cc-viewer 1.9.15 → 1.9.16

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-Sp3JYYKo.js"></script>
+  <script type="module" crossorigin src="./assets/index-sgW8MlD3.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-I6I2F7Rv.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-Zkm6UHQg.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-CC09MDyZ.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.9.15",
+  "version": "1.9.16",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/ask/perm-bridge.js

@@ -164,7 +164,10 @@ const TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 
 function postToViewer() {
   return new Promise((resolve, reject) => {
-    const body = JSON.stringify({ toolName, input: toolInput });
+    // Forward the session cwd so the server can resolve the project-forked
+    // autoApproveSeconds for the right workspace (falls back to the server's
+    // current project key when absent — backward compatible).
+    const body = JSON.stringify({ toolName, input: toolInput, cwd: typeof payload?.cwd === 'string' ? payload.cwd : undefined });
     const req = httpClient.request({
       hostname: '127.0.0.1',
       port: Number(port),

package/server/lib/auto-approve.js

@@ -0,0 +1,160 @@
+// Server-side auto-approve countdown for plan/permission approvals.
+//
+// The auto-approve countdown used to live entirely in the web client: when the
+// browser tab was closed, backgrounded (timer throttling), or disconnected, no
+// approval ever fired and the pending request degraded to the 5-minute deny
+// timeout. This module moves the deadline to the server: the countdown is armed
+// from the moment the approval request arrives (wall-clock), and the server
+// resolves the pending approval itself at deadline + AUTO_APPROVE_BUFFER_MS.
+// The buffer gives a connected client whose own countdown fires at the exact
+// deadline a head start, so a watched approval is still answered by the client
+// and the server timer is only the fallback.
+//
+// Cancellation is durable while the approval is pending: a client cancel marks
+// the entry (autoCancelled) and clears the server timer, the approval stays
+// pending for a manual decision, and the cancelled state is replayed to newly
+// connected clients so they never re-arm a countdown.
+//
+// Semantics of the settings (shared with the client):
+//   plan: prefs.approvalModal.planAutoApproveSeconds (default 0 = off)
+//   perm: prefs.autoApproveSeconds                  (default 3 when unset)
+//   0/off, N>0 = N seconds, -1 = instant (resolve immediately, no buffer).
+// AskUserQuestion approvals are never auto-approved.
+
+import { readPrefsRaw } from './prefs-store.js';
+import { getCurrentProjectKey, hasFork, resolveScoped } from './project-prefs.js';
+import { reportSwallowed } from './error-report.js';
+
+export const AUTO_APPROVE_BUFFER_MS = 1000;
+export const DEFAULT_PERM_AUTO_APPROVE_SECONDS = 3;
+export const AUTO_APPROVE_INSTANT = -1;
+// A hand-edited preferences.json can hold an absurdly large value. Besides being
+// pointless, a value above the 5-minute hard approval timeout would advertise an
+// autoApproveAt the deny timeout always beats (a lying countdown); and beyond
+// 2^31-1 ms Node's setTimeout clamps the delay to 1ms (instant approval). Cap the
+// countdown at the approval timeout so the advertised deadline is always reachable.
+export const MAX_AUTO_APPROVE_SECONDS = 300;
+
+/**
+ * Extract the configured seconds for a kind ('plan' | 'perm') from an effective
+ * prefs object. Returns null when disabled (0 / invalid / negative other than -1 /
+ * absurdly large).
+ */
+export function effectiveAutoApproveSeconds(kind, prefs) {
+  const raw = kind === 'plan'
+    ? prefs?.approvalModal?.planAutoApproveSeconds
+    : (prefs?.autoApproveSeconds ?? DEFAULT_PERM_AUTO_APPROVE_SECONDS);
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds)) return null;
+  if (seconds === AUTO_APPROVE_INSTANT) return AUTO_APPROVE_INSTANT;
