cc-viewer 1.8.19 → 1.8.21

package/server/routes/v2.js

@@ -44,7 +44,12 @@ async function v2Entry(req, res, parsedUrl) {
     sseWrite(res, `{"entry":${result.entry},"prevMain":${result.prevMain ?? 'null'}}`);
     wireEnd(res);
   } catch (err) {
-    console.error('[v2-entry]', file, err && err.stack || err);
+    // A NOT_FOUND here is routine, not an error: the detail-fetch target (a v3
+    // row's session dir) was quota-pruned or /clear-cleaned after the list was
+    // rendered. The 404 is the correct, sufficient response — logging it to
+    // stderr as a stack would be pure noise. Only genuine faults (validation
+    // bugs, mid-stream I/O errors) are worth the console.
+    if (err.code !== 'NOT_FOUND') console.error('[v2-entry]', file, err && err.stack || err);
     if (!res.headersSent) {
       const status = err.code === 'NOT_FOUND' ? 404 : err.code === 'ACCESS_DENIED' ? 403 : 500;
       res.writeHead(status, { 'Content-Type': 'application/json' });

package/server/routes/workspaces.js

@@ -82,8 +82,12 @@ function workspacesLaunch(req, res, parsedUrl, isLocal, deps) {
       // 启动 PTY
       const proxyPort = process.env.CCV_PROXY_PORT;
       if (proxyPort) {
-        const { spawnClaude } = await import('../pty-manager.js');
-        await spawnClaude(parseInt(proxyPort), wsPath, mergedArgs, deps.workspaceClaudePath, deps.workspaceIsNpmVersion, deps.actualPort, deps.protocol, deps.INTERNAL_TOKEN);
+        // Multi-instance (2026-10-06): spawnClaude now mints a fresh instanceKey per call and
+        // no longer kills an existing same-cwd record, so re-launching an ALREADY-LIVE cwd
+        // here would silently start a duplicate claude. ensurePtyForCwd restores the intended
+        // "re-open = reuse" semantics: attach to the live record instead of re-spawning.
+        const { ensurePtyForCwd } = await import('../pty-manager.js');
+        await ensurePtyForCwd({ cwd: wsPath, proxyPort: parseInt(proxyPort), extraArgs: mergedArgs, claudePath: deps.workspaceClaudePath, isNpmVersion: deps.workspaceIsNpmVersion, serverPort: deps.actualPort, serverProtocol: deps.protocol, internalToken: deps.INTERNAL_TOKEN });
       }
 
       deps.setWorkspaceLaunched(true);
@@ -171,7 +175,10 @@ function workspacesDelete(req, res, parsedUrl) {
 
 function workspacesStop(req, res, parsedUrl, isLocal, deps) {
   Promise.all([
-    import('../pty-manager.js').then(({ killPty }) => killPty()),
+    // killAllMain (not killPty): a cross-project /resume takeover can leave a background
+    // project's PTY alive; stop must reap every main PTY, not just the active one, or the
+    // old project's claude leaks past the workspace session.
+    import('../pty-manager.js').then(({ killAllMain }) => killAllMain()),
     import('../scratch-pty-manager.js').then(({ killAllScratch }) => killAllScratch()).catch(() => {}),
   ]).then(() => {
     // 接续原有清理流程

package/server/server.js

@@ -40,6 +40,7 @@ import { teamRoutes } from './routes/team.js';
 import { authRoutes } from './routes/auth.js';
 import { dingtalkRoutes } from './routes/dingtalk.js';
 import { imRoutes } from './routes/im.js';
+import { resumeRoutes } from './routes/resume.js';
 import { proxyStatsRoutes } from './routes/proxy-stats.js';
 import { setProxyStatsListener } from './lib/proxy/proxy-stats.js';
 import * as imCore from './lib/im/im-bridge-core.js';
@@ -96,6 +97,7 @@ function execWithStdin(cmd, args, input, options) {
 }
 import { _initPromise, _projectName, _logDir, _v2Writer, streamingState, resetStreamingState, PROFILE_PATH, RETRY_CONFIG_PATH, _retryConfigState, setLivePort, getImLiveText, resetImLiveText, markSessionStart } from './interceptor.js';
 import { V2LiveFeed } from './lib/v2/live-feed.js';
+import { filterClientsByViewProject, projectOfSessionDir, resolveActivityFeedKey } from './lib/v2/view-router.js';
 import { sanitizePathComponent } from './lib/v2/layout.js';
 import { maybeResumeConvert } from './lib/v2/convert-manager.js';
 import { LOG_DIR, setLogDir, getClaudeConfigDir, isBrowserOpenSuppressed } from '../findcc.js';
@@ -118,6 +120,7 @@ import { applyTaskEvent, resetTasks, getTaskSnapshot, shouldResetTasks } from '.
 import { createImLogWatcher } from './lib/im/im-log-watcher.js';
 import { unwatchAllWorkflows } from './lib/workflow-watcher.js';
 import { backupConfigs } from './lib/config-backup.js';
+import { migrateCredentialsToVault } from './lib/credential-migrate.js';
 import { normalizeBasePath, validateBasePath, stripBasePath } from './lib/base-path.js';
 import { createHardenedCleanup } from './lib/term-signals.js';
 import { createBackpressureGate } from './lib/ws-backpressure.js';
@@ -172,9 +175,12 @@ const IGNORED_PATTERNS = new Set([
   '.idea', '.vscode'
 ]);
 
