cc-viewer 1.9.0 → 1.9.2

package/server/routes/preferences.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { LOG_DIR, setLogDir, getClaudeConfigDir, discoverClaudeExecutables, resolveExplicitClaudePath, CLAUDE_EXECUTABLE_PREF_KEY } from '../../findcc.js';
-import { PROFILE_PATH, _defaultConfig, getActiveProfileId, getStoredRoles, isOfficialDefaultEndpoint, setActiveProfileForWorkspace, _loadProxyProfile, RETRY_CONFIG_PATH, _retryConfigState, _loadRetryConfigState } from '../interceptor.js';
+import { PROFILE_PATH, _defaultConfig, getActiveProfileId, getStoredRoles, isOfficialDefaultEndpoint, setActiveProfileForWorkspace, _loadProxyProfile, hydrateProfilesWithApiKeys, RETRY_CONFIG_PATH, _retryConfigState, _loadRetryConfigState } from '../interceptor.js';
 import { migrateProxyProfileList, isValidRoleValue, PROXY_ROLE_KEYS } from '../lib/interceptor-core.js';
 import { DEFAULT_RETRY_CONFIG, validateRetryConfig, resolveRetryConfig } from '../lib/proxy/proxy-retry.js';
 import { discoverCcSwitchProviders, mergeImportedProfiles } from '../lib/ccswitch-import.js';
@@ -15,7 +15,10 @@ import { inspectShellHook } from '../lib/shell-hook-inspect.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { listPlatforms } from '../lib/im/im-config.js';
 import { mutatePrefs, applyPrefsPatch, readPrefsRaw } from '../lib/prefs-store.js';
+import { mutateJsonSync } from '../lib/json-store.js';
+import { persistProfilesApiKeys } from '../lib/credential-access.js';
 import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
 import {
   getCurrentProjectKey, getCurrentProjectName, hasFork, listForks, resolveScoped,
 } from '../lib/project-prefs.js';
@@ -27,22 +30,6 @@ function stripImConfigs(obj) {
   if (obj) for (const id of listPlatforms()) delete obj[id];
 }
 
-// Loopback identifies the socket peer, not the browser page that initiated a
-// request. Since the server intentionally has permissive CORS for legacy APIs,
-// sensitive executable-selection endpoints need their own same-origin guard.
-function isSameOriginBrowserRequest(req, parsedUrl) {
-  const origin = req.headers?.origin;
-  if (!origin) return true; // CLI/native clients do not send Origin.
-  if (req.headers?.['sec-fetch-site'] === 'cross-site') return false;
-  try {
-    const originUrl = new URL(origin);
-    if (parsedUrl?.origin) return originUrl.origin.toLowerCase() === parsedUrl.origin.toLowerCase();
-    return originUrl.host.toLowerCase() === String(req.headers?.host || '').toLowerCase();
-  } catch {
-    return false;
-  }
-}
-
 // /theme 选择器特征：选项文案高特异、不太可能出现在普通生成输出里（ESC 兜底的门控签名）
 const THEME_PICKER_RE = /Auto \(match terminal\)|colorblind-friendly/;
 
