cc-viewer 1.8.9 → 1.8.10

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-BbF89uTe.js"></script>
+  <script type="module" crossorigin src="./assets/index-C4Jei4gi.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-FhK5cQx7.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-virtuoso-B_7lc2Ot.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-DL3yyKRQ.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/auth.js

@@ -218,10 +218,18 @@ export function parseCookies(header) {
  *   urlToken, cookieToken, accessToken,
  *   enabled, password, wantsHtml
  * }
- * → { action: 'allow' | 'login-page' | 'unauthorized' | 'forbidden' }
+ * → { action: 'allow' | 'login-page' | 'unauthorized' | 'forbidden', isAdmin: boolean }
  *
  * Caller invariants (see plan): 'login-page' / 'unauthorized' / 'forbidden' MUST
  * terminate the request; only 'allow' falls through to the Host allowlist + routing.
+ *
+ * `isAdmin` = loopback OR an authenticated remote (valid urlToken / cookieToken). It is computed
+ * from the credential-bearing allow branches, so the two can never drift apart — server.js uses
+ * it to elevate management routes (see lib/is-admin.js). Static-asset, /api/auth/login, AND the
+ * empty-password branch are allow-exempt but NOT admin: empty-password mode means "no read
+ * protection", but destructive/admin actions (delete skills, change the password, adjust
+ * retry/proxy config that multiplies the host's paid upstream spend) must NOT be opened to every
+ * unauthenticated LAN/internet client — those stay credential-or-loopback gated even in open mode.
  */
 export function decideAuth(ctx) {
   const {
@@ -230,6 +238,14 @@ export function decideAuth(ctx) {
     enabled, password, wantsHtml,
   } = ctx;
 
+  // Admin = the credential-bearing / trusted-peer allow branches. Deliberately EXCLUDES the
+  // empty-password allow branch: "no read protection" must not become "everyone is admin".
+  // Single source of truth for both gating and remote-admin elevation.
+  const isAdmin =
+    isLocal === true ||
+    urlToken === accessToken ||
+    cookieToken === accessToken;
+
   if (
     isStaticAsset ||
     pathname === '/api/auth/login' || // login endpoint must be reachable unauthenticated
@@ -238,16 +254,16 @@ export function decideAuth(ctx) {
     cookieToken === accessToken ||
     (enabled && password === '')      // empty password = explicitly no protection
   ) {
-    return { action: 'allow' };
+    return { action: 'allow', isAdmin };
   }
 
   if (enabled) {
     // Password auth on but no valid credential: HTML navigations get the login page,
     // XHR/asset/WS get a plain 401.
-    return { action: wantsHtml ? 'login-page' : 'unauthorized' };
+    return { action: wantsHtml ? 'login-page' : 'unauthorized', isAdmin };
   }
   // Password auth off → preserve original token-only behaviour (403).
-  return { action: 'forbidden' };
+  return { action: 'forbidden', isAdmin };
 }
 
 function escapeHtml(s) {

package/server/lib/is-admin.js

@@ -0,0 +1,27 @@
+// Remote-admin elevation for management routes (container / cloud deployment).
+//
+// cc-viewer's sensitive management endpoints are gated on `isLocal` (loopback socket
+// peer) — a model that assumes the admin sits on the host machine. In a single-container
+// or cloud deployment the admin's browser is remote, so `isLocal` is false and every
+// management call 403s even after the caller has authenticated (password-login cookie or
+// `?token=` URL).
+//
+// `server.js handleRequest` therefore computes `isAdmin = isLocal || authenticated-remote`
+// (mirroring decideAuth's remote-allow branches) and attaches it as `req.ccvIsAdmin`
+// before dispatch. Management handlers call `isAdminReq(req, isLocal)` instead of a bare
+// `isLocal` check so an authenticated remote admin is treated like the loopback admin.
+//
+// IMPORTANT: this must NOT be used for the internal machine bridges (events.js hook
+// notifies, ask-perm.js streamChunk) — those carry INTERNAL_TOKEN from the local claude
+// child process and must stay strictly loopback. Only human-facing management routes use
+// isAdminReq.
+
+/**
+ * Is this request from an admin — loopback, or an authenticated remote client?
+ * @param {object} req  the incoming request (server.js sets req.ccvIsAdmin after auth)
+ * @param {boolean} isLocal  loopback socket peer (the dispatch-threaded flag)
+ * @returns {boolean}
+ */
+export function isAdminReq(req, isLocal) {
+  return isLocal === true || req?.ccvIsAdmin === true;
+}

