cc-viewer 1.8.19 → 1.8.20

package/server/routes/auth.js

@@ -39,10 +39,13 @@ function buildState(deps, isLocal, isAdmin) {
     enabled: s.effective.enabled,
     isAdmin,
     password: isLocal ? s.effective.password : null,
+    // Surface the fail-closed signal so the admin UI can disable the password field and explain
+    // why a save would be refused (see the 409 PASSWORD_UNREADABLE branch in authConfigPost).
+    passwordUnreadable: !!s.effective.passwordUnreadable,
     scope: s.scope,                       // 'project' | 'global' — which one is in effect
     hasProjectOverride: s.hasProjectOverride,
     projectDir: s.projectDir,             // null when not project-scoped (non-CLI mode)
-    global: { enabled: s.global.enabled, password: isLocal ? s.global.password : null },
+    global: { enabled: s.global.enabled, password: isLocal ? s.global.password : null, passwordUnreadable: !!s.global.passwordUnreadable },
   };
 }
 
@@ -117,6 +120,23 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     const cur = scope === 'global'
       ? state.global
       : (state.hasProjectOverride ? state.effective : { enabled: false, password: '' });
+    // Fail-closed: the current scope's vault password exists but is UNREADABLE (lost master.key /
+    // tampered ciphertext). cur.password has collapsed to '' for the gate, but the real ciphertext
+    // must NOT be destroyed. Refuse any save that would overwrite/clear it — including the
+    // auto-generate-on-enable path (next.password is '' here) and any edit-and-save (which would
+    // delete/replace the unreadable entry). The admin recovers by restoring master.key, not by a
+    // save that silently wipes the previous secret.
+    // Read the flag from the SAME scope object as `cur` — a global-unreadable password must NOT
+    // refuse a save whose target is a fresh project override (a different vault ref).
+    const curUnreadable = !!cur.passwordUnreadable;
+    if (curUnreadable) {
+      res.writeHead(409, JSON_HEADERS);
+      res.end(JSON.stringify({
+        error: 'LAN password is stored in the credential vault but is currently unreadable (lost master.key or corrupt credentials.json). Refusing to overwrite it. Restore master.key to recover, or clear the vault entry first.',
+        code: 'PASSWORD_UNREADABLE',
+      }));
+      return;
+    }
     const next = { enabled: cur.enabled, password: cur.password };
     if (typeof incoming.enabled === 'boolean') next.enabled = incoming.enabled;
     const passwordProvided = typeof incoming.password === 'string';

