cc-viewer 1.9.14 → 1.9.15

package/server/lib/view-root.js

@@ -1,7 +1,6 @@
 // View-root resolution (multi-project, 2026-10): map an optional `?project=`
 // name to the REAL filesystem root of that project, so project-scoped READ
-// routes (file tree / git / skills / memory / stats / search) can follow the
-// viewed parallel project instead of always the bound one.
+// routes and boundary-checked file mutations follow the viewed project.
 //
 // Name → path sources (both consulted, in order):
 //   1. workspace-registry (loadWorkspaces) — persistent { path, projectName },
@@ -22,7 +21,8 @@
 //   3. still >1 real candidate → 400, never a silent guess.
 //
 // Pure + dependency-injected (fs/registry/pty seams) so it is directly
-// node-testable. WRITE routes must NOT use this — they stay bound-only.
+// node-testable. File mutation routes use the same resolver as their reads;
+// every target must still pass the resolved root's filesystem boundary checks.
 
 import { realpathSync, existsSync, statSync } from 'node:fs';
 import { projectKeyForCwd } from './system-prompt-snapshots.js';
@@ -192,7 +192,7 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
 }
 
 /**
- * HTTP-facing wrapper shared by every project-scoped READ route (multi-project,
+ * HTTP-facing wrapper shared by project-scoped routes (multi-project,
  * 2026-10): resolves `?project=` (or a POST-body override) via resolveViewRoot
  * and, on failure, writes the error response itself. Returns the resolved root
  * to continue with, or null after replying (the caller must return early).

package/server/pty-manager.js

@@ -1290,12 +1290,15 @@ export function resolveInstanceForCwd(cwd) {
  * would make resize/scrollback/getPtyState follow whichever project was last
  * SENT to, a new cross-project bleed (review P1, 2026-10-05).
  */
-function _resolveKeyByAnchor({ sessionId, project, instanceKey } = {}) {
+function _resolveKeyByAnchor({ sessionId, project, instanceKey, strict = false } = {}) {
+  // Explicit strict targets never fall back to the active conversation. Without this,
+  // a dead project/instance could receive a queued prompt meant for another one.
   // Multi-instance: an explicit instanceKey is the strongest anchor — it pins THIS exact
   // process (disambiguating two same-cwd instances that basename routing cannot).
   if (typeof instanceKey === 'string' && /^ccv-[0-9a-f]+$/.test(instanceKey)) {
     const rec = ptys.get(instanceKey);
     if (rec && rec.ptyProcess) return instanceKey;
+    if (strict) return null;
   }
   const projKey = (typeof project === 'string' && project) ? _resolveKey({ project }) : null;
   if (typeof sessionId === 'string' && sessionId) {
@@ -1313,12 +1316,13 @@ function _resolveKeyByAnchor({ sessionId, project, instanceKey } = {}) {
     }
   }
   if (projKey) return projKey;
+  if (strict) return null;
   return activePtyKey != null && ptys.has(activePtyKey) ? activePtyKey : null;
 }
 
 /** writeToPty variant routed by an explicit anchor instead of the global active pointer. */
-export function writeToPtyFor(data, { sessionId, project, instanceKey } = {}) {
-  const key = _resolveKeyByAnchor({ sessionId, project, instanceKey });
+export function writeToPtyFor(data, { sessionId, project, instanceKey, strict = false } = {}) {
+  const key = _resolveKeyByAnchor({ sessionId, project, instanceKey, strict });
   const s = key ? ptys.get(key) : null;
   if (s && s.ptyProcess) {
     s.ptyProcess.write(data);
@@ -1332,11 +1336,7 @@ export function writeToPtyFor(data, { sessionId, project, instanceKey } = {}) {
  * the write fails (onComplete(false)) WITHOUT falling back to the project/active record —
  * scheduled-task injection must never land in the wrong conversation (review P0-2). */
 export function writeToPtySequentialFor(chunks, onComplete, opts = {}, anchor = {}) {
-  let key = _resolveKeyByAnchor(anchor);
-  if (opts && opts.strict && typeof anchor.instanceKey === 'string' && anchor.instanceKey) {
-    const rec = ptys.get(anchor.instanceKey);
-    if (!rec || !rec.ptyProcess) key = null; // strict: a dead explicit instance never falls back
-  }
+  const key = _resolveKeyByAnchor({ ...anchor, strict: opts.strict === true });
   const s = key ? ptys.get(key) : null;
   if (!s || !s.ptyProcess || !chunks || chunks.length === 0) {
     if (onComplete) onComplete(false);