package/server/routes/auth.js

@@ -1,11 +1,12 @@
 // Password-auth API routes. See server/lib/auth.js for the underlying logic and
 // the plan for the overall design.
 //
-//   GET  /api/auth/state   — public; reveals the plaintext password only to admin (isLocal).
-//   POST /api/auth/config  — admin-only (!isLocal → 403); enable/disable + set password.
+//   GET  /api/auth/state   — public; reveals the plaintext password only to a loopback admin.
+//   POST /api/auth/config  — admin-only (loopback, or authenticated remote admin; else 403); enable/disable + set password.
 //   POST /api/auth/login   — public + IP rate-limited; on success Set-Cookie ccv_auth=ACCESS_TOKEN.
 import { createHash, timingSafeEqual } from 'node:crypto';
 import { generatePassword } from '../lib/auth.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 
@@ -28,14 +29,15 @@ function readBody(req, deps, cb) {
   req.on('end', () => cb(body));
 }
 
-function buildState(deps, isLocal) {
+function buildState(deps, isLocal, isAdmin) {
   // Reports the EFFECTIVE config (gate enforces this) plus enough scope info for the
   // admin UI to manage both the global default and a per-project override.
-  // Passwords (effective + global) are only revealed to the admin (local).
+  // Plaintext passwords stay loopback-only even for an authenticated remote admin
+  // (mirrors the IM status secret policy); `isAdmin` reflects loopback OR remote-auth.
   const s = deps.getAuthState();
   return {
     enabled: s.effective.enabled,
-    isAdmin: isLocal,
+    isAdmin,
     password: isLocal ? s.effective.password : null,
     scope: s.scope,                       // 'project' | 'global' — which one is in effect
     hasProjectOverride: s.hasProjectOverride,
@@ -81,11 +83,11 @@ function recordFailedAttempt(ip) {
 
 function authState(req, res, parsedUrl, isLocal, deps) {
   res.writeHead(200, JSON_HEADERS);
-  res.end(JSON.stringify(buildState(deps, isLocal)));
+  res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
 }
 
 function authConfigPost(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'admin-only' }));
     return;
@@ -104,7 +106,7 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     if (incoming.clearOverride === true) {
       deps.clearAuthOverride();
       res.writeHead(200, JSON_HEADERS);
-      res.end(JSON.stringify(buildState(deps, isLocal)));
+      res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
       return;
     }
     // Target scope: explicit 'global' → global; otherwise project when this server has a
@@ -126,7 +128,7 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     }
     deps.setAuthConfig(next, scope);
     res.writeHead(200, JSON_HEADERS);
-    res.end(JSON.stringify(buildState(deps, isLocal)));
+    res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
   });
 }
 

package/server/routes/dingtalk.js

@@ -1,11 +1,13 @@
 // DingTalk bridge config API. See server/lib/im/dingtalk-config.js (storage) and
 // server/lib/im/dingtalk-bridge.js (the Stream client) for the underlying logic.
 //
-//   GET  /api/dingtalk/status — public; remote callers get only hasSecret, the local (admin)
-//                               caller additionally gets the plaintext appSecret to view/copy.
-//   POST /api/dingtalk/config — loopback-only (!isLocal → 403); save creds, reload bridge.
-//   POST /api/dingtalk/test   — loopback-only; validate creds (fetch an access token).
+//   GET  /api/dingtalk/status — public; remote callers get only enabled+hasSecret+connection; an
+//                               authenticated remote admin additionally gets process+pid and lastError
+//                               (error chip); only the plaintext appSecret stays loopback-only.
+//   POST /api/dingtalk/config — admin-only (loopback, or authenticated remote admin); save creds, reload bridge.
+//   POST /api/dingtalk/test   — admin-only; validate creds (fetch an access token).
 import { loadDingTalkState, saveDingTalkConfig, loadDingTalkConfig } from '../lib/im/dingtalk-config.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 
@@ -36,7 +38,19 @@ async function dingtalkStatus(req, res, parsedUrl, isLocal, deps) {
   }
   res.writeHead(200, JSON_HEADERS);
   if (!isLocal) {
-    // connectionState passes through as-is; lastError stays loopback-only (mirrors routes/im.js).
+    // Authenticated remote admin (container/cloud): full process/connection state (incl.
+    // `lastError` so the header chip can render the real error) — only the plaintext appSecret
+    // stays loopback-only (the frontend edit form only reads hasSecret).
+    if (isAdminReq(req, isLocal)) {
+      res.end(JSON.stringify({
+        ...loadDingTalkState(),
+        connection: conn,
+        process: processInfo,
+        pid: deps.dingtalk.isWorker ? process.pid : (processInfo?.pid ?? null),
+      }));
+      return;
+    }
+    // connectionState passes through as-is; lastError stays loopback-only (non-admin remote).
     res.end(JSON.stringify({
       enabled: loadDingTalkState().enabled,
       hasSecret: loadDingTalkState().hasSecret,
@@ -55,8 +69,9 @@ async function dingtalkStatus(req, res, parsedUrl, isLocal, deps) {
 }
 