package/server/routes/preferences.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { LOG_DIR, setLogDir, getClaudeConfigDir, discoverClaudeExecutables, resolveExplicitClaudePath, CLAUDE_EXECUTABLE_PREF_KEY } from '../../findcc.js';
-import { PROFILE_PATH, _defaultConfig, getActiveProfileId, getStoredRoles, isOfficialDefaultEndpoint, setActiveProfileForWorkspace, _loadProxyProfile, RETRY_CONFIG_PATH, _retryConfigState, _loadRetryConfigState } from '../interceptor.js';
+import { PROFILE_PATH, _defaultConfig, getActiveProfileId, getStoredRoles, isOfficialDefaultEndpoint, setActiveProfileForWorkspace, _loadProxyProfile, hydrateProfilesWithApiKeys, RETRY_CONFIG_PATH, _retryConfigState, _loadRetryConfigState } from '../interceptor.js';
 import { migrateProxyProfileList, isValidRoleValue, PROXY_ROLE_KEYS } from '../lib/interceptor-core.js';
 import { DEFAULT_RETRY_CONFIG, validateRetryConfig, resolveRetryConfig } from '../lib/proxy/proxy-retry.js';
 import { discoverCcSwitchProviders, mergeImportedProfiles } from '../lib/ccswitch-import.js';
@@ -15,6 +15,8 @@ import { inspectShellHook } from '../lib/shell-hook-inspect.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im/im-config.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { mutateJsonSync } from '../lib/json-store.js';
+import { persistProfilesApiKeys } from '../lib/credential-access.js';
 import { isAdminReq } from '../lib/is-admin.js';
 import {
   getCurrentProjectKey, getCurrentProjectName, hasFork, listForks, resolveScoped,
@@ -163,12 +165,18 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       // 切日志目录：把旧文件的完整内容（含 auth 密码 / prefsByProject forks / 其它偏好）带到新位置，
       // 避免切目录后密码与各项目 fork 凭空消失；并把写目标在 setLogDir 前后固定为"新文件"，让本次
       // 合并只跑在一个文件 / 一把锁上（不再因 LOG_DIR 中途漂移而劈裂进程内锁队列）。
+      // logDir 是机器全局、可改变进程数据根的操作（移动 vault 根会影响 LAN 门与代理注入），
+      // 因此只允许 admin（本机 loopback 或已鉴权远程 admin）触发——未鉴权远程/项目客户端直接剥掉。
       let targetFile = deps.getPrefsFile();
       let carried = null;
       if (incoming.logDir && typeof incoming.logDir === 'string') {
-        carried = readPrefsRaw(targetFile); // 旧文件全量（锁外读，迁移属罕见 admin 操作）
-        setLogDir(incoming.logDir);
-        targetFile = deps.getPrefsFile();
+        if (!isAdminReq(req, isLocal)) {
+          delete incoming.logDir; // non-admin cannot move the data root (would open the LAN gate)
+        } else {
+          carried = readPrefsRaw(targetFile); // 旧文件全量（锁外读，迁移属罕见 admin 操作）
+          setLogDir(incoming.logDir);
+          targetFile = deps.getPrefsFile();
+        }
       }
       // 全局写入：locked + atomic（prefs-store），与 fork 写共用同一把锁，避免并发写互相覆盖含密码的
       // preferences.json。Deep-merge approvalModal 的逻辑下沉到 applyPrefsPatch，与 /api/project-prefs
@@ -310,14 +318,28 @@ function proxyProfilesGet(req, res, parsedUrl, isLocal, deps) {
     if (Array.isArray(data.profiles)) {
       const { profiles: migrated, changed } = migrateProxyProfileList(data.profiles);
       if (changed) {
-        data = { ...data, profiles: migrated };
         try {
-          mkdirSync(dirname(PROFILE_PATH), { recursive: true });
-          writeFileSync(PROFILE_PATH, JSON.stringify(data, null, 2), { mode: 0o600 });
+          // Write the migration back while pulling apiKeys into the vault (so the old plaintext is
+          // never re-persisted). Read-merge-write INSIDE the lock (mutateJsonSync mutates in place
+          // and the kernel writes back the same reference), mutexed with the startup credential-strip
+          // and proxyProfilesPost.
+          mutateJsonSync(PROFILE_PATH, (current) => {
+            const base = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+            const stripped = persistProfilesApiKeys(migrated, null, { isMaskedFn: () => false });
+            base.profiles = stripped;
+            return base;
+          }, { mode: 0o600, strictCorrupt: true, fallback: {} });
+          data = { ...data, profiles: migrated };
           _loadProxyProfile();
         } catch { /* 迁移落盘失败不阻塞 GET；下次仍会尝试 */ }
       }
     }
+    // profile.json no longer carries apiKeys (they live in the credential vault) — decrypt-backfill
+    // them onto the list for serving. The local admin gets plaintext to view/copy; a remote caller
+    // is masked by deps.maskProfiles below (same as before).
+    if (Array.isArray(data.profiles)) {
+      data = { ...data, profiles: hydrateProfilesWithApiKeys(data.profiles) };
+    }
