cc-viewer 1.8.9 → 1.8.11

package/server/lib/skills-api.js

@@ -24,43 +24,65 @@ export function validateSkillName(name) {
   return true;
 }
 
-// 解析 SKILL.md frontmatter 的 description。支持 3 种 YAML 形式：
-//   1) description: plain text            ← 单行
-//   2) description: "quoted text"         ← 带引号
-//   3) description: |                     ← block scalar（保留换行）
-//      multi\n line\n content
-//   4) description: >                     ← folded scalar（换行折成空格）
-// 失败返 null，UI 兜底"无描述"。
-function parseSkillMdFrontmatter(skillDir) {
-  const mdPath = join(skillDir, 'SKILL.md');
-  if (!existsSync(mdPath)) return null;
-  try {
-    const text = readFileSync(mdPath, 'utf8');
-    const m = /^---\s*\n([\s\S]*?)\n---/.exec(text);
-    if (!m) return null;
-    const lines = m[1].split('\n');
-    let descIdx = -1, firstVal = '';
-    for (let i = 0; i < lines.length; i++) {
-      const lm = /^description\s*:\s*(.*)$/.exec(lines[i]);
-      if (lm) { descIdx = i; firstVal = lm[1].trim(); break; }
-    }
-    if (descIdx < 0) return null;
+// Parse SKILL.md frontmatter text → { name, description } (each string|null),
+// or null when no parseable `---` frontmatter block exists.
+// name: single-line `name: value` (surrounding quotes stripped).
+// description supports 4 YAML forms:
+//   1) description: plain text            ← single line
+//   2) description: "quoted text"         ← quoted
+//   3) description: |                     ← block scalar (keeps newlines)
+//   4) description: >                     ← folded scalar (newlines → spaces)
+// Values that are empty after trimming are returned as null (treated as absent).
+export function parseSkillFrontmatter(text) {
+  // Tolerate CRLF line endings (Windows-authored SKILL.md) — otherwise the whole
+  // frontmatter block fails to match and valid skills are rejected as INVALID_FRONTMATTER.
+  const m = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---/.exec(text);
+  if (!m) return null;
+  const lines = m[1].split('\n').map((l) => l.replace(/\r$/, ''));
 
-    // block scalar: | / |- / > / >-
+  let name = null;
+  const nm = /^name\s*:\s*(.*)$/m.exec(m[1]);
+  if (nm) {
+    const v = nm[1].trim().replace(/\r$/, '').replace(/^["']|["']$/g, '');
+    name = v || null;
+  }
+
+  let description = null;
+  let descIdx = -1, firstVal = '';
+  for (let i = 0; i < lines.length; i++) {
+    const lm = /^description\s*:\s*(.*)$/.exec(lines[i]);
+    if (lm) { descIdx = i; firstVal = lm[1].trim(); break; }
+  }
+  if (descIdx >= 0) {
     if (/^[|>][-+]?$/.test(firstVal)) {
+      // block scalar: | / |- / > / >-
       const fold = firstVal.startsWith('>');
       const collected = [];
       for (let i = descIdx + 1; i < lines.length; i++) {
         const line = lines[i];
-        // 块结束：非空且不以空白字符开头（视为下一个顶级 key）
+        // Block ends at a non-empty line without leading whitespace (next top-level key).
         if (line !== '' && !/^\s/.test(line)) break;
         collected.push(line.replace(/^\s+/, ''));
       }
       while (collected.length && collected[collected.length - 1] === '') collected.pop();
-      return fold ? collected.join(' ') : collected.join('\n');
+      description = fold ? collected.join(' ') : collected.join('\n');
+    } else {
+      description = firstVal.replace(/^["']|["']$/g, '');
     }
-    // 单行 scalar（去首尾引号）
-    return firstVal.replace(/^["']|["']$/g, '');
+    if (!description || !description.trim()) description = null;
+  }
+
+  return { name, description };
+}
+
+// Read <skillDir>/SKILL.md and return the frontmatter description (delegates to
+// parseSkillFrontmatter). Returns null on any failure — the UI falls back to "no description".
+function parseSkillMdFrontmatter(skillDir) {
+  const mdPath = join(skillDir, 'SKILL.md');
+  if (!existsSync(mdPath)) return null;
+  try {
+    const fm = parseSkillFrontmatter(readFileSync(mdPath, 'utf8'));
+    return fm ? fm.description : null;
   } catch { return null; }
 }
 