+  if (seconds <= 0) return null;
+  if (seconds > MAX_AUTO_APPROVE_SECONDS) return null;
+  return seconds;
+}
+
+/**
+ * Read prefs (project-fork aware) and compute the auto-approve deadline for a
+ * pending approval. `projectKey` is the session cwd (SDK) or hook-reported cwd
+ * (PTY hook); falls back to the server's current project key.
+ *
+ * Returns:
+ *   { enabled:false }                                      — no auto-approve
+ *   { enabled:true, instant, seconds, autoApproveAt }      — absolute epoch ms deadline
+ */
+export function computeAutoApprove(kind, projectKey, { now = Date.now(), readPrefs = readPrefsRaw, file } = {}) {
+  let prefs = {};
+  try {
+    prefs = readPrefs(file) || {};
+  } catch (err) {
+    reportSwallowed('auto-approve.read-prefs', err);
+    return { enabled: false };
+  }
+  const key = typeof projectKey === 'string' && projectKey ? projectKey : getCurrentProjectKey();
+  const effective = hasFork(prefs, key) ? resolveScoped(prefs, prefs.prefsByProject[key]) : prefs;
+  const seconds = effectiveAutoApproveSeconds(kind, effective);
+  if (seconds === null) return { enabled: false };
+  const instant = seconds === AUTO_APPROVE_INSTANT;
+  return {
+    enabled: true,
+    instant,
+    seconds,
+    autoApproveAt: instant ? now : now + seconds * 1000,
+  };
+}
+
+/**
+ * Delay for the server-side fallback timer: the user-visible deadline plus the
+ * request buffer, never negative. Instant fires on the same tick (0).
+ */
+export function autoApproveFireDelayMs(computed, now = Date.now()) {
+  if (!computed?.enabled) return null;
+  if (computed.instant) return 0;
+  return Math.max(0, computed.autoApproveAt - now) + AUTO_APPROVE_BUFFER_MS;
+}
+
+/**
+ * Arm the server-side fallback timer. Returns the auto state stored on the
+ * pending entry: { autoApproveAt, seconds, cancelled, timer }.
+ * `onFire` is invoked once when the deadline (+buffer) passes; callers must
+ * re-check the entry is still pending and not cancelled inside onFire.
+ * Instant (-1) fires SYNCHRONOUSLY — the caller MUST register the pending entry
+ * (and emit the pending frame) before calling this.
+ */
+export function createAutoApproveState(computed, onFire) {
+  const delay = autoApproveFireDelayMs(computed);
+  if (delay === null) return null; // disabled — never arm
+  const state = {
+    autoApproveAt: computed.autoApproveAt,
+    seconds: computed.seconds,
+    cancelled: false,
+    timer: null,
+  };
+  if (delay === 0) {
+    onFire();
+    return state;
+  }
+  state.timer = setTimeout(onFire, delay);
+  return state;
+}
+
+/**
+ * Cancel an armed auto-approve state: clears the timer and marks it cancelled.
+ * Accepts either the auto state itself or the whole pending entry ({ auto,
+ * autoCancelled }) — the entry form also stamps the durable entry-level flag so
+ * replays never re-arm. Returns true only on the first cancellation (so callers
+ * broadcast once).
+ */
+export function cancelAutoApproveState(autoOrEntry) {
+  if (!autoOrEntry) return false;
+  // Entry form: { auto, autoCancelled }
+  if (Object.prototype.hasOwnProperty.call(autoOrEntry, 'autoCancelled')) {
+    const entry = autoOrEntry;
+    if (entry.autoCancelled) return false;
+    entry.autoCancelled = true;
+    if (entry.auto) {
+      entry.auto.cancelled = true;
+      if (entry.auto.timer) {
+        clearTimeout(entry.auto.timer);
+        entry.auto.timer = null;
+      }
+    }
+    return true;
+  }
+  const auto = autoOrEntry;
+  if (auto.cancelled) return false;
+  auto.cancelled = true;
+  if (auto.timer) {
+    clearTimeout(auto.timer);
+    auto.timer = null;
+  }
+  return true;
+}
+
+/** Fields merged into pending/replay frames for the client countdown UI. */
+export function replayAutoApproveFields(auto, autoCancelled) {
+  return {
+    autoApproveAt: autoCancelled ? null : (auto?.autoApproveAt ?? null),
+    autoApproveSeconds: auto?.seconds ?? null,
+    autoCancelled: autoCancelled === true,
+  };
+}