package/server/routes/files-content.js

@@ -2,8 +2,10 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream } from 'node:fs';
 import { join, basename, dirname, resolve, sep } from 'node:path';
 import { isReadAllowed, reasonToStatus } from '../lib/file-access-policy.js';
-import { ERROR_STATUS_MAP } from '../lib/file-api.js';
-import { viewRootOrReply } from '../lib/view-root.js';
+import { ERROR_STATUS_MAP, isPathContained } from '../lib/file-api.js';
+import { viewRootOrReply, resolveViewRoot } from '../lib/view-root.js';
+import { findSdkSessionByInstance } from '../lib/sdk-session-index.js';
+import { projectKeyForCwd } from '../lib/system-prompt-snapshots.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
 import { reportSwallowed } from '../lib/error-report.js';
@@ -11,16 +13,20 @@ import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
 
-// Multi-project (2026-10): project-scoped READ routes resolve the viewed
-// project via the shared viewRootOrReply (?project=). WRITE routes keep the
-// bound root. SYNCHRONOUS: these handlers were sync before multi-project, and
+// Multi-project file operations use the same viewed root for reads and writes.
+// Every file-browser mutation enforces realpath containment in that root;
+// explicit editor sessions retain their existing allowlisted external paths.
 // their tests (and the dispatcher's sync-call convention) assert on res
 // immediately after the call — the override must not async-ify them.
-function _viewRootOrReply(req, res, parsedUrl) {
+// Both reads and writes resolve the viewed project. Absolute editor paths are
+// still governed by the allowlist; browser writes stay within the selected root.
+function _viewRootOrReply(req, res, parsedUrl, bodyProject, bodyInstance) {
   return viewRootOrReply(req, res, parsedUrl, {
     boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
     loadWorkspaces,
     listLivePtys,
+    bodyProject,
+    bodyInstance,
   });
 }
 
@@ -167,6 +173,37 @@ function projectMemory(req, res, parsedUrl) {
   projectMemoryEntry(req, res, parsedUrl, respondJson);
 }
 
