cc-viewer 1.8.19 → 1.8.21

package/server/routes/ask-perm.js

@@ -2,6 +2,8 @@
 import { loadAskStore, consumeIfFinal as askStoreConsumeIfFinal, markCancelled as askStoreMarkCancelled } from '../lib/ask/ask-store.js';
 import { runWaterfallHook, runParallelHook } from '../lib/plugin-loader.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
+import { filterClientsByViewProject } from '../lib/v2/view-router.js';
+import { _projectName } from '../interceptor.js';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {
@@ -512,13 +514,31 @@ function streamChunk(req, res, parsedUrl, isLocal, deps) {
       }
       // 用 named event 'stream-progress' 避免混入 data: 流与 dedup 冲突
       // 精简 payload：前端只需要 timestamp/url/content 渲染 Live overlay
+      // Multi-project (2026-10): stamp the SOURCE project so the broadcast can
+      // be routed only to clients VIEWING that project — an unfiltered
+      // broadcast let project A's typewriter render inside project B's view
+      // (the SSE cross-project bleed). `entry._resumeProject` is the emitting
+      // claude's own project (self-reported via x-ccv-project-dir); absent ⇒
+      // the bound project (legacy no-header producer).
+      const sourceProject = (typeof entry._resumeProject === 'string' && entry._resumeProject)
+        ? entry._resumeProject
+        : (_projectName || '');
       const _streamChunkPayload = {
         timestamp: entry.timestamp,
         url: entry.url,
         content: entry.response?.body?.content || [],
         model: entry.body?.model,
+        // B3 (multi-session view-attach): relay the session uuid so an attached
+        // client can drop the other session's typewriter. Additive — older clients
+        // ignore it.
+        sessionId: typeof entry.sessionId === 'string' ? entry.sessionId : null,
+        project: sourceProject,
       };
-      sendEventToClients(deps.clients, 'stream-progress', _streamChunkPayload);
+      sendEventToClients(
+        filterClientsByViewProject(deps.clients, sourceProject, _projectName || ''),
+        'stream-progress',
+        _streamChunkPayload,
+      );
       runParallelHook('onStreamChunk', _streamChunkPayload);
     } catch {}
     try { res.writeHead(204); res.end(); } catch {}

package/server/routes/auth.js

@@ -39,10 +39,13 @@ function buildState(deps, isLocal, isAdmin) {
     enabled: s.effective.enabled,
     isAdmin,
     password: isLocal ? s.effective.password : null,
+    // Surface the fail-closed signal so the admin UI can disable the password field and explain
+    // why a save would be refused (see the 409 PASSWORD_UNREADABLE branch in authConfigPost).
+    passwordUnreadable: !!s.effective.passwordUnreadable,
     scope: s.scope,                       // 'project' | 'global' — which one is in effect
     hasProjectOverride: s.hasProjectOverride,
     projectDir: s.projectDir,             // null when not project-scoped (non-CLI mode)
-    global: { enabled: s.global.enabled, password: isLocal ? s.global.password : null },
+    global: { enabled: s.global.enabled, password: isLocal ? s.global.password : null, passwordUnreadable: !!s.global.passwordUnreadable },
   };
 }
 
@@ -117,6 +120,23 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     const cur = scope === 'global'
       ? state.global
       : (state.hasProjectOverride ? state.effective : { enabled: false, password: '' });
+    // Fail-closed: the current scope's vault password exists but is UNREADABLE (lost master.key /
+    // tampered ciphertext). cur.password has collapsed to '' for the gate, but the real ciphertext
+    // must NOT be destroyed. Refuse any save that would overwrite/clear it — including the
+    // auto-generate-on-enable path (next.password is '' here) and any edit-and-save (which would
+    // delete/replace the unreadable entry). The admin recovers by restoring master.key, not by a
+    // save that silently wipes the previous secret.
+    // Read the flag from the SAME scope object as `cur` — a global-unreadable password must NOT
+    // refuse a save whose target is a fresh project override (a different vault ref).
+    const curUnreadable = !!cur.passwordUnreadable;
+    if (curUnreadable) {
+      res.writeHead(409, JSON_HEADERS);
+      res.end(JSON.stringify({
+        error: 'LAN password is stored in the credential vault but is currently unreadable (lost master.key or corrupt credentials.json). Refusing to overwrite it. Restore master.key to recover, or clear the vault entry first.',
+        code: 'PASSWORD_UNREADABLE',
+      }));
+      return;
+    }
     const next = { enabled: cur.enabled, password: cur.password };
     if (typeof incoming.enabled === 'boolean') next.enabled = incoming.enabled;
     const passwordProvided = typeof incoming.password === 'string';

