cc-viewer 1.8.14 → 1.9.0

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-OWc1WNdK.js"></script>
+  <script type="module" crossorigin src="./assets/index-CjbBUDGP.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-DKIytXho.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-4qgXq03k.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-D5Z5D9fq.js">

package/node_modules/@ccv/core/src/context-rules.js

@@ -77,7 +77,10 @@ const MODEL_CONTEXT_SIZES = [
   { match: /kimi|moonshot|^k3$/i, tokens: 256000 },
   // deepseek-v4 defaults to 1M; placed before generic /deepseek/ so the
   // first-match-wins loop picks it up before falling through to 128K.
+  // The `deepseek-flash` shorthand (an alias of deepseek-v4-flash, see the prompt
+  // layer's MODEL_ID_ALIASES) must hit the same 1M tier — /deepseek/ would give 128K.
   { match: /deepseek-v4/i, tokens: 1000000 },
+  { match: /^deepseek-flash/i, tokens: 1000000 },
   { match: /deepseek/i, tokens: 128000 },
 ];
 
@@ -118,6 +121,8 @@ export function classifyContextWindow(modelName) {
   if (!modelName || typeof modelName !== 'string') return 200000;
   if (modelName.toLowerCase().includes('1m')) return 1000000;
   if (/kimi|moonshot|^k3$/i.test(modelName)) return 1000000;
+  // deepseek-flash 简写(deepseek-v4-flash 的别名)归 1M 桶,与请求侧判定对齐。
+  if (/^deepseek-flash/i.test(modelName)) return 1000000;
   return getModelMaxTokens(modelName) >= 1000000 ? 1000000 : 200000;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.8.14",
+  "version": "1.9.0",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/i18n.js

@@ -263,8 +263,8 @@ const i18nData = {
     "uk": "⚠️  Не вдалося записати shell hook: {error}"
   },
   "cli.usage.hint": {
-    "zh": "\n如需卸载，请运行: ccv --uninstall",
-    "en": "\nTo uninstall, run: ccv --uninstall",
+    "zh": "\nShell hook 需重开终端(或 source rc 文件)后生效;此后终端里的 `claude -c` 也会经 ccv 注入。\n如需卸载，请运行: ccv --uninstall",
+    "en": "\nThe shell hook takes effect in NEW terminals (or after sourcing your rc file); afterwards `claude -c` in a terminal is also injected via ccv.\nTo uninstall, run: ccv --uninstall",
     "zh-TW": "\n如需卸載，請執行: ccv --uninstall",
     "ko": "\n제거하려면 실행: ccv --uninstall",
     "ja": "\nアンインストールするには: ccv --uninstall",

package/server/interceptor.js

@@ -14,14 +14,18 @@ import { homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { dirname, join, basename } from 'node:path';
 import { LOG_DIR } from '../findcc.js';
-import { assembleStreamMessage, createStreamAssembler, isAnthropicApiPath, isMainAgentRequest, replaceTopLevelModel, injectOutputConfigEffort, resolveProfileModel, extractAgentSpawnPairs, classifyProxyRole, resolveRoleProfile, normalizeRoles, mergeActivePayload } from './lib/interceptor-core.js';
+import { assembleStreamMessage, createStreamAssembler, isAnthropicApiPath, isMainAgentRequest, replaceTopLevelModel, replaceTopLevelSystem, injectOutputConfigEffort, resolveProfileModel, extractAgentSpawnPairs, classifyProxyRole, resolveRoleProfile, normalizeRoles, mergeActivePayload } from './lib/interceptor-core.js';
 import { V2Writer } from './lib/v2/v2-writer.js';
 import { reportSwallowed } from '@ccv/core/error-report';
-import { latestMainSessionDir, sessionHasCompletedMainTurn } from './lib/v2/session-select.js';
+import { latestMainSessionDir, sessionHasMainTurn, sessionHasCompletedMainTurn } from './lib/v2/session-select.js';
 import { sanitizePathComponent } from './lib/v2/layout.js';
+import { parseAgentId, findHeader } from './lib/v2/agent-id.js';
+import { parseUserId } from './lib/session-id.js';
 import { setRetryConfigPath, loadRetryConfig, DEFAULT_RETRY_CONFIG } from './lib/proxy/proxy-retry.js';
 import { setProjectName } from './lib/project-state.js';
 import { consumePendingForResume, writeSnapshot, projectKeyForCwd } from './lib/system-prompt-snapshots.js';
+import { liveSystemPromptEnabled, getLaunchSystemPromptInfo, getLiveEntry, putLiveEntry, selectEntriesForModel, applyLiveSystem, knownInjectedTexts } from './lib/system-prompt-live.js';
+import { MODEL_PROMPT_DIR } from './lib/model-system-prompts.js';
 
