cc-viewer 1.7.3 → 1.7.5

package/server/proxy.js

@@ -1,17 +1,27 @@
 
 import { createServer } from 'node:http';
 import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import * as interceptor from './interceptor.js';
 import { setupInterceptor } from './interceptor.js';
 import { extractApiErrorMessage, formatProxyRequestError } from './lib/proxy-errors.js';
 import { getProxyDispatcher } from './lib/proxy-env.js';
 import { getClaudeConfigDir } from '../findcc.js';
+import { isAnthropicApiPath } from './lib/interceptor-core.js';
+import { executeRequest, extractModel } from './lib/proxy-retry.js';
+import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy-stats.js';
+import { LOG_DIR } from '../findcc.js';
 
 // Setup interceptor to patch fetch
 setupInterceptor();
 
+// 通知 stats-worker 重扫 proxy 明细（review P2：原实现动态 import('./server.js') 反向触达
+// statsWorker 单例——若未来出现 proxy-only 进程，首条请求会因模块加载副作用意外拉起第二个
+// viewer。现在方向摆正：server.js（statsWorker 属主）加载时经 proxy-stats.js 的
+// setProxyStatsListener 注册回调，本模块只 emit；server 未加载则 emit 为 no-op）。
+const _notifyProxyStats = emitProxyStatsUpdate;
+
 // 强制上游返回未压缩响应，取代仅剥 zstd 的旧策略。
 // 原因：链路中的网关/代理（典型是本地 MITM 网络代理）可能把上游的压缩 body 原样透传，
 // 却把 content-encoding 响应头剥掉。undici 看不到 content-encoding 就不会解压，于是把一坨
@@ -111,27 +121,35 @@ export function startProxy() {
           headers: headers,
         };
 
-        // 标记此请求为 CC-Viewer 代理转发的 Claude API 请求
-        // 拦截器识别到此 Header 会强制记录，忽略 URL 匹配规则
-        fetchOptions.headers['x-cc-viewer-trace'] = 'true';
-
-        if (body.length > 0) {
-          fetchOptions.body = body;
-        }
-
         // 走用户的网络代理：Node 内置全局 fetch 既不读 http_proxy/https_proxy，也看不到
         // userland undici 的 setGlobalDispatcher，必须把代理 dispatcher 显式传进来，否则
         // 上游请求会绕过代理直连 api.anthropic.com（详见 lib/proxy-env.js 注释）。
         const proxyDispatcher = getProxyDispatcher();
-        if (proxyDispatcher) {
-          fetchOptions.dispatcher = proxyDispatcher;
-        }
 
         // 拼接完整 URL，保留 originalBaseUrl 中的路径前缀
         const cleanBase = originalBaseUrl.endsWith('/') ? originalBaseUrl.slice(0, -1) : originalBaseUrl;
         const cleanReq = req.url.startsWith('/') ? req.url.slice(1) : req.url;
         const fullUrl = `${cleanBase}/${cleanReq}`;
 
+        // 大模型 API 请求（/v1/messages 等）走重试引擎：serial/race/stagger 重试 + 明细统计。
+        // 重试引擎内部用 x-cc-viewer-trace 头让 interceptor 记录每次重试尝试到会话日志（网络视图数据源），
+        // 模型替换由重试引擎用 resolveProfileModel 纯函数完成（interceptor 对 trace 请求会再跑一次，幂等 no-op）。
+        // 非大模型 API 请求走原逻辑（同样用 x-cc-viewer-trace 让 interceptor 记录，但不经重试引擎）。
+        if (isAnthropicApiPath(fullUrl)) {
+          await handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher);
+          return;
+        }
+
+        // ── 非大模型 API：原逻辑（透传，interceptor 记录）──
+        fetchOptions.headers['x-cc-viewer-trace'] = 'true';
+
+        if (body.length > 0) {
+          fetchOptions.body = body;
+        }
+        if (proxyDispatcher) {
+          fetchOptions.dispatcher = proxyDispatcher;
+        }
+
         const response = await fetch(fullUrl, fetchOptions);
 
