cc-viewer 1.9.15 → 1.9.16

package/server/routes/files-content.js

@@ -1,8 +1,10 @@
 // Read-oriented file-access routes (moved verbatim from server.js handleRequest).
-import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream } from 'node:fs';
-import { join, basename, dirname, resolve, sep } from 'node:path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream, readdirSync } from 'node:fs';
+import { join, basename, dirname, resolve, relative, sep } from 'node:path';
+import { homedir } from 'node:os';
 import { isReadAllowed, reasonToStatus } from '../lib/file-access-policy.js';
 import { ERROR_STATUS_MAP, isPathContained } from '../lib/file-api.js';
+import { listSkills } from '../lib/skills-api.js';
 import { viewRootOrReply, resolveViewRoot } from '../lib/view-root.js';
 import { findSdkSessionByInstance } from '../lib/sdk-session-index.js';
 import { projectKeyForCwd } from '../lib/system-prompt-snapshots.js';
@@ -12,6 +14,8 @@ import { reportSwallowed } from '../lib/error-report.js';
 import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-discovery.js';
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
+import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
 
 // Multi-project file operations use the same viewed root for reads and writes.
 // Every file-browser mutation enforces realpath containment in that root;
@@ -537,7 +541,7 @@ function fileDownloadWithRoot(req, res, parsedUrl, reqPath, cwd) {
   }
 }
 
-function fileContentPost(req, res, parsedUrl) {
+function fileContentPost(req, res, parsedUrl, isLocal) {
   // The shared read root keeps its raw cwd for projectMemory's store-key
   // encoding. Normalize only this mutation's containment comparisons.
   let writeRoot;
@@ -609,6 +613,13 @@ function fileContentPost(req, res, parsedUrl) {
         }
         // Check containment before creating any missing parent directories.
         // Explicit $EDITOR sessions retain their allowlisted external paths.
+        // editorSession is client-claimed — require admin to honor it, otherwise
+        // any caller could use it as a write-root bypass (see /api/target-files).
+        if (editorSession && !isAdminReq(req, isLocal)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Forbidden', reason: 'editor-session-requires-admin' }));
+          return;
+        }
         if (!editorSession && !isInsideWriteRoot(ancestorPolicy.real)) {
           res.writeHead(403, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
@@ -628,6 +639,11 @@ function fileContentPost(req, res, parsedUrl) {
         return;
       }
 
+      if (editorSession && !isAdminReq(req, isLocal)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Forbidden', reason: 'editor-session-requires-admin' }));
+        return;
+      }
       if (!editorSession && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
@@ -646,6 +662,231 @@ function fileContentPost(req, res, parsedUrl) {
   });
 }
 