 
 
@@ -437,21 +441,31 @@ export { _v2Writer };
 // bounded cold-load window (DEFAULT_EVENTS_LIMIT) as any session — never
 // limit=0 — so it stays memory-safe (S10). All three cold-load consumers
 // (/events, /api/requests, workspace reload) route through here.
-export function getLiveLogSource() {
+export function getLiveLogSource({ serveInFlight = true } = {}) {
   const dir = _v2Writer.currentSessionDir();
-  // "Activated" requires a COMPLETED main turn, not merely a written main
-  // request line: a session with only an in-flight first request has nothing a
-  // cold load can render yet, so keep falling back to the previous conversation
-  // (which CAN render) until the current one has a done. Removes the blank flash
-  // between "first `-c`/fresh main request written" and "its response emitted".
-  if (dir && sessionHasCompletedMainTurn(dir)) return dir; // activated current session
+  // "Activated": a completed main turn, OR — only when the caller's wire can
+  // render it — a first main turn currently in flight (req line on disk, no
+  // done yet). The in-flight case became renderable once the client batch
+  // path stopped blocking known-full in-progress carriers (v3 wire: the req
+  // + its conv state are written at request initiation, 2026-09-13
+  // refresh-blank fix), so serve OUR OWN current dir instead of falling back
+  // to the previous conversation. Legacy-wire callers pass
+  // serveInFlight:false: their cold stream carries the placeholder, which the
+  // client batch gate still blocks — serving the in-flight dir there blanks
+  // the panel where the previous conversation rendered before (worst after
+  // an Esc-aborted first turn, whose placeholder is never replaced).
+  // sessionHasMainTurn stays the second arm (not a replacement): || short-
+  // circuits on true, so its narrow head-only scan (256KB) runs ONLY when
+  // the wide completed-turn scan (8MB) already returned false — precisely
+  // the in-flight case it exists to catch, at zero extra cost otherwise.
+  if (dir && (sessionHasCompletedMainTurn(dir) || (serveInFlight && sessionHasMainTurn(dir)))) return dir; // activated current session
   if (!_projectName) return ''; // no project bound yet (mirrors v2-writer's guard)
   try {
-    // excludeDir: the current session just failed the completed-turn gate, but
-    // the picker's weaker has-a-main-req gate would re-select it (it is the
-    // newest dir once its first main req is written) — handing back exactly the
-    // blank in-flight session the strict gate rejected. Excluding it makes the
-    // fallback actually land on the previous, renderable conversation.
+    // excludeDir: the caller's activated gate and the picker now share the
+    // same has-a-main-req predicate, so exclusion is not selection logic — it
+    // closes the TOCTOU race where a main req line lands between the gate
+    // check above and the picker's scan (the current dir would otherwise be
+    // re-selected as the newest, nullifying the fallback).
     // skipForeignLive: a parallel ccv window's in-flight session must never be
     // served as THIS window's cold load (multi-window isolation); a crashed
     // window's claim expires with its pid, so its session stays selectable.
@@ -902,16 +916,39 @@ export function setupInterceptor() {
     // （_defaultConfig 首请求才捕获）。
     // 短路：无 main profile 且无任何角色分配时，角色不影响结果（_effProfile 恒 null），
     // 跳过分类的 system 文本提取开销 —— 未配置用户零成本。
+    // 但 live system 已启用时必须分类（review 第二轮 P0-1）：短路硬编码 'main' 会让同进程
+    // native teammate（含团队标记）/ subagent（含 cc_is_subagent 标记）以 'main' 穿过 live
+    // 门被强注入主 persona —— 恰是分类要保护的标记被覆盖。与 proxy.js:142 的分流同构：
+    // 仅当「确实无需分类」（无 profile + 无角色分配 + live 未启用）才短路。
     let _fetchUrl = url;
     let _fetchOpts = options;
-    const _proxyRole = (!_activeProfile && _roleIds.subagent === 'follow' && _roleIds.teammate === 'follow')
-      ? 'main'
-      : classifyProxyRole(requestEntry?.body, {
-        isTeammate: _isTeammate,
-        isCountTokens: !!requestEntry?.isCountTokens,
-        isHeartbeat: !!requestEntry?.isHeartbeat,
-      });
+    const _skipClassify = !_activeProfile && _roleIds.subagent === 'follow' && _roleIds.teammate === 'follow'
+      && !liveSystemPromptEnabled();
+    // 最高优先级硬判据（review 第二轮二次验证 P1-1 残余，与 contentFilter.js:158 同构）：
+    // 请求头 x-claude-code-agent-id 是 SDK 命名队友（name@…）/ 匿名子代理（hex）的判别信号，
+    // 不依赖 system 文本 —— body 正则（TEAMMATE_SYSTEM_RE / cc_is_subagent）对「SDK 身份行 +
+    // 无 billing 标记」的形态失效，会把这类请求误判 'main' 而注入主 persona。named→teammate、
+    // anon→subagent，覆盖 body 分类。O(1) header 查键，但在短路口（live 未启用+无配置）
+    // 无需角色时不做 —— 保持未配置用户零成本语义。
+    let _proxyRole;
+    if (_skipClassify) {
+      _proxyRole = 'main';
+    } else {
+      const _agent = parseAgentId(findHeader(requestEntry?.headers, 'x-claude-code-agent-id'));
+      _proxyRole = _agent
+        ? (_agent.named ? 'teammate' : 'subagent')
+        : classifyProxyRole(requestEntry?.body, {
+          isTeammate: _isTeammate,
+          isCountTokens: !!requestEntry?.isCountTokens,
+          isHeartbeat: !!requestEntry?.isHeartbeat,
+        });
+    }
     const _effProfile = _effectiveRoleProfile(_proxyRole);
+    // 生效模型解析提到块外：live system 改写（步骤 3.5）需要在无 baseURL 的纯模型
+    // profile 下也能拿到目标模型；_targetModel 为 null 时回落到请求自身的 model。
+    const _rb0 = requestEntry?.body;
+    const _oldModel0 = (_rb0 && typeof _rb0 === 'object' && typeof _rb0.model === 'string') ? _rb0.model : undefined;
+    const _targetModel0 = (_effProfile && _oldModel0) ? resolveProfileModel(_oldModel0, _effProfile) : null;
     if (_effProfile && _effProfile.baseURL && requestEntry) {
       try {
         // 1. URL 重写: 用 baseURL 替换 origin，智能处理路径重叠
@@ -998,6 +1035,124 @@ export function setupInterceptor() {
       } catch { }
     }
 