         // fetch 自动解压，需移除编码相关 header 避免客户端重复解压
@@ -201,3 +219,132 @@ export function startProxy() {
     });
   });
 }
+
+// ── 大模型 API 请求处理：重试引擎 + 明细统计 ──────────────────────
+// mode=off 时仍写 1 条明细（attempts=1）以支撑可用率统计；完全禁用统计用 CCV_PROXY_STATS=off。
+// 重试配置由 interceptor._retryConfigState 提供（live binding，watchFile 热刷新），
+// 每请求取最新值，UI 改 retry-config.json 后下一个请求即生效，无需重启。
+const _retryConfigGetter = () => interceptor._retryConfigState;
+
+async function handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyDispatcher) {
+  const statsEnabled = process.env.CCV_PROXY_STATS !== 'off';
+  const retryConfig = _retryConfigGetter(); // live binding：每请求取最新重试配置
+  const profile = interceptor._activeProfile || null;
+
+  // 清理可能的 trace 头（singleFetch 会重新加，避免旧值干扰）；interceptor 会正常记录请求
+  // 同时清理 hop-by-hop / 传输编码头：body 已被 buffer 成完整 Buffer，
+  // 残留的 transfer-encoding:chunked / content-length 会让 undici 拒绝（invalid transfer-encoding header）
+  const retryFetchOptions = {
+    method: fetchOptions.method,
+    headers: { ...fetchOptions.headers },
+  };
+  delete retryFetchOptions.headers['x-cc-viewer-trace'];
+  delete retryFetchOptions.headers['transfer-encoding'];
+  delete retryFetchOptions.headers['Transfer-Encoding'];
+  delete retryFetchOptions.headers['connection'];
+  delete retryFetchOptions.headers['Connection'];
+  delete retryFetchOptions.headers['content-length'];
+  delete retryFetchOptions.headers['Content-Length'];
+  if (body.length > 0) {
+    retryFetchOptions.body = body;
+  }
+
+  // Model name for the stats detail record (extracted from the request body)
+  const model = extractModel(body);
+
+  // Client-disconnect propagation: without this, a client that gave up leaves
+  // the retry loop hammering (and billing) the upstream for up to
+  // maxRetryDurationMs. res 'close' before the response is finished means the
+  // client is gone → abort every in-flight/queued attempt via the engine.
+  const clientAbort = new AbortController();
+  res.on('close', () => {
+    if (!res.writableEnded) {
+      try { clientAbort.abort(); } catch { /* best effort */ }
+    }
+  });
+
+  // 执行带重试的请求
+  const result = await executeRequest({
+    url: fullUrl,
+    fetchOptions: retryFetchOptions,
+    retryConfig,
+    ctx: { dispatcher: proxyDispatcher, profile, signal: clientAbort.signal },
+  });
+
+  const { response, attempts, retryCodes, durationMs, finalStatus, succeeded, upstreamStatus } = result;
+
+  // Client already gone: nothing to write; the engine has aborted upstream work.