package/server/routes/events.js

@@ -9,6 +9,9 @@ import { reportSwallowed } from '@ccv/core/error-report';
 import { sseHead, sseWrite, needsDrain, wireEnd, awaitWireDrain, isWireV3Enabled } from '../lib/wire-compress.js';
 import { readV2ColdBundle } from '../lib/v2/meta-rows.js';
 import { readV2SingleEntry } from '../lib/v2/adapter.js';
+import { resolveSessionDirName, latestMainSessionDir } from '../lib/v2/session-select.js';
+import { sanitizePathComponent, normalizeSessionCwd } from '../lib/v2/layout.js';
+import { listLivePtys } from '../pty-manager.js';
 import { enrichRawIfNeeded } from '../lib/enrich-plan-input.js';
 import { validateLogPath } from '../lib/log-management.js';
 import { isMainAgentEntry, extractCachedContent } from '../lib/kv-cache-analyzer.js';
@@ -188,12 +191,15 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   const updFrame = sseUpdateBadgeFrame(deps.pendingMajorUpdate);
   if (updFrame) sseWrite(res, updFrame);
 
-  // 1.7.0 迁移引导（P2）：当前项目仍有未转换的 v1 日志 → 连接即推 migrate_prompt。
+  // 1.7.0 迁移引导（P2）：「正在被查看的项目」仍有未转换的 v1 日志 → 连接即推 migrate_prompt。
   // 是否弹窗由客户端决定（「不再提醒」偏好在客户端；continued=true 时无视 dismissed
   // 再提醒一次——`-c` 续接的对话前半段在旧格式里，不迁移就看不到）。工作区切换后的
-  // 提示由 workspaces launch 路由对存量连接广播（本帧只覆盖新连接）。
+  // 提示由 workspaces launch 路由对存量连接广播（本帧只覆盖新连接）。viewedProject
+  // (declared below from ?project=) scopes the check to the project the client is
+  // actually viewing, not always the bound one.
   try {
-    const mig = migrationStatus(LOG_DIR, _projectName || '');
+    const migProject = parsedUrl.searchParams.get('project') || _projectName || '';
+    const mig = migrationStatus(LOG_DIR, migProject);
     if (mig.pending) {
       sseWrite(res, `event: migrate_prompt\ndata: ${JSON.stringify({ ...mig, continued: isContinuedLaunch() })}\n\n`);
     }
@@ -203,8 +209,15 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   const sinceParam = parsedUrl.searchParams.get('since');
   const ccParam = parseInt(parsedUrl.searchParams.get('cc'), 10) || 0;
   const projectParam = parsedUrl.searchParams.get('project');
-  const projectMatch = !projectParam || projectParam === (_projectName || '');
-  const useIncremental = !!(sinceParam && ccParam > 0 && projectMatch && !isNaN(new Date(sinceParam).getTime()));
+  // Multi-project (2026-10): a foreign `?project=` (a parallel-project VIEW)
+  // may ALSO resume incrementally — the view-state cache keeps the departing
+  // project's lastTs and the client returns with `?project=<p>&since=<lastTs>`.
+  // The previous `projectMatch` gate forced a full cold reload for any
+  // non-bound project (the "slow switch" half of the bug). `?project` already
+  // self-declares the view scope, and the cold-source resolution below serves
+  // that project's current session read-only without re-binding the server —
+  // so the bound-match condition is dropped (cc>0 + a valid date still guard).
+  const useIncremental = !!(sinceParam && ccParam > 0 && !isNaN(new Date(sinceParam).getTime()));
 
   // 分页参数：
   // - mobile 首次加载传 ?limit=200
@@ -223,6 +236,102 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   }
   const useLimit = effectiveLimit > 0;
 