     // 用 interceptor.getActiveProfileId() 返回 effective active（workspace > profile.json.active > 'max'）
     const effectiveActive = getActiveProfileId();
     // 本机(127.0.0.1)= admin：下发明文 profile.apiKey 供本人在编辑表单(👁 折叠)里查阅/复制；已授权
@@ -353,22 +375,21 @@ function proxyProfilesPost(req, res, parsedUrl, isLocal, deps) {
       if (!incoming.profiles.some(p => p.id === 'max')) {
         incoming.profiles = [{ id: 'max', name: 'Default' }, ...(incoming.profiles || [])];
       }
-      // 如果 apiKey 是 mask 值（未修改），从磁盘读取原始值保留
-      let existing = {};
-      try { if (existsSync(PROFILE_PATH)) existing = JSON.parse(readFileSync(PROFILE_PATH, 'utf-8')); } catch { }
-      const existingMap = {};
-      if (existing.profiles) existing.profiles.forEach(p => { if (p.apiKey) existingMap[p.id] = p.apiKey; });
-      for (const p of incoming.profiles) {
-        if (p.apiKey && deps.isMasked(p.apiKey) && existingMap[p.id]) {
-          p.apiKey = existingMap[p.id];
-        }
-      }
-      // 只写 profiles 列表到 profile.json；active 不再入文件（避免跨进程串台）
-      // 保留老数据里的 active 字段不变，以便老版本 ccv 或手动编辑者的回退能力
-      const toWrite = { ...existing, profiles: incoming.profiles };
-      const dir = dirname(PROFILE_PATH);
-      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-      writeFileSync(PROFILE_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // Only the profiles list is written to profile.json; `active` is no longer persisted here
+      // (avoids cross-process clobbering). The existing file's `active` field is preserved so an
+      // older ccv or a hand editor can still fall back to it. Read-merge-write INSIDE the lock
+      // (mutateJsonSync), mutexed with the startup credential-strip and setActiveProfileForWorkspace —
+      // an unlocked snapshot would let persistProfilesApiKeys' deletion loop remove concurrently-added
+      // vault entries and overwrite the whole list.
+      // apiKey 抽出到凭证 vault（密文存 credentials.json），profile.json 不再携带 key。
+      // masked 回显 → 保留该 profile 的既有 vault 条目（不动、不回写 sentinel）；
+      // 新明文 → 写 vault；空 → 删该条目；被移除的 profile（全量替换端点）→ 删其 vault 条目。
+      mutateJsonSync(PROFILE_PATH, (current) => {
+        const existing = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+        const strippedProfiles = persistProfilesApiKeys(incoming.profiles, existing.profiles, { isMaskedFn: deps.isMasked });
+        existing.profiles = strippedProfiles;
+        return existing;
+      }, { mode: 0o600, strictCorrupt: true, fallback: {} });
       // 角色分配校验：只认 subagent/teammate 两个 key（roles.main 之类的杂键直接丢弃）；
       // 值必须是 follow / max / 入参 profiles 里存在的 id（按将落盘的列表校验，而非旧文件），
       // 非法值归 'follow'（宽容风格，不 400）。被删 profile 的悬空角色由读取时归 follow 兜底。
@@ -541,13 +562,20 @@ async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
         }
         existing = parsed;
       }
-      // merge
-      const merged = mergeImportedProfiles(existing.profiles || [], result.profiles);
-      const toWrite = { ...existing, profiles: merged.profiles };
-      // 落盘
-      const dir = dirname(PROFILE_PATH);
-      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-      writeFileSync(PROFILE_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // Persist: locked read-merge-write (mutateJsonSync), mutexed with the other profile.json
+      // writers. The merge MUST be recomputed inside the lock against the CURRENT on-disk list —
+      // computing it outside from a pre-lock snapshot and overwriting the whole list would erase a
+      // proxy-profiles POST that lands in that window. apiKeys are pulled into the vault; merge
+      // semantics never delete existing vault entries (no existingProfiles passed). cc-switch imports
+      // fresh plaintext keys (not a masked echo), so isMaskedFn is always false. `merged` is read
+      // back out of the lock for the response counts.
+      let merged = null;
+      mutateJsonSync(PROFILE_PATH, (current) => {
+        const base = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+        merged = mergeImportedProfiles(base.profiles || [], result.profiles);
+        base.profiles = persistProfilesApiKeys(merged.profiles, null, { isMaskedFn: () => false });
+        return base;
+      }, { mode: 0o600, strictCorrupt: true, fallback: {} });
       // active 处理：setActive=true 且 cc-switch 有 current → 切换；否则保持现状
       let activeChanged = false;
       if (setActive && result.currentId) {