 function dingtalkConfigPost(req, res, parsedUrl, isLocal, deps) {
-  // Loopback-only: an app_secret must never be settable over the LAN even with a valid token.
-  if (!isLocal) {
+  // Admin-only (loopback, or an authenticated remote admin): an app_secret must never be
+  // settable by an unauthenticated LAN client even with a valid token.
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'Loopback only' }));
     return;
@@ -104,7 +119,7 @@ function dingtalkConfigPost(req, res, parsedUrl, isLocal, deps) {
 }
 
 function dingtalkTestPost(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'Loopback only' }));
     return;

package/server/routes/im.js

@@ -1,13 +1,15 @@
 // Generic multi-IM bridge config + process-control API. Platform-parametric (keyed by descriptor id).
 //
-//   GET  /api/im/:platform/status  — public; remote callers get only enabled+hasSecret+connection,
-//                                    the local (admin) caller additionally gets plaintext secrets + process info.
-//   POST /api/im/:platform/config  — loopback-only; save creds, then drive the process manager
+//   GET  /api/im/:platform/status  — public; remote callers get only enabled+hasSecret+connection;
+//                                    an authenticated remote admin additionally gets process+pid and
+//                                    connection/process lastError (for the error chip); only the
+//                                    plaintext secrets stay loopback-only; the loopback admin gets all.
+//   POST /api/im/:platform/config  — admin-only (loopback, or authenticated remote admin); save creds, then drive the process manager
 //                                    (enable→stop+spawn worker, disable→stop). Allowlist is optional:
 //                                    enabling with an empty one warns (not blocked) since the worker
 //                                    runs with --dangerously-skip-permissions.
-//   POST /api/im/:platform/test    — loopback-only; validate creds (fetch an access token).
-//   POST /api/im/:platform/process — loopback-only; {action:start|stop|restart} the detached worker.
+//   POST /api/im/:platform/test    — admin-only; validate creds (fetch an access token).
+//   POST /api/im/:platform/process — admin-only; {action:start|stop|restart} the detached worker.
 //                                    'start' requires stored creds (400 `missing …` otherwise) and
 //                                    also persists enabled:true (merged into the stored config):
 //                                    a worker spawned while the config says disabled no-ops in
@@ -27,6 +29,7 @@ import { readImAppendSystem, writeImAppendSystem, buildImAppendSystemPreset, MAX
 import { imDir } from '../lib/im/im-lock.js';
 import { resolvePrefLang } from '../lib/im/im-lang.js';
 import { listSkills, moveSkill, deleteSkill } from '../lib/skills-api.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import { importSkillTo } from './skills.js';
 import { LOG_DIR } from '../../findcc.js';
 import { join, basename } from 'node:path';
@@ -116,7 +119,20 @@ async function imStatus(req, res, parsedUrl, isLocal, deps) {
 