+  // Cold-load source resolution. Two view scopes, both read-only and NEITHER
+  // re-binds the server (the bound project `_projectName` is untouched):
+  //  - `?sid=<uuid>`: THAT session's full transcript (incl. pre-attach history)
+  //    instead of the single "current" session dir. `?project=<p>` scopes the
+  //    sid lookup to project <p>'s dir; without it the lookup scans the bound
+  //    project and a foreign sid resolves to null.
+  //  - `?project=<p>` (no sid): project <p>'s CURRENT session — the newest
+  //    readable, non-teammate session with a main turn — so a parallel-project
+  //    chip can be VIEWED without respawning or killing its process.
+  const sidParamRaw = parsedUrl.searchParams.get('sid');
+  const sidParam = (typeof sidParamRaw === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sidParamRaw)) ? sidParamRaw : null;
+  // Multi-instance (2026-10-06): `?instance=<instanceKey>` narrows the view to ONE concurrent
+  // process of a same-cwd project (which otherwise share a basename session dir pool). It
+  // scopes the no-sid cold-load pick (each instance resolves to ITS OWN latest session) and is
+  // stamped on the SSE response so the per-project live feed can route to exactly the clients
+  // viewing that instance. Validated to the minted `ccv-<hex>` shape.
+  const instanceParamRaw = parsedUrl.searchParams.get('instance');
+  const instanceParam = (typeof instanceParamRaw === 'string' && /^ccv-[0-9a-f]+$/.test(instanceParamRaw)) ? instanceParamRaw : null;
+  // `projectParam` (declared above for the incremental guard) doubles as the view
+  // scope. The project this client is VIEWING: the explicit ?project= override,
+  // else the bound project. Stamped onto the SSE response so per-project feeds can
+  // route live entries to exactly the clients viewing that project.
+  const viewedProject = projectParam || (_projectName || '');
+  const resolveColdSource = () => {
+    if (sidParam) {
+      const project = projectParam || _projectName;
+      if (!project) return null;
+      try {
+        const projectDir = join(LOG_DIR, sanitizePathComponent(project));
+        const dirName = resolveSessionDirName(projectDir, sidParam);
+        return dirName ? join(projectDir, 'sessions', dirName) : null;
+      } catch (err) {
+        reportSwallowed('events.sid-resolve', err, { sid: sidParam });
+        return null;
+      }
+    }
+    // No sid: a foreign ?project= resolves to that project's current session
+    // (skipForeignLive honors multi-window isolation, same as getLiveLogSource's
+    // fallback). When it matches the bound project (or is absent) the standard
+    // live source already serves exactly this — return null to take that path.
+    // Multi-instance (2026-10-06): an explicit `?instance=` ALSO drives a cold-source pick even
+    // when the project IS the bound one — a second same-cwd instance must cold-load ITS OWN
+    // latest session, not the bound project's `_currentSid` (which the most-recent instance
+    // overwrites). Without this branch the instance filter was unreachable for the bound
+    // project and the first paint showed the OTHER instance's conversation.
+    if (projectParam && (projectParam !== (_projectName || '') || instanceParam)) {
+      try {
+        // Same-name isolation (2026-10-07): resolve the TARGET instance's owning cwd so the
+        // cold-load fallback can be scoped to it (two cross-dir same-basename projects share
+        // this basename pool). The live PTY record's cwd is the same spawn cwd the writer
+        // stamped into meta.cwd (its `s.cwd`) — so compare after the same lexical normalize.
+        // Instance dead / no live record / lookup failure → '' → no cwd filter
+        // (conservative, identical to today's whole-pool fallback; never mis-excludes history).
+        let targetCwd = '';
+        if (instanceParam) {
+          try {
+            const rec = listLivePtys().find((p) => p && p.instanceKey === instanceParam);
+            targetCwd = rec && rec.cwd ? normalizeSessionCwd(rec.cwd) : '';
+          } catch (err) { targetCwd = ''; reportSwallowed('events.target-cwd', err); }
+        }
+        return latestMainSessionDir(join(LOG_DIR, sanitizePathComponent(projectParam)), { skipForeignLive: true, instanceKey: instanceParam || '', targetCwd }) || null;
+      } catch (err) {
+        reportSwallowed('events.project-resolve', err, { project: projectParam });
+        return null;
+      }
+    }
+    return null;
+  };
+  const viewColdDir = resolveColdSource();
+  // Silent-fallback guard (design: never silently fall back). A `?sid=<uuid>`
+  // that resolves to null (the session dir was /clear-pruned or quota-cleaned)
+  // must NOT fall through to the live current session while the client believes
+  // it attached — tell the client explicitly so it can toast + auto-detach.
+  const sidNotFound = !!(sidParam && !viewColdDir);
+  if (sidNotFound) {
+    try { sseWrite(res, `event: sid-not-found\ndata: ${JSON.stringify({ sid: sidParam, ts: Date.now() })}\n\n`); } catch { }
+  }
+  // Multi-instance (2026-10-06): an explicit `?instance=` that resolves to NO session dir must
+  // likewise NOT silently fall through to the bound project's current session (the instance
+  // filter excludes legacy/other-instance dirs, so an empty result would otherwise show the
+  // WRONG project's/instance's conversation). Tell the client explicitly (same posture as
+  // sid-not-found) so it can surface an empty state instead of cross-project bleed.
+  const instanceNotFound = !!(instanceParam && !sidParam && !viewColdDir);
+  if (instanceNotFound) {
+    try { sseWrite(res, `event: sid-not-found\ndata: ${JSON.stringify({ sid: null, instance: instanceParam, reason: 'instance-no-session', ts: Date.now() })}\n\n`); } catch { }
+  }
+  // When a view-scoped dir was requested AND resolved, it replaces the live-source
+  // cold load; otherwise fall back to the standard single-current-session source.
+  const coldSource = viewColdDir || null;
+  // A client viewing a non-bound project needs that project's live feed running
+  // (its PTY is alive but its feed is lazy). Start it idempotently; the feed's
+  // per-project client filter keeps its entries scoped to this project's viewers.
+  if (viewedProject && viewedProject !== (_projectName || '') && typeof deps.ensureProjectFeed === 'function') {
+    try { deps.ensureProjectFeed(viewedProject); } catch (err) { reportSwallowed('events.ensure-feed', err, { project: viewedProject }); }
+  }
+
   // KV-Cache / context_window 追踪（扫描全量条目，不受 since 过滤影响）
   let latestKvCache = null;
   let latestContextWindow = null;
@@ -243,7 +352,7 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   // Wire v3 (V3.S5): flagged + v2 source ⇒ the legacy full-entry cold stream
   // is REPLACED by rows + native lines (the byte win); the client assembler
   // rebuilds entries locally. v1 legacy files keep the entry pipeline.
-  const _v3Src = deps.wireV3 ? getLiveLogSource() : null;
+  const _v3Src = deps.wireV3 ? (coldSource || getLiveLogSource()) : null;
   const v3Cold = !!(_v3Src && existsSync(join(_v3Src, 'journal.jsonl')));
 