-// 多 git 仓库支持：解析 repo 参数为安全的 cwd 路径
-function resolveRepoCwd(repoParam) {
-  const projectDir = process.env.CCV_PROJECT_DIR || process.cwd();
+// 多 git 仓库支持：解析 repo 参数为安全的 cwd 路径。
+// Multi-project (2026-10): `baseDir` lets a viewed parallel project override
+// the bound root (git READ routes pass resolveViewRoot's result); omitting it
+// keeps the bound behavior byte-identical.
+function resolveRepoCwd(repoParam, baseDir) {
+  const projectDir = baseDir || process.env.CCV_PROJECT_DIR || process.cwd();
   if (!repoParam || repoParam === '.') return projectDir;
   if (repoParam.includes('/') || repoParam.includes('..') || repoParam.includes('\\')) return null;
   const candidate = join(projectDir, repoParam);
@@ -490,34 +496,108 @@ const MIME_TYPES = {
   '.woff2': 'font/woff2',
 };
 
-// S6b: v2 live feed — the live channel when the v2 writer is active. Lazy
-// singleton so worker/test paths that never watch anything pay nothing.
-let _v2LiveFeed = null;
-function _ensureV2LiveFeed() {
-  if (!_v2LiveFeed) {
-    _v2LiveFeed = new V2LiveFeed({
+// S6b: v2 live feed — the live channel when the v2 writer is active. ONE feed
+// per project (the bound project plus any project a client is currently
+// VIEWING via /events?project=). Feeds are lazy so worker/test paths that never
+// watch anything pay nothing. Keyed by the absolute project dir.
+const _v2LiveFeeds = new Map(); // projectDir → V2LiveFeed
+
+// Per-project client filter handed to every feed: a feed for project P must
+// broadcast only to SSE clients whose VIEWED project is P. Pure predicate lives
+// in lib/v2/view-router.js (unit-tested); this closure just binds the live
+// bound-project name.
+function _filterClientsByViewProject(clientList, project) {
+  return filterClientsByViewProject(clientList, project, _projectName || '');
+}
+
+function _ensureProjectFeed(projectName) {
+  if (!projectName) return null;
+  const projectDir = join(LOG_DIR, sanitizePathComponent(projectName));
+  let feed = _v2LiveFeeds.get(projectDir);
+  if (!feed) {
+    feed = new V2LiveFeed({
       clients,
       getClaudePid,
       runParallelHook,
       // The stats worker's v2 units are session dirs (stats-worker.js v9).
       notifyStatsWorker,
       wireV3: WIRE_V3,
+      project: projectName,
+      clientFilter: _filterClientsByViewProject,
     });
+    feed.start(projectDir);
+    _v2LiveFeeds.set(projectDir, feed);
+  } else if (!feed._active) {
+    feed.start(projectDir);
   }
-  return _v2LiveFeed;
+  return feed;
 }
 