+// The SDK context snapshot prices MEMORY.md itself, not every linked detail file.
+// Supplement only the index's existing single-segment .md links with a transparent
+// content-length estimate; never allocate the SDK total across unrelated files.
+export function estimateLinkedMemoryTokens(content, dir) {
+  const estimates = {};
+  const MAX_BYTES = 512 * 1024;
+  const MAX_LINKS = 100;
+  if (typeof content !== 'string' || typeof dir !== 'string') return estimates;
+  const links = new Set();
+  for (const match of content.matchAll(/\]\(\s*([^)\s]+\.md)(?:[?#][^)\s]*)?(?:\s+"[^"]*")?\s*\)/gi)) {
+    let name;
+    try { name = decodeURIComponent(match[1].split('#')[0].split('?')[0]); } catch { continue; }
+    if (!name || name.includes('/') || name.includes('\\') || name.includes('\0') || name.startsWith('.')) continue;
+    links.add(name);
+    if (links.size >= MAX_LINKS) break;
+  }
+  let realDir;
+  try { realDir = realpathSync(dir); } catch { return estimates; }
+  const prefix = realDir.endsWith(sep) ? realDir : realDir + sep;
+  for (const name of links) {
+    try {
+      const realFile = realpathSync(join(realDir, name));
+      const stat = statSync(realFile);
+      if (!realFile.startsWith(prefix) || !stat.isFile() || stat.size > MAX_BYTES) continue;
+      if (!isReadAllowed(realFile).ok) continue;
+      estimates[name] = { tokens: Math.ceil(stat.size / 4), source: 'file-content-estimate' };
+    } catch { /* Missing/unreadable links remain without an estimate. */ }
+  }
+  return estimates;
+}
+
 // The entry wraps BOTH the view-root resolution and the read in the endpoint's
 // single error surface (the searchParams-throw defense test asserts a 500 from
 // THIS catch, regardless of which stage throws).
@@ -202,7 +239,9 @@ function projectMemoryWithRoot(req, res, parsedUrl, respondJson, cwd) {
       if (!st.isFile()) return respondJson(400, { error: 'Not a file' });
       if (st.size > MAX_BYTES) return respondJson(413, { error: 'File too large' });
       const content = readFileSync(policy.real, 'utf-8');
-      return respondJson(200, { exists: true, dir, indexPath, content });
+      // Only SDK mode consumes these estimates. PTY keeps the original cheap index read.
+      const memoryTokenEstimates = process.env.CCV_SDK_MODE === '1' ? estimateLinkedMemoryTokens(content, dir) : undefined;
+      return respondJson(200, { exists: true, dir, indexPath, content, memoryTokenEstimates });
     }
 
     // 明细文件: 仅接受单段 basename + .md 后缀
@@ -231,7 +270,7 @@ function projectMemoryWithRoot(req, res, parsedUrl, respondJson, cwd) {
     if (!st.isFile()) return respondJson(400, { error: 'Not a file' });
     if (st.size > MAX_BYTES) return respondJson(413, { error: 'File too large' });
     const content = readFileSync(realFile, 'utf-8');
-    return respondJson(200, { name: fileParam, path: realFile, content });
+    return respondJson(200, { name: fileParam, path: realFile, content, tokens: Math.ceil(Buffer.byteLength(content, 'utf8') / 4), tokenSource: 'file-content-estimate' });
   } catch (err) {
     // 与 /api/file-content 一致：已知 errno（ENOENT/EACCES 等）走 ERROR_STATUS_MAP 映射；
     // 500 时不回显 err.message —— 可能含 ~/.claude/projects/<encoded>/memory/ 路径片段。
@@ -311,13 +350,51 @@ function fileRaw(req, res, parsedUrl) {
   const url = parsedUrl.pathname;
   const method = req.method;
   let reqPath;
-  if (url.startsWith('/api/file-raw/')) {
+  let scopedProject = '';
+  let scopedInstance = '';
+  if (url.startsWith('/api/file-raw/view/')) {
+    const parts = url.slice('/api/file-raw/view/'.length).split('/');
+    let project = '';
+    let instance = '';
+    try {
+      project = decodeURIComponent(parts[0] || '');
+      instance = decodeURIComponent(parts[1] || '');
+      reqPath = decodeURIComponent(parts.slice(2).join('/'));
+    } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid path' }));
+      return;
+    }
+    scopedProject = project;
+    scopedInstance = instance;
+  } else if (url.startsWith('/api/file-raw/')) {
     const tail = parsedUrl.pathname.slice('/api/file-raw/'.length);
     try { reqPath = decodeURIComponent(tail); } catch { reqPath = tail; }
   } else {
     reqPath = parsedUrl.searchParams.get('path');
   }
-  const cwd = _viewRootOrReply(req, res, parsedUrl);
+  let resolvedView = null;
+  if (scopedProject) {
+    resolvedView = resolveViewRoot({
+      projectParam: scopedProject,
+      instanceParam: scopedInstance,
+      boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+      loadWorkspaces,
+      listLivePtys,
+    });
+    // The path already pins its project. A stale/mismatched instance must not
+    // silently redirect it to the bound project or a different workspace.
+    const instanceRecord = scopedInstance ? findSdkSessionByInstance(scopedInstance) : null;
+    const instanceMatches = !scopedInstance || (instanceRecord
+      && (instanceRecord.projectName === scopedProject
+        || projectKeyForCwd(instanceRecord.cwd) === scopedProject));
+    if (!resolvedView.ok || (scopedInstance && !instanceMatches)) {
+      res.writeHead(resolvedView.ok ? 400 : resolvedView.status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: resolvedView.ok ? 'Project scope mismatch' : resolvedView.error }));
+      return;
+    }
+  }
+  const cwd = resolvedView?.root || _viewRootOrReply(req, res, parsedUrl);
   if (!cwd) return;
   fileRawWithRoot(req, res, parsedUrl, reqPath, cwd, method);
 }
@@ -460,7 +537,11 @@ function fileDownloadWithRoot(req, res, parsedUrl, reqPath, cwd) {
   }
 }
 