   res.writeHead(200, JSON_HEADERS);
   if (!isLocal) {
-    // Loopback gate: a token-authorized LAN client sees only what the header chip needs.
+    // Authenticated remote admin (container/cloud): full process/connection state so the settings
+    // UI start() poll sees `process.state === 'ready'` AND the header chip can render the real
+    // error (`connection.lastError` — the worker's own report, not a stored secret). Only the
+    // plaintext SECRETS stay loopback-only (the frontend edit form only ever reads hasSecret).
+    if (isAdminReq(req, isLocal)) {
+      res.end(JSON.stringify({
+        ...state,
+        connection,
+        process: processInfo,
+        pid: deps.im.isWorker ? process.pid : (processInfo?.pid ?? null),
+      }));
+      return;
+    }
+    // Unauthenticated/non-admin remote: only what the header chip needs.
     // connectionState is passed through as-is (no defaulting); lastError stays loopback-only.
     res.end(JSON.stringify({
       enabled: state.enabled,
@@ -141,7 +157,7 @@ async function imStatus(req, res, parsedUrl, isLocal, deps) {
 function imConfigPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, async (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -182,7 +198,7 @@ function imConfigPost(req, res, parsedUrl, isLocal, deps) {
 function imTestPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, async (body) => {
     let incoming = {};
     try { incoming = body ? JSON.parse(body) : {}; } catch { /* fall back to stored */ }
@@ -204,7 +220,7 @@ function imTestPost(req, res, parsedUrl, isLocal, deps) {
 function imProcessPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   // 只有主进程负责管理 worker；worker 自身不应被要求 spawn/stop（避免嵌套）。
   if (deps.im.isWorker) {
     res.writeHead(409, JSON_HEADERS);
@@ -273,23 +289,23 @@ function imLogs(req, res, parsedUrl, isLocal, deps) {
 }
 
 // 发送者身份映射（senderId → {name, avatar, ts}）：供「对话记录」按 senderId 显示真实姓名+头像。
-// loopback-only：姓名/头像属个人信息，不向局域网暴露（与 config/test/process 同级）。
+// admin-only: names/avatars are personal info, not exposed to unauthenticated LAN clients (same tier as config/test/process).
 function imSenders(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   res.writeHead(200, JSON_HEADERS);
   res.end(JSON.stringify({ platform: id, senders: readSenders(id) }));
 }
 
-// 「模型性格定义」= 该 IM worker 工作目录下的 CC_APPEND_SYSTEM.md（启动 claude 时注入为
-// --append-system-prompt-file）。loopback-only：本地文件内容、admin-only。
+// "Model persona definition" = CC_APPEND_SYSTEM.md in that IM worker's working dir (injected at claude launch as
+// --append-system-prompt-file). admin-only: local file content (loopback, or an authenticated remote admin).
 // 该文件仅在 worker 启动时读取一次，故保存后需重启该 IM worker 才生效（前端据此提示用户）。
 // ?default=1：返回当前语言的预置文本（绕过磁盘文件），供编辑器「恢复默认」按钮加载——不落盘，由用户保存才生效。
 function imAppendSystemGet(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   try {
     const def = parsedUrl?.searchParams?.get('default');
     const lang = resolvePrefLang();
@@ -305,7 +321,7 @@ function imAppendSystemGet(req, res, parsedUrl, isLocal, deps) {
 function imAppendSystemPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -327,13 +343,13 @@ function imAppendSystemPost(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
-// 「${IM} SKILL 管理」= 该 IM worker 工作目录下的 .claude/skills/。loopback-only（本地文件操作、admin-only）。
+// "${IM} SKILL management" = the .claude/skills/ under that IM worker's working dir. admin-only (local file ops; loopback, or an authenticated remote admin).
 // 复用 skills-api 的 listSkills/moveSkill（按 projectDir 参数化）+ skills.js 的 importSkillTo（按 skillsRoot 参数化）。
 // IM worker 仅在启动时读取 skills，故增删/启停后需重启该 IM worker 才生效（前端提示用户）。
 function imSkills(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   try {
     const dir = imDir(id);
     // projectDir 与 homeDir 都指向 IM 目录：两次扫描命中同一 .claude/skills（user+project 重复），
@@ -350,7 +366,7 @@ function imSkills(req, res, parsedUrl, isLocal, deps) {
 function imSkillsToggle(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -371,7 +387,7 @@ function imSkillsToggle(req, res, parsedUrl, isLocal, deps) {
 function imSkillsDelete(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -392,7 +408,7 @@ function imSkillsDelete(req, res, parsedUrl, isLocal, deps) {
 function imSkillsImport(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   importSkillTo(req, res, { skillsRoot: join(imDir(id), '.claude', 'skills'), windowsReserved: deps.WINDOWS_RESERVED_NAMES });
 }
 