package/server/routes/auth.js

@@ -1,11 +1,12 @@
 // Password-auth API routes. See server/lib/auth.js for the underlying logic and
 // the plan for the overall design.
 //
-//   GET  /api/auth/state   — public; reveals the plaintext password only to admin (isLocal).
-//   POST /api/auth/config  — admin-only (!isLocal → 403); enable/disable + set password.
+//   GET  /api/auth/state   — public; reveals the plaintext password only to a loopback admin.
+//   POST /api/auth/config  — admin-only (loopback, or authenticated remote admin; else 403); enable/disable + set password.
 //   POST /api/auth/login   — public + IP rate-limited; on success Set-Cookie ccv_auth=ACCESS_TOKEN.
 import { createHash, timingSafeEqual } from 'node:crypto';
 import { generatePassword } from '../lib/auth.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 
@@ -28,14 +29,15 @@ function readBody(req, deps, cb) {
   req.on('end', () => cb(body));
 }
 
-function buildState(deps, isLocal) {
+function buildState(deps, isLocal, isAdmin) {
   // Reports the EFFECTIVE config (gate enforces this) plus enough scope info for the
   // admin UI to manage both the global default and a per-project override.
-  // Passwords (effective + global) are only revealed to the admin (local).
+  // Plaintext passwords stay loopback-only even for an authenticated remote admin
+  // (mirrors the IM status secret policy); `isAdmin` reflects loopback OR remote-auth.
   const s = deps.getAuthState();
   return {
     enabled: s.effective.enabled,
-    isAdmin: isLocal,
+    isAdmin,
     password: isLocal ? s.effective.password : null,
     scope: s.scope,                       // 'project' | 'global' — which one is in effect
     hasProjectOverride: s.hasProjectOverride,
@@ -81,11 +83,11 @@ function recordFailedAttempt(ip) {
 
 function authState(req, res, parsedUrl, isLocal, deps) {
   res.writeHead(200, JSON_HEADERS);
-  res.end(JSON.stringify(buildState(deps, isLocal)));
+  res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
 }
 
 function authConfigPost(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'admin-only' }));
     return;
@@ -104,7 +106,7 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     if (incoming.clearOverride === true) {
       deps.clearAuthOverride();
       res.writeHead(200, JSON_HEADERS);
-      res.end(JSON.stringify(buildState(deps, isLocal)));
+      res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
       return;
     }
     // Target scope: explicit 'global' → global; otherwise project when this server has a
@@ -126,7 +128,7 @@ function authConfigPost(req, res, parsedUrl, isLocal, deps) {
     }
     deps.setAuthConfig(next, scope);
     res.writeHead(200, JSON_HEADERS);
-    res.end(JSON.stringify(buildState(deps, isLocal)));
+    res.end(JSON.stringify(buildState(deps, isLocal, isAdminReq(req, isLocal))));
   });
 }
 

package/server/routes/dingtalk.js

@@ -1,11 +1,13 @@
 // DingTalk bridge config API. See server/lib/im/dingtalk-config.js (storage) and
 // server/lib/im/dingtalk-bridge.js (the Stream client) for the underlying logic.
 //
-//   GET  /api/dingtalk/status — public; remote callers get only hasSecret, the local (admin)
-//                               caller additionally gets the plaintext appSecret to view/copy.
-//   POST /api/dingtalk/config — loopback-only (!isLocal → 403); save creds, reload bridge.
-//   POST /api/dingtalk/test   — loopback-only; validate creds (fetch an access token).
+//   GET  /api/dingtalk/status — public; remote callers get only enabled+hasSecret+connection; an
+//                               authenticated remote admin additionally gets process+pid and lastError
+//                               (error chip); only the plaintext appSecret stays loopback-only.
+//   POST /api/dingtalk/config — admin-only (loopback, or authenticated remote admin); save creds, reload bridge.
+//   POST /api/dingtalk/test   — admin-only; validate creds (fetch an access token).
 import { loadDingTalkState, saveDingTalkConfig, loadDingTalkConfig } from '../lib/im/dingtalk-config.js';
+import { isAdminReq } from '../lib/is-admin.js';
 