+    // 3.5. Live system 改写 —— system 文本随主模型热切换 + (sessionId, model) 静态化。
+    //    独立于上面的 baseURL 块（纯模型 profile 无 baseURL 也要生效）。门：
+    //    liveSystemPromptEnabled（启动期 ccv 确实注入且未 suppressed/env 关闭）+
+    //    role=main（teammate/subagent 跳过，保护角色分类标记）+ 非 count_tokens/heartbeat
+    //    （utility 端点绝不能发明/改写 system，会污染 token 计数）。
+    //    门判据用 _proxyRole（classifyProxyRole），不再用 requestEntry.mainAgent
+    //    （isMainAgentRequest）：后者要求 system 含 "You are Claude Code" 官方文案，
+    //    而 override 主场景（--system-prompt-file 整段替换）的 base 是自定义 persona，
+    //    会被该判据误排 → live 特性在 override 主场景整体失效。_proxyRole 对 override
+    //    persona 正确返回 'main'。isMainAgentRequest 仍用于日志/v2 分类。
+    //    判据收窄说明（review 第二轮）：旧门 isMainAgentRequest 是「system 文案子串 + tools
+    //    启发式」两重判据，新门 classifyProxyRole 仅「teammate/subagent 标记正则」一重 ——
+    //    对「无标记 teammate / 无 billing 标记 subagent」由「不改写」变为「改写」，判据
+    //    由两重降为一重。配套：tools 结构门（与 proxy-retry.js 对齐，挡 title-gen 等
+    //    tools=[] 的旁路调用）+ P0-1 短路口分类修复，把主要受害面收回。
+    //    继承性风险（残余）：同进程同 persona teammate 若不含 TEAMMATE_SYSTEM_RE 标记仍判
+    //    'main'（见 interceptor-core.js classifyProxyRole 注释），依赖该正则分类。
+    //    tools 门阈值用「非空」(>=1) 与 proxy 完全一致 —— 不设数量下限：真实语料 1~5 工具
+    //    的合法主会话/子代理变体存在（web_search 单工具、Bash+Read+WebFetch+WebSearch 4 工具），
+    //    它们靠 cc_is_subagent 标记被 classifyProxyRole 正确排除，不能靠工具数误判。
+    //    启动模型条目 seed 自启动期注入字节（零渲染）；切到其它模型时按当前选中模型
+    //    同步选择 + 渲染 —— ${...} 变量复用启动期按 launchInfo 发布的变量快照（git/os/env
+    //    与启动文本一致），仅 time/model 实时，热切换首请求即生效。
+    //    自带 try/catch + reportSwallowed：外层 baseURL 块的裸 catch 覆盖不到这里。
+    try {
+      const _hookTools = requestEntry?.body?.tools;
+      if (requestEntry && _proxyRole === 'main' &&
+          !requestEntry.isCountTokens && !requestEntry.isHeartbeat &&
+          Array.isArray(_hookTools) && _hookTools.length > 0 &&
+          liveSystemPromptEnabled()) {
+        const _targetModel = _targetModel0 || _oldModel0;
+        const _projectKey = _projectName; // 每请求快照一次：工作区切换中途不串写
+        const _sid = parseUserId(requestEntry.body?.metadata?.user_id)?.sessionId ?? null;
+        if (_targetModel && _projectKey && _sid) {
+          const _li = getLaunchSystemPromptInfo();
+          let _liveEntry = getLiveEntry(_projectKey, _sid, _targetModel);
+          // 启动模型 seed：
+          //  - pinned（resume -c/-r）：无条件 seed 自 pin 字节（不比较模型 id）——resume 的
+          //    启动模型就是 pin 的模型，seed 自 pin 字节即「pin 不被强行覆盖」（防模板漂移
+          //    重选破坏被恢复上下文的 KV-cache）。
+          //  - fresh：仅当本次启动确实注入了内容且模型匹配时 seed（不重新渲染，保住 Bind A）。
+          // 启动没注入（强行覆盖要补的场景）则 fallthrough 到下面的同步选择 + 渲染。
+          // 模型 id 判据：剥 [1m] 后缀后比较（resolveProfileModel 同款，Claude Code 1M
+          // context 标记不应影响匹配）。resolvedModelId 为 null（启动无模型信号）时不 seed
+          // —— 无法确认请求模型即启动模型，保守走同步选择（避免把启动字节错配给切换后的
+          // 不同家族模型）。该场景下同步选择用启动期变量快照渲染（${git.*} 等与启动一致）。
+          const _strip1m = (s) => (typeof s === 'string' ? s.replace(/\[1m\]/gi, '').trim() : '');
+          const _modelMatch = _li && (
+            _li.pinned === true ||
+            (_li.resolvedModelId != null && _strip1m(_targetModel) === _strip1m(_li.resolvedModelId))
+          );
+          const _seedable = _li && _li.entries.length > 0 && _modelMatch;
+          if (!_liveEntry && _seedable) {
+            const seeded = { override: null, append: null };
+            for (const e of _li.entries) {
+              if (e.flag === '--system-prompt-file') seeded.override = e.content;