   // S6b: the cold-load source is the current v2 session dir when the v2
@@ -252,7 +361,7 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   // in-flight placeholder, which the client batch gate still blocks — the
   // previous conversation is the better cold load there (interceptor.js
   // getLiveLogSource header comment).
-  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(getLiveLogSource({ serveInFlight: !!deps.wireV3 }), async (raw) => {
+  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(coldSource || getLiveLogSource({ serveInFlight: !!deps.wireV3 }), async (raw) => {
     // 直接发送原始 JSON 字符串，不做 parse/reconstruct/stringify
     // ExitPlanMode V2 空 input 的条目按需补全 plan / planFilePath，其它原样透传
     if (res.destroyed || !res.writable) return;
@@ -412,6 +521,13 @@ async function events(req, res, parsedUrl, isLocal, deps) {
 
   // 历史数据 + KV-Cache + context_window 全部发送完毕后，才将客户端加入广播列表。
   // 这样 watcher 的 sendToClients 不会在 load 阶段向该客户端推送 live entry。
+  // Stamp the viewed project so per-project feeds route live entries to exactly
+  // the clients viewing that project (unset ⇒ the bound project, the default).
+  if (viewedProject) res._ccvViewProject = viewedProject;
+  // Multi-instance: stamp the viewed instance too, so a same-cwd project's live feed can
+  // route each instance's entries to exactly the clients viewing THAT instance (unset ⇒
+  // instance-agnostic, the pre-multi-instance default).
+  if (instanceParam) res._ccvViewInstance = instanceParam;
   deps.clients.push(res);
 