+function targetError(status, message) {
+  return Object.assign(new Error(message), { status });
+}
+
+// Map fs errno to a sensible HTTP status: missing → 404, permission → 403,
+// symlink loop → 400 (treat as malformed), anything else → 404 (don't leak).
+function errnoToStatus(err) {
+  const code = err?.code;
+  if (code === 'EACCES' || code === 'EPERM') return 403;
+  if (code === 'ELOOP') return 400;
+  return 404;
+}
+
+function realDirectory(path, label) {
+  let real;
+  try { real = realpathSync(path); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  let st;
+  try { st = statSync(real); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  if (!st.isDirectory()) throw targetError(400, `${label} is not a directory`);
+  return real;
+}
+
+function checkedDirectory(path, label) {
+  const real = realDirectory(path, label);
+  const policy = isReadAllowed(real);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), `${label} not readable`);
+  return policy.real;
+}
+
+function insidePath(path, root) {
+  return path === root || path.startsWith(root + sep);
+}
+
+function targetNavigation(targetReal, cwd) {
+  const projectReal = realDirectory(cwd, 'Project');
+  if (insidePath(targetReal, projectReal)) return { rootReal: projectReal, rootKind: 'project' };
+  // $HOME becomes the navigation root for home-resident targets (user skills,
+  // plugins, the global CLAUDE.md). Entries outside the allowlist (e.g. ~/.ssh,
+  // ~/.aws) are filtered per-entry by isReadAllowed, and sensitive paths inside
+  // ~/.claude are covered by file-access-policy's denylist. The /api/target-files
+  // handler additionally gates this endpoint behind isAdminReq + same-origin so
+  // a cross-site page cannot enumerate the user's home tree.
+  const homeReal = realDirectory(homedir(), 'Home');
+  if (insidePath(targetReal, homeReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: homeReal, rootKind: 'home' };
+  }
+  const configReal = realDirectory(getClaudeConfigDir(), 'Claude config');
+  if (insidePath(targetReal, configReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: realDirectory(dirname(configReal), 'Config root'), rootKind: 'config' };
+  }
+  // Allowlist fallback: targets that live inside another allowlisted root
+  // (registered workspaces, /tmp/cc-viewer-uploads, etc.) are reachable via
+  // /api/claude-md's discovery (which uses isReadAllowed), so we must not
+  // 403 them here. Use the target's own directory as the navigation root —
+  // no parent browsing, but at least the entry the user clicked actually opens.
+  const policy = isReadAllowed(targetReal);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), 'Target not readable');
+  return { rootReal: realDirectory(targetReal, 'Target'), rootKind: 'target' };
+}
+
+function targetScope(targetReal, cwd) {
+  const navigation = targetNavigation(targetReal, cwd);
+  return { ...navigation, targetPath: relative(navigation.rootReal, targetReal).split(sep).join('/') };
+}
+
+function targetRelPath(raw) {
+  if (raw == null) return null;
+  if (raw === '') return [];
+  if (typeof raw !== 'string' || raw.length > 2048 || raw.includes('\0') || raw.includes('\\')
+    || raw.startsWith('/') || /^[a-zA-Z]:/.test(raw)) {
+    throw targetError(400, 'Invalid path');
+  }
+  const segments = raw.split('/');
+  if (segments.some(segment => !segment || segment === '.' || segment === '..')) {
+    throw targetError(400, 'Invalid path');
+  }
+  // Hard cap on navigation depth: each segment triggers at least one
+  // synchronous readdir + per-entry realpath/stat in `ancestors`, and a 2KB
+  // free-form path could otherwise fan out into hundreds of syscalls per
+  // request. 32 is far deeper than any realistic skill / CLAUDE.md location.
+  if (segments.length > 32) throw targetError(400, 'Path too deep');
+  return segments;
+}
+
+function resolveTargetRoot(parsedUrl, cwd) {
+  const kind = parsedUrl.searchParams.get('kind');
+  if (kind === 'claude-md') {
+    const id = parsedUrl.searchParams.get('id') || '';
