cc-viewer 1.9.1 → 1.9.3

package/server/lib/v2/layout.js

@@ -6,6 +6,7 @@
 // and the swallowed ENOENT would silently drop v2 lines (plan risk F2).
 
 import { mkdirSync, writeFileSync, renameSync, existsSync, openSync, writeSync, fsyncSync, closeSync, readdirSync, statSync } from 'node:fs';
+import { readdir as readdirAsync, stat as statAsync } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 
 // The wire-format version this build writes AND the only one it reads.
@@ -107,6 +108,30 @@ export function dirSizeSync(dir) {
   return total;
 }
 
+/**
+ * Async sibling of dirSizeSync (2026-10-08): same semantics (recursive byte size,
+ * raced-deletion tolerant), but never blocks the event loop. Used by read-only,
+ * latency-sensitive paths (the /api/workspaces list) where freezing the whole
+ * Node process for ~2.4s while we walk 80k files is unacceptable — SSE streams
+ * and PTY output starve. The sync variant stays for offline converter / writer
+ * paths where blocking is fine (spawn-time, not request-time).
+ */
+export async function dirSizeAsync(dir) {
+  let total = 0;
+  let entries;
+  try { entries = await readdirAsync(dir, { withFileTypes: true }); } catch { return total; }
+  // Sequential per directory (avoid fd exhaustion on wide trees); parallel across
+  // sibling directories would still serialize on disk I/O in practice.
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    try {
+      if (e.isDirectory()) total += await dirSizeAsync(p);
+      else if (e.isFile()) total += (await statAsync(p)).size;
+    } catch { /* raced deletion — skip */ }
+  }
+  return total;
+}
+
 export function convEpochPath(paths, convKey, epoch) {
   return join(paths.conversationsDir, sanitizePathComponent(convKey), `e${epoch}.jsonl`);
 }

package/server/pty-manager.js

@@ -1060,8 +1060,13 @@ export function killPty() {
  * same dead-state a natural exit produces). Records whose process already
  * exited are never re-anchor targets.
  *
+ * The killed record's persistent `cwd` is captured BEFORE the kill and
+ * returned so the close route can tell "the BOUND project was closed" apart
+ * from "a parallel project was closed" by exact-cwd comparison against
+ * CCV_PROJECT_DIR (never by basename — same-name twins would false-hit).
+ *
  * @returns {{ ok:boolean, key?:string, killedActive?:boolean,
- *            reattachedTo?:string|null, reason?:string }}
+ *            reattachedTo?:string|null, cwd?:string, reason?:string }}
  */
 export function killPtyFor({ cwd, project, instanceKey } = {}) {
   // Multi-instance forced disambiguation (2026-10-06): a project-name-only close that matches
@@ -1076,6 +1081,10 @@ export function killPtyFor({ cwd, project, instanceKey } = {}) {
   if (!key) return { ok: false, reason: 'not-found' };
   const s = ptys.get(key);
   if (!s) return { ok: false, reason: 'not-found' };
+  // Capture the record's ORIGINAL spawn cwd before the kill (never realpath'd —
+  // both sides of the comparison stay in the same path space; a realpath would
+  // split /tmp vs /private/tmp and miss the bound-cwd match).
+  const killedCwd = s.cwd || s.currentWorkspacePath || s.lastWorkspacePath || '';
   _killPtyRecord(s);
   const killedActive = key === activePtyKey;
   let reattachedTo = null;
@@ -1085,7 +1094,7 @@ export function killPtyFor({ cwd, project, instanceKey } = {}) {
     }
     if (reattachedTo) activePtyKey = reattachedTo;
   }
-  return { ok: true, key, killedActive, reattachedTo };
+  return { ok: true, key, killedActive, reattachedTo, cwd: killedCwd };
 }
 