+  if (clientAbort.signal.aborted || res.writableEnded) {
+    return;
+  }
+
+  // 注入 X-Forward-Attempts 头（告知客户端本次重试了几次，与 llm-retry-proxy 一致）
+  const responseHeaders = {};
+  if (response.headers && typeof response.headers.entries === 'function') {
+    for (const [key, value] of response.headers.entries()) {
+      if (key.toLowerCase() !== 'content-encoding' && key.toLowerCase() !== 'transfer-encoding' && key.toLowerCase() !== 'content-length') {
+        responseHeaders[key] = value;
+      }
+    }
+  }
+  responseHeaders['x-forward-attempts'] = String(attempts);
+
+  // 写代理重试明细（主线程写，之后通知 stats-worker 重扫聚合）
+  if (statsEnabled && interceptor._projectName) {
+    try {
+      const projectDir = join(LOG_DIR, interceptor._projectName);
+      const filePath = dailyFilePath(projectDir, todayStr());
+      const record = buildRecord({
+        method: req.method,
+        path: req.url,
+        model,
+        profileId: profile?.id || 'default',
+        profileName: profile?.name || 'Default',
+        // Review P2 fix: upstreamStatus was hard-wired to finalStatus, killing
+        // the dual-status distinction (race/stagger fallbacks can differ).
+        upstreamStatus: upstreamStatus ?? finalStatus,
+        finalStatus,
+        attempts,
+        durationMs,
+        succeeded,
+        retryCodes,
+      });
+      appendRecord(filePath, record);
+      // 通知 stats-worker 重扫该 proxy 明细文件（缓存 dynamic import，非每请求新建）
+      const fileName = basename(filePath);
+      _notifyProxyStats(fileName);
+    } catch (err) {
+      if (process.env.CCV_DEBUG) {
+        console.error('[CC-Viewer Proxy] Failed to write proxy stats:', err.message);
+      }
+    }
+  }
+
+  // 网络异常（finalStatus=0）或竞速全失败：返回 502 + Proxy Error，与原 catch 分支一致
+  if (finalStatus === 0) {
+    res.writeHead(502, { 'x-forward-attempts': String(attempts) });
+    res.end('Proxy Error');
+    return;
+  }
+
+  // 响应客户端
+  res.writeHead(finalStatus, responseHeaders);
+
+  if (response.body) {
+    const { Readable, pipeline } = await import('node:stream');
+    // @ts-ignore
+    const nodeStream = Readable.fromWeb(response.body);
+    nodeStream.on('error', () => {});
+    pipeline(nodeStream, res, (err) => {
+      if (err && process.env.CCV_DEBUG) {
+        console.error('[CC-Viewer Proxy] Stream pipeline error:', err.message);
+      }
+    });
+  } else if (response.text) {
+    // 竞速失败兜底 response：用 text() 取 body
+    const text = await response.text();
+    res.end(text);
+  } else {
+    res.end();
+  }
+}