package/server/server.js

@@ -118,6 +118,7 @@ import { applyTaskEvent, resetTasks, getTaskSnapshot, shouldResetTasks } from '.
 import { createImLogWatcher } from './lib/im/im-log-watcher.js';
 import { unwatchAllWorkflows } from './lib/workflow-watcher.js';
 import { backupConfigs } from './lib/config-backup.js';
+import { migrateCredentialsToVault } from './lib/credential-migrate.js';
 import { normalizeBasePath, validateBasePath, stripBasePath } from './lib/base-path.js';
 import { createHardenedCleanup } from './lib/term-signals.js';
 import { createBackpressureGate } from './lib/ws-backpressure.js';
@@ -785,6 +786,7 @@ async function handleRequest(req, res) {
     accessToken: ACCESS_TOKEN,
     enabled: authConfig.enabled,
     password: authConfig.password,
+    passwordUnreadable: authConfig.passwordUnreadable,
     wantsHtml,
   });
   // Remote-admin elevation (container/cloud deploy): an authenticated remote caller is
@@ -990,6 +992,11 @@ export async function startViewer() {
   // (滚动留 10 份)。2026-06-06 事故:配置随 LOG_DIR 整树丢失后无处可恢复。fire-and-forget。
   setImmediate(() => { try { backupConfigs(); } catch { /* ignore */ } });
 
+  // 启动期一次性凭证迁移:preferences/profile 里的明文/base64 密钥 → credentials.json(AES-256-GCM)。
+  // 必须在 backupConfigs 之后挂(先留一份迁移前备份),幂等(逐字段写 vault→读回比对→剔旧字段),
+  // 失败字段保留原值不丢,下次启动重试。fire-and-forget,不阻塞启动。
+  setImmediate(() => { try { migrateCredentialsToVault(); } catch { /* ignore */ } });
+
   // 启动时清理磁盘上 ASK_HOOK_TIMEOUT_MS 之前的 ask 条目（兜底防泄漏）。
   // 内存 Map 不 hydrate：旧 res 已死、新 ask-bridge 重连同 toolUseId 会自动复用槽位
   // （server.js 已有"旧 res 已断 → 复用"分支），无需在这里主动重建内存态。
@@ -1364,6 +1371,7 @@ async function setupTerminalWebSocket(httpServer) {
         accessToken: ACCESS_TOKEN,
         enabled: authConfig.enabled,
         password: authConfig.password,
+        passwordUnreadable: authConfig.passwordUnreadable,
         wantsHtml: false,
       });
       if (wsAuth.action !== 'allow') {

package/server/workspace-registry.js

@@ -1,42 +1,24 @@
 // Workspace Registry - 工作区持久化管理
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
 import { readdir, stat } from 'node:fs/promises';
-import { renameSyncWithRetry } from './lib/file-api.js';
-import { withFileLockAsync } from './lib/async-file-lock.js';
+import { mutateJson, readJsonSafe, writeJsonAtomic } from './lib/json-store.js';
 import { dirSizeSync } from './lib/v2/layout.js';
 import { isDiscardableSession } from './lib/v2/session-select.js';
-import { join, basename, resolve } from 'node:path';
+import { join, basename, resolve, dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { LOG_DIR } from '../findcc.js';
 
 // 动态获取（LOG_DIR 可能在运行时被 setLogDir 修改）
 function getWorkspacesFile() { return join(LOG_DIR, 'workspaces.json'); }
-function getLockFile() { return join(LOG_DIR, 'workspaces.lock'); }
 
 export function loadWorkspaces() {
-  try {
-    if (!existsSync(getWorkspacesFile())) return [];
-    const data = JSON.parse(readFileSync(getWorkspacesFile(), 'utf-8'));
-    return Array.isArray(data.workspaces) ? data.workspaces : [];
-  } catch {
-    return [];
-  }
+  const data = readJsonSafe(getWorkspacesFile(), {});
+  return Array.isArray(data.workspaces) ? data.workspaces : [];
 }
 