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 
@@ -36,7 +38,19 @@ async function dingtalkStatus(req, res, parsedUrl, isLocal, deps) {
   }
   res.writeHead(200, JSON_HEADERS);
   if (!isLocal) {
-    // connectionState passes through as-is; lastError stays loopback-only (mirrors routes/im.js).
+    // Authenticated remote admin (container/cloud): full process/connection state (incl.
+    // `lastError` so the header chip can render the real error) — only the plaintext appSecret
+    // stays loopback-only (the frontend edit form only reads hasSecret).
+    if (isAdminReq(req, isLocal)) {
+      res.end(JSON.stringify({
+        ...loadDingTalkState(),
+        connection: conn,
+        process: processInfo,
+        pid: deps.dingtalk.isWorker ? process.pid : (processInfo?.pid ?? null),
+      }));
+      return;
+    }
+    // connectionState passes through as-is; lastError stays loopback-only (non-admin remote).
     res.end(JSON.stringify({
       enabled: loadDingTalkState().enabled,
       hasSecret: loadDingTalkState().hasSecret,
@@ -55,8 +69,9 @@ async function dingtalkStatus(req, res, parsedUrl, isLocal, deps) {
 }
 
 function dingtalkConfigPost(req, res, parsedUrl, isLocal, deps) {
-  // Loopback-only: an app_secret must never be settable over the LAN even with a valid token.
-  if (!isLocal) {
+  // Admin-only (loopback, or an authenticated remote admin): an app_secret must never be
+  // settable by an unauthenticated LAN client even with a valid token.
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'Loopback only' }));
     return;
@@ -104,7 +119,7 @@ function dingtalkConfigPost(req, res, parsedUrl, isLocal, deps) {
 }
 
 function dingtalkTestPost(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, JSON_HEADERS);
     res.end(JSON.stringify({ error: 'Loopback only' }));
     return;

package/server/routes/files-fs.js

@@ -6,7 +6,7 @@ import {
 import { join, dirname, basename, resolve, sep } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { execFile, spawn } from 'node:child_process';
-import { bumpWorkspacesVersion } from '../lib/file-access-policy.js';
+import { bumpWorkspacesVersion, isReadAllowed } from '../lib/file-access-policy.js';
 import { validateImportDir } from '../lib/file-api.js';
 import { PROFILE_PATH, _projectName, _logDir } from '../interceptor.js';
 import { LOG_DIR, getClaudeConfigDir } from '../../findcc.js';
@@ -659,6 +659,80 @@ function resolvePath(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// Lightweight existence probe for the chat markdown code-span feature: the web
+// client batches path-looking inline code spans here and only renders them
+// clickable when the file provably exists. Uniform {exists:false} for every
+// not-readable-as-regular-file outcome (missing / outside allowlist / denied /
+// directory) — never echoes policy reasons, so this is a strictly weaker oracle
+// than /api/file-content's 404/403 split.
+const FILES_EXISTS_MAX_BATCH = 50;
+const FILES_EXISTS_MAX_PATH = 1024;
+const FILES_EXISTS_MAX_BODY = 256 * 1024; // 50 × 1024 + JSON overhead ≪ this
+
+function filesExists(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  let aborted = false;
+  req.on('data', chunk => {
+    body += chunk;
+    if (body.length > FILES_EXISTS_MAX_BODY && !aborted) {
+      aborted = true;
+      res.writeHead(413, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Request too large' }));
+      req.destroy();
+    }
+  });
+  req.on('end', () => {
+    if (aborted) return;
+    let parsed;
+    try { parsed = JSON.parse(body); } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid request body' }));
+      return;
+    }
+    const paths = parsed && parsed.paths;
+    if (!Array.isArray(paths)) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid paths' }));
+      return;
+    }
+    if (paths.length > FILES_EXISTS_MAX_BATCH) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Too many paths' }));
+      return;
+    }
+    for (const p of paths) {
+      if (typeof p !== 'string' || p.length > FILES_EXISTS_MAX_PATH) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid path' }));
+        return;
+      }
+    }
+    const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+    const results = paths.map(p => ({ path: p, exists: probeFileExists(p, cwd) }));
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ results }));
+  });
+}
+
+function probeFileExists(p, cwd) {
+  try {
+    const isAbs = /^([a-zA-Z]:[\\/]|[\\/])/.test(p);
+    // Mirrors /api/file-content: a relative `..` segment can never be opened by
+    // the click path either, so report it as non-existent rather than 400.
+    // Segment-wise check — a legit filename like `foo..bar.md` must not match.
+    if (!isAbs && p.split(/[\\/]/).includes('..')) return false;
+    // Resolve BEFORE isReadAllowed: realpathSync inside the policy resolves
+    // relative input against process.cwd(), which is the app dir (not the
+    // project) in packaged Electron runs.
+    const absPath = isAbs ? p : resolve(cwd, p);
+    const policy = isReadAllowed(absPath);
+    if (!policy.ok) return false;
+    return statSync(policy.real).isFile();
+  } catch {
+    return false; // one bad path must not sink the whole batch
+  }
+}
+
 function createFile(req, res, parsedUrl, isLocal, deps) {
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
@@ -964,6 +1038,7 @@ export const filesFsRoutes = [
   { method: 'POST', match: 'exact', path: '/api/reveal-file', handler: revealFile },
   { method: 'POST', match: 'exact', path: '/api/open-file', handler: openFile },
   { method: 'POST', match: 'exact', path: '/api/resolve-path', handler: resolvePath },
+  { method: 'POST', match: 'exact', path: '/api/files-exists', handler: filesExists },
   { method: 'POST', match: 'exact', path: '/api/create-file', handler: createFile },
   { method: 'POST', match: 'exact', path: '/api/open-terminal', handler: openTerminal },
   { method: 'POST', match: 'exact', path: '/api/create-dir', handler: createDir },