 // Kill EVERY main PTY across all projects (workspaces stop / process teardown). The no-arg

package/server/routes/events.js

@@ -318,13 +318,42 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   // filter excludes legacy/other-instance dirs, so an empty result would otherwise show the
   // WRONG project's/instance's conversation). Tell the client explicitly (same posture as
   // sid-not-found) so it can surface an empty state instead of cross-project bleed.
-  const instanceNotFound = !!(instanceParam && !sidParam && !viewColdDir);
-  if (instanceNotFound) {
+  //
+  // Liveness-aware (2026-10-10): a NEWLY created workspace's claude is alive but has not
+  // sent its first request yet, so it legitimately has no session dir. Flagging that as an
+  // error made the client detach back to the bound project — and the cold load below then
+  // streamed the BOUND project's current session (cross-project bleed). A LIVE instance
+  // therefore gets an EMPTY view instead: the cold stream is pinned to the empty source
+  // (load_start{total:0} → load_end, no chunks), the client stays on this instance, and the
+  // per-project live feed streams its first turn in place the moment the PTY writes its
+  // first session dir. Only a DEAD instance keeps the explicit sid-not-found posture (the
+  // client toasts + auto-detaches to the bound view — unchanged from before this fix).
+  const instanceNoSession = !!(instanceParam && !sidParam && !viewColdDir);
+  let instanceAlive = false;
+  if (instanceNoSession) {
+    try {
+      instanceAlive = listLivePtys().some((p) => p && p.instanceKey === instanceParam);
+    } catch (err) {
+      // Lookup failure degrades to the explicit dead-instance posture (never
+      // silently blank the client on a lookup error).
+      instanceAlive = false;
+      reportSwallowed('events.instance-live', err, { instance: instanceParam });
+    }
+  }
+  if (instanceNoSession && !instanceAlive) {
     try { sseWrite(res, `event: sid-not-found\ndata: ${JSON.stringify({ sid: null, instance: instanceParam, reason: 'instance-no-session', ts: Date.now() })}\n\n`); } catch { }
   }
   // When a view-scoped dir was requested AND resolved, it replaces the live-source
   // cold load; otherwise fall back to the standard single-current-session source.
   const coldSource = viewColdDir || null;
+  // An instance with no session dir has NO legitimate cold source — pin EVERY cold
+  // read to the literal empty source, whether the instance is alive (empty live view:
+  // the per-project feed streams its first turn in place once written) or dead (the
+  // client detaches on the sid-not-found above; the cold frames would be dropped by
+  // its stale guard anyway). Both fallback sites below (`coldSource || getLiveLogSource()`,
+  // on the legacy wire AND the v3 wire) would otherwise resolve the BOUND project's
+  // current session — the exact cross-project bleed this guard exists to stop.
+  const emptyLiveView = instanceNoSession;
   // A client viewing a non-bound project needs that project's live feed running
   // (its PTY is alive but its feed is lazy). Start it idempotently; the feed's
   // per-project client filter keeps its entries scoped to this project's viewers.
@@ -352,7 +381,7 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   // Wire v3 (V3.S5): flagged + v2 source ⇒ the legacy full-entry cold stream
   // is REPLACED by rows + native lines (the byte win); the client assembler
   // rebuilds entries locally. v1 legacy files keep the entry pipeline.
-  const _v3Src = deps.wireV3 ? (coldSource || getLiveLogSource()) : null;
+  const _v3Src = (deps.wireV3 && !emptyLiveView) ? (coldSource || getLiveLogSource()) : null;
   const v3Cold = !!(_v3Src && existsSync(join(_v3Src, 'journal.jsonl')));
 