+    if (!/^[0-9a-f]{12}$/i.test(id)) throw targetError(400, 'Invalid id');
+    const candidate = discoverClaudeMdCandidates({
+      cwd,
+      claudeConfigDir: getClaudeConfigDir(),
+      isReadAllowedFn: isReadAllowed,
+    }).find(entry => entry.id === id);
+    if (!candidate || basename(candidate.realPath) !== 'CLAUDE.md') throw targetError(404, 'Target not found');
+    return { ...targetScope(realDirectory(dirname(candidate.realPath), 'Directory'), cwd), targetKind: 'claude-md' };
+  }
+  if (kind !== 'skill') throw targetError(400, 'Invalid target kind');
+  const source = parsedUrl.searchParams.get('source');
+  const targetPath = parsedUrl.searchParams.get('targetPath');
+  if (!['user', 'project', 'plugin'].includes(source)) throw targetError(400, 'Invalid skill source');
+  if (typeof targetPath !== 'string' || !targetPath || targetPath.length > 4096 || targetPath.includes('\0')) {
+    throw targetError(400, 'Invalid skill path');
+  }
+  const skill = listSkills({ projectDir: cwd })
+    .find(entry => entry.source === source && entry.path === targetPath);
+  if (!skill) throw targetError(404, 'Target not found');
+  const rootReal = realDirectory(skill.path, 'Directory');
+  const scope = targetScope(rootReal, cwd);
+  const anchor = source === 'project'
+    ? scope.rootReal
+    : dirname(dirname(skill.path));
+  const anchorReal = realDirectory(anchor, 'Skill root');
+  if (!insidePath(rootReal, anchorReal)) throw targetError(403, 'Target outside skill root');
+  // Plugin root must follow the configured Claude config dir, not the default
+  // homedir()/.claude — otherwise plugin skills break under CLAUDE_CONFIG_DIR.
+  if (source === 'plugin' && !insidePath(rootReal, realDirectory(join(getClaudeConfigDir(), 'plugins'), 'Plugin root'))) {
+    throw targetError(403, 'Target outside plugin root');
+  }
+  return { ...scope, targetKind: 'skill' };
+}
+
+function listTargetDirectory(rootReal, segments, deps, requireReadable = true) {
+  const dirReal = requireReadable
+    ? checkedDirectory(segments.length ? join(rootReal, ...segments) : rootReal, 'Directory')
+    : realDirectory(segments.length ? join(rootReal, ...segments) : rootReal, 'Directory');
+  if (!isPathContained(dirReal, rootReal)) throw targetError(403, 'Path outside target');
+  const ignored = deps?.IGNORED_PATTERNS || new Set();
+  const entries = [];
+  let dirents;
+  try {
+    dirents = readdirSync(dirReal, { withFileTypes: true });
+  } catch (err) {
+    // EACCES → 403 (permission), ENOENT/ENOTDIR → 404 (race with rename/delete),
+    // anything else falls back to 404 so we don't leak internal state via 500.
+    throw targetError(errnoToStatus(err), 'Directory not readable');
+  }
+  // Hard cap on returned entries: this is a synchronous loop with realpath +
+  // stat + isReadAllowed per entry, and the endpoint fans out via `ancestors`,
+  // so an unbounded listing of a huge dir (e.g. ~/.claude/projects/<hash>/)
+  // would block the event loop and return a giant JSON payload. 5000 is well
+  // past any realistic skill/CLAUDE.md folder.
+  const MAX_ENTRIES = 5000;
+  for (const entry of dirents) {
+    if (entries.length >= MAX_ENTRIES) break;
+    if (ignored.has(entry.name)) continue;
+    const fullPath = join(dirReal, entry.name);
+    let real;
+    try { real = realpathSync(fullPath); } catch (err) { reportSwallowed('targetFiles.entry.realpath', err); continue; }
+    if (!insidePath(real, rootReal)) continue;
+    const policy = isReadAllowed(real);
+    if (!policy.ok) continue;
+    let st;
+    try { st = statSync(policy.real); } catch (err) { reportSwallowed('targetFiles.entry.stat', err); continue; }
+    if (!st.isDirectory() && !st.isFile()) continue;
+    entries.push({ name: entry.name, type: st.isDirectory() ? 'directory' : 'file', absPath: policy.real });
+  }
+  entries.sort((a, b) => a.type !== b.type
+    ? (a.type === 'directory' ? -1 : 1)
+    : a.name.localeCompare(b.name));
+  return entries;
+}
+
+function targetFiles(req, res, parsedUrl, isLocal, deps) {
+  try {