-/** Start the live channel for the current project (v2 live feed). No-op until
- *  a project is bound (workspace mode defers to the launch route). */
+/** Start the live channel for the bound project (v2 live feed) and route the
+ *  writer's per-session activity to the right project's feed. No-op until a
+ *  project is bound (workspace mode defers to the launch route). */
 function startLogWatch() {
   if (!_projectName) return;
-  const feed = _ensureV2LiveFeed();
-  feed.start(join(LOG_DIR, sanitizePathComponent(_projectName)));
-  _v2Writer.setOnActivity((dir) => feed.tick(dir));
+  _ensureProjectFeed(_projectName);
+  // The writer holds sessions for EVERY live project (per-project PTYs write
+  // through it). Route each activity dir to its owning project's feed by the
+  // <LOG_DIR>/<projectSan>/sessions/ prefix, so a viewed background project's
+  // live entries reach ITS feed (and its viewing clients) too.
+  _v2Writer.setOnActivity((dir) => {
+    const feed = _feedForSessionDir(dir);
+    if (feed) feed.tick(dir);
+  });
+  // Feed each resolved (sid, project) into the PTY sid index so chat sends can
+  // be routed to the PTY owning that conversation (anchor routing, 2026-10-05).
+  // Lazy import keeps pty-manager out of the early module graph (and off the
+  // boundary allowlist); a failure must never break logging.
+  // Multi-instance (2026-10-06): prefer the instanceKey-exact route when the claude
+  // self-reported one (`x-ccv-instance`) — it pins the sid to THIS process, which basename
+  // routing cannot do for two same-cwd instances. Fall back to the basename route for
+  // legacy / external producers that send no instance header.
+  _v2Writer.setOnSessionResolved((sid, project, instanceKey) => {
+    import('./pty-manager.js')
+      .then((pm) => {
+        try {
+          const pinned = instanceKey && typeof pm.setPtySessionIdForInstance === 'function'
+            ? pm.setPtySessionIdForInstance(instanceKey, sid)
+            : false;
+          if (!pinned) pm.setPtySessionId(project, sid);
+        } catch (err) { reportSwallowed('server.sid-pin', err); }
+      })
+      .catch((err) => { reportSwallowed('server.sid-pin-import', err); });
+  });
+}
+
+// The bound project's feed (may not exist yet). Single key builder, shared by
+// both _feedForSessionDir fallbacks so the ensure/fallback keys can't drift.
+function _boundFeed() {
+  return _v2LiveFeeds.get(join(LOG_DIR, sanitizePathComponent(_projectName || ''))) || null;
+}
+
+// Resolve the live feed that owns a session dir, from its
+// <LOG_DIR>/<projectSan>/sessions/<dir> path. When the prefix isolates a
+// known project but that project has NO live feed (no client is viewing it —
+// feeds are lazy), return null rather than falling back to the bound feed:
+// the activity belongs to a DIFFERENT project, and routing it to the bound
+// project's viewers is exactly the cross-project bleed this layer exists to
+// prevent (2026-10-05). Only when the prefix does not resolve a project at all
+// (a dir outside <LOG_DIR>/<projectSan>/sessions/) do we fall back to the
+// bound feed defensively.
+function _feedForSessionDir(dir) {
+  const { feedKey, allowBoundFallback } = resolveActivityFeedKey(dir, LOG_DIR, sep);
+  // A resolved project owns this activity: route to ITS feed, or drop when it
+  // has none (lazy feeds — no viewer, no broadcast). Never re-route a foreign
+  // project's activity to the bound feed (the cross-project bleed, 2026-10-05).
+  if (feedKey) return _v2LiveFeeds.get(join(LOG_DIR, feedKey)) || null;
+  // No owning project (dir outside every <LOG_DIR>/<projectSan>/sessions/
+  // root): bound feed, defensively — the legacy single-project behavior.
+  return allowBoundFallback ? _boundFeed() : null;
 }
 
 function stopLogWatch() {
-  if (_v2LiveFeed) _v2LiveFeed.stop();
+  for (const feed of _v2LiveFeeds.values()) feed.stop();
+  _v2LiveFeeds.clear();
   _v2Writer.setOnActivity(null);
 }
 
@@ -610,6 +690,7 @@ const deps = {
   notifyParentPending: _notifyParentPending,
   startLogWatch,
   stopLogWatch,
+  ensureProjectFeed: _ensureProjectFeed,
   scheduleTurnEndBroadcast: _scheduleTurnEndBroadcast,
   // SessionStart hook notify → conversation-switch signal (in-terminal
   // /resume). The source gate + V2Writer re-bind live in the interceptor.
@@ -732,6 +813,7 @@ const _routes = [
   ...dingtalkRoutes,
   ...imRoutes,
   ...proxyStatsRoutes,
+  ...resumeRoutes,
 ];
 const dispatch = createDispatcher(_routes);
 