+              else if (e.flag === '--append-system-prompt-file') seeded.append = e.content;
+            }
+            if (seeded.override || seeded.append) {
+              putLiveEntry(_projectKey, _sid, _targetModel, seeded);
+              _liveEntry = seeded;
+            }
+          }
+          // 强行覆盖：缓存未就绪（含「启动未注入」与「切换到非启动模型」两种）→ 同步按
+          // 当前选中模型选择 + 渲染。渲染已无现场子进程：${...} 变量取自启动期按
+          // launchInfo 发布的变量快照（git/os/env 与启动文本一致），仅 time/model 实时 ——
+          // 故热切换**首请求即生效**。旧实现的 setImmediate 异步旁路让首请求沿用上一个
+          // 模型的人格（人格错配），已拆除。选择本身是小文件同步读（模型条目 + sentinel），
+          // 固化后不再重复。
+          // pinned 双保险：F2 resume（pinned 且 entries 为空）语义是「绝不改动既有上下文
+          // 的 system」——launch-config 已对 F2 关 allowLive，这里再挡一层（防御陈旧 launchInfo）。
+          if (!_liveEntry && _li && _li.workspaceDir && !(_li.pinned === true && _li.entries.length === 0)) {
+            try {
+              const _selected = selectEntriesForModel(_targetModel, {
+                workspaceDir: _li.workspaceDir,
+                globalModelDir: join(LOG_DIR, MODEL_PROMPT_DIR),
+              });
+              if (_selected) {
+                // putLiveEntry 落盘失败（如超 256KB 上限/磁盘不可写）不影响当次改写：
+                // wire 仍用选中文本，只是下次请求重选一遍（与 seed 分支同一取舍）。
+                putLiveEntry(_projectKey, _sid, _targetModel, _selected);
+                _liveEntry = _selected;
+              }
+              // 无匹配条目 → _selected 为 null，当次请求不改写（selectEntriesForModel total）
+            } catch (err) { reportSwallowed('interceptor.live-system-select', err); }
+          }
+          if (_liveEntry && requestEntry.body && _fetchOpts?.body) {
+            const _known = knownInjectedTexts(_projectKey, _sid);
+            const _hadSystem = 'system' in requestEntry.body;
+            // 强行覆盖：body 无 system（启动未注入）时用空字符串合成目标形态
+            const _newSystem = applyLiveSystem(_hadSystem ? requestEntry.body.system : '', _liveEntry, _known);
+            if (_newSystem !== null) {
+              const _sysJson = JSON.stringify(_newSystem);
+              const _rawBody = typeof _fetchOpts.body === 'string'
+                ? _fetchOpts.body
+                : (Buffer.isBuffer(_fetchOpts.body) ? _fetchOpts.body.toString('utf-8') : null);
+              if (_rawBody !== null) {
+                // body 原本无 system → 允许前插（仅 main 非 utility 请求会走到这里）
+                let _rewritten = replaceTopLevelSystem(_rawBody, _sysJson, { allowPrepend: !_hadSystem });
+                if (_rewritten === null) {
+                  try {
+                    const _b = JSON.parse(_rawBody);
+                    _b.system = _newSystem;
+                    _rewritten = JSON.stringify(_b);
+                  } catch { _rewritten = null; }
+                }
+                if (_rewritten !== null) {
+                  // 保持 body 类型：进 Buffer 出 Buffer，进 string 出 string
+                  _fetchOpts = { ..._fetchOpts, body: Buffer.isBuffer(_fetchOpts.body) ? Buffer.from(_rewritten, 'utf-8') : _rewritten };
+                  requestEntry.body = { ...requestEntry.body, system: _newSystem };
+                }
+              }
+            }
+          }
+        }
+      }
+    } catch (err) { reportSwallowed('interceptor.live-system', err); }
+
     if (requestEntry) {
       // v2 req-phase ingest: journal seq is allocated inside, still in the
       // fetch hook's synchronous segment (the proxy rewrite above is fully