-function fileContentPost(req, res) {
+function fileContentPost(req, res, parsedUrl) {
+  // The shared read root keeps its raw cwd for projectMemory's store-key
+  // encoding. Normalize only this mutation's containment comparisons.
+  let writeRoot;
+  const isInsideWriteRoot = (path) => isPathContained(path, writeRoot);
   const MAX_BODY = 5 * 1024 * 1024; // 5MB，与 GET 路由限制对齐
   let body = '';
   let overflow = false;
@@ -475,8 +556,10 @@ function fileContentPost(req, res) {
       return;
     }
     try {
-      const { path: reqPath, content } = JSON.parse(body);
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const { path: reqPath, content, editorSession } = JSON.parse(body);
+      const cwd = _viewRootOrReply(req, res, parsedUrl);
+      if (!cwd) return;
+      try { writeRoot = realpathSync(cwd); } catch { writeRoot = cwd; }
       if (!reqPath) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Invalid path' }));
@@ -489,7 +572,6 @@ function fileContentPost(req, res) {
       }
       const isAbs = /^([a-zA-Z]:[\\/]|[\\/])/.test(reqPath);
       const absPath = isAbs ? reqPath : resolve(cwd, reqPath);
-
       // 写路径同样走 policy(收敛 editorSession 后门):允许覆盖现有文件;
       // 新文件场景递归向上找最近存在的祖先目录,只要它在 allowlist 内即放行。
       // (旧实现只查 immediate parent,父目录也不存在时误拒嵌套新建。)
@@ -525,6 +607,13 @@ function fileContentPost(req, res) {
           res.end(JSON.stringify(body));
           return;
         }
+        // Check containment before creating any missing parent directories.
+        // Explicit $EDITOR sessions retain their allowlisted external paths.
+        if (!editorSession && !isInsideWriteRoot(ancestorPolicy.real)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
+          return;
+        }
         // 在祖先 real 路径下重建目标。Denylist 已在祖先 prefix 层生效,
         // 这里相信 allowlist 祖先的合法性(项目目录 / ~/.claude/cc-viewer 等)。
         targetReal = join(ancestorPolicy.real, ...descent);
@@ -539,6 +628,11 @@ function fileContentPost(req, res) {
         return;
       }
 
+      if (!editorSession && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
+        return;
+      }
       writeFileSync(targetReal, content, 'utf-8');
       const stat = statSync(targetReal);
       res.writeHead(200, { 'Content-Type': 'application/json' });

package/server/routes/files-fs.js

@@ -7,16 +7,17 @@ import { join, dirname, basename, resolve, sep } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { execFile, spawn } from 'node:child_process';
 import { bumpWorkspacesVersion, isReadAllowed } from '../lib/file-access-policy.js';
-import { validateImportDir } from '../lib/file-api.js';
+import { isPathContained, validateImportDir, renameSyncWithRetry } from '../lib/file-api.js';
+import { reportSwallowed } from '../lib/error-report.js';
 import { viewRootOrReply } from '../lib/view-root.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
 import { PROFILE_PATH, _projectName, _logDir } from '../interceptor.js';
 import { LOG_DIR, getClaudeConfigDir } from '../../findcc.js';
 