@@ -785,6 +867,7 @@ async function handleRequest(req, res) {
     accessToken: ACCESS_TOKEN,
     enabled: authConfig.enabled,
     password: authConfig.password,
+    passwordUnreadable: authConfig.passwordUnreadable,
     wantsHtml,
   });
   // Remote-admin elevation (container/cloud deploy): an authenticated remote caller is
@@ -990,6 +1073,11 @@ export async function startViewer() {
   // (滚动留 10 份)。2026-06-06 事故:配置随 LOG_DIR 整树丢失后无处可恢复。fire-and-forget。
   setImmediate(() => { try { backupConfigs(); } catch { /* ignore */ } });
 
+  // 启动期一次性凭证迁移:preferences/profile 里的明文/base64 密钥 → credentials.json(AES-256-GCM)。
+  // 必须在 backupConfigs 之后挂(先留一份迁移前备份),幂等(逐字段写 vault→读回比对→剔旧字段),
+  // 失败字段保留原值不丢,下次启动重试。fire-and-forget,不阻塞启动。
+  setImmediate(() => { try { migrateCredentialsToVault(); } catch { /* ignore */ } });
+
   // 启动时清理磁盘上 ASK_HOOK_TIMEOUT_MS 之前的 ask 条目（兜底防泄漏）。
   // 内存 Map 不 hydrate：旧 res 已死、新 ask-bridge 重连同 toolUseId 会自动复用槽位
   // （server.js 已有"旧 res 已断 → 复用"分支），无需在这里主动重建内存态。
@@ -1292,7 +1380,7 @@ export async function startViewer() {
 async function setupTerminalWebSocket(httpServer) {
   try {
     const { WebSocketServer } = await import('ws');
-    const { writeToPty, writeToPtySequential, resizePty, onPtyData, onPtyExit, getPtyState, getPtyKind, getOutputBuffer, getCurrentWorkspace, spawnShell, findSafeSliceStart } = await import('./pty-manager.js');
+    const { writeToPty, writeToPtySequential, writeToPtyFor, writeToPtySequentialFor, resizePty, onPtyData, onPtyExit, getPtyState, getPtyKind, getOutputBuffer, getCurrentWorkspace, spawnShell, findSafeSliceStart, attachPtyFor } = await import('./pty-manager.js');
     const {
       spawnScratch,
       writeScratch,
@@ -1317,6 +1405,7 @@ async function setupTerminalWebSocket(httpServer) {
       chatQueue.initChatQueue({
         writeToPty,
         writeToPtySequential,
+        writeToPtySequentialFor,
         getPtyKind,
         isStreaming: () => streamingState.active,
         hasPendingApproval: () => pendingAskHooks.size > 0 || pendingPermHooks.size > 0,
@@ -1364,6 +1453,7 @@ async function setupTerminalWebSocket(httpServer) {
         accessToken: ACCESS_TOKEN,
         enabled: authConfig.enabled,
         password: authConfig.password,
+        passwordUnreadable: authConfig.passwordUnreadable,
         wantsHtml: false,
       });
       if (wsAuth.action !== 'allow') {
@@ -1371,6 +1461,18 @@ async function setupTerminalWebSocket(httpServer) {
         return;
       }
       if (pathname === '/ws/terminal') {
+        // Multi-PTY view attach (2026-10): `?project=<name>` pins the freshly
+        // connected client to the project it is VIEWING, so the initial
+        // state/buffer frames below come from that project's record — not from
+        // whatever project happened to spawn last. Unknown/absent project is a
+        // silent no-op (single-project behavior unchanged).
+        const viewProject = wsUrl.searchParams.get('project');
+        // Multi-instance: `&instance=<key>` pins the attach to THAT exact process when a
+        // same-cwd project runs two concurrent instances (basename alone is ambiguous).
+        const viewInstance = wsUrl.searchParams.get('instance');
+        if (viewProject || viewInstance) {
+          try { attachPtyFor({ project: viewProject || undefined, instanceKey: viewInstance || undefined }); } catch { }
+        }
         wss.handleUpgrade(req, socket, head, (ws) => {
           wss.emit('connection', ws, req);
         });
@@ -1775,11 +1877,11 @@ async function setupTerminalWebSocket(httpServer) {
       ws.on('message', async (raw) => {
         try {
           const msg = JSON.parse(raw.toString());
-          // SDK 模式没有 PTY：PTY 专属消息(input/sequential input/resync/resize)一律 no-op,
+          // SDK 模式没有 PTY：PTY 专属消息(input/sequential input/resync/resize/attach)一律 no-op,
           // 否则 'input' 会在无会话时触发 spawnShell() 拉出一个用户看不见的裸 shell。
           // sdk-*/ask-*/perm-*/image-* 等控制消息不受影响。scratch WS 是独立 handler,不受此闸门影响。
           if (isSdkMode && (msg.type === 'input' || msg.type === 'input-sequential'
-              || msg.type === 'resync-request' || msg.type === 'resize')) {
+              || msg.type === 'resync-request' || msg.type === 'resize' || msg.type === 'attach')) {
             return;
           }
           if (msg.type === 'input') {