package/server/routes/preferences.js

@@ -14,6 +14,7 @@ import { readClaudeProjectModel } from '../lib/context-watcher.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im/im-config.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import {
   getCurrentProjectKey, getCurrentProjectName, hasFork, listForks, resolveScoped,
 } from '../lib/project-prefs.js';
@@ -52,12 +53,16 @@ export function _resetThemeSyncForTests() { _themeSyncInFlight = false; }
 function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   let prefs = {};
   try { if (existsSync(deps.getPrefsFile())) prefs = JSON.parse(readFileSync(deps.getPrefsFile(), 'utf-8')); } catch { }
+  // isAdmin = loopback OR authenticated remote (container/cloud admin); _isLocal stays the
+  // physical loopback fact. Computed once up-front so every admin gate below (fork keys,
+  // executable key, _isAdmin echo) uses the SAME value.
+  const isAdmin = isAdminReq(req, isLocal);
   // auth 配置(含明文密码)与偏好同存于 preferences.json,但绝不能从这里下发 ——
   // 密码仅由 admin-only 的 /api/auth/state 暴露给本机。否则远程密码登录用户也能读到明文。
   // 全局 auth 与每个项目的 authByProject 覆盖都要剥离(后者同样含明文密码)。
   delete prefs.auth;
   delete prefs.authByProject;
-  if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+  if (!isAdmin || !isSameOriginBrowserRequest(req, parsedUrl)) {
     delete prefs[CLAUDE_EXECUTABLE_PREF_KEY];
   }
   stripImConfigs(prefs); // dingtalk / feishu / … — admin-only, never to a LAN client
@@ -65,8 +70,10 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   // 解析出该项目的有效偏好；本机(admin)始终看全局。forks blob 绝不下发，仅以 _projectPrefsKeys
   // 元信息告知本机管理入口该不该出现。元字段以 _ 前缀标记，POST 侧会剥离不落盘。
   const _projectKey = getCurrentProjectKey();
+  // _scoped keys on isLocal (physical loopback): a remote admin still gets the scoped project
+  // view like other remote users — only the MANAGE capability (_projectPrefsKeys) is admin-gated.
   const _scoped = !isLocal && hasFork(prefs, _projectKey);
-  const _forkKeys = isLocal ? listForks(prefs) : null; // 计算需早于 delete prefsByProject
+  const _forkKeys = isAdmin ? listForks(prefs) : null; // 计算需早于 delete prefsByProject; admin（本机或远程）可见 fork 列表
   const _fork = _scoped ? prefs.prefsByProject[_projectKey] : null;
   delete prefs.prefsByProject;
   if (_scoped) {
@@ -90,11 +97,14 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
     prefs.approvalModal.voicePack = vpReconcile(LOG_DIR, prefs.approvalModal.voicePack);
   }
   // 项目独立配置元信息（_ 前缀 = 仅回包、不落盘；POST 侧统一剥离）：前端据此决定
-  // 非本机显示"启动项目独立配置"开关、本机在有 fork 时显示"配置管理"入口。
+  // 非本机显示"启动项目独立配置"开关、admin（本机或已鉴权远程）在有 fork 时显示"配置管理"入口。
+  // _isAdmin = loopback OR authenticated remote (container/cloud admin); _isLocal stays the
+  // physical loopback fact (drives remote-only affordances like "Download to local").
   prefs._isLocal = isLocal;
+  prefs._isAdmin = isAdmin;
   prefs._projectName = getCurrentProjectName();
   prefs._projectScoped = _scoped;
-  if (isLocal) prefs._projectPrefsKeys = _forkKeys;
+  if (isAdmin) prefs._projectPrefsKeys = _forkKeys;
   res.writeHead(200, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(prefs));
 }
@@ -119,9 +129,9 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       delete incoming.auth;
       delete incoming.authByProject;
       // Claude executable selection controls which local program CCV executes.
-      // It is machine-global and therefore writable only by the loopback admin,
-      // never by a remote/project-scoped preferences client.
-      if (!isLocal) {
+      // It is machine-global and therefore writable only by an admin (loopback, or an
+      // authenticated remote admin) — never by an unauthenticated remote/project client.
+      if (!isAdminReq(req, isLocal)) {
         delete incoming[CLAUDE_EXECUTABLE_PREF_KEY];
       } else if (Object.prototype.hasOwnProperty.call(incoming, CLAUDE_EXECUTABLE_PREF_KEY)) {
         const value = incoming[CLAUDE_EXECUTABLE_PREF_KEY];
@@ -211,7 +221,7 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       delete prefs.auth;
       delete prefs.authByProject;
       delete prefs.prefsByProject; // fork blob 绝不回显（与 GET 一致）
-      if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+      if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
         delete prefs[CLAUDE_EXECUTABLE_PREF_KEY];
       }
       stripImConfigs(prefs);
@@ -228,9 +238,10 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
 }
 