-// Multi-project (2026-10): project-scoped READ routes resolve the viewed
-// project via the shared viewRootOrReply (?project=, or POST body {project}
-// for the body-carrying read probes). WRITE routes keep the bound root.
+// Project-scoped file operations resolve the viewed project via the shared
+// viewRootOrReply (?project=, or POST body {project}/{instance}). Mutations
+// still enforce realpath containment in that root before touching the disk.
 // SYNCHRONOUS: the affected handlers were sync before multi-project and their
 // tests assert on res immediately after the call.
 function _viewRootOrReply(req, res, parsedUrl, bodyProject, bodyInstance) {
@@ -161,11 +162,31 @@ function importFile(req, res, parsedUrl, isLocal, deps) {
   req.on('end', () => {
     if (aborted) return;
     try {
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl);
+      if (!cwd) return;
       const targetDir = join(cwd, dir);
-      mkdirSync(targetDir, { recursive: true });
-      const realDir = realpathSync(targetDir);
       const realCwd = realpathSync(cwd);
+      let cursor = targetDir;
+      const missing = [];
+      while (!existsSync(cursor)) {
+        missing.unshift(basename(cursor));
+        const parent = dirname(cursor);
+        if (parent === cursor) break;
+        cursor = parent;
+      }
+      const realAncestor = realpathSync(cursor);
+      if (realAncestor !== realCwd && !realAncestor.startsWith(realCwd + sep)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
+        return;
+      }
+      // Create only after the nearest existing ancestor is known to be inside
+      // the view; mkdir first would let an escaping symlink create outside dirs.
+      for (const segment of missing) {
+        cursor = join(cursor, segment);
+        mkdirSync(cursor);
+      }
+      const realDir = realpathSync(targetDir);
       if (realDir !== realCwd && !realDir.startsWith(realCwd + sep)) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
@@ -339,7 +360,8 @@ function renameFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const oldFullPath = join(cwd, oldPath);
       const parentDir = dirname(oldFullPath);
       const newFullPath = join(parentDir, newName);
@@ -349,13 +371,48 @@ function renameFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'File not found' }));
         return;
       }
+      if (!isPathContained(oldFullPath, cwd)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
+        return;
+      }
+      // On a case-insensitive filesystem the differently-cased destination is
+      // the source itself, not a collision. A temporary name makes the case
+      // change work on NTFS and APFS even when realpath keeps the old casing.
+      const oldName = basename(oldPath);
+      if (oldName !== newName && oldName.toLowerCase() === newName.toLowerCase()) {
+        try {
+          if (realpathSync.native(newFullPath) === realpathSync.native(oldFullPath)) {
+            const tempPath = join(parentDir, `.ccv-rename-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+            renameSyncWithRetry(oldFullPath, tempPath);
+            try { renameSyncWithRetry(tempPath, newFullPath); }
+            catch (err) {
+              try { renameSyncWithRetry(tempPath, oldFullPath); }
+              catch (rollbackErr) { reportSwallowed('filesFs.renameRollback', rollbackErr, { tempPath }); }
+              throw err;
+            }
+            const newRelPath = oldPath.includes('/') ? oldPath.substring(0, oldPath.lastIndexOf('/') + 1) + newName : newName;
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, newPath: newRelPath }));
+            return;
+          }
+        } catch (err) {
+          // Case-sensitive filesystems have no destination to realpath yet;
+          // that is the normal rename case, not a server error.
+          if (err.code !== 'ENOENT') {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+            return;
+          }
+        }
+      }
       // 检查目标是否已存在
       if (existsSync(newFullPath)) {
         res.writeHead(409, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Target already exists' }));
         return;
       }
-      renameSync(oldFullPath, newFullPath);
+      renameSyncWithRetry(oldFullPath, newFullPath);
       const newRelPath = oldPath.includes('/') ? oldPath.substring(0, oldPath.lastIndexOf('/') + 1) + newName : newName;
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true, newPath: newRelPath }));
@@ -391,7 +448,8 @@ function moveFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const oldFullPath = join(cwd, fromPath);
       const toDirFull = join(cwd, toDir);
       // 检查源文件/目录存在
@@ -417,6 +475,11 @@ function moveFile(req, res, parsedUrl, isLocal, deps) {
         }
       }
       const name = basename(fromPath);
+      if (!isPathContained(oldFullPath, cwd) || !isPathContained(toDirFull, cwd)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
+        return;
+      }
       const newFullPath = join(toDirFull, name);
       // 检查目标位置不存在同名文件
       if (existsSync(newFullPath)) {