+    // /api/target-files exposes directory listings under the user's home and
+    // ~/.claude (which contains transcripts, prompt history, env snapshots).
+    // Combined with the global `Access-Control-Allow-Origin: *` and loopback's
+    // no-auth path, a bare GET would let any web page enumerate the user's
+    // ~/.claude tree. Require admin AND a same-origin browser request.
+    if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'forbidden' }));
+      return;
+    }
+    const cwd = _viewRootOrReply(req, res, parsedUrl);
+    if (!cwd) return;
+    const scope = resolveTargetRoot(parsedUrl, cwd);
+    const rawPath = parsedUrl.searchParams.get('path');
+    const requestedSegments = targetRelPath(rawPath);
+    const segments = requestedSegments === null ? scope.targetPath.split('/').filter(Boolean) : requestedSegments;
+    const entries = listTargetDirectory(scope.rootReal, segments, deps, segments.length > 0 || scope.rootKind !== 'home');
+    const rootEntries = requestedSegments === null && segments.length > 0
+      ? listTargetDirectory(scope.rootReal, [], deps, scope.rootKind === 'project')
+      : entries;
+    const targetEntries = requestedSegments === null
+      ? entries.filter(entry => insidePath(entry.absPath, join(scope.rootReal, ...segments)))
+      : entries;
+    const targetSegments = scope.targetPath ? scope.targetPath.split('/') : [];
+    const ancestors = [];
+    // Ancestors are the chain from the navigation root down to the directory
+    // being listed. When the caller passed no `path` that's the chain leading
+    // to the target itself; when they passed `path`, the chain is the requested
+    // segments. We deliberately DO NOT use path.relative(targetPath, rawPath)
+    // here — that helper happily produces "../.." for sibling branches, which
+    // would pollute the cache with pseudo-paths and re-list directories the
+    // user never navigated into.
+    const chainSegments = requestedSegments === null ? targetSegments : segments;
+    // Request-scoped memo: targetFiles lists the same directory multiple times
+    // (entries + ancestors chain often share prefixes), so we cache by dir key
+    // to avoid duplicate readdirSync storms on large directories.
+    const listMemo = new Map();
+    const listOnce = (segs, requireReadable) => {
+      const key = segs.join('/') + (requireReadable ? '|r' : '|n');
+      if (!listMemo.has(key)) listMemo.set(key, listTargetDirectory(scope.rootReal, segs, deps, requireReadable));
+      return listMemo.get(key);
+    };
+    const ancestorCount = Math.max(0, chainSegments.length - (requestedSegments === null ? 0 : 1));
+    for (let i = 0; i <= ancestorCount; i++) {
+      const path = chainSegments.slice(0, i).join('/');
+      ancestors.push({ path, entries: listOnce(path ? path.split('/') : [], false) });
+    }
+    const { rootReal, ...response } = scope;
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ...response, targetPath: segments.join('/'), entries: rootEntries, targetEntries, ancestors }));
+  } catch (err) {
+    const status = err.status || ERROR_STATUS_MAP[err.code] || 500;
+    if (status === 500) console.error('[api/target-files]', err);
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: status === 500 ? 'Internal error' : err.message }));
+  }
+}
+
 export const filesContentRoutes = [
   { method: 'GET', match: 'exact', path: '/api/plan-file', handler: planFile },
   { method: 'GET', match: 'exact', path: '/api/file-content', handler: fileContentGet },
@@ -654,4 +895,5 @@ export const filesContentRoutes = [
   { predicate: (url, method) => (url === '/api/file-raw' || url.startsWith('/api/file-raw/')) && (method === 'GET' || method === 'HEAD'), handler: fileRaw },
   { predicate: (url, method) => url === '/api/download-file' && (method === 'GET' || method === 'HEAD'), handler: fileDownload },
   { method: 'POST', match: 'exact', path: '/api/file-content', handler: fileContentPost },
+  { method: 'GET', match: 'exact', path: '/api/target-files', handler: targetFiles },
 ];