package/server/lib/file-access-policy.js

@@ -233,8 +233,30 @@ export function isReadAllowed(absPath) {
     if (SENSITIVE_CLAUDE_FILES.has(last)) {
       return { ok: false, reason: 'sensitive-claude-config' };
     }
-    // 任意子目录下的 settings.json / settings.local.json 也拦
-    if (/^settings(\.local)?\.json$/i.test(last)) {
+    // settings.json / settings.local.json at any depth, plus all backups/variants
+    // (settings.json.bk*, settings_*.json, etc.) — rolling backup files carry the
+    // same env/api-key content and must not slip past the exact-name match.
+    if (/^settings(\.local)?\.json($|\.)|^settings_.*\.json$/i.test(last)) {
+      return { ok: false, reason: 'sensitive-claude-config' };
+    }
+    // Prompt history, project transcripts, shell snapshots, file history, and
+    // paste cache contain user prompt content and (in the case of shell snapshots)
+    // live env vars. Block the whole subtree EXCEPT projects/<encoded>/memory/**,
+    // which is the documented per-project memory dir served by /api/project-memory.
+    const rel = norm(real.slice(norm(withSep(claudeReal)).length));
+    const firstSeg = rel.split(sep)[0];
+    if (firstSeg === 'todos' || firstSeg === 'shell-snapshots'
+      || firstSeg === 'file-history' || firstSeg === 'paste-cache' || firstSeg === 'session-env') {
+      return { ok: false, reason: 'sensitive-claude-config' };
+    }
+    if (firstSeg === 'projects') {
+      const parts = rel.split(sep);
+      const isMemoryDir = parts.length >= 3 && parts[2] === 'memory';
+      if (!isMemoryDir) {
+        return { ok: false, reason: 'sensitive-claude-config' };
+      }
+    }
+    if (last === 'history.jsonl') {
       return { ok: false, reason: 'sensitive-claude-config' };
     }
   }

package/server/lib/sdk-manager.js

@@ -36,6 +36,12 @@ import { createHash, randomBytes } from 'node:crypto';
 import { registerSdkSessionLister } from './sdk-session-index.js';
 import { readPrefsRaw } from './prefs-store.js';
 import { projectKeyForCwd } from './system-prompt-snapshots.js';
+import {
+  computeAutoApprove,
+  createAutoApproveState,
+  cancelAutoApproveState,
+  replayAutoApproveFields,
+} from './auto-approve.js';
 
 let _query;
 try {
@@ -1489,11 +1495,24 @@ function _createSession(key, cwd) {
           }
         } catch (err) { reportSwallowed('sdk-manager.waterfall.plan', err); }
       }
-      const planPayload = { type: 'sdk-plan-pending', id, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin };
+      // Server-side auto-approve countdown (armed from request arrival, wall-clock):
+      // the pending frame carries the absolute deadline so clients render the remaining
+      // time instead of arming their own full-length timer; the server resolves the
+      // approval itself at deadline + 1s buffer when no client answered.
+      // Unattended scheduled-task runs (ctx != null → origin 'scheduled-task') are exempt
+      // from the server-side auto-approve fallback — with no human watching, an ephemeral
+      // run must wait for a decision (5-min deny), symmetric to the npm-publish floor below.
+      const planAuto = ctx ? { enabled: false } : computeAutoApprove('plan', _cwd);
+      // Always stamp autoApproveSeconds (0 = server says OFF): the client's local pref
+      // can disagree with the fork-resolved server value, and absence would make the
+      // client fall back to its own countdown and defeat a fork-level off.
+      const planPayload = { type: 'sdk-plan-pending', id, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin,
+        autoApproveSeconds: planAuto.enabled ? planAuto.seconds : 0,
+        ...(planAuto.enabled ? { autoApproveAt: planAuto.autoApproveAt } : {}) };
       if (_broadcastWs) {
         _broadcastWs(planPayload);
       }
-      const result = await _waitForApproval(id, 5 * 60 * 1000, 'plan', planPayload, options?.signal, ctx);
+      const result = await _waitForApproval(id, 5 * 60 * 1000, 'plan', planPayload, options?.signal, ctx, planAuto);
       if (result === null) {
         return { behavior: 'deny', message: 'Timeout waiting for plan approval' };
       }
@@ -1523,7 +1542,7 @@ function _createSession(key, cwd) {
       // server/lib/ask/ask-constants.js.
       const askTimeoutMs = ASK_TIMEOUT_MS;
       const askStartedAt = Date.now();
-      const askPayload = { type: 'sdk-ask-pending', id, questions: input.questions, startedAt: askStartedAt, timeoutMs: askTimeoutMs, cwd: _cwd, sessionId: effSessionId(), ...origin };
+      const askPayload = { type: 'sdk-ask-pending', id, questions: input.questions, startedAt: askStartedAt, timeoutMs: askTimeoutMs, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin };
       if (_broadcastWs) {
         _broadcastWs(askPayload);
       }
@@ -1599,12 +1618,18 @@ function _createSession(key, cwd) {
         // unknown decision → fall through to normal approval flow
       } catch (err) { reportSwallowed('sdk-manager.waterfall.perm', err); }
     }
-    const permPayload = { type: 'perm-hook-pending', id, toolName, input, cwd: _cwd, sessionId: effSessionId(), ...origin };
+    // npm publish is a hard safety floor: it must always wait for a HUMAN decision
+    // (the 5-minute deny timeout applies), never the server-side auto-approve fallback.
+    // Same exemption for unattended scheduled-task runs (ctx != null).
+    const permAuto = (isPublish || ctx) ? { enabled: false } : computeAutoApprove('perm', _cwd);
+    const permPayload = { type: 'perm-hook-pending', id, toolName, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin,
+      autoApproveSeconds: permAuto.enabled ? permAuto.seconds : 0,
+      ...(permAuto.enabled ? { autoApproveAt: permAuto.autoApproveAt } : {}) };
     if (_broadcastWs) {
       _broadcastWs(permPayload);
     }
 