   // 任务清单快照补推：内存态不在冷加载数据里，页面刷新/重连后横条要等下一次

package/server/routes/expert.js

@@ -38,6 +38,46 @@ async function resolveDir(deps) {
   return deps.isWorkspaceMode ? null : process.cwd();
 }
 
+// Multi-project (2026-10): expert GET routes resolve the viewed project ONLY
+// when ?project= is present (resolveViewRoot). Absent it they fall back to the
+// legacy resolveDir chain (live cwd > CCV_PROJECT_DIR > null-in-workspace-mode)
+// — the workspaceMode "no active workspace ⇒ null" contract is preserved
+// verbatim. POST routes keep the bound resolveDir (writes stay bound).
+async function _viewRootOrReply(req, res, parsedUrl, deps) {
+  const projectParam = parsedUrl?.searchParams?.get('project');
+  const instanceParam = parsedUrl?.searchParams?.get('instance');
+  if (!projectParam && !instanceParam) return resolveDir(deps);
+  const { resolveViewRoot } = await import('../lib/view-root.js');
+  const { loadWorkspaces } = await import('../workspace-registry.js');
+  const { listLivePtys } = await import('../pty-manager.js');
+  const r = resolveViewRoot({
+    projectParam,
+    instanceParam,
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+  });
+  if (!r.ok) {
+    sendJson(res, r.status, { error: r.error });
+    return null;
+  }
+  return r.root;
+}
+
+async function getSystemText(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const dir = await _viewRootOrReply(req, res, parsedUrl, deps);
+    // Legacy no-active-workspace surface: dir=null → readWorkspaceSystemText
+    // returns the empty append surface (active=false) — not an error.
+    const { mode, text } = readWorkspaceSystemText(dir);
+    sendJson(res, 200, { dir: dir || null, active: !!dir, mode, text });
+  } catch (e) {
+    // 原始 fs 错误只落服务端日志，对外返回通用错误码(不外泄绝对路径/系统细节)。
+    console.error('[CC Viewer] expert system-text GET failed:', e.message);
+    sendJson(res, 500, { error: 'read_failed' });
+  }
+}
+
 function sendJson(res, code, obj) {
   if (res.headersSent) return;
   try {
@@ -102,18 +142,6 @@ function computeSystemPromptStatus(dir) {
   return out;
 }
 
-async function getSystemText(req, res, parsedUrl, isLocal, deps) {
-  try {
-    const dir = await resolveDir(deps);
-    const { mode, text } = readWorkspaceSystemText(dir);
-    sendJson(res, 200, { dir: dir || null, active: !!dir, mode, text });
-  } catch (e) {
-    // 原始 fs 错误只落服务端日志，对外返回通用错误码(不外泄绝对路径/系统细节)。
-    console.error('[CC Viewer] expert system-text GET failed:', e.message);
-    sendJson(res, 500, { error: 'read_failed' });
-  }
-}
-
 function postSystemText(req, res, parsedUrl, isLocal, deps) {
   let body = '';
   let truncated = false;
@@ -158,7 +186,9 @@ function collectModelEntries(dir) {
 
 async function getModelPrompts(req, res, parsedUrl, isLocal, deps) {
   try {
-    const dir = await resolveDir(deps);
+    const dir = await _viewRootOrReply(req, res, parsedUrl, deps);
+    // dir=null（无活动工作区）不是错误：照常渲染 workspaceActive:false + 全局条目
+    //（与改动前 resolveDir 返回 null 的路径逐字节一致）。
     const globalDir = join(LOG_DIR, MODEL_PROMPT_DIR);
     const status = computeSystemPromptStatus(dir);
     // 内置 preset 条目（默认生效层）：text 为 renderPresetTemplate 输出（边界已剥离），
@@ -195,7 +225,9 @@ async function getModelPrompts(req, res, parsedUrl, isLocal, deps) {
 // 轻量状态查询(不内联提示词文本)：头部工具栏据此决定是否自动露出「系统提示词修改」入口。
 async function getSystemPromptStatus(req, res, parsedUrl, isLocal, deps) {
   try {
-    const dir = await resolveDir(deps);
+    const dir = await _viewRootOrReply(req, res, parsedUrl, deps);
+    // dir=null（无活动工作区）不是错误：computeSystemPromptStatus 容忍 null
+    //（旧 resolveDir 返回 null 的路径照常渲染全局命中）。
     sendJson(res, 200, computeSystemPromptStatus(dir));
   } catch (e) {
     console.error('[CC Viewer] expert system-prompt-status GET failed:', e.message);