package/server/lib/builtin-model-prompts.js

@@ -25,6 +25,14 @@ import { reportSwallowed } from '@ccv/core/error-report';
 // Tombstone file inside a scope's model-prompt dir: a JSON array of canonical names.
 export const BUILTIN_DISABLED_FILE = '.builtin-disabled.json';
 
+// 改名/族系合并的一次性兼容映射：墓碑按规范大写名比对，preset 改名（如 Qwen-3.7-Max
+// 合并为族系条目 Qwen-3）会让旧墓碑（QWEN-3.7-MAX）静默失效 —— 用户显式 opt-out 被
+// 逆转。读墓碑时把旧名归一到现名，保住 opt-out（本模块注释承诺的「不静默逆转」原则）。
+// One-shot rename aliases: a preset rename must not silently void an existing tombstone.
+const TOMBSTONE_RENAMES = {
+  'QWEN-3.7-MAX': 'QWEN-3',
+};
+
 // 物化目录：preset 文本（边界已剥离、${...} 保持字面量，spawn 渲染管线再替换变量）
 // 写成内容寻址的临时文件，供 --system-prompt-file 注入（文件对形式是快照钉扎的前提）。
 // 惰性读取 env 覆盖（测试用）：node --test 多进程并行时共享目录会被彼此的 GC 竞态误删。
@@ -99,7 +107,10 @@ export function readBuiltinDisabled(modelPromptDir) {
     const raw = readFileSync(target, 'utf-8');
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) throw new Error('tombstone file is not a JSON array');
-    const names = parsed.map((n) => normalizeModelName(typeof n === 'string' ? n : '')).filter(Boolean);
+    const names = parsed.map((n) => {
+      const canonical = normalizeModelName(typeof n === 'string' ? n : '');
+      return TOMBSTONE_RENAMES[canonical] || canonical;
+    }).filter(Boolean);
     return [...new Set(names)].sort();
   } catch (err) {
     console.warn(`[CC Viewer] built-in prompt tombstone ${target} unreadable (${err.message}); treating as no disables`);

package/server/lib/create_system_prompt.js

@@ -71,7 +71,9 @@ function firstNonEmpty(...values) {
 }
 
 function currentDate(timeZone, date) {
-  if (timeZone.length > 0) {
+  // Guard: a non-string timeZone (e.g. undefined from a null snapshot) must not throw
+  // on `.length` — fall through to the ISO branch below.
+  if (typeof timeZone === 'string' && timeZone.length > 0) {
     const formatted = stringOrEmpty(() =>
       new Intl.DateTimeFormat('en-CA', {
         timeZone,
@@ -249,6 +251,97 @@ export function createSystemPromptVariables(overrides = {}, opts = {}) {
   return mergeSystemPromptVariables(variables, overrides)
 }
 