package/server/routes/skills.js

@@ -9,13 +9,20 @@ import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
 
 // Multi-project (2026-10): the skills LIST resolves the viewed project via
-// the shared viewRootOrReply (?project=). toggle/delete (mutations) keep the
-// bound root.
-function _viewRootOrReply(req, res, parsedUrl) {
+// the shared viewRootOrReply (?project=). toggle/delete used to keep the
+// bound root — that was a deliberate safety choice, but it breaks multi-view
+// semantics: the list shows skills for project B while a click on toggle or
+// delete silently rewrote project A's same-named skill. Resolve mutations
+// through the same viewRootOrReply (with body-level project/instance) so the
+// action targets the project the user is actually looking at; the helper
+// still constrains the resolved root to bound/registered/live projects.
+function _viewRootOrReply(req, res, parsedUrl, bodyProject, bodyInstance) {
   return viewRootOrReply(req, res, parsedUrl, {
     boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
     loadWorkspaces,
     listLivePtys,
+    bodyProject,
+    bodyInstance,
   });
 }
 
@@ -34,18 +41,20 @@ async function skillsList(req, res, parsedUrl) {
 }
 
 // Skill 动态装卸 —— 切换单个 skill（在 skills/ 和 skills-skip/ 之间 move）
-function skillsToggle(req, res) {
+function skillsToggle(req, res, parsedUrl) {
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > 4096) req.destroy(); });
   req.on('end', async () => {
     try {
-      const { source, name, enable } = JSON.parse(body);
+      const { source, name, enable, project, instance } = JSON.parse(body);
+      const projectDir = _viewRootOrReply(req, res, parsedUrl, project, instance);
+      if (!projectDir) return;
       // 不加进程锁：moveSkill 里 existsSync 前置 + renameSync 原子性已能让并发
       // toggle 落到合理分支（一个成功、另一个拿 SOURCE_MISSING 或 DUPLICATE）；
       // 前端 toggling:Set 也已防同 tab 连点，两者叠加足够安全
       moveSkill({
         source, name, enable: !!enable,
-        projectDir: process.env.CCV_PROJECT_DIR || process.cwd(),
+        projectDir,
       });
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));
@@ -75,10 +84,12 @@ function skillsDelete(req, res, parsedUrl, isLocal) {
   req.on('data', chunk => { body += chunk; if (body.length > 4096) req.destroy(); });
   req.on('end', async () => {
     try {
-      const { source, name, enabled } = JSON.parse(body);
+      const { source, name, enabled, project, instance } = JSON.parse(body);
+      const projectDir = _viewRootOrReply(req, res, parsedUrl, project, instance);
+      if (!projectDir) return;
       deleteSkill({
         source, name, enabled: !!enabled,
-        projectDir: process.env.CCV_PROJECT_DIR || process.cwd(),
+        projectDir,
       });
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));

package/server/server.js

@@ -51,6 +51,7 @@ import * as imCore from './lib/im/im-bridge-core.js';
 import * as imProcMgr from './lib/im/im-process-manager.js';
 import * as chatQueue from './lib/chat-queue.js';
 import { reportSwallowed } from './lib/error-report.js';
+import { cancelAutoApproveState } from './lib/auto-approve.js';
 import { initScheduledTaskScheduler, startScheduledTaskScheduler, stopScheduledTaskScheduler } from './lib/scheduled-task-scheduler.js';
 import { executeScheduledTask } from './lib/scheduled-task-executor.js';
 import './lib/adapters/dingtalk-adapter.js'; // side-effect: registers the DingTalk adapter
@@ -636,6 +637,15 @@ function getAllLocalIps() {
   return ips;
 }
 
+// Approval/cancel message id validator — the single source for the ≤256-char +
+// [a-zA-Z0-9_-] whitelist shared by ask-cancel / sdk-plan-auto-cancel /
+// perm-hook-auto-cancel (keeps the three branches consistent).
+function validateApprovalId(raw) {
+  if (raw == null) return null;
+  const id = String(raw);
+  return id.length > 0 && id.length <= 256 && /^[a-zA-Z0-9_-]+$/.test(id) ? id : null;
+}
+
 // ─── Route dependency bag ──────────────────────────────────────────
 // Single dependency object handed to every per-domain route handler (server/routes/*).
 // Built once; route bodies were moved out of handleRequest's if-chain verbatim, with
@@ -1614,6 +1624,7 @@ function _buildPluginInteractions() {
       const entry = pendingPermHooks.get(id);
       if (!entry) return false;
       clearTimeout(entry.timer);
+      if (entry.auto?.timer) clearTimeout(entry.auto.timer);
       pendingPermHooks.delete(id);
       try {
         if (!entry.res.headersSent) {
@@ -2161,7 +2172,14 @@ async function setupTerminalWebSocket(httpServer) {
       // 直到超时 silent deny)。连接时重发,前端 perm 分支按 id 去重,天然幂等。
       for (const [id, entry] of pendingPermHooks) {
         try {
-          ws.send(JSON.stringify({ type: 'perm-hook-pending', id, toolName: entry.toolName, input: entry.input }));
+          ws.send(JSON.stringify({
+            type: 'perm-hook-pending', id, toolName: entry.toolName, input: entry.input,
+            autoApproveAt: entry.autoCancelled ? null : (entry.auto?.autoApproveAt ?? null),
+            // 0 = server says OFF (fork-off / npm publish floor): never let a reconnecting
+            // client fall back to its local pref and re-arm a countdown the server disabled.
+            autoApproveSeconds: entry.auto?.seconds ?? 0,
+            autoCancelled: entry.autoCancelled === true,
+          }));
         } catch {}
       }
 