package/server/routes/preferences.js

@@ -3,8 +3,11 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { LOG_DIR, setLogDir, getClaudeConfigDir } from '../../findcc.js';
-import { PROFILE_PATH, _defaultConfig, getActiveProfileId, setActiveProfileForWorkspace, _loadProxyProfile } from '../interceptor.js';
+import { PROFILE_PATH, _defaultConfig, getActiveProfileId, setActiveProfileForWorkspace, _loadProxyProfile, RETRY_CONFIG_PATH, _retryConfigState, _loadRetryConfigState } from '../interceptor.js';
 import { migrateProxyProfileList } from '../lib/interceptor-core.js';
+import { DEFAULT_RETRY_CONFIG, validateRetryConfig, resolveRetryConfig } from '../lib/proxy-retry.js';
+import { discoverCcSwitchProviders, mergeImportedProfiles } from '../lib/ccswitch-import.js';
+import { reportSwallowed } from '../lib/error-report.js';
 import { setLang } from '../i18n.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';
@@ -299,6 +302,182 @@ function proxyProfilesPost(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// ── 代理重试配置（GET/POST + SSE，仿 proxyProfilesGet/Post，但无密钥脱敏、无 workspace 隔离）──
+// 返回 { config, defaults }：config = 当前生效（env 基础 + retry-config.json 覆盖后的 live binding）；
+// defaults = DEFAULT_RETRY_CONFIG，供 UI「恢复默认」按钮参照。
+
+function retryConfigGet(req, res, _parsedUrl, _isLocal, _deps) {
+  try {
+    // _retryConfigState 是 live binding（watchFile 刷新），即当前生效配置。
+    // 缺省兜底：若拦截器尚未初始化（理论上不会，但防御性），即时解析一次。
+    const config = _retryConfigState || resolveRetryConfig();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ config, defaults: DEFAULT_RETRY_CONFIG }));
+  } catch {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ config: DEFAULT_RETRY_CONFIG, defaults: DEFAULT_RETRY_CONFIG }));
+  }
+}
+
+function retryConfigPost(req, res, _parsedUrl, isLocal, deps) {
+  // Local-only, mirroring ccswitchImportPost: retry config is written to a
+  // cross-process file every ccv instance hot-reloads, and race/stagger with
+  // high concurrency multiplies the HOST's paid upstream requests — a LAN
+  // client must not be able to amplify the host's API spend machine-wide.
+  if (!isLocal) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: 'retry config is local-only' }));
+    return;
+  }
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    try {
+      const incoming = JSON.parse(body);
+      if (!incoming || typeof incoming !== 'object' || !incoming.config || typeof incoming.config !== 'object') {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid retry config: expected { config: {...} }' }));
+        return;
+      }
+      // 校验 + 归一化（与 resolveRetryConfig 共用 validateRetryConfig，单一真源）
+      const validated = validateRetryConfig(incoming.config);
+      // 合并默认值，保证写盘的是完整配置（缺字段回落默认，避免读到半截配置）
+      const toWrite = { ...DEFAULT_RETRY_CONFIG, ...validated };
+      const dir = dirname(RETRY_CONFIG_PATH);
+      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+      writeFileSync(RETRY_CONFIG_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // 立即刷新本进程 live binding（不等 watchFile 1.5s 轮询）
+      _loadRetryConfigState();
+      // SSE 广播给本进程所有客户端（同 proxy_profile 模式）
+      sendEventToClients(deps.clients, 'retry_config', { config: _retryConfigState });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true }));
+    } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid JSON' }));
+    }
+  });
+}
+
+// ── cc-switch 导入 ─────────────────────────────────────
+// cc-switch 是 Tauri 桌面应用，把供应商凭证存 SQLite（cc-switch.db providers 表）。
+// 本路由跨平台探测 cc-switch 数据目录，只读查 claude 类型供应商，映射成 cc-viewer profile。
+// GET=预览（不落盘）；POST=执行导入（merge 进 profile.json + SSE 广播刷新）。
+
+async function ccswitchProvidersGet(req, res, _parsedUrl, isLocal, _deps) {
+  try {
+    const result = await discoverCcSwitchProviders();
+    // 脱敏：非本机不下发明文 apiKey（与 proxyProfilesGet 的 maskProfiles 策略一致）
+    const profiles = isLocal ? result.profiles : (result.profiles || []).map(p => ({
+      ...p,
+      apiKey: p.apiKey ? `${p.apiKey.slice(0, 4)}****` : '',
+    }));
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+      profiles,
+      currentId: result.currentId || null,
+      dbPath: result.dbPath,
+      error: result.error,
+    }));
+  } catch (err) {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ profiles: [], error: String(err && err.message || err) }));
+  }
+}
+
+// POST body 可选 { setActive: true } —— 是否把 cc-switch 的 current 设为 cc-viewer active。
+// 默认不设（避免覆盖用户当前选择）。导入只 merge 列表，凭证刷新幂等。