 function claudeExecutablesGet(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+  const isAdmin = isAdminReq(req, isLocal);
+  if (!isAdmin || !isSameOriginBrowserRequest(req, parsedUrl)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: isLocal ? 'Same-origin request required' : 'Loopback only' }));
+    res.end(JSON.stringify({ error: isAdmin ? 'Same-origin request required' : 'Loopback only' }));
     return;
   }
   let configuredPath = null;
@@ -406,11 +417,12 @@ function retryConfigGet(req, res, _parsedUrl, _isLocal, _deps) {
 }
 
 function retryConfigPost(req, res, _parsedUrl, isLocal, deps) {
-  // Local-only, mirroring ccswitchImportPost: retry config is written to a
+  // Admin-only, mirroring ccswitchImportPost: retry config is written to a
   // cross-process file every ccv instance hot-reloads, and race/stagger with
-  // high concurrency multiplies the HOST's paid upstream requests — a LAN
-  // client must not be able to amplify the host's API spend machine-wide.
-  if (!isLocal) {
+  // high concurrency multiplies the HOST's paid upstream requests — an unauthenticated
+  // LAN client must not be able to amplify the host's API spend machine-wide.
+  // An authenticated remote admin (container/cloud) is trusted like the loopback admin.
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'retry config is local-only' }));
     return;
@@ -474,7 +486,7 @@ async function ccswitchProvidersGet(req, res, _parsedUrl, isLocal, _deps) {
 // POST body 可选 { setActive: true } —— 是否把 cc-switch 的 current 设为 cc-viewer active。
 // 默认不设（避免覆盖用户当前选择）。导入只 merge 列表，凭证刷新幂等。
 async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'cc-switch import is local-only' }));
     return;

package/server/routes/project-prefs.js

@@ -14,6 +14,7 @@ import { basename } from 'node:path';
 import { LOG_DIR } from '../../findcc.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import {
   getCurrentProjectKey, hasActiveProject, snapshotForFork, stripSensitive,
 } from '../lib/project-prefs.js';
@@ -73,7 +74,7 @@ async function updateHandler(req, res, parsedUrl, isLocal, deps) {
   const hasProject = typeof body.project === 'string' && body.project;
   let key;
   if (hasProject) {
-    if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+    if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
     key = body.project;
   } else {
     if (!hasActiveProject()) return sendJson(res, 409, { error: 'no-active-project' });
@@ -91,9 +92,9 @@ async function updateHandler(req, res, parsedUrl, isLocal, deps) {
   sendJson(res, 200, { ok: true });
 }
 
-// POST /api/project-prefs/delete — remove a fork. Loopback admin only.
+// POST /api/project-prefs/delete — remove a fork. Admin only (loopback or authenticated remote).
 async function deleteHandler(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
   let body;
   try { body = await readBody(req, deps); } catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
   const key = body.project;
@@ -107,9 +108,9 @@ async function deleteHandler(req, res, parsedUrl, isLocal, deps) {
   sendJson(res, 200, { ok: true });
 }
 
-// GET /api/project-prefs — every fork + contents (for the loopback management modal).
+// GET /api/project-prefs — every fork + contents (for the admin management modal).
 function listHandler(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
   const prefs = readPrefsRaw();
   const forks = (prefs && prefs.prefsByProject && typeof prefs.prefsByProject === 'object') ? prefs.prefsByProject : {};
   const currentKey = getCurrentProjectKey();

package/server/routes/skills.js

@@ -3,6 +3,7 @@ import { mkdirSync, writeFileSync, existsSync } from 'node:fs';
 import { join, resolve, sep, dirname } from 'node:path';
 import { getClaudeConfigDir } from '../../findcc.js';
 import { listSkills, moveSkill, deleteSkill, validateSkillName } from '../lib/skills-api.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 async function skillsList(req, res) {
   try {
@@ -44,10 +45,12 @@ function skillsToggle(req, res) {
   });
 }
 