@@ -2208,6 +2226,13 @@ async function setupTerminalWebSocket(httpServer) {
           if (p.kind === 'ask') {
             payload.startedAt = Date.now();
             payload.timeoutMs = p.remainingMs;
+          } else {
+            // plan/perm: carry the server-side auto-approve deadline so a reconnected
+            // client renders the REMAINING time (and a cancelled one never re-arms)
+            // instead of restarting a full-length countdown.
+            payload.autoApproveAt = p.autoApproveAt ?? null;
+            payload.autoCancelled = p.autoCancelled === true;
+            if (p.autoApproveSeconds != null) payload.autoApproveSeconds = p.autoApproveSeconds;
           }
           try { ws.send(JSON.stringify(payload)); } catch (err) { reportSwallowed('sdk.approval-replay', err); }
         }
@@ -2670,6 +2695,7 @@ async function setupTerminalWebSocket(httpServer) {
             if (hookEntry) {
               const { res: hookRes, timer } = hookEntry;
               clearTimeout(timer);
+              if (hookEntry.auto?.timer) clearTimeout(hookEntry.auto.timer);
               pendingPermHooks.delete(msg.id);
               permAnswered = true;
               try {
@@ -2706,7 +2732,7 @@ async function setupTerminalWebSocket(httpServer) {
             // cancelId/Reason 校验：与 toolUseId 同套白名单（≤256 字符 + [a-zA-Z0-9_-]）+ reason ≤500
             // 防恶意/buggy client 塞超长 key 撑大 _pendingApprovals 或塞 1MB reason 打爆 broadcast。
             const rawId = msg.id != null ? String(msg.id) : null;
-            const cancelId = rawId && rawId.length > 0 && rawId.length <= 256 && /^[a-zA-Z0-9_-]+$/.test(rawId) ? rawId : null;
+            const cancelId = validateApprovalId(msg.id);
             if (rawId && !cancelId) {
               console.warn('[server] ask-cancel rejected: invalid id format');
               return;
@@ -2782,20 +2808,63 @@ async function setupTerminalWebSocket(httpServer) {
               }
             }
           } else if (msg.type === 'sdk-plan-auto-cancel') {
-            // Cancellation stops the automatic timers on other viewers too. It is
-            // not an approval/denial: the plan remains pending for manual review.
-            if (_sdkResolveApproval && msg.id) broadcastWsMessage({
-              type: 'sdk-plan-auto-cancel', id: msg.id,
+            // Cancellation stops the automatic timers on every viewer AND the
+            // server-side fallback timer. It is not an approval/denial: the plan
+            // remains pending for manual review; the cancelled state is replayed
+            // to fresh clients so they never re-arm the countdown.
+            const rawPlanCancelId = msg.id != null ? String(msg.id) : null;
+            const planCancelId = validateApprovalId(msg.id);
+            if (rawPlanCancelId && !planCancelId) {
+              console.warn('[server] sdk-plan-auto-cancel rejected: invalid id format');
+              return;
+            }
+            let handled = false;
+            if (planCancelId && _sdkAutoCancelApproval) {
+              try { handled = _sdkAutoCancelApproval(planCancelId, 'plan') === true; } catch (err) { reportSwallowed('server.plan-auto-cancel', err); }
+            }
+            // Legacy relay fallback: no SDK pending matched (PTY-mode senders or a