+// ─── Cacheable variable snapshot / live re-composition ──────────────────────
+// Hot model switching re-renders the injected system text on every switch. Collecting
+// variables shells out to git (spawnSync, up to 8 calls × 15 s timeout in a repo),
+// which must never run in the fetch hook's synchronous segment. So the collected set
+// is split at the launch boundary:
+//   - snapshot: everything the launch collected EXCEPT `time.date` and `model.name` —
+//     env / os / runtime / cwd / git / memory index / timezone / knowledgeCutoff …
+//     Stable for the whole process lifetime, so a switched-model text agrees with the
+//     launch text outside the live keys.
+//   - live: `time.date` (re-derived at render time) and `model.name` (the model of
+//     THIS request). `time.timezone` stays in the snapshot on purpose: it is env/ICU
+//     derived and immutable, and reusing it keeps the Time section byte-identical to
+//     the launch text. `model.knowledgeCutoff` is env-derived too, so it stays.
+
+// A full empty-variable skeleton used when there is no snapshot at all (launch with
+// no injection / launch whose injected text had no `${...}` / pinned-resume). Rendering
+// against this yields EMPTY strings for `${git.*}` etc. — never literal `${git.branch}`
+// text in the prompt. `git.isRepository` reads as the string 'false' so the Git section
+// reads "Is a git repository: false" rather than vanishing.
+function emptySystemPromptVariableSkeleton() {
+  return {
+    environment: {
+      cwd: '', originalCwd: '', home: '', user: '', workspaceRoots: '', path: '', lang: '',
+    },
+    git: {
+      isRepository: 'false', root: '', branch: '', mainBranch: '', userName: '', recentCommits: '',
+    },
+    os: {
+      platform: '', type: '', arch: '', shell: '', version: '', release: '', hostname: '',
+      availableParallelism: '', totalMemory: '',
+    },
+    runtime: { nodeVersion: '', execPath: '', pid: '', ppid: '' },
+    permissions: { mode: '', approvalsReviewer: '' },
+    sandbox: { mode: '', networkAccess: '', writableRoots: '' },
+    terminal: { term: '', colorTerm: '' },
+    filesystem: { tmpdir: '', pathSeparator: '', pathDelimiter: '' },
+    model: { name: '', knowledgeCutoff: '' },
+    memory: { dir: '', index: '', enabled: 'false' },
+    scratchpad: { dir: '' },
+  }
+}
+
+// Guard: the cached git object must carry all 6 fields with `isRepository` as a string,
+// otherwise fall back to an all-empty git block. A malformed/partial snapshot would
+// otherwise leak a literal `${git.branch}` into the prompt under missingVariableMode
+// 'keep' (user-visible corruption).
+function sanitizeGitBlock(git) {
+  if (!git || typeof git !== 'object') return emptySystemPromptVariableSkeleton().git
+  const fields = ['isRepository', 'root', 'branch', 'mainBranch', 'userName', 'recentCommits']
+  const ok = fields.every((f) => typeof git[f] === 'string') && (git.isRepository === 'true' || git.isRepository === 'false')
+  return ok ? git : emptySystemPromptVariableSkeleton().git
+}
+
+/**
+ * Split a collected variable set into the cacheable snapshot. Removes ONLY `time.date`
+ * and `model.name` (the two live values); keeps `time.timezone` and the rest so the
+ * snapshot can be keyed by workspace and reused across every hot switch in the process.
+ * Total: unusable input → null (callers fall back to an empty skeleton).
+ */
+export function toSystemPromptVariableSnapshot(variables) {
+  if (!variables || typeof variables !== 'object') return null
+  const { time, model, ...rest } = variables // eslint-disable-line no-unused-vars
+  return {
+    ...rest,
+    git: sanitizeGitBlock(rest.git),
+    time: { timezone: (time && typeof time.timezone === 'string') ? time.timezone : '' },
+    model: {
+      knowledgeCutoff: (model && typeof model.knowledgeCutoff === 'string') ? model.knowledgeCutoff : '',
+    },
+  }
+}
+
+/**
+ * Rebuild a render-ready variable set from a snapshot + the live values.
+ * `now` is injectable for tests; production always uses the current clock.
+ * A null/partial snapshot still yields a usable set built on an empty skeleton —
+ * `${git.*}` renders as empty strings, never as literal `${git.branch}` text.
+ */
+export function fromSystemPromptVariableSnapshot(snapshot, { modelId = null, now = new Date() } = {}) {
+  const base = (snapshot && typeof snapshot === 'object') ? snapshot : emptySystemPromptVariableSkeleton()
+  const tz = (base.time && typeof base.time.timezone === 'string' && base.time.timezone)
+    ? base.time.timezone
+    : stringOrEmpty(() => Intl.DateTimeFormat().resolvedOptions().timeZone)
+  const modelName = (typeof modelId === 'string' && modelId) ? modelId.replace(/\[1m\]$/i, '') : ''
+  return mergeSystemPromptVariables(base, {
+    git: sanitizeGitBlock(base.git),
+    time: { date: currentDate(tz, now), timezone: tz },
+    model: { name: modelName },
+  })
+}
+
 function readDottedPath(path, variables) {
   const normalizedPath = path.trim()
   if (Object.prototype.hasOwnProperty.call(variables, normalizedPath)) {

package/server/lib/interceptor-core.js

@@ -399,6 +399,150 @@ export function replaceTopLevelModel(jsonStr, oldModel, newModel) {
   return jsonStr.slice(0, idx) + replaced + jsonStr.slice(idx + needle.length);
 }
 