package/server/routes/im.js

@@ -1,13 +1,15 @@
 // Generic multi-IM bridge config + process-control API. Platform-parametric (keyed by descriptor id).
 //
-//   GET  /api/im/:platform/status  — public; remote callers get only enabled+hasSecret+connection,
-//                                    the local (admin) caller additionally gets plaintext secrets + process info.
-//   POST /api/im/:platform/config  — loopback-only; save creds, then drive the process manager
+//   GET  /api/im/:platform/status  — public; remote callers get only enabled+hasSecret+connection;
+//                                    an authenticated remote admin additionally gets process+pid and
+//                                    connection/process lastError (for the error chip); only the
+//                                    plaintext secrets stay loopback-only; the loopback admin gets all.
+//   POST /api/im/:platform/config  — admin-only (loopback, or authenticated remote admin); save creds, then drive the process manager
 //                                    (enable→stop+spawn worker, disable→stop). Allowlist is optional:
 //                                    enabling with an empty one warns (not blocked) since the worker
 //                                    runs with --dangerously-skip-permissions.
-//   POST /api/im/:platform/test    — loopback-only; validate creds (fetch an access token).
-//   POST /api/im/:platform/process — loopback-only; {action:start|stop|restart} the detached worker.
+//   POST /api/im/:platform/test    — admin-only; validate creds (fetch an access token).
+//   POST /api/im/:platform/process — admin-only; {action:start|stop|restart} the detached worker.
 //                                    'start' requires stored creds (400 `missing …` otherwise) and
 //                                    also persists enabled:true (merged into the stored config):
 //                                    a worker spawned while the config says disabled no-ops in
@@ -27,6 +29,7 @@ import { readImAppendSystem, writeImAppendSystem, buildImAppendSystemPreset, MAX
 import { imDir } from '../lib/im/im-lock.js';
 import { resolvePrefLang } from '../lib/im/im-lang.js';
 import { listSkills, moveSkill, deleteSkill } from '../lib/skills-api.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import { importSkillTo } from './skills.js';
 import { LOG_DIR } from '../../findcc.js';
 import { join, basename } from 'node:path';
@@ -116,7 +119,20 @@ async function imStatus(req, res, parsedUrl, isLocal, deps) {
 
   res.writeHead(200, JSON_HEADERS);
   if (!isLocal) {
-    // Loopback gate: a token-authorized LAN client sees only what the header chip needs.
+    // Authenticated remote admin (container/cloud): full process/connection state so the settings
+    // UI start() poll sees `process.state === 'ready'` AND the header chip can render the real
+    // error (`connection.lastError` — the worker's own report, not a stored secret). Only the
+    // plaintext SECRETS stay loopback-only (the frontend edit form only ever reads hasSecret).
+    if (isAdminReq(req, isLocal)) {
+      res.end(JSON.stringify({
+        ...state,
+        connection,
+        process: processInfo,
+        pid: deps.im.isWorker ? process.pid : (processInfo?.pid ?? null),
+      }));
+      return;
+    }
+    // Unauthenticated/non-admin remote: only what the header chip needs.
     // connectionState is passed through as-is (no defaulting); lastError stays loopback-only.
     res.end(JSON.stringify({
       enabled: state.enabled,
@@ -141,7 +157,7 @@ async function imStatus(req, res, parsedUrl, isLocal, deps) {
 function imConfigPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, async (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -182,7 +198,7 @@ function imConfigPost(req, res, parsedUrl, isLocal, deps) {
 function imTestPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, async (body) => {
     let incoming = {};
     try { incoming = body ? JSON.parse(body) : {}; } catch { /* fall back to stored */ }
@@ -204,7 +220,7 @@ function imTestPost(req, res, parsedUrl, isLocal, deps) {
 function imProcessPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   // 只有主进程负责管理 worker；worker 自身不应被要求 spawn/stop（避免嵌套）。
   if (deps.im.isWorker) {
     res.writeHead(409, JSON_HEADERS);
@@ -273,23 +289,23 @@ function imLogs(req, res, parsedUrl, isLocal, deps) {
 }
 