@@ -487,7 +550,8 @@ function deleteFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullPath = join(cwd, filePath);
       if (!existsSync(fullPath)) {
         res.writeHead(404, { 'Content-Type': 'application/json' });
@@ -565,7 +629,8 @@ function revealFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullPath = join(cwd, filePath);
       if (!existsSync(fullPath)) {
         res.writeHead(404, { 'Content-Type': 'application/json' });
@@ -623,7 +688,8 @@ function openFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullPath = join(cwd, filePath);
       if (!existsSync(fullPath)) {
         res.writeHead(404, { 'Content-Type': 'application/json' });
@@ -671,12 +737,11 @@ function resolvePath(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      // resolve-path is an internal UI helper (resolve a relative path against
-      // the project root for reveal/open actions). It stays BOUND-only (review
-      // P2-5): resolving a foreign project's root and echoing its absolute path
-      // back would make this endpoint a weak path-leak oracle for projects the
-      // caller is not viewing.
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      // Resolve a project-relative path against the same viewed root used by
+      // reveal/open. Registered projects and live instances use the shared
+      // resolver, so same-name projects cannot silently fall back to the bound cwd.
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullPath = relPath ? join(cwd, relPath) : cwd;
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true, fullPath }));
@@ -790,7 +855,8 @@ function createFile(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullDirPath = relDir ? join(cwd, relDir) : cwd;
       if (!existsSync(fullDirPath) || !statSync(fullDirPath).isDirectory()) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -838,7 +904,8 @@ function openTerminal(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullDir = relDir ? join(cwd, relDir) : cwd;
       if (!existsSync(fullDir) || !statSync(fullDir).isDirectory()) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -860,23 +927,40 @@ function openTerminal(req, res, parsedUrl, isLocal, deps) {
       } else {
         // Linux: try common terminal emulators
         const terminals = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
-        let launched = false;
-        for (const term of terminals) {
+        // spawn reports a missing executable asynchronously, outside try/catch.
+        // Probe each candidate with piped stdio so the next one can be attempted
+        // after ENOENT; detach only after a successful spawn.
+        const tryTerminal = (index) => {
+          if (index >= terminals.length) {
+            const child = spawn('xdg-open', [fullDir], { stdio: 'ignore', detached: true });
+            child.on('error', (err) => { reportSwallowed('filesFs.openTerminal', err, { terminal: 'xdg-open' }); });
+            child.unref();
+            return;
+          }
+          const term = terminals[index];
+          let child;
           try {
             if (term === 'gnome-terminal') {
-              spawn(term, ['--working-directory=' + fullDir], { stdio: 'ignore', detached: true }).unref();
+              child = spawn(term, ['--working-directory=' + fullDir], { stdio: 'pipe' });
             } else if (term === 'konsole') {
-              spawn(term, ['--workdir', fullDir], { stdio: 'ignore', detached: true }).unref();
+              child = spawn(term, ['--workdir', fullDir], { stdio: 'pipe' });
             } else {
-              spawn(term, [], { cwd: fullDir, stdio: 'ignore', detached: true }).unref();
+              child = spawn(term, [], { cwd: fullDir, stdio: 'pipe' });
             }
-            launched = true;
-            break;
-          } catch { continue; }
-        }
-        if (!launched) {
-          spawn('xdg-open', [fullDir], { stdio: 'ignore', detached: true }).unref();
-        }
+          } catch {
+            tryTerminal(index + 1);
+            return;
+          }
+          child.once('error', (err) => {
+            reportSwallowed('filesFs.openTerminal', err, { terminal: term });
+            tryTerminal(index + 1);
+          });
+          child.once('spawn', () => {
+            for (const stream of [child.stdin, child.stdout, child.stderr]) stream?.destroy();
+            child.unref();
+          });
+        };
+        tryTerminal(0);
       }
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));
@@ -915,7 +999,8 @@ function createDir(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Invalid path' }));
         return;
       }
-      const cwd = process.env.CCV_PROJECT_DIR || process.cwd();
+      const cwd = _viewRootOrReply(req, res, parsedUrl, parsed.project, parsed.instance);
+      if (!cwd) return;
       const fullDirPath = relDir ? join(cwd, relDir) : cwd;
       if (!existsSync(fullDirPath) || !statSync(fullDirPath).isDirectory()) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -965,8 +1050,9 @@ function openProfileDir(req, res) {
   res.end(JSON.stringify({ ok: true, dir }));
 }
 