+// ─── replaceTopLevelSystem ────────────────────────────────────────────────────
+// system 文本随主模型热切换（system-prompt-live.js）的 wire 层原语：在原始 JSON
+// 字符串上定向替换顶层 "system" 成员的值，避免对巨型 wire body（-c checkpoint
+// 可达数十 MB）做二次 JSON.parse + 全量 re-stringify。
+//
+// 与 replaceTopLevelModel 的三点差异：
+// 1. needle 只有 key（值可能极大且未知），嵌套的同名成员（如工具 input_schema
+//    里名为 "system" 的属性）会产生多候选 → 要求顶层候选唯一，否则返回 null
+//    由调用方回退 parse/stringify。
+// 2. 值的结束位置用「字符串/转义感知的有界扫描」定位（string 处理 \" 与 \\；
+//    array/object 做深度计数，跳过字符串内部）。扫描结束后校验下一个非空白字符
+//    必须是 `,` 或 `}`（顶层对象内的合法后继），否则视为定位失败返回 null。
+// 3. body 没有顶层 "system" 成员时（罕见，如某些 utility 调用），opts.allowPrepend
+//    为 true 才前插；否则返回 null。前插的重复键风险与 injectOutputConfigEffort
+//    同理——调用方必须先在解析后的 body 上确认 system 不存在。
+//
+// newSystemJson 是完整的新值 JSON（字符串或数组的序列化形态，调用方负责 JSON.stringify）。
+// 返回替换后的字符串；无法唯一定位 / 入参非法 → null（调用方回退）。
+
+// 从 jsonStr[i]（值首字符，必须为 " [ { 或字面量）扫描到值结束，返回结束下标（exclusive），
+// 无法定位 → -1。字符串处理 \" 与 \\ 转义；数组/对象做深度计数并跳过字符串内容；
+// 字面量（true/false/null/number）直接扫到分隔符。system 值在真实 wire 上只会是
+// string 或 array，其余形态防御性支持。
+function _scanJsonValueEnd(jsonStr, i) {
+  const open = jsonStr[i];
+  if (open === '"') {
+    let p = i + 1;
+    while (p < jsonStr.length) {
+      const c = jsonStr[p];
+      if (c === '\\') { p += 2; continue; }
+      if (c === '"') return p + 1;
+      p++;
+    }
+    return -1;
+  }
+  if (open === '[' || open === '{') {
+    let depth = 0;
+    let p = i;
+    while (p < jsonStr.length) {
+      const c = jsonStr[p];
+      if (c === '"') {
+        const end = _scanJsonValueEnd(jsonStr, p);
+        if (end === -1) return -1;
+        p = end;
+        continue;
+      }
+      if (c === '[' || c === '{') depth++;
+      else if (c === ']' || c === '}') {
+        depth--;
+        if (depth === 0) return p + 1;
+        if (depth < 0) return -1;
+      }
+      p++;
+    }
+    return -1;
+  }
+  // literal: true / false / null / number → 扫到 , } ] 或空白
+  const m = /^-?\d+(\.\d+)?([eE][+-]?\d+)?|^true|^false|^null/.exec(jsonStr.slice(i, i + 32));
+  return m ? i + m[0].length : -1;
+}
+
+export function replaceTopLevelSystem(jsonStr, newSystemJson, opts = {}) {
+  if (typeof jsonStr !== 'string' || !jsonStr ||
+      typeof newSystemJson !== 'string' || !newSystemJson) return null;
+  // 防御：newSystemJson 必须是合法 JSON 值（调用方 Bug 直接把垃圾写上 wire 不可接受）。
+  try { JSON.parse(newSystemJson); } catch { return null; }
+
+  const needles = ['"system":', '"system" :'];
+  // 顶层必须是对象：顶层数组（如 [{...}]）里的成员也可能通过 { 边界校验，
+  // 但那不是顶层 "system" —— 整体拒绝（调用方回退）。
+  const openIdx = jsonStr.search(/\S/);
+  if (openIdx === -1 || jsonStr[openIdx] !== '{') return null;
+  // 深度感知候选扫描（review 第二轮 P1-4）：成员边界校验（前一非空白字符是 { 或 ,）
+  // 不足以区分「顶层 system」与「嵌套同名成员」—— tools[i].input_schema.properties.system
+  // 前面同样是 {。必须跟踪 JSON 容器深度，只接受 depth===1（顶层对象内）的候选，
+  // 否则前插/替换会把 persona 写进工具 schema（顶层 system 根本没设置）。
+  //
+  // 性能（review 第二轮二次验证 P1）：逐字符深度扫描是 O(body)，对巨型 -c checkpoint