   // S6b: the cold-load source is the current v2 session dir when the v2
@@ -361,7 +390,7 @@ async function events(req, res, parsedUrl, isLocal, deps) {
   // in-flight placeholder, which the client batch gate still blocks — the
   // previous conversation is the better cold load there (interceptor.js
   // getLiveLogSource header comment).
-  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(coldSource || getLiveLogSource({ serveInFlight: !!deps.wireV3 }), async (raw) => {
+  const coldLoadResult = v3Cold ? null : await streamRawEntriesAsync(emptyLiveView ? '' : (coldSource || getLiveLogSource({ serveInFlight: !!deps.wireV3 })), async (raw) => {
     // 直接发送原始 JSON 字符串，不做 parse/reconstruct/stringify
     // ExitPlanMode V2 空 input 的条目按需补全 plan / planFilePath，其它原样透传
     if (res.destroyed || !res.writable) return;
@@ -406,6 +435,12 @@ async function events(req, res, parsedUrl, isLocal, deps) {
       // Pass 1 完成、Pass 2 开始前：发送 load_start
       // 增量模式下不显示 loading 遮罩，非增量模式显示进度
       const loadStartData = { total: totalCount, incremental: !!useIncremental };
+      // An instance with no session dir (new workspace / pruned while alive):
+      // flag the empty view so the client invalidates any view-cache snapshot it
+      // restored for this scope — otherwise an incremental `?since&cc=` resume
+      // would merge an empty delta onto the CACHED (now-deleted) conversation and
+      // keep rendering it. load_end fires right after with zero chunks.
+      if (emptyLiveView) loadStartData.empty = true;
       // 分页模式下附加 hasMore/oldestTs（增量模式由客户端从缓存自行判断）
       if (useLimit) {
         loadStartData.hasMore = !!hasMore;
@@ -438,6 +473,9 @@ async function events(req, res, parsedUrl, isLocal, deps) {
       for (const p of native.convPayloads) v3Bytes += p.length;
       for (const p of native.respPayloads) v3Bytes += p.length;
       const loadStartData = { total: meta.totalCount, incremental: !!useIncremental, v3Bytes };
+      // Same empty-view flag as the legacy onReady path above (unreachable on the
+      // v3 wire today — an empty source is never a v2 dir — but kept symmetric).
+      if (emptyLiveView) loadStartData.empty = true;
       if (useLimit) {
         loadStartData.hasMore = !!meta.hasMore;
         loadStartData.oldestTs = meta.oldestTimestamp || '';
@@ -497,8 +535,11 @@ async function events(req, res, parsedUrl, isLocal, deps) {
     sseWrite(res, `event: context_window\ndata: ${JSON.stringify(latestContextWindow)}\n\n`);
     pushedContextWindow = true;
   }
-  // Fallback: no MainAgent in log (e.g. fresh session after -c), read context-window.json
-  if (!pushedContextWindow) {
+  // Fallback: no MainAgent in log (e.g. fresh session after -c), read context-window.json.
+  // Skipped for an empty live view: CONTEXT_WINDOW_FILE is a single GLOBAL file (not
+  // project-scoped), so pushing it here would paint another project's usage onto a
+  // brand-new workspace. The first real main turn pushes a genuine measurement instead.
+  if (!pushedContextWindow && !emptyLiveView) {
     try {
       const cwRaw = readFileSync(CONTEXT_WINDOW_FILE, 'utf-8');
       const cwFile = JSON.parse(cwRaw);

package/server/routes/resume.js

@@ -17,7 +17,12 @@
 //   POST /api/live-processes/close  { project }
 //       Kill that project's main PTY (the web header tab's × button). Admin-only
 //       (loopback or authenticated remote admin); 403 otherwise, 404 when the
-//       project has no record. The record is kept for a later re-launch.
+//       project has no record. The record is kept for a later re-launch. When the
+//       killed project WAS the bound one and a survivor is still live, the server
+//       re-binds its workspace identity (_projectName + CCV_PROJECT_DIR) to that
+//       survivor (a same-name/same-cwd twin degrades this to a dir-only rebind),
+//       broadcasts workspace_started(rebound:true) so every client lands on the
+//       survivor, and the response carries `rebound: { project, cwd }`.
 //
 //   POST /api/resume-session  { sessionUuid, project?, instanceKey? }
 //       TRUE /resume (2026-10-06): inject `/resume <uuid>` into the target
@@ -34,11 +39,18 @@
 // this handler is a thin HTTP wrapper.
 
 import { LOG_DIR } from '../../findcc.js';
-import { _projectName, _v2Writer } from '../interceptor.js';
+import { _projectName, _v2Writer, initForWorkspace } from '../interceptor.js';
+// Static import (not the route-local dynamic import) so the close-rebind helper
+// can call listLivePtys synchronously — a static import keeps the single shared
+// module instance, and module state is shared either way.
+import { listLivePtys } from '../pty-manager.js';
 import { listResumeSessions } from '../lib/v2/resume-list.js';
 import { projectKeyForCwd } from '../lib/system-prompt-snapshots.js';
+import { readClaudeProjectModel } from '../lib/context-watcher.js';
+import { bumpWorkspacesVersion } from '../lib/file-access-policy.js';
 import { isAdminReq } from '../lib/is-admin.js';
 import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+import { sseWrite } from '../lib/wire-compress.js';
 import { reportSwallowed } from '@ccv/core/error-report';
 