+async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
+  if (!isLocal) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: 'cc-switch import is local-only' }));
+    return;
+  }
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const incoming = body ? JSON.parse(body) : {};
+      const setActive = incoming && incoming.setActive === true;
+      const result = await discoverCcSwitchProviders();
+      if (result.error && result.profiles.length === 0) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: result.error, imported: 0, updated: 0 }));
+        return;
+      }
+      // Read existing profile.json. A missing file is a legitimate first import,
+      // but a file that exists and fails to parse must ABORT: merging into an
+      // empty base and writing back would silently wipe every user-created
+      // proxy_ profile (existing IS the source of truth here, unlike
+      // proxyProfilesPost where the client sends the full desired list).
+      let existing = { profiles: [] };
+      if (existsSync(PROFILE_PATH)) {
+        let parsed = null;
+        try {
+          parsed = JSON.parse(readFileSync(PROFILE_PATH, 'utf-8'));
+        } catch (err) {
+          reportSwallowed('ccswitch-import.read-existing', err);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            ok: false,
+            error: 'existing profile.json is unreadable; import aborted to avoid overwriting your profiles',
+            imported: 0, updated: 0,
+          }));
+          return;
+        }
+        // JSON that parses to a non-object (null, array, number) is just as
+        // destructive to merge into — treat it the same as a parse failure.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            ok: false,
+            error: 'existing profile.json has an unexpected shape; import aborted to avoid overwriting your profiles',
+            imported: 0, updated: 0,
+          }));
+          return;
+        }
+        existing = parsed;
+      }
+      // merge
+      const merged = mergeImportedProfiles(existing.profiles || [], result.profiles);
+      const toWrite = { ...existing, profiles: merged.profiles };
+      // 落盘
+      const dir = dirname(PROFILE_PATH);
+      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+      writeFileSync(PROFILE_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // active 处理：setActive=true 且 cc-switch 有 current → 切换；否则保持现状
+      let activeChanged = false;
+      if (setActive && result.currentId) {
+        setActiveProfileForWorkspace(result.currentId);
+        activeChanged = true;
+      } else {
+        _loadProxyProfile(); // 刷新列表（可能增删了）
+      }
+      // SSE 广播给前端刷新（profile: 'refresh' 是 truthy 哨兵，
+      // 触发 AppBase SSE handler 的 if(data.profile) 重新 GET 全量列表）
+      const effectiveActive = getActiveProfileId();
+      sendEventToClients(deps.clients, 'proxy_profile', {
+        active: effectiveActive,
+        profile: 'refresh',
+      });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        imported: merged.imported,
+        updated: merged.updated,
+        total: merged.profiles.length,
+        activeChanged,
+        dbPath: result.dbPath,
+      }));
+    } catch (err) {
+      // ok:false keeps the response contract uniform — the client decides
+      // success strictly on data.ok, never on the presence of counter fields.
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: String(err && err.message || err) }));
+    }
+  });
+}
+
 export const preferencesRoutes = [
   { method: 'GET', match: 'exact', path: '/api/preferences', handler: preferencesGet },
   { method: 'POST', match: 'exact', path: '/api/preferences', handler: preferencesPost },
@@ -306,4 +485,8 @@ export const preferencesRoutes = [
   { method: 'POST', match: 'exact', path: '/api/claude-settings', handler: claudeSettingsPost },
   { method: 'GET', match: 'exact', path: '/api/proxy-profiles', handler: proxyProfilesGet },
   { method: 'POST', match: 'exact', path: '/api/proxy-profiles', handler: proxyProfilesPost },
+  { method: 'GET', match: 'exact', path: '/api/retry-config', handler: retryConfigGet },
+  { method: 'POST', match: 'exact', path: '/api/retry-config', handler: retryConfigPost },
+  { method: 'GET', match: 'exact', path: '/api/ccswitch-providers', handler: ccswitchProvidersGet },
+  { method: 'POST', match: 'exact', path: '/api/ccswitch-import', handler: ccswitchImportPost },
 ];