-    const result = await _waitForApproval(id, 5 * 60 * 1000, 'perm', permPayload, options?.signal, ctx);
+    const result = await _waitForApproval(id, 5 * 60 * 1000, 'perm', permPayload, options?.signal, ctx, permAuto);
     if (result === null) {
       return { behavior: 'deny', message: 'Timeout waiting for user approval' };
     }
@@ -1645,30 +1670,52 @@ function _createSession(key, cwd) {
     } catch (err) { console.warn('[sdk-manager] approval-dismiss broadcast threw:', err?.message); }
   }
 
-  function _waitForApproval(id, timeoutMs, kind, replay = null, signal = null, ctx = null) {
+  function _waitForApproval(id, timeoutMs, kind, replay = null, signal = null, ctx = null, autoMeta = null) {
     // Record the id on the ephemeral run's ctx ONLY when it actually parks (the three
     // callers below sit after every auto-allow/hard-deny early-return, so an auto-allowed
     // tool never lands here) — keeps ctx.approvalIds bounded (review P3: no unbounded growth).
     if (ctx && Array.isArray(ctx.approvalIds)) ctx.approvalIds.push(id);
     return new Promise((resolve) => {
       const timer = setTimeout(() => {
+        const cur = _pendingApprovals.get(id);
+        if (cur?.auto) cancelAutoApproveState(cur.auto);
         _pendingApprovals.delete(id);
         // Close the modal on every client — a silent deny would leave it hanging forever.
         _broadcastApprovalDismiss(kind, id, 'timeout');
         resolve(null);
       }, timeoutMs);
-      _pendingApprovals.set(id, {
+      const entry = {
         kind,  // 'ask' | 'plan' | 'perm' — lets cancelApproval distinguish types so an
         // ask-cancel does not collide with a plan/perm id
         replay,  // exact broadcast payload announced to clients — replayed to a fresh WS connection
         startedAt: Date.now(),
         timeoutMs,
+        // Durable auto-approve cancellation: a client cancel marks this and clears the
+        // server fallback timer, the approval stays pending for a manual decision, and
+        // the flag is replayed to fresh clients so they never re-arm the countdown.
+        autoCancelled: false,
+        auto: null,
         resolve: (value) => {
           clearTimeout(timer);
+          const cur = _pendingApprovals.get(id);
+          if (cur?.auto) cancelAutoApproveState(cur.auto);
           _pendingApprovals.delete(id);
           resolve(value);
         },
-      });
+      };
+      _pendingApprovals.set(id, entry);
+      // Arm the server-side fallback AFTER the entry is in the map: instant (-1) fires
+      // synchronously and resolves through the same first-wins wrapper.
+      if (autoMeta?.enabled) {
+        entry.auto = createAutoApproveState(autoMeta, () => {
+          const p = _pendingApprovals.get(id);
+          if (!p || p.autoCancelled) return;
+          p.resolve(kind === 'plan' ? { approve: true, feedback: '' } : { decision: 'allow' });
+          try {
+            _broadcastWs?.({ type: kind === 'plan' ? 'sdk-plan-resolved' : 'perm-hook-resolved', id, reason: 'auto-approved', cwd: _cwd, sessionId: _sessionId || null, instanceKey });
+          } catch (err) { reportSwallowed('sdk-manager.auto-approve-broadcast', err); }
+        });
+      }
       // CLI-side abort of the in-flight control request (e.g. interrupt while the modal is
       // open): settle through the same first-wins path as a timeout so the promise resolves
       // to deny and the modal closes everywhere. { once: true } prevents listener leaks.
@@ -1711,11 +1758,37 @@ function _createSession(key, cwd) {
     for (const [id, p] of _pendingApprovals) {
       const remaining = (p.timeoutMs ?? 0) - (now - (p.startedAt ?? now));
       if (remaining <= 0) continue;
-      out.push({ id, kind: p.kind || null, replay: p.replay || null, remainingMs: remaining });
+      out.push({
+        id, kind: p.kind || null, replay: p.replay || null, remainingMs: remaining,
+        ...replayAutoApproveFields(p.auto, p.autoCancelled),
+      });
     }
     return out;
   }
 