 function sendJson(res, code, obj) {
@@ -166,8 +178,11 @@ function postLiveProcessAttachHandler(req, res, parsedUrl, isLocal, deps) {
 // possible with a mere view token). 404 when the project has no record. When
 // the killed PTY was the terminal's active attachment, the server re-anchors
 // the attachment to another live record internally (killedActive in the
-// response); the client decides its own view repair from the remaining tab
-// list (it does not need the re-anchor target).
+// response). When the killed project WAS the bound one and a survivor is still
+// live, the server ALSO re-binds its workspace identity (_projectName +
+// CCV_PROJECT_DIR) to that survivor and broadcasts workspace_started(rebound:true)
+// so every client lands on the survivor (the "当前项目" label would otherwise
+// stay on the just-closed project); the response then carries `rebound`.
 function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
   // Two gates, both required: admin identity (loopback or authenticated remote
   // admin) AND same-origin browser context. The server intentionally answers
@@ -210,7 +225,18 @@ function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
         sendJson(res, 404, { ok: false, reason: r.reason || 'not-found' });
         return;
       }
-      sendJson(res, 200, { ok: true, project, instanceKey: r.key || instanceKey || null, killedActive: r.killedActive === true });
+      // Bound-project rebound (2026-10): when the closed PTY WAS the server's bound
+      // project, the binding (projectName / CCV_PROJECT_DIR / log dir) would otherwise
+      // keep pointing at a dead project — the "当前项目" label stays on the just-closed
+      // name while the survivor is left as a mere chip. Rebind to a survivor and
+      // broadcast workspace_started so every client (including the closing tab) lands
+      // on the survivor. Judgment is by the killed record's ORIGINAL cwd vs
+      // CCV_PROJECT_DIR — never by basename, or a same-name twin close would false-hit.
+      let rebound = null;
+      try {
+        rebound = _maybeRebindAfterClose(r, deps);
+      } catch (err) { reportSwallowed('resume-route.close-rebind', err); }
+      sendJson(res, 200, { ok: true, project, instanceKey: r.key || instanceKey || null, killedActive: r.killedActive === true, rebound });
     } catch (err) {
       reportSwallowed('resume-route.close', err);
       sendJson(res, 500, { ok: false, reason: 'close-failed' });
@@ -218,6 +244,135 @@ function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// Bound-project rebound helper (2026-10). After killPtyFor removed the BOUND
+// project's PTY, pick a surviving live claude record and re-bind the server's
+// workspace identity to it. A full rebind additionally broadcasts
+// workspace_started (with `rebound:true` / `reboundFrom`) so the affected SSE
+// clients re-scope to the survivor; a DIR-ONLY rebind (a same-name twin owns
+// the name's session space) moves CCV_PROJECT_DIR without broadcasting.
+// Returns { project, cwd } when a rebind happened, else null (closed project
+// was not the bound one / no survivor / a same-cwd twin still lives / Electron
+// multi-tab).
+// May throw only BEFORE the rebind is applied (a pre-state-change failure →
+// the caller wraps it into a 200 with rebound:null, which is accurate then);
+// after the state change it never throws (the restart side-effects are each
+// wrapped), so a returned rebound always matches reality.
+//
+// ORDERING INVARIANT: the broadcast (full rebind only) is emitted BEFORE the
+// best-effort feed/timer restarts, and the whole kill→rebind→broadcast block
+// is synchronous (no await) — under Node's single thread no interleaved
+// request can observe a half-applied rebind, and a throwing side-effect can no
+// longer strand the "binding moved but nobody was told" state (the broadcast
+// has already gone out by then).
+function _maybeRebindAfterClose(killResult, deps) {
+  // Electron multi-tab: the manager process does NOT own log init (the tab
+  // workers do); mirroring workspaces.js:56, skip rebind entirely there.
+  if (process.env.CCV_ELECTRON_MULTITAB === '1') return null;
+  const killedCwd = typeof killResult.cwd === 'string' ? killResult.cwd : '';
+  const boundCwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  // Exact-cwd equality, no realpath — both sides stay in the same path space
+  // (a realpath would split /tmp vs /private/tmp and miss the hit).
+  if (!killedCwd || killedCwd !== boundCwd) return null;
+
+  // Pick the survivor: a still-live CLAUDE record (listLivePtys also returns
+  // 'shell' scratch PTYs, which /api/live-processes itself filters out of its
+  // own processes[]), preferring the record killPtyFor just re-anchored the
+  // terminal attachment to (reattachedTo), then the terminal's live attachment
+  // (isActive — preserves the launch-time invariant bound == attached), else
+  // the first live claude record in Map order.
+  const live = listLivePtys().filter((p) => p && p.cwd && (!p.ptyKind || p.ptyKind === 'claude'));
+  if (!live.length) return null;
+  // A same-cwd TWIN of the closed bound project still lives → the bound
+  // identity (same project name, same log dir) is already correct for it;
+  // rebinding away would only wipe that twin's session bindings for nothing.
+  if (live.some((p) => p.cwd === killedCwd)) return null;
+  const survivor = live.find((p) => p.key === killResult.reattachedTo)
+    || live.find((p) => p.isActive)
+    || live[0];
+  if (!survivor || !survivor.cwd) return null;
+
+  const killedName = projectKeyForCwd(killedCwd);
+  const survivorProject = projectKeyForCwd(survivor.cwd);
+  // initForWorkspace's scoped resetSessions keys on the SANITIZED project name
+  // (v2-writer.js). So any time the CLOSED project's name still has a live