+  // （可达数十 MB）比「回退 parse+stringify」还贵 —— 而绝大多数请求（无 system 的旁路
+  // 调用、或 system 在后的大 body）根本不需要全文扫描。先用 indexOf 预筛：body 完全
+  // 不含 "system" 字样（含字符串值内）时 candidates 恒为空，直接跳过扫描（O(needle)
+  // 原生加速）；只有确实含 needle 才付出深度扫描成本。预筛命中不等于有候选（可能在
+  // 字符串值内），仍需扫描确认 —— 预筛只在「确定无 needle」时短路，语义不变。
+  const candidates = [];
+  const _hasNeedle = jsonStr.indexOf('"system"') !== -1; // 覆盖 "system": 与 "system" : 两 needle 的公共前缀
+  if (_hasNeedle) {
+    let depth = 0;
+    let p = openIdx;
+    while (p < jsonStr.length) {
+      const c = jsonStr[p];
+      if (c === '"') {
+        // 字符串内容整体跳过（含转义）—— 但先检查它是否是 depth===1 的 "system" 键
+        if (depth === 1) {
+          for (const needle of needles) {
+            if (jsonStr.startsWith(needle, p)) {
+              // 键边界：前一个非空白字符必须是 { 或 ,（顶层对象成员位置）
+              let q = p - 1;
+              while (q >= 0 && (jsonStr[q] === ' ' || jsonStr[q] === '\t' || jsonStr[q] === '\n' || jsonStr[q] === '\r')) q--;
+              if (q >= 0 && (jsonStr[q] === '{' || jsonStr[q] === ',')) {
+                candidates.push({ idx: p, needle });
+              }
+              break;
+            }
+          }
+        }
+        const end = _scanJsonValueEnd(jsonStr, p);
+        if (end === -1) return null;
+        p = end;
+        continue;
+      }
+      if (c === '{' || c === '[') depth++;
+      else if (c === '}' || c === ']') depth--;
+      p++;
+    }
+  }
+  if (candidates.length > 1) return null; // 嵌套同名成员 → 回退 parse/stringify
+
+  if (candidates.length === 0) {
+    // 无顶层 system 成员：只有显式允许才前插（utility 端点绝不能发明 system）。
+    if (opts.allowPrepend !== true) return null;
+    const i = jsonStr.indexOf('{');
+    if (i === -1) return null;
+    if (/\S/.test(jsonStr.slice(0, i))) return null; // 顶层必须是对象
+    const after = jsonStr.slice(i + 1);
+    const m = after.match(/^\s*(\S)/);
+    const needsComma = !!(m && m[1] !== '}');
+    const insert = `"system":${newSystemJson}` + (needsComma ? ',' : '');
+    return jsonStr.slice(0, i + 1) + insert + jsonStr.slice(i + 1);
+  }
+
+  const { idx, needle } = candidates[0];
+  // 值起始：跳过冒号后的空白
+  let vStart = idx + needle.length;
+  while (vStart < jsonStr.length && (jsonStr[vStart] === ' ' || jsonStr[vStart] === '\t' || jsonStr[vStart] === '\n' || jsonStr[vStart] === '\r')) vStart++;
+  if (vStart >= jsonStr.length) return null;
+  const vEnd = _scanJsonValueEnd(jsonStr, vStart);
+  if (vEnd === -1) return null;
+  // 值后边界：下一个非空白字符必须是 , 或 }（顶层对象内的合法后继）
+  let p = vEnd;
+  while (p < jsonStr.length && (jsonStr[p] === ' ' || jsonStr[p] === '\t' || jsonStr[p] === '\n' || jsonStr[p] === '\r')) p++;
+  if (p >= jsonStr.length || (jsonStr[p] !== ',' && jsonStr[p] !== '}')) return null;
+  return jsonStr.slice(0, vStart) + newSystemJson + jsonStr.slice(vEnd);
+}
+
 // proxy profile hot-switch 模型解析：按 request body 里 model 的家族名映射到 profile 的对应字段。
 // 家族用**大小写不敏感子串**匹配（/opus/i 等），只认这几个已知家族单词——
 // 因此 claude-opus-4-8、未来的 claude-opus-5 等任何版本都命中同一家族，版本升级无需重配。