package/server/routes/proxy-stats.js

@@ -0,0 +1,95 @@
+// Proxy retry stats routes — HTTP endpoints for proxy retry statistics.
+//
+// The stats-worker scans proxy_*.jsonl detail logs and aggregates them into the
+// proxyStats field of <project>/<project>.json (same file as token stats). These
+// routes only read that data and trigger refreshes.
+//
+// Route shape follows the _dispatch.js descriptor convention:
+//   { method, match: 'exact'|'prefix', path, handler(req, res, parsedUrl, isLocal, deps) }
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { LOG_DIR } from '../../findcc.js';
+import { _projectName } from '../interceptor.js';
+
+// GET /api/proxy-stats — returns the current project's proxy retry stats (proxyStats field).
+// Response body: { proxyStats: {...} }; proxyStats is null when there is no data.
+function getProxyStats(req, res) {
+  try {
+    if (!_projectName) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'No project name', proxyStats: null }));
+      return;
+    }
+    const statsFile = join(LOG_DIR, _projectName, `${_projectName}.json`);
+    if (!existsSync(statsFile)) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ proxyStats: null }));
+      return;
+    }
+    const stats = JSON.parse(readFileSync(statsFile, 'utf-8'));
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ proxyStats: stats.proxyStats || null }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message, proxyStats: null }));
+  }
+}
+
+// POST /api/refresh-proxy-stats — triggers a full re-scan by the stats-worker (including proxy detail aggregation).
+// Reuses the existing worker's scan-all message mechanism; shares the same worker as /api/refresh-stats.
+// scan-all refreshes both token stats and proxy stats (both are produced in the same generateProjectStats run).
+//
+// Review P2 fix — in-flight coalescing: the old handler attached one worker
+// listener per request (30s lifetime → listener pile-up under repeated
+// clicks/floods) and resolved on ANY scan-all-done (two concurrent refreshes
+// cross-resolved each other). Now a module-level latch: the first request
+// starts ONE scan with ONE listener; requests arriving while it runs just
+// join the waiter list and share its completion. A flood of POSTs therefore
+// costs a single full scan instead of N.
+let _refreshWaiters = null; // Array<res> while a scan is in flight
+
+function refreshProxyStats(req, res, parsedUrl, isLocal, deps) {
+  try {
+    if (!deps.statsWorker) deps.startStatsWorker();
+    if (!deps.statsWorker) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Stats worker not available' }));
+      return;
+    }
+    if (_refreshWaiters) {
+      _refreshWaiters.push(res); // join the in-flight scan
+      return;
+    }
+    _refreshWaiters = [res];
+    const worker = deps.statsWorker;
+    const finish = (status, body) => {
+      const waiters = _refreshWaiters || [];
+      _refreshWaiters = null;
+      clearTimeout(timeout);
+      worker.removeListener('message', onDone);
+      const payload = JSON.stringify(body);
+      for (const r of waiters) {
+        try {
+          r.writeHead(status, { 'Content-Type': 'application/json' });
+          r.end(payload);
+        } catch { /* client may have disconnected while waiting */ }
+      }
+    };
+    const timeout = setTimeout(() => finish(504, { error: 'Proxy stats refresh timed out' }), 30000);
+    timeout.unref?.();
+    const onDone = (m) => {
+      if (m.type === 'scan-all-done') finish(200, { ok: true });
+    };
+    worker.on('message', onDone);
+    worker.postMessage({ type: 'scan-all', logDir: LOG_DIR });
+  } catch (err) {
+    _refreshWaiters = null;
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+export const proxyStatsRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/proxy-stats', handler: getProxyStats },
+  { method: 'POST', match: 'exact', path: '/api/refresh-proxy-stats', handler: refreshProxyStats },
+];