+  // record (a same-name twin in another dir, or the survivor itself is a
+  // same-name twin), running initForWorkspace would wipe that LIVE project's
+  // session bindings. In every such case the project NAME (and thus the log
+  // dir) does not change — so do a DIR-ONLY rebind instead: point
+  // CCV_PROJECT_DIR at the survivor (file-tree/git/skills/allowlist roots follow
+  // the live project) while skipping initForWorkspace entirely.
+  const closedNameStillLive = live.some((p) => projectKeyForCwd(p.cwd) === killedName);
+  const survivorIsSameName = survivorProject === killedName;
+  const dirOnly = closedNameStillLive || survivorIsSameName;
+
+  let result;
+  if (dirOnly) {
+    // _projectName / _logDir stay (same sanitized name — already correct);
+    // only the bound ROOT moves to the surviving twin's directory. No broadcast
+    // either (see below): the name — and with it every client's SSE scope stamp
+    // — is unchanged, so there is nothing to re-scope.
+    result = { projectName: killedName };
+  } else {
+    result = initForWorkspace(survivor.cwd);
+  }
+  process.env.CCV_PROJECT_DIR = survivor.cwd;
+  // The file-access allowlist caches its roots (including the bound project
+  // dir) and is only invalidated on register/remove or LOG_DIR change — none of
+  // which fire on a close-rebind. Bump it so the survivor's dir is an allowed
+  // root even when it never went through this server's registerWorkspace.
+  try { bumpWorkspacesVersion(); } catch (err) { reportSwallowed('resume-route.close-rebind.roots', err); }
+
+  // Broadcast workspace_started to EVERY SSE client (same fan-out as launch,
+  // workspaces.js:101-107) BEFORE the throwable side-effects below, so a
+  // failure there can't leave "binding moved but clients untold" — but ONLY for
+  // a full rebind. A dir-only rebind keeps the project NAME — and with it every
+  // client's SSE scope stamp — moving only the bound ROOT to the survivor's dir,
+  // so there is nothing for any client to re-scope: a broadcast would needlessly
+  // hard-reset every same-name viewer mid-stream for a root-only change.
+  // Deliberately NO load_start/load_chunk/load_end replay: those handlers have
+  // no project guard on the client (AppBase.jsx:1990-2148) and would pour the
+  // survivor's transcript into a tab that is viewing a THIRD project. Each
+  // AFFECTED client re-scopes and cold-loads its own view on receipt (the
+  // `rebound:true` marker + its own local view state decide; see the
+  // workspace_started handler in AppBase.jsx).
+  if (!dirOnly) {
+    const payload = `event: workspace_started\ndata: ${JSON.stringify({
+      projectName: result.projectName,
+      path: survivor.cwd,
+      claudeProjectModel: readClaudeProjectModel(survivor.cwd),
+      rebound: true,
+      // The project name this client's SSE scope was stamped with before the
+      // rebind. Clients whose SSE (or an attach/parallel view) is still pinned
+      // to it are the affected domain and must reset + reconnect; a tab viewing
+      // an unrelated project must keep its view and its live feed.
+      reboundFrom: killedName,
+    })}\n\n`;
+    const clients = (deps && deps.clients) || [];
+    clients.forEach((client) => {
+      try { sseWrite(client, payload); } catch (err) { reportSwallowed('resume-route.close-rebind.write', err); }
+    });
+  }
+
+  // Best-effort feed/timer restarts for the new bound project. Without
+  // startLogWatch the survivor's writer activity hits "no feed → drop" and the
+  // real-time pane never updates until a manual refresh; statsWorker/
+  // streamingStatusTimer mirror workspaces.js:71-75. All deps.* are
+  // optional-chained so unit tests need only stub what they assert on. Each is
+  // individually wrapped AND runs AFTER the broadcast: if one throws it is
+  // reported and swallowed, never turning the (already-applied) rebind into a
+  // misleading rebound:null on the 200 response.
+  if (deps && typeof deps.startLogWatch === 'function') {
+    try { deps.startLogWatch(); } catch (err) { reportSwallowed('resume-route.close-rebind.logwatch', err); }
+  }
+  if (deps && !deps.statsWorker && typeof deps.startStatsWorker === 'function') {
+    try { deps.startStatsWorker(); } catch (err) { reportSwallowed('resume-route.close-rebind.stats', err); }
+  }
+  if (deps && typeof deps.startStreamingStatusTimer === 'function') {
+    try { deps.startStreamingStatusTimer(); } catch (err) { reportSwallowed('resume-route.close-rebind.stream', err); }
+  }
+  return { project: result.projectName, cwd: survivor.cwd };
+}
+
 const RESUME_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 // POST /api/resume-session { sessionUuid, project?, instanceKey? } — TRUE /resume:
@@ -255,6 +410,18 @@ function postResumeSessionHandler(req, res, parsedUrl, isLocal, deps) {
       return;
     }
     try {
+      // SDK mode: there is no claude PTY to inject `/resume` into — the sdk-manager
+      // switches the session identity directly (next user message resumes it).
+      // Read the env at request time (not module top) so tests can flip it per case.
+      if (process.env.CCV_SDK_MODE === '1') {
+        const sdk = await import('../lib/sdk-manager.js');
+        const r = sdk.switchToSession(sessionUuid);
+        if (r.ok) { sendJson(res, 200, { ok: true }); return; }
+        if (r.reason === 'busy') { sendJson(res, 409, { ok: false, reason: 'busy' }); return; }
+        if (r.reason === 'unavailable') { sendJson(res, 409, { ok: false, reason: 'unavailable' }); return; }
+        sendJson(res, 400, { ok: false, reason: r.reason || 'bad-uuid' });
+        return;
+      }
       const pm = await import('../pty-manager.js');
       const targetProject = project || (_projectName || '');
       // Multi-instance: a project-name-only resume that matches 2+ live same-basename