 // 发送者身份映射（senderId → {name, avatar, ts}）：供「对话记录」按 senderId 显示真实姓名+头像。
-// loopback-only：姓名/头像属个人信息，不向局域网暴露（与 config/test/process 同级）。
+// admin-only: names/avatars are personal info, not exposed to unauthenticated LAN clients (same tier as config/test/process).
 function imSenders(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   res.writeHead(200, JSON_HEADERS);
   res.end(JSON.stringify({ platform: id, senders: readSenders(id) }));
 }
 
-// 「模型性格定义」= 该 IM worker 工作目录下的 CC_APPEND_SYSTEM.md（启动 claude 时注入为
-// --append-system-prompt-file）。loopback-only：本地文件内容、admin-only。
+// "Model persona definition" = CC_APPEND_SYSTEM.md in that IM worker's working dir (injected at claude launch as
+// --append-system-prompt-file). admin-only: local file content (loopback, or an authenticated remote admin).
 // 该文件仅在 worker 启动时读取一次，故保存后需重启该 IM worker 才生效（前端据此提示用户）。
 // ?default=1：返回当前语言的预置文本（绕过磁盘文件），供编辑器「恢复默认」按钮加载——不落盘，由用户保存才生效。
 function imAppendSystemGet(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   try {
     const def = parsedUrl?.searchParams?.get('default');
     const lang = resolvePrefLang();
@@ -305,7 +321,7 @@ function imAppendSystemGet(req, res, parsedUrl, isLocal, deps) {
 function imAppendSystemPost(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -327,13 +343,13 @@ function imAppendSystemPost(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
-// 「${IM} SKILL 管理」= 该 IM worker 工作目录下的 .claude/skills/。loopback-only（本地文件操作、admin-only）。
+// "${IM} SKILL management" = the .claude/skills/ under that IM worker's working dir. admin-only (local file ops; loopback, or an authenticated remote admin).
 // 复用 skills-api 的 listSkills/moveSkill（按 projectDir 参数化）+ skills.js 的 importSkillTo（按 skillsRoot 参数化）。
 // IM worker 仅在启动时读取 skills，故增删/启停后需重启该 IM worker 才生效（前端提示用户）。
 function imSkills(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   try {
     const dir = imDir(id);
     // projectDir 与 homeDir 都指向 IM 目录：两次扫描命中同一 .claude/skills（user+project 重复），
@@ -350,7 +366,7 @@ function imSkills(req, res, parsedUrl, isLocal, deps) {
 function imSkillsToggle(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -371,7 +387,7 @@ function imSkillsToggle(req, res, parsedUrl, isLocal, deps) {
 function imSkillsDelete(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   readBody(req, deps, (body) => {
     let incoming;
     try { incoming = JSON.parse(body); }
@@ -392,7 +408,7 @@ function imSkillsDelete(req, res, parsedUrl, isLocal, deps) {
 function imSkillsImport(req, res, parsedUrl, isLocal, deps) {
   const id = platformOf(parsedUrl.pathname);
   if (!id) { notFound(res); return; }
-  if (!isLocal) { loopbackOnly(res); return; }
+  if (!isAdminReq(req, isLocal)) { loopbackOnly(res); return; }
   importSkillTo(req, res, { skillsRoot: join(imDir(id), '.claude', 'skills'), windowsReserved: deps.WINDOWS_RESERVED_NAMES });
 }
 