package/server/routes/files-content.js

@@ -3,11 +3,27 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathS
 import { join, basename, dirname, resolve, sep } from 'node:path';
 import { isReadAllowed, reasonToStatus } from '../lib/file-access-policy.js';
 import { ERROR_STATUS_MAP } from '../lib/file-api.js';
+import { viewRootOrReply } from '../lib/view-root.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
 import { reportSwallowed } from '@ccv/core/error-report';
 import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-discovery.js';
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
 
+// Multi-project (2026-10): project-scoped READ routes resolve the viewed
+// project via the shared viewRootOrReply (?project=). WRITE routes keep the
+// bound root. SYNCHRONOUS: these handlers were sync before multi-project, and
+// their tests (and the dispatcher's sync-call convention) assert on res
+// immediately after the call — the override must not async-ify them.
+function _viewRootOrReply(req, res, parsedUrl) {
+  return viewRootOrReply(req, res, parsedUrl, {
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+  });
+}
+
 // file-raw 扩展名 → MIME 映射。图片走 <img> 预览;html 走 iframe 预览(带下方 CSP sandbox);
 // 其余为 HTML 预览的同目录子资源(c8/nyc/lcov-genhtml 等静态报告):CSP sandbox 使文档
 // 处于 opaque origin,对一切子资源都是跨源——跨源样式表受浏览器严格 MIME 校验,
@@ -84,7 +100,12 @@ function planFile(req, res, parsedUrl) {
 