+            // stale id) — keep the old behavior so other clients still stop counting.
+            if (!handled && planCancelId) broadcastWsMessage({
+              type: 'sdk-plan-auto-cancel', id: planCancelId,
               cwd: msg.cwd || null, project: msg.project || null,
               instanceKey: msg.instanceKey || null,
             });
+          } else if (msg.type === 'perm-hook-auto-cancel') {
+            // Symmetric to sdk-plan-auto-cancel for permission approvals: destroys the
+            // server-side fallback timer (SDK pending or PTY-hook long-poll), keeps the
+            // approval pending for a manual decision, and notifies all clients.
+            const rawPermCancelId = msg.id != null ? String(msg.id) : null;
+            const permCancelId = validateApprovalId(msg.id);
+            if (rawPermCancelId && !permCancelId) {
+              console.warn('[server] perm-hook-auto-cancel rejected: invalid id format');
+              return;
+            }
+            let permCancelHandled = false;
+            if (permCancelId && _sdkAutoCancelApproval) {
+              try { permCancelHandled = _sdkAutoCancelApproval(permCancelId, 'perm') === true; } catch (err) { reportSwallowed('server.perm-auto-cancel', err); }
+            }
+            if (!permCancelHandled && permCancelId) {
+              const hookEntry = pendingPermHooks.get(permCancelId);
+              if (hookEntry) {
+                cancelAutoApproveState(hookEntry);
+                permCancelHandled = true;
+                if (terminalWss) {
+                  const cmsg = JSON.stringify({ type: 'perm-hook-auto-cancel', id: permCancelId });
+                  terminalWss.clients.forEach((c) => {
+                    if (c.readyState === 1) try { c.send(cmsg); } catch {}
+                  });
+                }
+              }
+            }
           } else if (msg.type === 'sdk-plan-answer') {
             // Plan approval in SDK mode
-            if (_sdkResolveApproval) {
-              _sdkResolveApproval(msg.id, { approve: msg.approve !== false, feedback: msg.feedback || '' });
+            let planAnswered = false;
+            if (_sdkResolveApproval && msg.id) {
+              planAnswered = _sdkResolveApproval(msg.id, { approve: msg.approve !== false, feedback: msg.feedback || '' }) === true;
             }
-            // Broadcast resolved to other clients
-            if (terminalWss) {
+            // Broadcast resolved to other clients only when an answer was actually
+            // processed — a stale/unknown id must not close other viewers' plan modal.
+            if (planAnswered && terminalWss) {
               const rmsg = JSON.stringify({ type: 'sdk-plan-resolved', id: msg.id });
               terminalWss.clients.forEach((c) => {
                 if (c !== ws && c.readyState === 1) try { c.send(rmsg); } catch {}
@@ -3715,6 +3784,8 @@ function _broadcastApprovalCloses(cancelled, reason) {
 /** Reference to sdk-manager's resolveApproval (set by cli.js after import). */
 let _sdkResolveApproval = null;
 export function setSdkResolveApproval(fn) { _sdkResolveApproval = fn; }
+let _sdkAutoCancelApproval = null;
+export function setSdkAutoCancelApproval(fn) { _sdkAutoCancelApproval = fn; }
 