package/server/routes/preferences.js

@@ -14,6 +14,7 @@ import { readClaudeProjectModel } from '../lib/context-watcher.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im/im-config.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import {
   getCurrentProjectKey, getCurrentProjectName, hasFork, listForks, resolveScoped,
 } from '../lib/project-prefs.js';
@@ -52,12 +53,16 @@ export function _resetThemeSyncForTests() { _themeSyncInFlight = false; }
 function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   let prefs = {};
   try { if (existsSync(deps.getPrefsFile())) prefs = JSON.parse(readFileSync(deps.getPrefsFile(), 'utf-8')); } catch { }
+  // isAdmin = loopback OR authenticated remote (container/cloud admin); _isLocal stays the
+  // physical loopback fact. Computed once up-front so every admin gate below (fork keys,
+  // executable key, _isAdmin echo) uses the SAME value.
+  const isAdmin = isAdminReq(req, isLocal);
   // auth 配置(含明文密码)与偏好同存于 preferences.json,但绝不能从这里下发 ——
   // 密码仅由 admin-only 的 /api/auth/state 暴露给本机。否则远程密码登录用户也能读到明文。
   // 全局 auth 与每个项目的 authByProject 覆盖都要剥离(后者同样含明文密码)。
   delete prefs.auth;
   delete prefs.authByProject;
-  if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+  if (!isAdmin || !isSameOriginBrowserRequest(req, parsedUrl)) {
     delete prefs[CLAUDE_EXECUTABLE_PREF_KEY];
   }
   stripImConfigs(prefs); // dingtalk / feishu / … — admin-only, never to a LAN client
@@ -65,8 +70,10 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
   // 解析出该项目的有效偏好；本机(admin)始终看全局。forks blob 绝不下发，仅以 _projectPrefsKeys
   // 元信息告知本机管理入口该不该出现。元字段以 _ 前缀标记，POST 侧会剥离不落盘。
   const _projectKey = getCurrentProjectKey();
+  // _scoped keys on isLocal (physical loopback): a remote admin still gets the scoped project
+  // view like other remote users — only the MANAGE capability (_projectPrefsKeys) is admin-gated.
   const _scoped = !isLocal && hasFork(prefs, _projectKey);
-  const _forkKeys = isLocal ? listForks(prefs) : null; // 计算需早于 delete prefsByProject
+  const _forkKeys = isAdmin ? listForks(prefs) : null; // 计算需早于 delete prefsByProject; admin（本机或远程）可见 fork 列表
   const _fork = _scoped ? prefs.prefsByProject[_projectKey] : null;
   delete prefs.prefsByProject;
   if (_scoped) {
@@ -90,11 +97,14 @@ function preferencesGet(req, res, parsedUrl, isLocal, deps) {
     prefs.approvalModal.voicePack = vpReconcile(LOG_DIR, prefs.approvalModal.voicePack);
   }
   // 项目独立配置元信息（_ 前缀 = 仅回包、不落盘；POST 侧统一剥离）：前端据此决定
-  // 非本机显示"启动项目独立配置"开关、本机在有 fork 时显示"配置管理"入口。
+  // 非本机显示"启动项目独立配置"开关、admin（本机或已鉴权远程）在有 fork 时显示"配置管理"入口。
+  // _isAdmin = loopback OR authenticated remote (container/cloud admin); _isLocal stays the
+  // physical loopback fact (drives remote-only affordances like "Download to local").
   prefs._isLocal = isLocal;
+  prefs._isAdmin = isAdmin;
   prefs._projectName = getCurrentProjectName();
   prefs._projectScoped = _scoped;
-  if (isLocal) prefs._projectPrefsKeys = _forkKeys;
+  if (isAdmin) prefs._projectPrefsKeys = _forkKeys;
   res.writeHead(200, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(prefs));
 }
@@ -119,9 +129,9 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       delete incoming.auth;
       delete incoming.authByProject;
       // Claude executable selection controls which local program CCV executes.
-      // It is machine-global and therefore writable only by the loopback admin,
-      // never by a remote/project-scoped preferences client.
-      if (!isLocal) {
+      // It is machine-global and therefore writable only by an admin (loopback, or an
+      // authenticated remote admin) — never by an unauthenticated remote/project client.
+      if (!isAdminReq(req, isLocal)) {
         delete incoming[CLAUDE_EXECUTABLE_PREF_KEY];
       } else if (Object.prototype.hasOwnProperty.call(incoming, CLAUDE_EXECUTABLE_PREF_KEY)) {
         const value = incoming[CLAUDE_EXECUTABLE_PREF_KEY];
@@ -211,7 +221,7 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       delete prefs.auth;
       delete prefs.authByProject;
       delete prefs.prefsByProject; // fork blob 绝不回显（与 GET 一致）
-      if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+      if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
         delete prefs[CLAUDE_EXECUTABLE_PREF_KEY];
       }
       stripImConfigs(prefs);
@@ -228,9 +238,10 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
 }
 