 function fileContentGet(req, res, parsedUrl) {
   const reqPath = parsedUrl.searchParams.get('path');
-  const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  const cwd = _viewRootOrReply(req, res, parsedUrl);
+  if (!cwd) return;
+  fileContentGetWithRoot(req, res, parsedUrl, reqPath, cwd);
+}
+
+function fileContentGetWithRoot(req, res, parsedUrl, reqPath, cwd) {
   try {
     if (!reqPath) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -143,10 +164,30 @@ function projectMemory(req, res, parsedUrl) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+  projectMemoryEntry(req, res, parsedUrl, respondJson);
+}
+
+// The entry wraps BOTH the view-root resolution and the read in the endpoint's
+// single error surface (the searchParams-throw defense test asserts a 500 from
+// THIS catch, regardless of which stage throws).
+function projectMemoryEntry(req, res, parsedUrl, respondJson) {
   try {
-    const cwdRaw = process.env.CCV_PROJECT_DIR || process.cwd();
-    const cwd = cwdRaw.replace(/[/\\]+$/, '');
-    const encoded = cwd.replace(/[^a-zA-Z0-9-]/g, '-');
+    const cwd = _viewRootOrReply(req, res, parsedUrl);
+    if (!cwd) return;
+    projectMemoryWithRoot(req, res, parsedUrl, respondJson, cwd);
+  } catch (err) {
+    // 与 /api/file-content 一致：已知 errno（ENOENT/EACCES 等）走 ERROR_STATUS_MAP 映射；
+    // 500 时不回显 err.message —— 可能含 ~/.claude/projects/<encoded>/memory/ 路径片段。
+    const status = ERROR_STATUS_MAP[err.code] || 500;
+    const message = status === 500 ? 'Internal error' : err.message;
+    respondJson(status, { error: message });
+  }
+}
+
+function projectMemoryWithRoot(req, res, parsedUrl, respondJson, cwd) {
+  try {
+    const cwdClean = cwd.replace(/[/\\]+$/, '');
+    const encoded = cwdClean.replace(/[^a-zA-Z0-9-]/g, '-');
     const dir = join(getClaudeConfigDir(), 'projects', encoded, 'memory');
     const fileParam = parsedUrl.searchParams.get('file');
     const MAX_BYTES = 512 * 1024;
@@ -205,8 +246,22 @@ function claudeMd(req, res, parsedUrl) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
   };
+  // The entry wraps BOTH the view-root resolution and the read in the
+  // endpoint's single error surface (the searchParams-throw defense test
+  // asserts a 500 from THIS catch, regardless of which stage throws).
+  try {
+    const cwd = _viewRootOrReply(req, res, parsedUrl);
+    if (!cwd) return;
+    claudeMdWithRoot(req, res, parsedUrl, respondJson, cwd);
+  } catch (err) {
+    const status = ERROR_STATUS_MAP[err.code] || 500;
+    const message = status === 500 ? 'Internal error' : err.message;
+    respondJson(status, { error: message });
+  }
+}
+
+function claudeMdWithRoot(req, res, parsedUrl, respondJson, cwd) {
   try {
-    const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
     const claudeConfigDir = getClaudeConfigDir();
     // 注入 isReadAllowed 做发现阶段预过滤: 不在 allowlist 内的祖先候选不进列表 ——
     // 否则 UI 会渲染出点击必 403 的"看得见点不开"chip。
@@ -262,7 +317,12 @@ function fileRaw(req, res, parsedUrl) {
   } else {
     reqPath = parsedUrl.searchParams.get('path');
   }
-  const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  const cwd = _viewRootOrReply(req, res, parsedUrl);
+  if (!cwd) return;
+  fileRawWithRoot(req, res, parsedUrl, reqPath, cwd, method);
+}
+
+function fileRawWithRoot(req, res, parsedUrl, reqPath, cwd, method) {
   try {
     if (!reqPath) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -336,7 +396,12 @@ function fileRaw(req, res, parsedUrl) {
 // No size cap — a download is precisely the path for files too large to preview.
 function fileDownload(req, res, parsedUrl) {
   const reqPath = parsedUrl.searchParams.get('path');
-  const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  const cwd = _viewRootOrReply(req, res, parsedUrl);
+  if (!cwd) return;
+  fileDownloadWithRoot(req, res, parsedUrl, reqPath, cwd);
+}
+
+function fileDownloadWithRoot(req, res, parsedUrl, reqPath, cwd) {
   try {
     if (!reqPath) {
       res.writeHead(400, { 'Content-Type': 'application/json' });

package/server/routes/files-fs.js

@@ -8,9 +8,27 @@ import { homedir, tmpdir } from 'node:os';
 import { execFile, spawn } from 'node:child_process';
 import { bumpWorkspacesVersion, isReadAllowed } from '../lib/file-access-policy.js';
 import { validateImportDir } from '../lib/file-api.js';
+import { viewRootOrReply } from '../lib/view-root.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
 import { PROFILE_PATH, _projectName, _logDir } from '../interceptor.js';
 import { LOG_DIR, getClaudeConfigDir } from '../../findcc.js';
 
+// Multi-project (2026-10): project-scoped READ routes resolve the viewed
+// project via the shared viewRootOrReply (?project=, or POST body {project}
+// for the body-carrying read probes). WRITE routes keep the bound root.
+// SYNCHRONOUS: the affected handlers were sync before multi-project and their
+// tests assert on res immediately after the call.
+function _viewRootOrReply(req, res, parsedUrl, bodyProject, bodyInstance) {
+  return viewRootOrReply(req, res, parsedUrl, {
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+    bodyProject,
+    bodyInstance,
+  });
+}
+
 function upload(req, res, parsedUrl, isLocal, deps) {
   const contentType = req.headers['content-type'] || '';
   const boundaryMatch = contentType.match(/boundary=(.+)/);
@@ -245,7 +263,8 @@ async function files(req, res, parsedUrl, isLocal, deps) {
     res.end(JSON.stringify({ error: 'Invalid path' }));
     return;
   }
-  const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  const cwd = _viewRootOrReply(req, res, parsedUrl);
+  if (!cwd) return;
   const targetDir = join(cwd, reqPath);
   try {
     const entries = readdirSync(targetDir, { withFileTypes: true });
@@ -636,7 +655,7 @@ function openFile(req, res, parsedUrl, isLocal, deps) {
 function resolvePath(req, res, parsedUrl, isLocal, deps) {
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
-  req.on('end', () => {
+  req.on('end', async () => {
     let parsed;
     try { parsed = JSON.parse(body); } catch {
       res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -650,6 +669,11 @@ function resolvePath(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
+      // resolve-path is an internal UI helper (resolve a relative path against
+      // the project root for reveal/open actions). It stays BOUND-only (review
+      // P2-5): resolving a foreign project's root and echoing its absolute path
+      // back would make this endpoint a weak path-leak oracle for projects the
+      // caller is not viewing.
       const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
       const fullPath = relPath ? join(cwd, relPath) : cwd;
       res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -709,7 +733,8 @@ function filesExists(req, res, parsedUrl, isLocal, deps) {
         return;
       }
     }
-    const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+    const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+    if (!cwd) return;
     const results = paths.map(p => ({ path: p, exists: probeFileExists(p, cwd) }));
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ results }));