@@ -1806,6 +1908,12 @@ async function setupTerminalWebSocket(httpServer) {
               }
             }
             // 拦截连续 Ctrl+C：2秒内连按2次则阻止并提醒，避免误退出 CLI
+            // Anchor routing (2026-10-05): a send carries the viewed project's
+            // {project, sessionId} so the input lands on that conversation's PTY,
+            // not whichever record the global activePtyKey last pointed to. Falls
+            // back to the legacy active-targeted write when no anchor is present.
+            const _anchor = { project: typeof msg.project === 'string' ? msg.project : undefined, sessionId: typeof msg.sessionId === 'string' ? msg.sessionId : undefined, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined };
+            const _write = (data) => (_anchor.project || _anchor.sessionId || _anchor.instanceKey) ? writeToPtyFor(data, _anchor) : writeToPty(data);
             if (msg.data === '\x03') {
               const now = Date.now();
               if (!ws._ctrlCLastTime) ws._ctrlCLastTime = 0;
@@ -1815,10 +1923,10 @@ async function setupTerminalWebSocket(httpServer) {
                 // 不发送第二次 Ctrl+C 到 PTY
               } else {
                 ws._ctrlCLastTime = now;
-                writeToPty(msg.data);
+                _write(msg.data);
               }
             } else {
-              writeToPty(msg.data);
+              _write(msg.data);
             }
           } else if (msg.type === 'input-sequential') {
             // Programmatic sequential input: send chunks one by one, waiting for PTY ACK
@@ -1844,7 +1952,12 @@ async function setupTerminalWebSocket(httpServer) {
               }
             };
             if (Array.isArray(chunks) && chunks.length > 0 && chunks.every(c => typeof c === 'string')) {
-              writeToPtySequential(chunks, replyDone, { settleMs: msg.settleMs || 150 });
+              const _seqAnchor = { project: typeof msg.project === 'string' ? msg.project : undefined, sessionId: typeof msg.sessionId === 'string' ? msg.sessionId : undefined, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined };
+              if (_seqAnchor.project || _seqAnchor.sessionId || _seqAnchor.instanceKey) {
+                writeToPtySequentialFor(chunks, replyDone, { settleMs: msg.settleMs || 150 }, _seqAnchor);
+              } else {
+                writeToPtySequential(chunks, replyDone, { settleMs: msg.settleMs || 150 });
+              }
             } else {
               replyDone(false);
             }
@@ -1854,6 +1967,39 @@ async function setupTerminalWebSocket(httpServer) {
               floodGate.reset();
               sendResync();
             }
+          } else if (msg.type === 'attach') {
+            // Multi-PTY view attach (2026-10): the client switched the main view to
+            // another parallel project (chip click / launch / cold-load landing) —
+            // re-anchor the shared PTY stream to THAT project's record, then replay
+            // its outputBuffer so the terminal paints the right screen immediately.
+            // attachPtyFor is idempotent and never spawns/kills; an unknown project
+            // degrades to attach-failed with the current view left untouched.
+            //
+            // KNOWN LIMITATION (documented, pre-existing): the attachment is a single
+            // server-wide pointer, not per-connection. Two tabs viewing DIFFERENT
+            // projects share it — the last attach wins and the other tab's terminal
+            // follows the new project too (its chat view is unaffected: SSE per-project
+            // filtering is per-connection). Same-project tabs attach identically →
+            // no-op. A per-connection PTY mux is out of scope for this fix.
+            const target = typeof msg.project === 'string' ? msg.project : '';
+            // Multi-instance: an explicit instanceKey pins the attach to THAT exact process
+            // (a same-cwd project's basename alone is ambiguous across two live instances).
+            const targetInstance = typeof msg.instanceKey === 'string' ? msg.instanceKey : '';
+            let res = null;
+            try { res = (target || targetInstance) ? attachPtyFor({ project: target || undefined, instanceKey: targetInstance || undefined }) : null; } catch { res = null; }
+            if (res && res.ok) {