@@ -163,12 +150,18 @@ function preferencesPost(req, res, parsedUrl, isLocal, deps) {
       // 切日志目录：把旧文件的完整内容（含 auth 密码 / prefsByProject forks / 其它偏好）带到新位置，
       // 避免切目录后密码与各项目 fork 凭空消失；并把写目标在 setLogDir 前后固定为"新文件"，让本次
       // 合并只跑在一个文件 / 一把锁上（不再因 LOG_DIR 中途漂移而劈裂进程内锁队列）。
+      // logDir 是机器全局、可改变进程数据根的操作（移动 vault 根会影响 LAN 门与代理注入），
+      // 因此只允许 admin（本机 loopback 或已鉴权远程 admin）触发——未鉴权远程/项目客户端直接剥掉。
       let targetFile = deps.getPrefsFile();
       let carried = null;
       if (incoming.logDir && typeof incoming.logDir === 'string') {
-        carried = readPrefsRaw(targetFile); // 旧文件全量（锁外读，迁移属罕见 admin 操作）
-        setLogDir(incoming.logDir);
-        targetFile = deps.getPrefsFile();
+        if (!isAdminReq(req, isLocal)) {
+          delete incoming.logDir; // non-admin cannot move the data root (would open the LAN gate)
+        } else {
+          carried = readPrefsRaw(targetFile); // 旧文件全量（锁外读，迁移属罕见 admin 操作）
+          setLogDir(incoming.logDir);
+          targetFile = deps.getPrefsFile();
+        }
       }
       // 全局写入：locked + atomic（prefs-store），与 fork 写共用同一把锁，避免并发写互相覆盖含密码的
       // preferences.json。Deep-merge approvalModal 的逻辑下沉到 applyPrefsPatch，与 /api/project-prefs
@@ -310,14 +303,28 @@ function proxyProfilesGet(req, res, parsedUrl, isLocal, deps) {
     if (Array.isArray(data.profiles)) {
       const { profiles: migrated, changed } = migrateProxyProfileList(data.profiles);
       if (changed) {
-        data = { ...data, profiles: migrated };
         try {
-          mkdirSync(dirname(PROFILE_PATH), { recursive: true });
-          writeFileSync(PROFILE_PATH, JSON.stringify(data, null, 2), { mode: 0o600 });
+          // Write the migration back while pulling apiKeys into the vault (so the old plaintext is
+          // never re-persisted). Read-merge-write INSIDE the lock (mutateJsonSync mutates in place
+          // and the kernel writes back the same reference), mutexed with the startup credential-strip
+          // and proxyProfilesPost.
+          mutateJsonSync(PROFILE_PATH, (current) => {
+            const base = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+            const stripped = persistProfilesApiKeys(migrated, null, { isMaskedFn: () => false });
+            base.profiles = stripped;
+            return base;
+          }, { mode: 0o600, strictCorrupt: true, fallback: {} });
+          data = { ...data, profiles: migrated };
           _loadProxyProfile();
         } catch { /* 迁移落盘失败不阻塞 GET；下次仍会尝试 */ }
       }
     }
+    // profile.json no longer carries apiKeys (they live in the credential vault) — decrypt-backfill
+    // them onto the list for serving. The local admin gets plaintext to view/copy; a remote caller
+    // is masked by deps.maskProfiles below (same as before).
+    if (Array.isArray(data.profiles)) {
+      data = { ...data, profiles: hydrateProfilesWithApiKeys(data.profiles) };
+    }
     // 用 interceptor.getActiveProfileId() 返回 effective active（workspace > profile.json.active > 'max'）
     const effectiveActive = getActiveProfileId();
     // 本机(127.0.0.1)= admin：下发明文 profile.apiKey 供本人在编辑表单(👁 折叠)里查阅/复制；已授权
@@ -353,22 +360,21 @@ function proxyProfilesPost(req, res, parsedUrl, isLocal, deps) {
       if (!incoming.profiles.some(p => p.id === 'max')) {
         incoming.profiles = [{ id: 'max', name: 'Default' }, ...(incoming.profiles || [])];
       }
-      // 如果 apiKey 是 mask 值（未修改），从磁盘读取原始值保留
-      let existing = {};
-      try { if (existsSync(PROFILE_PATH)) existing = JSON.parse(readFileSync(PROFILE_PATH, 'utf-8')); } catch { }
-      const existingMap = {};
-      if (existing.profiles) existing.profiles.forEach(p => { if (p.apiKey) existingMap[p.id] = p.apiKey; });