-export function saveWorkspaces(list) {
-  const tmpFile = `${getWorkspacesFile()}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
-  try {
-    mkdirSync(LOG_DIR, { recursive: true });
-    writeFileSync(tmpFile, JSON.stringify({ workspaces: list }, null, 2));
-
-    // Windows 上 renameSync 可能会因为目标文件存在或被占用而失败。统一走 server/lib/file-api.js
-    // renameSyncWithRetry helper（同款重试策略，跟 interceptor / log-management 一致）。
-    renameSyncWithRetry(tmpFile, getWorkspacesFile());
-  } catch (err) {
-    console.error('[CC Viewer] Failed to save workspaces:', err.message);
-    // 尝试清理临时文件
-    try { unlinkSync(tmpFile); } catch { }
-  }
+// Full-list rewrite on every mutation; non-secret so no 0600 (mode:false → umask).
+// Atomicity + cross-process mutex come from mutateJson below.
+function _saveWorkspaces(list) {
+  return { workspaces: list };
 }
 
 // 失效 file-access-policy 的 allowlist roots 缓存。lazy import 避免循环依赖。
@@ -47,10 +29,10 @@ function _invalidatePolicyCache() {
 }
 
 export async function registerWorkspace(absolutePath) {
-  const result = await withFileLockAsync(getLockFile(), () => {
+  const result = await mutateJson(getWorkspacesFile(), (data) => {
     const resolvedPath = resolve(absolutePath);
     const projectName = basename(resolvedPath).replace(/[^a-zA-Z0-9_\-\.]/g, '_');
-    const list = loadWorkspaces();
+    const list = Array.isArray(data.workspaces) ? data.workspaces : [];
     // Windows NTFS 不分大小写——`C:\App` 跟 `c:\app` 是同目录但 `===` 视为不同。
     // 仅 Win 下小写化比较；POSIX 保持原样不引入回归。
     const pathEq = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
@@ -58,7 +40,7 @@ export async function registerWorkspace(absolutePath) {
     if (existing) {
       existing.lastUsed = new Date().toISOString();
       existing.projectName = projectName;
-      saveWorkspaces(list);
+      data.workspaces = list;
       return existing;
     }
     const now = new Date().toISOString();
@@ -70,27 +52,37 @@ export async function registerWorkspace(absolutePath) {
       createdAt: now,
     };
     list.push(entry);
-    saveWorkspaces(list);
+    data.workspaces = list;
     return entry;
-  }, { ensureDir: LOG_DIR });
+  }, { mode: false, fallback: {}, ensureDir: LOG_DIR });
   _invalidatePolicyCache();
   return result;
 }
 
 export async function removeWorkspace(id) {
-  const result = await withFileLockAsync(getLockFile(), () => {
-    const list = loadWorkspaces();
+  const result = await mutateJson(getWorkspacesFile(), (data) => {
+    const list = Array.isArray(data.workspaces) ? data.workspaces : [];
     const filtered = list.filter(w => w.id !== id);
     if (filtered.length !== list.length) {
-      saveWorkspaces(filtered);
+      data.workspaces = filtered;
       return true;
     }
     return false;
-  }, { ensureDir: LOG_DIR });
+  }, { mode: false, fallback: {}, ensureDir: LOG_DIR });
   if (result) _invalidatePolicyCache();
   return result;
 }
 
+// Legacy sync save entry kept for any direct caller: writes the full list atomically via the
+// kernel (non-secret → umask). mkdirSync is handled inside writeJsonAtomic.
+export function saveWorkspaces(list) {
+  try {
+    writeJsonAtomic(getWorkspacesFile(), _saveWorkspaces(list), { mode: false });
+  } catch (err) {
+    console.error('[CC Viewer] Failed to save workspaces:', err.message);
+  }
+}
+
 export async function getWorkspaces() {
   const list = loadWorkspaces();
   const enriched = await Promise.all(list.map(async (w) => {