+  /**
+   * Cancel the SERVER-SIDE auto-approve countdown for a pending plan/perm approval
+   * (client clicked the countdown-cancel button). Unlike cancelApproval this does NOT
+   * resolve the approval — it stays pending for a manual decision; only the fallback
+   * timer is destroyed and the cancelled flag is replayed to fresh clients so they
+   * never re-arm. Returns true when the id matched a pending approval of that kind
+   * (even on a repeat cancel — the state change is durable while pending); false when
+   * nothing matched (caller falls back to the legacy relay-only behavior).
+   */
+  function _autoCancelApproval(id, kind) {
+    // plan/perm only — ask approvals never arm a server auto-approve timer.
+    if (kind !== 'plan' && kind !== 'perm') return false;
+    const pending = _pendingApprovals.get(id);
+    if (!pending || pending.kind !== kind) return false;
+    const first = cancelAutoApproveState(pending);
+    if (first && _broadcastWs) {
+      try {
+        _broadcastWs({ type: kind === 'plan' ? 'sdk-plan-auto-cancel' : 'perm-hook-auto-cancel', id, cwd: _cwd, sessionId: _sessionId || null, instanceKey });
+      } catch (err) { reportSwallowed('sdk-manager.auto-cancel-broadcast', err); }
+    }
+    return true;
+  }
+
   /**
    * Cancel a pending canUseTool approval — used by ask-cancel WS handler
    * (user clicked Cancel button or typed-interrupt in input bar).
@@ -2021,6 +2094,7 @@ function _createSession(key, cwd) {
     getQueueSnapshot: _getQueueSnapshot,
     resolveApproval: _resolveApproval,
     cancelApproval: _cancelApproval,
+    autoCancelApproval: _autoCancelApproval,
     getPendingApprovals: _getPendingApprovals,
     getSdkInitSnapshot: () => _lastInitSnapshot,
     getSessionStateSnapshot: () => {
@@ -2256,6 +2330,19 @@ export function cancelApproval(id, reason) {
   return false;
 }
 
+/**
+ * Cancel the server-side auto-approve countdown for a plan/perm approval,
+ * scanning EVERY session (auto-cancel WS handlers). The approval stays pending
+ * for a manual decision. Returns false when no pending approval matched, so the
+ * caller can fall back to the legacy relay-only broadcast.
+ */
+export function autoCancelApproval(id, kind) {
+  for (const sess of new Set([..._sessions.values(), ..._ephemeralHosts])) {
+    if (sess.autoCancelApproval(id, kind)) return true;
+  }
+  return false;
+}
+
 /**
  * Snapshot of pending approvals for WS-reconnect replay (server.js connection
  * handler). WITHOUT an anchor: aggregated across ALL sessions; WITH an anchor:

package/server/routes/ask-perm.js

@@ -7,6 +7,8 @@ import { _projectName } from '../interceptor.js';
 import { readPrefsRaw } from '../lib/prefs-store.js';
 import { getCurrentProjectKey, hasFork, resolveScoped } from '../lib/project-prefs.js';
 import { reportSwallowed } from '../lib/error-report.js';
+import { computeAutoApprove, createAutoApproveState } from '../lib/auto-approve.js';
+import { isPublishCommand } from '../lib/approval-policy.js';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {
@@ -394,7 +396,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
       return;
     }
     try {
-      const { toolName, input } = JSON.parse(body);
+      const { toolName, input, cwd } = JSON.parse(body);
       if (!toolName) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Missing toolName' }));
@@ -407,6 +409,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         const oldest = deps.pendingPermHooks.get(oldestId);
         if (oldest) {
           clearTimeout(oldest.timer);
+          if (oldest.auto?.timer) clearTimeout(oldest.auto.timer);
           try { if (!oldest.res.headersSent) { oldest.res.writeHead(429, { 'Content-Type': 'application/json' }); oldest.res.end(JSON.stringify({ error: 'Too many concurrent requests' })); } } catch {}
           deps.pendingPermHooks.delete(oldestId);
         }
@@ -431,6 +434,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
       const timer = setTimeout(() => {
         const entry = deps.pendingPermHooks.get(id);
         if (entry) {
+          if (entry.auto?.timer) clearTimeout(entry.auto.timer);
           deps.pendingPermHooks.delete(id);
           try {
             if (!entry.res.headersSent) {
@@ -447,11 +451,33 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         }
       }, PERM_HOOK_TIMEOUT);
 
-      deps.pendingPermHooks.set(id, { toolName, input, res, timer, createdAt: Date.now() });
+      // Server-side auto-approve countdown (same semantics as the SDK path in
+      // sdk-manager.js): armed from request arrival; the server answers the hook
+      // itself at deadline + 1s buffer when no client did. autoCancelled is set by
+      // the perm-hook-auto-cancel WS handler (the approval then stays pending for
+      // a manual decision) and replayed to fresh clients.
+      // npm publish is a hard safety floor: always wait for a human decision, never
+      // the server-side auto-approve fallback (SDK path parity: sdk-manager.js).
+      const autoMeta = isPublishCommand(toolName, input)
+        ? { enabled: false }
+        : computeAutoApprove('perm', typeof cwd === 'string' && cwd ? cwd : undefined, { file: deps.getPrefsFile?.() });
+
+      const hookEntry = {
+        toolName, input, res, timer, createdAt: Date.now(),
+        autoCancelled: false,
+        auto: null,
+      };
+      deps.pendingPermHooks.set(id, hookEntry);
 
       // Broadcast to all terminal WS clients
       if (deps.terminalWss) {
-        const pmsg = JSON.stringify({ type: 'perm-hook-pending', id, toolName, input });
+        const pmsg = JSON.stringify({
+          type: 'perm-hook-pending', id, toolName, input,
+          // Always stamp autoApproveSeconds (0 = server says OFF) so a client whose
+          // global pref disagrees with the fork-resolved value never re-arms locally.
+          autoApproveSeconds: autoMeta.enabled ? autoMeta.seconds : 0,
+          ...(autoMeta.enabled ? { autoApproveAt: autoMeta.autoApproveAt } : {}),
+        });
         deps.terminalWss.clients.forEach((client) => {
           if (client.readyState === 1) {
             try { client.send(pmsg); } catch {}
@@ -459,11 +485,36 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         });
       }
 
+      // Arm AFTER the entry is in the map AND the pending frame is out: instant (-1)
+      // fires synchronously and resolves through the entry, so clients observe the
+      // order pending → resolved (never a ghost panel for an already-answered hook).
+      if (autoMeta.enabled) {
+        hookEntry.auto = createAutoApproveState(autoMeta, () => {
+          const entry = deps.pendingPermHooks.get(id);
+          if (!entry || entry.autoCancelled) return;
+          clearTimeout(entry.timer);
+          deps.pendingPermHooks.delete(id);
+          try {
+            if (!entry.res.headersSent) {
+              entry.res.writeHead(200, { 'Content-Type': 'application/json' });
+              entry.res.end(JSON.stringify({ decision: 'allow' }));
+            }
+          } catch {}
+          if (deps.terminalWss) {
+            const rmsg = JSON.stringify({ type: 'perm-hook-resolved', id, reason: 'auto-approved' });
+            deps.terminalWss.clients.forEach((c) => {
+              if (c.readyState === 1) try { c.send(rmsg); } catch {}
+            });
+          }
+        });
+      }
+
       // Handle perm-bridge.js disconnection
       res.on('close', () => {
         const entry = deps.pendingPermHooks.get(id);
         if (entry) {
           clearTimeout(entry.timer);
+          if (entry.auto?.timer) clearTimeout(entry.auto.timer);
           deps.pendingPermHooks.delete(id);
           if (deps.terminalWss) {
             const tmsg = JSON.stringify({ type: 'perm-hook-timeout', id });