package/server/server.js

@@ -40,6 +40,8 @@ import { teamRoutes } from './routes/team.js';
 import { authRoutes } from './routes/auth.js';
 import { dingtalkRoutes } from './routes/dingtalk.js';
 import { imRoutes } from './routes/im.js';
+import { proxyStatsRoutes } from './routes/proxy-stats.js';
+import { setProxyStatsListener } from './lib/proxy-stats.js';
 import * as imCore from './lib/im-bridge-core.js';
 import * as imProcMgr from './lib/im-process-manager.js';
 import './lib/adapters/dingtalk-adapter.js'; // side-effect: registers the DingTalk adapter
@@ -76,11 +78,20 @@ function execWithStdin(cmd, args, input, options) {
     child.stdin.end();
   });
 }
-import { _initPromise, _projectName, _logDir, _v2Writer, streamingState, resetStreamingState, PROFILE_PATH, setLivePort, getImLiveText, resetImLiveText, markSessionStart } from './interceptor.js';
+import { _initPromise, _projectName, _logDir, _v2Writer, streamingState, resetStreamingState, PROFILE_PATH, RETRY_CONFIG_PATH, _retryConfigState, setLivePort, getImLiveText, resetImLiveText, markSessionStart } from './interceptor.js';
 import { V2LiveFeed } from './lib/v2/live-feed.js';
 import { sanitizePathComponent } from './lib/v2/layout.js';
 import { maybeResumeConvert } from './lib/v2/convert-manager.js';
 import { LOG_DIR, setLogDir, getClaudeConfigDir, isBrowserOpenSuppressed } from '../findcc.js';
+import { loadRetryConfig } from './lib/proxy-retry.js';
+
+// 代理重试配置：由 interceptor._retryConfigState 提供（live binding，watchFile 热刷新）。
+// mode 默认 off（向后兼容，不重试）。env 是启动默认/兜底，retry-config.json 覆盖 env。
+// 启动日志读一次首屏值；运行时 proxy.js 每请求读 interceptor._retryConfigState 取最新。
+const _startupRetryConfig = _retryConfigState || loadRetryConfig();
+if (_startupRetryConfig.mode !== 'off' && process.env.CCV_DEBUG) {
+  console.error(`[CC Viewer] Proxy retry: mode=${_startupRetryConfig.mode}, maxRetries=${_startupRetryConfig.maxRetries}, interval=${_startupRetryConfig.retryIntervalMs}ms`);
+}
 import { t, getLang, setLang } from './i18n.js';
 import { loadAuthConfig, loadAuthState, saveAuthConfig, clearProjectOverride, generatePassword, decideAuth, parseCookies, renderLoginPage, localeFromAcceptLanguage } from './lib/auth.js';
 import { checkAndUpdate } from './lib/updater.js';
@@ -422,6 +433,34 @@ function notifyStatsWorker(logFile) {
   }
 }
 
+// 供 proxy.js 在写入代理重试明细后通知 stats-worker 重扫聚合。
+// 单独 export 避免循环依赖（proxy.js 不能直接 import server.js 的 deps）。
+// Review P1 fix: one worker message per proxied LLM request made the worker
+// re-aggregate the whole project on EVERY request (O(N²) over a busy day —
+// the session-log path has the log-watcher debounce, the proxy path had
+// none). Trailing coalesce: the first notify schedules a flush, further
+// notifies within the window only update the pending file. unref() so a
+// pending flush never holds the process open on shutdown.
+const PROXY_STATS_DEBOUNCE_MS = 2000;
+let _proxyStatsFlushTimer = null;
+let _proxyStatsPendingFile = null;
+export function notifyProxyStats(logFile) {
+  _proxyStatsPendingFile = logFile;
+  if (_proxyStatsFlushTimer) return;
+  _proxyStatsFlushTimer = setTimeout(() => {
+    _proxyStatsFlushTimer = null;
+    const pending = _proxyStatsPendingFile;
+    _proxyStatsPendingFile = null;
+    if (!statsWorker) startStatsWorker();
+    notifyStatsWorker(pending);
+  }, PROXY_STATS_DEBOUNCE_MS);
+  _proxyStatsFlushTimer.unref?.();
+}
+// Dependency inversion (review P2): server.js owns the statsWorker, so IT
+// registers the notify callback with the proxy-stats lib; proxy.js only emits
+// through the lib and never reaches back into this module.
+setProxyStatsListener(notifyProxyStats);
+
 const MIME_TYPES = {
   '.html': 'text/html; charset=utf-8',
   '.js': 'application/javascript; charset=utf-8',
@@ -520,6 +559,7 @@ const deps = {
   get writeToPty() { return _writeToPty; },
   get onPtyData() { return _onPtyData; },
   get statsWorker() { return statsWorker; },
+  get retryConfig() { return _retryConfigState; },
   get workspaceLaunched() { return _workspaceLaunched; },
   setWorkspaceLaunched(v) { _workspaceLaunched = v; },
   get launchCallback() { return _launchCallback; },
@@ -652,6 +692,7 @@ const _routes = [
   ...teamRoutes,
   ...dingtalkRoutes,
   ...imRoutes,
+  ...proxyStatsRoutes,
 ];
 const dispatch = createDispatcher(_routes);
 