package/server/routes/workspaces.js

@@ -21,9 +21,15 @@ import { sseWrite } from '../lib/wire-compress.js';
 
 function workspacesList(req, res, parsedUrl, isLocal, deps) {
   import('../workspace-registry.js').then(async ({ getWorkspaces }) => {
-    const workspaces = await getWorkspaces();
+    // ?limit=N(2026-10-08):parsedUrl 是 WHATWG URL,只有 .searchParams 没有 .query。
+    // 先排序后富化,只算前 N 个的 dirSize/isDiscardable。默认 0(全部),上限 50
+    // 与 resume.js 的对齐。total 是富化前总数,预留给将来「按需加载」的前端。
+    const rawLimit = parsedUrl?.searchParams?.get('limit');
+    const parsedLimit = rawLimit != null ? Number(rawLimit) : 0;
+    const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(Math.floor(parsedLimit), 50) : 0;
+    const { workspaces, total } = await getWorkspaces({ limit });
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ workspaces, workspaceMode: deps.isWorkspaceMode && !deps.workspaceLaunched }));
+    res.end(JSON.stringify({ workspaces, total, workspaceMode: deps.isWorkspaceMode && !deps.workspaceLaunched }));
   }).catch(err => {
     res.writeHead(500, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: err.message }));

package/server/workspace-registry.js

@@ -1,13 +1,19 @@
 // Workspace Registry - 工作区持久化管理
-import { readdir, stat } from 'node:fs/promises';
+import { readdir, stat, readFile } from 'node:fs/promises';
 import { statSync } from 'node:fs';
 import { mutateJson, readJsonSafe, writeJsonAtomic } from './lib/json-store.js';
-import { dirSizeSync } from './lib/v2/layout.js';
+import { dirSizeAsync } from './lib/v2/layout.js';
 import { isDiscardableSession } from './lib/v2/session-select.js';
 import { join, basename, resolve, dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { LOG_DIR } from '../findcc.js';
 