+              try { ws.send(JSON.stringify({ type: 'attached', project: target, running: res.running, ptyKind: res.ptyKind, exitCode: res.exitCode })); } catch { }
+              const snap = getOutputBuffer();
+              if (snap) {
+                try { ws.send(JSON.stringify({ type: 'data', data: snap })); } catch { }
+              }
+            } else {
+              // Multi-instance: surface an ambiguous project-name attach (with the live
+              // candidates) so the client re-issues with an instanceKey instead of silently
+              // pinning an arbitrary same-cwd process.
+              const reason = (res && res.reason) || 'not-found';
+              try { ws.send(JSON.stringify({ type: 'attach-failed', project: target, reason, ...(res && res.candidates ? { candidates: res.candidates } : {}) })); } catch { }
+            }
           } else if (msg.type === 'ask-hook-answer') {
             // Client answered AskUserQuestion via hook bridge.
             // New protocol: msg.id required to address one of multiple pending asks.
@@ -2116,7 +2262,9 @@ async function setupTerminalWebSocket(httpServer) {
                   });
                 }
               } else {
-                try { chatQueue.enqueue(msg.text); } catch (err) { reportSwallowed('server.queue-message', err); }
+                const _qAnchor = { project: typeof msg.project === 'string' ? msg.project : undefined, sessionId: typeof msg.sessionId === 'string' ? msg.sessionId : undefined, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined };
+                const _anchorArg = (_qAnchor.project || _qAnchor.sessionId || _qAnchor.instanceKey) ? _qAnchor : undefined;
+                try { chatQueue.enqueue(msg.text, _anchorArg); } catch (err) { reportSwallowed('server.queue-message', err); }
               }
             }
           } else if (msg.type === 'queue-send-now') {
@@ -2485,7 +2633,15 @@ export function startStreamingStatusTimer() {
       const data = isActive
         ? { ...streamingState, elapsed: Date.now() - streamingState.startTime }
         : { active: false };
-      if (clients.length > 0 && sendEventToClients) sendEventToClients(clients, 'streaming_status', data);
+      // Multi-project (2026-10): streamingState is a global singleton tracking the
+      // BOUND project's main process — route the spinner only to clients viewing
+      // that project, so a parallel project's view never shows the bound
+      // project's streaming flag (cross-project spinner bleed). (Per-project
+      // streaming state is a follow-up; today a parallel view simply shows no
+      // spinner, matching the pre-multi-PTY single-project behavior.)
+      if (clients.length > 0 && sendEventToClients) {
+        sendEventToClients(_filterClientsByViewProject(clients, _projectName || ''), 'streaming_status', data);
+      }
     }
   }, 500);
   _streamingStatusTimer.unref();
@@ -2717,7 +2873,25 @@ if (!globalThis._ccvServerSignalsRegistered) {
   process.on('exit', handleExit);
   // hardened：watchdog 5s 强退 + 重复触发立退（防 Windows 上 stopViewer 内部
   // await 挂住导致 .finally(exit) 永不执行 = Ctrl+C 完全无反应）。
-  const _hardenedStop = createHardenedCleanup({ doCleanup: () => stopViewer() });
+  // Also reap scratch/resume children at this PROCESS-level exit point —
+  // without it they orphan on SIGINT/SIGTERM (node-pty children are session
+  // leaders, not cascade-killed by the OS). killAllScratch is idempotent.
+  // _doStop (the session-level stop/start cycle point) deliberately does NOT
+  // kill scratch PTYs: Electron tab switches go through it and must not reap a
+  // resume child owned by another tab.
+  const _hardenedStop = createHardenedCleanup({
+    doCleanup: () => Promise.all([
+      stopViewer(),
+      import('./scratch-pty-manager.js')
+        .then(({ killAllScratch }) => killAllScratch())
+        .catch((e) => reportSwallowed('server.stop.scratch', e)),
+      // Also reap every kept-alive main PTY (cross-project /resume leaves old
+      // projects' main PTYs running); idempotent, equals killPty() when single.
+      import('./pty-manager.js')
+        .then(({ killAllMain }) => killAllMain())
+        .catch((e) => reportSwallowed('server.stop.mainpty', e)),
+    ]),
+  });
   process.on('SIGINT', _hardenedStop);
   process.on('SIGTERM', _hardenedStop);
 }