-      for (const p of incoming.profiles) {
-        if (p.apiKey && deps.isMasked(p.apiKey) && existingMap[p.id]) {
-          p.apiKey = existingMap[p.id];
-        }
-      }
-      // 只写 profiles 列表到 profile.json；active 不再入文件（避免跨进程串台）
-      // 保留老数据里的 active 字段不变，以便老版本 ccv 或手动编辑者的回退能力
-      const toWrite = { ...existing, profiles: incoming.profiles };
-      const dir = dirname(PROFILE_PATH);
-      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-      writeFileSync(PROFILE_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // Only the profiles list is written to profile.json; `active` is no longer persisted here
+      // (avoids cross-process clobbering). The existing file's `active` field is preserved so an
+      // older ccv or a hand editor can still fall back to it. Read-merge-write INSIDE the lock
+      // (mutateJsonSync), mutexed with the startup credential-strip and setActiveProfileForWorkspace —
+      // an unlocked snapshot would let persistProfilesApiKeys' deletion loop remove concurrently-added
+      // vault entries and overwrite the whole list.
+      // apiKey 抽出到凭证 vault（密文存 credentials.json），profile.json 不再携带 key。
+      // masked 回显 → 保留该 profile 的既有 vault 条目（不动、不回写 sentinel）；
+      // 新明文 → 写 vault；空 → 删该条目；被移除的 profile（全量替换端点）→ 删其 vault 条目。
+      mutateJsonSync(PROFILE_PATH, (current) => {
+        const existing = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+        const strippedProfiles = persistProfilesApiKeys(incoming.profiles, existing.profiles, { isMaskedFn: deps.isMasked });
+        existing.profiles = strippedProfiles;
+        return existing;
+      }, { mode: 0o600, strictCorrupt: true, fallback: {} });
       // 角色分配校验：只认 subagent/teammate 两个 key（roles.main 之类的杂键直接丢弃）；
       // 值必须是 follow / max / 入参 profiles 里存在的 id（按将落盘的列表校验，而非旧文件），
       // 非法值归 'follow'（宽容风格，不 400）。被删 profile 的悬空角色由读取时归 follow 兜底。
@@ -541,13 +547,20 @@ async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
         }
         existing = parsed;
       }
-      // merge
-      const merged = mergeImportedProfiles(existing.profiles || [], result.profiles);
-      const toWrite = { ...existing, profiles: merged.profiles };
-      // 落盘
-      const dir = dirname(PROFILE_PATH);
-      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-      writeFileSync(PROFILE_PATH, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+      // Persist: locked read-merge-write (mutateJsonSync), mutexed with the other profile.json
+      // writers. The merge MUST be recomputed inside the lock against the CURRENT on-disk list —
+      // computing it outside from a pre-lock snapshot and overwriting the whole list would erase a
+      // proxy-profiles POST that lands in that window. apiKeys are pulled into the vault; merge
+      // semantics never delete existing vault entries (no existingProfiles passed). cc-switch imports
+      // fresh plaintext keys (not a masked echo), so isMaskedFn is always false. `merged` is read
+      // back out of the lock for the response counts.
+      let merged = null;
+      mutateJsonSync(PROFILE_PATH, (current) => {
+        const base = (current && typeof current === 'object' && !Array.isArray(current)) ? current : {};
+        merged = mergeImportedProfiles(base.profiles || [], result.profiles);
+        base.profiles = persistProfilesApiKeys(merged.profiles, null, { isMaskedFn: () => false });
+        return base;
+      }, { mode: 0o600, strictCorrupt: true, fallback: {} });
       // active 处理：setActive=true 且 cc-switch 有 current → 切换；否则保持现状
       let activeChanged = false;
       if (setActive && result.currentId) {