+// 与 stats-worker.js 的磁盘缓存对齐(2026-10-08):getWorkspaces 富化时优先读
+// LOG_DIR/<project>/<project>.json 的 files["sessions/<sid>"],以 journalSize+lastModified
+// 作新鲜度 key;命中即跳过 dirSizeSync。版本不一致或 key 缺失则回退到实时遍历。
+// 版本号必须与 stats-worker.js 的 STATS_VERSION 保持一致,否则旧缓存被错误信任。
+const STATS_CACHE_VERSION = 12;
+
 // 动态获取（LOG_DIR 可能在运行时被 setLogDir 修改）
 function getWorkspacesFile() { return join(LOG_DIR, 'workspaces.json'); }
 
@@ -97,45 +103,108 @@ export function saveWorkspaces(list) {
   }
 }
 
-export async function getWorkspaces() {
+export async function getWorkspaces(opts = {}) {
+  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? Math.floor(opts.limit) : null;
   const list = loadWorkspaces();
-  const enriched = await Promise.all(list.map(async (w) => {
-    // wire-v2 (1.7.0): logs live in per-session dirs under sessions/. The v1
-    // *.jsonl glob is kept as unmigratedV1Count — the combined logCount must
-    // stay non-zero for a declined-migration workspace, because the launcher's
-    // `logCount > 0 → auto -c` heuristic hangs off it (WorkspaceList.jsx).
-    let sessionCount = 0;
-    let unmigratedV1Count = 0;
-    let totalSize = 0;
-    const logDir = join(LOG_DIR, w.projectName);
-    try {
-      const files = await readdir(logDir);
-      for (const f of files) {
-        if (f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl')) {
-          unmigratedV1Count++;
-          try { totalSize += (await stat(join(logDir, f))).size; } catch { }
-        }
+  // 先按 lastUsed 降序(几乎免费,只是 8.5 KB JSON 的内存排序),再切片、再富化。
+  // 不调换顺序的话:全量富化 40 个工作区 ≈ 3.3s;先切片后富化,limit=5 ≈ 200ms。
+  const sorted = list.slice().sort((a, b) => new Date(b.lastUsed) - new Date(a.lastUsed));
+  const total = sorted.length;
+  const toEnrich = limit ? sorted.slice(0, limit) : sorted;
+  // 一次性读出涉及项目的 stats 磁盘缓存(每个项目一次读盘,富化期全部命中内存)。
+  // Map + Promise.all 的 has/set 不防重:同一 projectName 的多个 entry 在 await 之前都通过 has 检查,
+  // 导致重复读盘。先 Set 去重再读。
+  const uniqueProjects = [...new Set(toEnrich.map((w) => w.projectName))];
+  const cacheByProject = new Map();
+  await Promise.all(uniqueProjects.map(async (projectName) => {
+    cacheByProject.set(projectName, await _readStatsCache(projectName));
+  }));
+  const enriched = await Promise.all(toEnrich.map((w) => _enrichWorkspace(w, cacheByProject.get(w.projectName))));
+  return { workspaces: enriched, total };
+}
+
+/**
+ * 读一个工作区的 stats 磁盘缓存(若存在且版本匹配)。
+ * 缓存 schema:LOG_DIR/<project>/<project>.json 的 files["sessions/<sid>"] = {
+ *   size, journalSize, lastModified, ...
+ * },以 (journalSize, lastModified) 作新鲜度 key —— session 文件一变动,journal.jsonl
+ * 的 size/mtime 就变,缓存自然 miss 走实时遍历。
+ * 返回 files 对象;失败/版本不匹配返回 null(调用方整体回退到实时遍历)。
+ */
+async function _readStatsCache(projectName) {
+  // 防御:projectName 来自 workspaces.json(用户可手改),registerWorkspace 写入时只保证
+  // basename 级别消毒。若 workspaces.json 被改成包含 '/' / '\\' / '..' 的 projectName,
+  // 这里的 join 会越出 LOG_DIR。命中即拒,回退到实时遍历(性能降级但安全)。
+  if (typeof projectName !== 'string'
+      || projectName.includes('/')
+      || projectName.includes('\\')
+      || projectName.includes('..')) {
+    return null;
+  }
+  try {
+    const statsFile = join(LOG_DIR, projectName, `${projectName}.json`);
+    const raw = await readFile(statsFile, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || parsed._v !== STATS_CACHE_VERSION || !parsed.files || typeof parsed.files !== 'object') return null;
+    return parsed.files;
+  } catch {
+    return null; // 缓存不存在/损坏都算 miss,调用方走实时路径
+  }
+}
+
+/**
+ * 富化单个工作区的日志统计。命中 stats 缓存的 session 直接用缓存的 size;
+ * 未命中的 session 用 dirSizeAsync 异步递归(不阻塞事件循环,SSE/PTY 不再被冻结)。