package/server/system-prompt-templates/presets/kimi-k3.md

@@ -36,7 +36,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Do not wait passively for a teammate to report back: teammates sometimes finish their task without sending you a message. No notification ≠ not done — check `~/.claude/projects/<slug>/<session>/subagents/agent-*.jsonl` (or SendMessage the teammate) before waiting.
  - When a teammate goes quiet, ask it directly for its result or status — treat silence as "finished or stuck", never as "still working". Read results back with `tail -N <file> | jq -r 'select(.type=="assistant") | .message.content[] | select(.type=="text") | .text'` — never Read the whole jsonl.
  - Before telling the user a delegated task is blocked or incomplete, ping the teammate once; escalate to the user only if it still does not respond. After 2 empty wait rounds, change strategy; after ~10 minutes, do it yourself or tell the user. Never idle-poll.
- - When waiting for an async result (teammate/subagent report, background task), do not poll by repeatedly calling tools. These results arrive automatically as messages — stop calling tools, end your turn, and let them arrive. Reserve Monitor-style event-driven waiting for external state only (files, processes, ports). If you catch yourself checking the same thing's progress two turns in a row, that is polling — stop immediately.
+ - When waiting for an async result (teammate/subagent report, background task), end your turn and let it arrive — these results come back automatically as messages, so there is nothing to check. Never poll for completion: no Monitor, CronCreate, `sleep`, re-reading the agent's output file, or repeated TaskList/status checks. And never fill the wait with "waiting…" filler text or empty echo/status lines — if you have nothing to advance, stop. One short "delegated, awaiting result" line is enough. Reserve Monitor-style event-driven waiting for external state only (files, processes, ports). If you catch yourself checking the same thing's progress two turns in a row, that is polling — stop immediately.
 
 # Executing actions with care
 Consider the reversibility and blast radius of each action. Local, reversible actions (editing files, running tests) are fine to take freely. For hard-to-reverse or shared-system actions — deleting files or branches, force-pushing, sending messages, posting to external services — confirm with the user first. Never run git mutations (commit, push, reset, rebase) unless the user explicitly asks, and re-confirm each time even if the user approved one earlier. Investigate unexpected state before overwriting it.

package/server/workspace-registry.js

@@ -1,42 +1,25 @@
 // Workspace Registry - 工作区持久化管理
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
 import { readdir, stat } from 'node:fs/promises';
-import { renameSyncWithRetry } from './lib/file-api.js';
-import { withFileLockAsync } from './lib/async-file-lock.js';
+import { statSync } from 'node:fs';
+import { mutateJson, readJsonSafe, writeJsonAtomic } from './lib/json-store.js';
 import { dirSizeSync } from './lib/v2/layout.js';
 import { isDiscardableSession } from './lib/v2/session-select.js';
-import { join, basename, resolve } from 'node:path';
+import { join, basename, resolve, dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { LOG_DIR } from '../findcc.js';
 
 // 动态获取（LOG_DIR 可能在运行时被 setLogDir 修改）
 function getWorkspacesFile() { return join(LOG_DIR, 'workspaces.json'); }
-function getLockFile() { return join(LOG_DIR, 'workspaces.lock'); }
 
 export function loadWorkspaces() {
-  try {
-    if (!existsSync(getWorkspacesFile())) return [];
-    const data = JSON.parse(readFileSync(getWorkspacesFile(), 'utf-8'));
-    return Array.isArray(data.workspaces) ? data.workspaces : [];
-  } catch {
-    return [];
-  }
+  const data = readJsonSafe(getWorkspacesFile(), {});
+  return Array.isArray(data.workspaces) ? data.workspaces : [];
 }
 