package/server/routes/project-meta.js

@@ -4,8 +4,32 @@ import { join } from 'node:path';
 import { PACKAGE_JSON } from '../_paths.js';
 import { LOG_DIR } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
+import { sanitizePathComponent } from '../lib/v2/layout.js';
+import { resolveViewRoot } from '../lib/view-root.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
 import { detectHomebrewInstall } from '../lib/updater.js';
 
+// Multi-project (2026-10, review P2-6): stats reads for a VIEWED project must
+// not become a presence oracle over LOG_DIR — `?project=` is accepted ONLY
+// when it resolves to a registered workspace / live PTY (or the bound
+// project), never an arbitrary sanitized name.
+function _resolveStatsName(projectParam, res) {
+  if (!projectParam) return _projectName || '';
+  const r = resolveViewRoot({
+    projectParam,
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+  });
+  if (!r.ok) {
+    res.writeHead(r.status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: r.error }));
+    return null;
+  }
+  return sanitizePathComponent(projectParam);
+}
+
 // 判定当前 cc-viewer 的安装渠道，供前端精准匹配升级命令。
 //   - electron：桌面版（in-process server），走 GitHub Releases 重新下载安装包。
 //   - brew：Homebrew Cellar 布局命中 → `brew upgrade cc-viewer`（npm install -g 会跟 Cellar 打架）。
@@ -44,14 +68,19 @@ function versionInfo(req, res) {
   }
 }
 
-function projectStats(req, res) {
+function projectStats(req, res, parsedUrl) {
   try {
-    if (!_projectName) {
+    // Multi-project (2026-10): project-stats resolves the VIEWED project
+    // (?project=, registered/live only — never an arbitrary name).
+    const projectParam = parsedUrl && parsedUrl.searchParams ? parsedUrl.searchParams.get('project') : null;
+    const name = _resolveStatsName(projectParam, res);
+    if (name === null) return; // error already replied
+    if (!name) {
       res.writeHead(404, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'No project name' }));
       return;
     }
-    const statsFile = join(LOG_DIR, _projectName, `${_projectName}.json`);
+    const statsFile = join(LOG_DIR, name, `${name}.json`);
     if (!existsSync(statsFile)) {
       res.writeHead(404, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'Stats file not found' }));

package/server/routes/proxy-stats.js

@@ -10,17 +10,45 @@ import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { LOG_DIR } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
+import { sanitizePathComponent } from '../lib/v2/layout.js';
+import { resolveViewRoot } from '../lib/view-root.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
 
-// GET /api/proxy-stats — returns the current project's proxy retry stats (proxyStats field).
-// Response body: { proxyStats: {...} }; proxyStats is null when there is no data.
-function getProxyStats(req, res) {
+// Multi-project (2026-10, review P2-6): stats reads for a VIEWED project must
+// not become a presence oracle over LOG_DIR — `?project=` is accepted ONLY
+// when it resolves to a registered workspace / live PTY (or the bound
+// project), never an arbitrary sanitized name.
+function _resolveStatsName(projectParam, res) {
+  if (!projectParam) return _projectName || '';
+  const r = resolveViewRoot({
+    projectParam,
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+  });
+  if (!r.ok) {
+    res.writeHead(r.status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: r.error }));
+    return null;
+  }
+  return sanitizePathComponent(projectParam);
+}
+
+// GET /api/proxy-stats — returns the VIEWED project's proxy retry stats
+// (?project=, registered/live only; the log store is name-keyed, not fs-dir).
+// Response body: { proxyStats: {...} }; null when there is no data.
+function getProxyStats(req, res, parsedUrl) {
   try {
-    if (!_projectName) {
+    const projectParam = parsedUrl && parsedUrl.searchParams ? parsedUrl.searchParams.get('project') : null;
+    const name = _resolveStatsName(projectParam, res);
+    if (name === null) return; // error already replied
+    if (!name) {
       res.writeHead(404, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'No project name', proxyStats: null }));
       return;
     }
-    const statsFile = join(LOG_DIR, _projectName, `${_projectName}.json`);
+    const statsFile = join(LOG_DIR, name, `${name}.json`);
     if (!existsSync(statsFile)) {
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ proxyStats: null }));