package/server/routes/git.js

@@ -2,12 +2,32 @@
 import { existsSync, readdirSync, realpathSync } from 'node:fs';
 import { join, basename, resolve, sep } from 'node:path';
 import { getGitDiffs, countUntrackedLines, getUnpushedCommits, isValidCommitHash } from '../lib/git-diff.js';
+import { viewRootOrReply } from '../lib/view-root.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
 
 const GIT_RESTORE_LOCK_CLEANUP_MS = 30000;
 
-function gitRepos(req, res) {
+// Multi-project (2026-10): git READ routes resolve the viewed project via the
+// shared viewRootOrReply (?project=) and pass it as resolveRepoCwd's baseDir.
+// git-restore (destructive) keeps the bound root. SYNCHRONOUS: gitRepos was
+// sync before multi-project and its tests assert on res immediately.
+function _viewRootOrReply(req, res, parsedUrl) {
+  return viewRootOrReply(req, res, parsedUrl, {
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+  });
+}
+
+function gitRepos(req, res, parsedUrl) {
+  const projectDir = _viewRootOrReply(req, res, parsedUrl || new URL(req.url, 'http://localhost'));
+  if (!projectDir) return;
+  gitReposWithRoot(req, res, projectDir);
+}
+
+function gitReposWithRoot(req, res, projectDir) {
   try {
-    const projectDir = process.env.CCV_PROJECT_DIR || process.cwd();
     const repos = [];
     if (existsSync(join(projectDir, '.git'))) {
       repos.push({ name: basename(projectDir), path: '.', isRoot: true });
@@ -102,7 +122,9 @@ function gitRestore(req, res, parsedUrl, isLocal, deps) {
 async function gitStatus(req, res, parsedUrl, isLocal, deps) {
   try {
     const repoParam = parsedUrl.searchParams.get('repo');
-    const cwd = deps.resolveRepoCwd(repoParam);
+    const viewRoot = _viewRootOrReply(req, res, parsedUrl);
+    if (!viewRoot) return;
+    const cwd = deps.resolveRepoCwd(repoParam, viewRoot);
     if (!cwd) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'Invalid repo parameter', changes: [] }));
@@ -173,7 +195,9 @@ async function gitStatus(req, res, parsedUrl, isLocal, deps) {
 async function gitDiff(req, res, parsedUrl, isLocal, deps) {
   try {
     const repoParam = parsedUrl.searchParams.get('repo');
-    const cwd = deps.resolveRepoCwd(repoParam);
+    const viewRoot = _viewRootOrReply(req, res, parsedUrl);
+    if (!viewRoot) return;
+    const cwd = deps.resolveRepoCwd(repoParam, viewRoot);
     if (!cwd) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'Invalid repo parameter', diffs: [] }));
@@ -204,7 +228,9 @@ async function gitDiff(req, res, parsedUrl, isLocal, deps) {
 async function gitLogUnpushed(req, res, parsedUrl, isLocal, deps) {
   try {
     const repoParam = parsedUrl.searchParams.get('repo');
-    const cwd = deps.resolveRepoCwd(repoParam);
+    const viewRoot = _viewRootOrReply(req, res, parsedUrl);
+    if (!viewRoot) return;
+    const cwd = deps.resolveRepoCwd(repoParam, viewRoot);
     if (!cwd) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'Invalid repo parameter', commits: [], hasUpstream: false }));