-export function saveWorkspaces(list) {
-  const tmpFile = `${getWorkspacesFile()}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
-  try {
-    mkdirSync(LOG_DIR, { recursive: true });
-    writeFileSync(tmpFile, JSON.stringify({ workspaces: list }, null, 2));
-
-    // Windows 上 renameSync 可能会因为目标文件存在或被占用而失败。统一走 server/lib/file-api.js
-    // renameSyncWithRetry helper（同款重试策略，跟 interceptor / log-management 一致）。
-    renameSyncWithRetry(tmpFile, getWorkspacesFile());
-  } catch (err) {
-    console.error('[CC Viewer] Failed to save workspaces:', err.message);
-    // 尝试清理临时文件
-    try { unlinkSync(tmpFile); } catch { }
-  }
+// Full-list rewrite on every mutation; non-secret so no 0600 (mode:false → umask).
+// Atomicity + cross-process mutex come from mutateJson below.
+function _saveWorkspaces(list) {
+  return { workspaces: list };
 }
 
 // 失效 file-access-policy 的 allowlist roots 缓存。lazy import 避免循环依赖。
@@ -47,10 +30,10 @@ function _invalidatePolicyCache() {
 }
 
 export async function registerWorkspace(absolutePath) {
-  const result = await withFileLockAsync(getLockFile(), () => {
+  const result = await mutateJson(getWorkspacesFile(), (data) => {
     const resolvedPath = resolve(absolutePath);
     const projectName = basename(resolvedPath).replace(/[^a-zA-Z0-9_\-\.]/g, '_');
-    const list = loadWorkspaces();
+    let list = Array.isArray(data.workspaces) ? data.workspaces : [];
     // Windows NTFS 不分大小写——`C:\App` 跟 `c:\app` 是同目录但 `===` 视为不同。
     // 仅 Win 下小写化比较；POSIX 保持原样不引入回归。
     const pathEq = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
@@ -58,9 +41,22 @@ export async function registerWorkspace(absolutePath) {
     if (existing) {
       existing.lastUsed = new Date().toISOString();
       existing.projectName = projectName;
-      saveWorkspaces(list);
+      data.workspaces = list;
       return existing;
     }
+    // Gentle self-heal (2026-10-05): a same-name entry whose path no longer
+    // exists (moved/deleted checkout residue) is pruned on register — otherwise
+    // the collision makes view-root's no-live-PTY branch 400. Same-name entries
+    // whose path still exists are kept (never auto-delete user data).
+    // Only ENOENT/ENOTDIR count as "gone": existsSync() also returns false on
+    // EIO/EACCES/EPERM/a transiently unmounted volume, which must NOT prune a
+    // legitimate workspace.
+    const isGone = (p) => {
+      try { statSync(p); return false; }
+      catch (e) { return e && (e.code === 'ENOENT' || e.code === 'ENOTDIR'); }
+    };
+    list = list.filter(w =>
+      w.projectName !== projectName || pathEq(w.path, resolvedPath) || !isGone(w.path));
     const now = new Date().toISOString();
     const entry = {
       id: randomBytes(6).toString('hex'),
@@ -70,27 +66,37 @@ export async function registerWorkspace(absolutePath) {
       createdAt: now,
     };
     list.push(entry);
-    saveWorkspaces(list);
+    data.workspaces = list;
     return entry;
-  }, { ensureDir: LOG_DIR });
+  }, { mode: false, fallback: {}, ensureDir: LOG_DIR });
   _invalidatePolicyCache();
   return result;
 }
 
 export async function removeWorkspace(id) {
-  const result = await withFileLockAsync(getLockFile(), () => {
-    const list = loadWorkspaces();
+  const result = await mutateJson(getWorkspacesFile(), (data) => {
+    const list = Array.isArray(data.workspaces) ? data.workspaces : [];
     const filtered = list.filter(w => w.id !== id);
     if (filtered.length !== list.length) {
-      saveWorkspaces(filtered);
+      data.workspaces = filtered;
       return true;
     }
     return false;
-  }, { ensureDir: LOG_DIR });
+  }, { mode: false, fallback: {}, ensureDir: LOG_DIR });
   if (result) _invalidatePolicyCache();
   return result;
 }
 
+// Legacy sync save entry kept for any direct caller: writes the full list atomically via the
+// kernel (non-secret → umask). mkdirSync is handled inside writeJsonAtomic.
+export function saveWorkspaces(list) {
+  try {
+    writeJsonAtomic(getWorkspacesFile(), _saveWorkspaces(list), { mode: false });
+  } catch (err) {
+    console.error('[CC Viewer] Failed to save workspaces:', err.message);
+  }
+}
+
 export async function getWorkspaces() {
   const list = loadWorkspaces();
   const enriched = await Promise.all(list.map(async (w) => {