 function claudeExecutablesGet(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal || !isSameOriginBrowserRequest(req, parsedUrl)) {
+  const isAdmin = isAdminReq(req, isLocal);
+  if (!isAdmin || !isSameOriginBrowserRequest(req, parsedUrl)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: isLocal ? 'Same-origin request required' : 'Loopback only' }));
+    res.end(JSON.stringify({ error: isAdmin ? 'Same-origin request required' : 'Loopback only' }));
     return;
   }
   let configuredPath = null;
@@ -406,11 +417,12 @@ function retryConfigGet(req, res, _parsedUrl, _isLocal, _deps) {
 }
 
 function retryConfigPost(req, res, _parsedUrl, isLocal, deps) {
-  // Local-only, mirroring ccswitchImportPost: retry config is written to a
+  // Admin-only, mirroring ccswitchImportPost: retry config is written to a
   // cross-process file every ccv instance hot-reloads, and race/stagger with
-  // high concurrency multiplies the HOST's paid upstream requests — a LAN
-  // client must not be able to amplify the host's API spend machine-wide.
-  if (!isLocal) {
+  // high concurrency multiplies the HOST's paid upstream requests — an unauthenticated
+  // LAN client must not be able to amplify the host's API spend machine-wide.
+  // An authenticated remote admin (container/cloud) is trusted like the loopback admin.
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'retry config is local-only' }));
     return;
@@ -474,7 +486,7 @@ async function ccswitchProvidersGet(req, res, _parsedUrl, isLocal, _deps) {
 // POST body 可选 { setActive: true } —— 是否把 cc-switch 的 current 设为 cc-viewer active。
 // 默认不设（避免覆盖用户当前选择）。导入只 merge 列表，凭证刷新幂等。
 async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
-  if (!isLocal) {
+  if (!isAdminReq(req, isLocal)) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'cc-switch import is local-only' }));
     return;

package/server/routes/project-prefs.js

@@ -14,6 +14,7 @@ import { basename } from 'node:path';
 import { LOG_DIR } from '../../findcc.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { isAdminReq } from '../lib/is-admin.js';
 import {
   getCurrentProjectKey, hasActiveProject, snapshotForFork, stripSensitive,
 } from '../lib/project-prefs.js';
@@ -73,7 +74,7 @@ async function updateHandler(req, res, parsedUrl, isLocal, deps) {
   const hasProject = typeof body.project === 'string' && body.project;
   let key;
   if (hasProject) {
-    if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+    if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
     key = body.project;
   } else {
     if (!hasActiveProject()) return sendJson(res, 409, { error: 'no-active-project' });
@@ -91,9 +92,9 @@ async function updateHandler(req, res, parsedUrl, isLocal, deps) {
   sendJson(res, 200, { ok: true });
 }
 
-// POST /api/project-prefs/delete — remove a fork. Loopback admin only.
+// POST /api/project-prefs/delete — remove a fork. Admin only (loopback or authenticated remote).
 async function deleteHandler(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
   let body;
   try { body = await readBody(req, deps); } catch { return sendJson(res, 400, { error: 'Invalid JSON' }); }
   const key = body.project;
@@ -107,9 +108,9 @@ async function deleteHandler(req, res, parsedUrl, isLocal, deps) {
   sendJson(res, 200, { ok: true });
 }
 
-// GET /api/project-prefs — every fork + contents (for the loopback management modal).
+// GET /api/project-prefs — every fork + contents (for the admin management modal).
 function listHandler(req, res, parsedUrl, isLocal, deps) {
-  if (!isLocal) return sendJson(res, 403, { error: 'forbidden' });
+  if (!isAdminReq(req, isLocal)) return sendJson(res, 403, { error: 'forbidden' });
   const prefs = readPrefsRaw();
   const forks = (prefs && prefs.prefsByProject && typeof prefs.prefsByProject === 'object') ? prefs.prefsByProject : {};
   const currentKey = getCurrentProjectKey();