-function openProjectDir(req, res) {
-  const dir = process.env.CCV_PROJECT_DIR || process.cwd();
+function openProjectDir(req, res, parsedUrl) {
+  const dir = _viewRootOrReply(req, res, parsedUrl);
+  if (!dir) return;
   const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'explorer' : 'xdg-open';
   execFile(cmd, [dir], { windowsHide: true }, () => {});
   res.writeHead(200, { 'Content-Type': 'application/json' });

package/server/routes/resume.js

@@ -560,7 +560,7 @@ function postResumeSessionHandler(req, res, parsedUrl, isLocal, deps) {
       if (r.ok) {
         // Session identity just changed — drop any still-queued composer messages so a
         // message typed for the OLD conversation never drains into the resumed one.
-        try { chatQueue.clear(); } catch (err) { reportSwallowed('resume-route.clear-queue', err); }
+        try { chatQueue.clear({ project: targetProject || undefined, instanceKey: instanceKey || undefined }); } catch (err) { reportSwallowed('resume-route.clear-queue', err); }
         sendJson(res, 200, { ok: true });
         return;
       }

package/server/routes/sdk-context.js

@@ -2,14 +2,25 @@
 // the automatic turn-end/compact refreshes flow over the WS broadcast instead. A
 // `session-inactive` outcome is a NORMAL state (no turn run yet / query dead), so it
 // returns 200 with { ok:false, reason } rather than an HTTP error.
+//
+// Multi-session: `?project=` and `?instance=` pin the pull to the VIEWED workspace (same
+// query-param names as the other view-scoped routes). No params → active session. Unknown
+// or ambiguous anchors stay `session-inactive` (never fall back to the active session).
 import { reportSwallowed } from '../lib/error-report.js';
 
-async function sdkContextUsage(req, res) {
+async function sdkContextUsage(req, res, parsedUrl) {
   try {
     // Dynamic import: sdk-manager is only loaded in SDK mode (resume.js parity). The
     // literal specifier satisfies the boundary verifier's R7 rule.
     const sdk = await import('../lib/sdk-manager.js');
-    const r = await sdk.fetchContextUsage();
+    const params = parsedUrl && parsedUrl.searchParams;
+    const project = (params && params.get('project')) || '';
+    const instance = (params && params.get('instance')) || '';
+    // No params must stay `undefined` so fetchContextUsage keeps the active-session fallback.
+    const anchor = (project || instance)
+      ? { project: project || undefined, instanceKey: instance || undefined }
+      : undefined;
+    const r = await sdk.fetchContextUsage(anchor);
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(r.ok ? { ok: true, snapshot: r.snapshot } : { ok: false, reason: r.reason }));
   } catch (err) {