@@ -2306,6 +2347,7 @@ async function _doStop() {
   // 早期请求向已关闭的端口 POST 丢包。新 startViewer 的 listen 回调会再次 setLivePort
   setLivePort(null);
   try { unwatchFile(PROFILE_PATH); } catch {} // 清理 interceptor 的 StatWatcher
+  try { unwatchFile(RETRY_CONFIG_PATH); } catch {} // 清理 retry-config 的 StatWatcher
 }
 
 // ─── SDK Mode Exports ──────────────────────────────────────────

package/src/utils/contentFilter.js

@@ -285,6 +285,17 @@ export function isSyntheticPromptText(text) {
   return false;
 }
 
+// UltraPlan 输入识别：UltraPlanModal / CLI /ultraplan 都会把 ultraplanTemplates.js
+// 组装的 <system-reminder>[SCOPED INSTRUCTION]…</system-reminder> 模板前置到用户 prompt。
+// 该 marker 仅由 ultraplanTemplates.js 产出，故可作为「本轮是 UltraPlan 输入」的可靠信号。
+// stripSystemTags 会剥掉该块，所以必须在原始（未剥离）文本上判断；用负向前瞻确保 marker
+// 出现在同一个 <system-reminder>…</system-reminder> 块内部（不跨过闭合标签），避免用户正文里
+// 在某个无关 reminder 之后只是「提到」该短语时误判。
+export function isUltraplanText(text) {
+  if (!text || typeof text !== 'string') return false;
+  return /<system-reminder>(?:(?!<\/system-reminder>)[\s\S])*?\[SCOPED INSTRUCTION\]/i.test(text);
+}
+
 export function isSystemText(text) {
   if (!text) return true;
   const trimmed = text.trim();
@@ -469,7 +480,12 @@ export function classifyUserContent(content) {
   // 出现在 textBlocks 中；保留 skillBlocks 键以维持返回 shape（ChatView/ImConversationModal 消费）。
   const skillBlocks = [];
 
-  return { commands, textBlocks, skillBlocks, teammateBlocks, taskNotificationBlocks };
+  // 本轮是否为 UltraPlan 输入（原始文本仍含 <system-reminder>[SCOPED INSTRUCTION] marker，
+  // 此时尚未被 stripSystemTags 剥离）。消费方（ChatView）据此在用户气泡上方渲染 [UltraPlan] 标签。
+  const ultraplan = Array.isArray(content)
+    && content.some(b => b && b.type === 'text' && isUltraplanText(b.text));
+
+  return { commands, textBlocks, skillBlocks, teammateBlocks, taskNotificationBlocks, ultraplan };
 }
 
 /**

package/src/utils/isProxyMode.js

@@ -0,0 +1,11 @@
+// Shared proxy-mode detection logic.
+// Used by App.jsx (showProxyStatsNav gate) and AppHeader.jsx (menu visibility, Electron tab bar).
+//
+// "Confirmed proxy" = a non-built-in profile is active, or the built-in Default
+// points at a non-official endpoint (same api.anthropic.com test as ProxyModal's
+// Max warning). Official subscription → returns false.
+export function isProxyMode(activeProxyId, defaultConfig) {
+  if (activeProxyId && activeProxyId !== 'max') return true;
+  const origin = defaultConfig?.origin || '';
+  return !!origin && !/api\.anthropic\.com/i.test(origin);
+}