+ * isDiscardableSession 仍是同步调用 —— 它只读 meta.json + 扫 journal 头几行,
+ * 远比 dirSizeSync 便宜;完全异步化留作后续。
+ */
+async function _enrichWorkspace(w, statsCache) {
+  // wire-v2 (1.7.0): logs live in per-session dirs under sessions/. The v1
+  // *.jsonl glob is kept as unmigratedV1Count — the combined logCount must
+  // stay non-zero for a declined-migration workspace, because the launcher's
+  // `logCount > 0 → auto -c` heuristic hangs off it (WorkspaceList.jsx).
+  let sessionCount = 0;
+  let unmigratedV1Count = 0;
+  let totalSize = 0;
+  const logDir = join(LOG_DIR, w.projectName);
+  try {
+    const files = await readdir(logDir);
+    for (const f of files) {
+      if (f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl')) {
+        unmigratedV1Count++;
+        try { totalSize += (await stat(join(logDir, f))).size; } catch { }
       }
-    } catch { }
-    try {
-      const sids = await readdir(join(logDir, 'sessions'), { withFileTypes: true });
-      for (const e of sids) {
-        if (!e.isDirectory()) continue;
-        const sessionDir = join(logDir, 'sessions', e.name);
-        try {
-          await stat(join(sessionDir, 'journal.jsonl'));
-          // Quota-probe orphans must not count: logCount>0 drives the
-          // auto -c heuristic, and a probe-only workspace would auto-continue
-          // into a conversation that does not exist (2026-07-16).
-          if (isDiscardableSession(sessionDir)) continue;
-          // Folder size, not journal size — conv/blob/response files carry
-          // most of a session's bytes (journal alone undercounts ~12x).
-          totalSize += dirSizeSync(sessionDir);
+    }
+  } catch { }
+  try {
+    const sids = await readdir(join(logDir, 'sessions'), { withFileTypes: true });
+    for (const e of sids) {
+      if (!e.isDirectory()) continue;
+      const sessionDir = join(logDir, 'sessions', e.name);
+      const unitKey = `sessions/${e.name}`;
+      try {
+        const journalStat = await stat(join(sessionDir, 'journal.jsonl'));
+        // 缓存命中条件与 stats-worker 相同:journalSize + lastModified 双 key。
+        // 命中即非 discardable(stats-worker v11+ 的缓存条目写入前已过滤 probe-only session),
+        // 所以命中路径可以跳过 isDiscardableSession 的同步读 —— 省 ~200ms(实测 1787 session 的
+        // 热路径成本)。未命中再走原顺序:先判 probe,再递归 dirSizeAsync。
+        const cached = statsCache?.[unitKey];
+        const lastModified = journalStat.mtime.toISOString();
+        if (cached && cached.journalSize === journalStat.size && cached.lastModified === lastModified && typeof cached.size === 'number') {
+          totalSize += cached.size;
           sessionCount++;
-        } catch { /* dir without a journal is not a session yet */ }
-      }
-    } catch { }
-    return { ...w, logCount: sessionCount + unmigratedV1Count, sessionCount, unmigratedV1Count, totalSize };
-  }));
-  return enriched.sort((a, b) => new Date(b.lastUsed) - new Date(a.lastUsed));
+          continue;
+        }
+        // Quota-probe orphans must not count: logCount>0 drives the
+        // auto -c heuristic, and a probe-only workspace would auto-continue
+        // into a conversation that does not exist (2026-07-16).
+        if (isDiscardableSession(sessionDir)) continue;
+        // Folder size, not journal size — conv/blob/response files carry
+        // most of a session's bytes (journal alone undercounts ~12x).
+        totalSize += await dirSizeAsync(sessionDir);
+        sessionCount++;
+      } catch { /* dir without a journal is not a session yet */ }
+    }
+  } catch { }
+  return { ...w, logCount: sessionCount + unmigratedV1Count, sessionCount, unmigratedV1Count, totalSize };
 }