-// Skill 永久删除 —— 把单个 skill 文件夹从 skills/ 或 skills-skip/ 彻底删除（不可恢复）
-// loopback-only：不可逆 rmSync 不向局域网暴露（toggle 是可逆 move，这里更严）。
+// Permanently delete a skill — rmSync the skill folder from skills/ or skills-skip/ (irreversible).
+// admin-only: an irreversible rmSync is not exposed to unauthenticated LAN clients (toggle is a
+// reversible move — this is stricter); an authenticated remote admin (container/cloud) is allowed
+// the same as the loopback admin.
 function skillsDelete(req, res, parsedUrl, isLocal) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: 'Loopback only' }));
     return;

package/server/routes/voice-pack.js

@@ -1,6 +1,6 @@
 // Voice-pack routes (moved verbatim from server.js handleRequest).
 // Manages user-uploaded audio + serves the bundled "皇上系列" default pack.
-// Uploads are loopback-only — LAN clients can play but not write.
+// Uploads/deletes are admin-only (loopback, or authenticated remote admin) — other clients can play but not write.
 import { lstatSync, statSync, createReadStream } from 'node:fs';
 import { LOG_DIR } from '../../findcc.js';
 import {
@@ -18,6 +18,7 @@ import {
   EVENT_KEYS as VP_EVENT_KEYS,
   MAX_AUDIO_BYTES as VP_MAX_BYTES,
 } from '../lib/voice-pack-manager.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 function voicePackList(req, res) {
   try {
@@ -45,10 +46,10 @@ function voicePackList(req, res) {
 }
 
 function voicePackUpload(req, res, parsedUrl, isLocal) {
-  // Loopback-only — refuse LAN clients even if they hold a valid token.
-  // The token already gates LAN access but voice-pack writes touch the local FS
-  // and end up reachable from every client; keep the write side strictly local.
-  if (!isLocal) {
+  // Admin-only — refuse unauthenticated LAN clients even if they hold a valid token.
+  // The token already gates LAN access but voice-pack writes touch the local FS and end up
+  // reachable from every client; an authenticated remote admin (container/cloud) is allowed.
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: 'Upload allowed from loopback only' }));
     return;
@@ -106,7 +107,7 @@ function voicePackUpload(req, res, parsedUrl, isLocal) {
 }
 
 function voicePackDelete(req, res, parsedUrl, isLocal) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: 'Delete allowed from loopback only' }));
     return;

package/server/server.js

@@ -757,17 +757,27 @@ async function handleRequest(req, res) {
   const isLocal = remoteIp === '127.0.0.1' || remoteIp === '::1' || remoteIp === '::ffff:127.0.0.1';
   const isStaticAsset = url.startsWith('/assets/') || url === '/favicon.ico';
   const wantsHtml = method === 'GET' && ((req.headers.accept || '').includes('text/html') || url === '/');
+  // Hoisted so decideAuth and the isAdmin computation share the SAME credential values.
+  const urlToken = parsedUrl.searchParams.get('token');
+  const cookieToken = parseCookies(req.headers.cookie).ccv_auth;
   const authDecision = decideAuth({
     isStaticAsset,
     pathname: url,
     isLocal,
-    urlToken: parsedUrl.searchParams.get('token'),
-    cookieToken: parseCookies(req.headers.cookie).ccv_auth,
+    urlToken,
+    cookieToken,
     accessToken: ACCESS_TOKEN,
     enabled: authConfig.enabled,
     password: authConfig.password,
     wantsHtml,
   });
+  // Remote-admin elevation (container/cloud deploy): an authenticated remote caller is
+  // treated as admin for management routes (isAdminReq in lib/is-admin.js). isAdmin comes
+  // straight from decideAuth (single source of truth — it mirrors the remote-allow branches
+  // and can never drift from them). Loopback is always admin. This MUST NOT relax the
+  // internal machine bridges (events.js hook notifies, ask-perm.js streamChunk) — those
+  // stay strictly loopback + INTERNAL_TOKEN.
+  req.ccvIsAdmin = authDecision.isAdmin === true;
   if (authDecision.action === 'login-page') {
     const lang = localeFromAcceptLanguage(req.headers['accept-language']) || getLang();
     res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });