cc-viewer 1.8.19 → 1.8.21

package/README.md

@@ -191,7 +191,7 @@ By default, remote (LAN) access requires the `?token=` query that ccv prints at
 * Remote devices opening the LAN URL (without a token) are shown a minimal password page; entering the correct password sets an `HttpOnly` cookie and the page refreshes into the app. The existing `?token=` URL keeps working in parallel.
 * An **empty password means no protection at all** — it is allowed, but the admin UI shows a clear security warning.
 * **Global default + per-project override:** by default one password covers every project. From the QR popover the admin can switch between **This project** and **Global** — set a project-specific password that overrides the global default for that project only, or remove the override to inherit the global setting again. (A disabled project override means "no protection for this project", which is different from removing it.)
-* The on/off state and password(s) are persisted alongside your other settings in cc-viewer's `preferences.json` — a global `auth` key plus an optional `authByProject` map (the password is base64-obfuscated, not stored as raw plaintext; file mode `0600`). The login cookie is tied to the per-launch token, so restarting ccv requires remote devices to log in again.
+* The on/off state is persisted alongside your other settings in cc-viewer's `preferences.json` — a global `auth` key plus an optional `authByProject` map (file mode `0600`). The password itself is **not** kept there: it is encrypted at rest (AES-256-GCM) in `credentials.json` under the same data root, with the machine-local key in `master.key` (both mode `0600`). The login cookie is tied to the per-launch token, so restarting ccv requires remote devices to log in again.
 
 ### Container / cloud deployment (remote admin)
 
@@ -205,6 +205,8 @@ cc-viewer works in a single container or on a cloud host where you reach the UI
 * **Security recommendations for a public/cloud deployment:** enable password login (or keep the random `?token=` URL secret), and put the instance behind a reverse proxy that terminates HTTPS. Persist the log/settings directory by mounting a volume at the path pointed to by `CCV_LOG_DIR` (default `~/.claude/cc-viewer`) so your preferences, auth password, and IM credentials survive container restarts.
 * **Reverse-proxy note:** access control is based on the socket peer address (`X-Forwarded-For` is deliberately not trusted, to prevent spoofing). This does not affect remote admins — they authenticate by token/password, not by IP. It only means "same-container" detection relies on a real loopback connection.
 
+* **Design doc:** how local config maps to a cloud database and the cloud-sync model (cloud-authoritative, local read-only fallback) is described in [Config Convergence & Cloud-Sync Advisory](./docs/config-cloud-sync.md) ([中文](./docs/config-cloud-sync.zh.md)). This is a proposal, not yet implemented.
+
 
 ### Model-specific system prompts
 

package/cli.js

@@ -19,6 +19,7 @@ import { normalizeBasePath } from './server/lib/base-path.js';
 import { mergeSettingsIntoArgs } from './server/lib/settings-merge.js';
 import { splitSdkLaunchArgs, resolveLaunchSystemPrompt, insertBeforeDashDash } from './server/lib/launch-config.js';
 import { createHardenedCleanup, installWinKeypressFallback } from './server/lib/term-signals.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 
@@ -552,7 +553,7 @@ async function runCliMode(extraClaudeArgs = [], cwd, noOpen = false) {
   }
 
   // 3. 启动 PTY 中的 claude
-  const { spawnClaude, killPty, onPtyExit } = await import('./server/pty-manager.js');
+  const { spawnClaude, killAllMain, onPtyExit } = await import('./server/pty-manager.js');
   const { isCodeFuseManagedEnvironment } = await import('./server/lib/codefuse-managed-mode.js');
   const codeFuseManaged = isCodeFuseManagedEnvironment();
   let managedExitCode = 0;
@@ -566,8 +567,20 @@ async function runCliMode(extraClaudeArgs = [], cwd, noOpen = false) {
       // cannot look like a second cleanup request and force the hardened 130 exit path.
       removeManagedExitListener?.();
       removeManagedExitListener = null;
-      killPty();
-      return serverMod.stopViewer();
+      // Kill ALL main PTYs, not just the active one — cross-project /resume keeps
+      // the previous project's main PTY alive, and it must not outlive this process
+      // as an orphan (node-pty children are session leaders; no OS cascade kill).
+      // killAllMain is idempotent and equals killPty() in the single-PTY case.
+      killAllMain();
+      // Reap scratch/resume children too — without this they outlive the main
+      // process as orphans (node-pty children are session leaders; the OS does
+      // not cascade-kill them). killAllScratch is idempotent.
+      return Promise.all([
+        serverMod.stopViewer(),
+        import('./server/scratch-pty-manager.js')
+          .then(({ killAllScratch }) => killAllScratch())
+          .catch((e) => reportSwallowed('cli.cleanup.scratch', e)),
+      ]);
     },
     exit: (code) => process.exit(code ?? managedExitCode),
   });
@@ -589,6 +602,16 @@ async function runCliMode(extraClaudeArgs = [], cwd, noOpen = false) {
     process.exit(1);
   }
 
+  // Keep the launcher-verified executable available to later workspace launches
+  // (POST /api/workspaces/launch → deps.workspaceClaudePath). Without this the
+  // route falls back to resolveNativePath(), which can pick a DIFFERENT binary
+  // than the one just spawned (e.g. the npm global build instead of the
+  // CodeFuse-managed one) — on managed machines that binary is SIGKILLed on
+  // exec, so a [+] project launch dies instantly (the "terminal loads history
+  // but claude never starts" bug). Restores the wiring dropped in f209f508.
+  serverMod.setWorkspaceClaudeArgs(extraClaudeArgs);
+  serverMod.setWorkspaceClaudePath(claudePath, isNpmVersion);
+
   // 4. 自动打开浏览器
   const protocol = serverMod.getProtocol();
   const basePath = normalizeBasePath(process.env.CCV_BASE_PATH);
@@ -898,7 +921,13 @@ async function runSdkMode(extraClaudeArgs = [], cwd, noOpen = false) {
   const cleanup = createHardenedCleanup({
     doCleanup: () => {
       sdkManager.stopSession();
-      return serverMod.stopViewer();
+      // Reap scratch/resume children (see runCliMode cleanup); idempotent.
+      return Promise.all([
+        serverMod.stopViewer(),
+        import('./server/scratch-pty-manager.js')
+          .then(({ killAllScratch }) => killAllScratch())
+          .catch((e) => reportSwallowed('cli.cleanup.scratch', e)),
+      ]);
     },
   });
   process.on('SIGINT', cleanup);