-session flag: probes may create the session state
+      // before the real turn arrives. The live-sessions-dir gate keeps the offline
+      // converter (staging dirs) from consuming LIVE pendings. Fully caught: a lost
+      // bind degrades to the no-record resume path, never to a dropped log entry.
+      if (!adoptTarget && entry.mainAgent && !entry.isCountTokens && !entry.isHeartbeat
+        && this._sessionsDirName === 'sessions'
+        && s && !s.sysPromptBindDone) {
+        s.sysPromptBindDone = true;
+        try {
+          const pend = consumePendingForWireByKey(project, systemTextOfBody(entry.body), this._logDir);
+          if (pend) {
+            writeSnapshotByKey(project, sid, { entries: pend.entries, model: pend.model, boundVia: 'wire' }, { logDir: this._logDir });
+          }
+        } catch (err) { reportSwallowed('v2-write.sys-prompt-bind', err); }
+      }
+
       // Flush requests that arrived before the first sid (they belong here).
       // Their handles are parked in _lateHandles so a completion that arrives
       // after the flush still gets its done line (folded by rid).

package/server/lib/v2/verify.js

@@ -28,7 +28,7 @@
 import { statSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { iterateRawEntriesAsync } from '../log-stream.js';
-import { createIncrementalReconstructor } from '../delta-reconstructor.js';
+import { createIncrementalReconstructor } from '@ccv/core/delta-reconstructor';
 import { listSessionIds, readSession, indexSession, messagesDigest, blobRefOf } from './replay.js';
 
 const MAX_REPORTED_DIFFS = 50;

package/server/lib/voice-pack-manager.js

@@ -11,7 +11,7 @@
 import { existsSync, mkdirSync, writeFileSync, unlinkSync, readdirSync, statSync, readFileSync, lstatSync } from 'node:fs';
 import { join, extname } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { EVENT_KEYS, DEFAULT_BINDINGS, BUNDLED_PACK_IDS } from './voice-pack-events.js';
+import { EVENT_KEYS, DEFAULT_BINDINGS, BUNDLED_PACK_IDS } from '@ccv/core/voice-pack-events';
 import { DIST_DIR, PUBLIC_DIR } from '../_paths.js';
 
 // Bundled pack lookup order, per packId:
@@ -35,7 +35,7 @@ for (const packId of BUNDLED_PACK_IDS) {
   }
 }
 
-export { EVENT_KEYS } from './voice-pack-events.js';
+export { EVENT_KEYS } from '@ccv/core/voice-pack-events';
 export const ID_PATTERN = /^[a-f0-9-]{8,64}$/;
 export const ALLOWED_EXTS = new Set(['.mp3', '.wav', '.ogg', '.m4a']);
 export const MAX_AUDIO_BYTES = 2 * 1024 * 1024; // 2MB per file
@@ -334,6 +334,5 @@ export function reconcileVoicePackPrefs(logDir, vp) {
 // Re-export shared defaults so consumers can pull everything from one module.
 export { DEFAULT_BINDINGS, BUNDLED_PACK_IDS };
 
-// mergeApprovalModalPrefs / mergeVoicePackInto moved to server/lib/approval-modal-prefs.js
-//( — merge logic isn't voice-pack-specific). Import from
-// './approval-modal-prefs.js' directly.
+// mergeApprovalModalPrefs / mergeVoicePackInto moved to @ccv/core/approval-modal-prefs
+// (merge logic isn't voice-pack-specific). Import from '@ccv/core/approval-modal-prefs' directly.

package/server/lib/wire-compress.js

@@ -19,7 +19,7 @@
  * knee on large sessions; q5 collapses to ~2.5x there).
  */
 import zlib from 'node:zlib';
-import { reportSwallowed } from './error-report.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 import { awaitDrainOrClose } from './sse-backpressure.js';
 
 const C = zlib.constants;

package/server/proxy.js

@@ -5,13 +5,13 @@ import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import * as interceptor from './interceptor.js';
 import { setupInterceptor } from './interceptor.js';
-import { extractApiErrorMessage, formatProxyRequestError } from './lib/proxy-errors.js';
-import { getProxyDispatcher } from './lib/proxy-env.js';
+import { extractApiErrorMessage, formatProxyRequestError } from './lib/proxy/proxy-errors.js';
+import { getProxyDispatcher } from './lib/proxy/proxy-env.js';
 import { getClaudeConfigDir } from '../findcc.js';
 import { isAnthropicApiPath, classifyProxyRole } from './lib/interceptor-core.js';
-import { executeRequest, extractModel } from './lib/proxy-retry.js';
-import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy-stats.js';
-import { reportSwallowed } from './lib/error-report.js';
+import { executeRequest, extractModel } from './lib/proxy/proxy-retry.js';
+import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy/proxy-stats.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 import { LOG_DIR } from '../findcc.js';
 
 // Setup interceptor to patch fetch