 /** Reference to sdk-manager's cancelApproval (set by cli.js after import). */
 // 与 _sdkResolveApproval 平行——但语义不同：cancelApproval 让 _waitForApproval resolve

package/server/system-prompt-templates/presets/kimi-k3.md

@@ -22,6 +22,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Convergence budget: once you have enough evidence to answer, stop searching and answer; a partial report beats endless exploration.
  - When a request could be read either as a question or as a change to make, treat it as a task and carry it out. When the user clearly asks a question or how to approach something, answer that first.
  - Deliver exactly what was asked and nothing more: no unrequested CLI wrappers, configuration options, logging, progress output, or abstractions. This is very important to your performance.
+ - Do not schedule real-environment verification (deploy checks, live E2E, manual smoke runs) unless the user explicitly asks — it burns tokens for little signal.
  - Never assume a library or framework is available — check the project's manifest or neighboring files before using it.
  - Do not introduce security vulnerabilities (injection, XSS, path traversal, and the rest of the OWASP top 10); fix insecure code you write immediately.
  - Iterate to green: run the relevant tests or code path, read the failure, fix the cause, and run again.

package/ultraAgents/code-expert.json

@@ -41,5 +41,5 @@
     "tr": "Kıdemli mühendis: çoklu ajan keşfi, plan incelemesi ve yüksek kaliteli uygulama — kod incelemesi, yeniden düzenleme, performans, sürdürülebilirlik.",
     "uk": "Senior-інженер: багатоагентне дослідження, рев'ю плану та якісна реалізація — рев'ю коду, рефакторинг, продуктивність, супровід."
   },
-  "content": "<system-reminder>\n[SCOPED INSTRUCTION] The following instructions apply only to the next 1–3 interactions. Once the task is complete, these instructions should gradually decrease in priority and no longer affect subsequent interactions. You should be adept at utilizing tools such as `AskUserQuestion`, `EnterPlanMode`, and `TeamCreate`, rather than relying solely on plain text processing. Before execution, you must ensure that the `EnterPlanMode`, `ExitPlanMode`, `SendMessage`, `TaskCreate`, `TaskUpdate`, `TaskStop`, `TaskGet`, `TaskOutput` and `TaskList` tools are loaded.\n\nPre-requisite: Use `AskUserQuestion` to clarify user intent whenever the request is ambiguous (target element, interaction style, scope of platforms, etc.). Skip only if the intent is unambiguous.\n\nLeverage a multi-agent exploration mechanism to formulate a highly detailed implementation plan.\n\nInstructions:\n1. Use the `Agent` tool to spawn parallel agents that simultaneously explore different aspects of the codebase:\n- If necessary, assign a preliminary researcher to use the `webSearch` tool to first investigate cutting-edge solutions in the relevant industry domain;\n- One agent responsible for understanding the relevant existing code and architecture;\n- One agent responsible for identifying all files that need to be modified;\n- One agent responsible for identifying potential risks, edge cases, and dependencies;\n- You may add other roles or deploy additional agents beyond the three listed above; the maximum number of concurrently dispatched agents is 5.\n\n2. Synthesize the findings from all agents into a detailed, step-by-step implementation plan.\n\n3. Use the `Agent` tool to spawn 2-3 review agents that examine the plan from different perspectives, checking for missing steps, potential risks, or corresponding mitigation strategies.\n\n4. Integrate the feedback gathered during the review process, then call `ExitPlanMode` to submit your final plan.\n\n5. Once `ExitPlanMode` returns a result:\n- If approved: proceed to execute the plan within this session.\n- If rejected: revise the plan based on the feedback provided and call `ExitPlanMode` again.\n- If an error occurs (including receiving a \"Not in Plan Mode\" message): do **not** follow the suggestions provided in the error message; instead, prompt the user for further instructions.\n\nYour final plan must include the following elements:\n- A clear summary of the implementation strategy;\n- An ordered list of files to be created or modified, with precise details of the required changes for each file;\n- A step-by-step execution sequence;\n- Testing and validation procedures;\n- Potential risks and their corresponding mitigation strategies;\n\n6. After the final plan has been successfully executed:\nFirst run `git diff --quiet && git diff --cached --quiet` (or equivalent) to detect whether the working tree actually has non-trivial changes; if there are no real changes (or only whitespace/comment-only edits), skip the UltraReview step.\nOtherwise, if the project is managed with Git:\nInitiate a team (`TeamCreate`), dynamically allocating the number of teammates based on task complexity (5 is recommended);\nIf the `TeamCreate` tool is unavailable, spawn teammates directly with the `Agent` tool (note: as teammates, not plain subagents);\nTask: Conduct a Code Review of the current git changes from multiple perspectives;\nPre-requisites:\n- The git repository may be located in a subdirectory of the current directory; prefer `git rev-parse --show-toplevel` (fall back to recursive lookup) before proceeding;\n- In the case of multiple repositories, tasks may be executed separately;\nThe team's goal is to analyze the current Git change log and validate each modification from different perspectives, specifically including:\n- Whether requirements/objectives have been met and functionality is complete;\n- Whether newly added code introduces side effects, breaks existing functionality, or poses potential risks;\n- Code quality: naming, readability, complexity, technical debt, maintainability;\n- Testing and documentation: whether there is adequate test coverage, and whether critical logic has necessary comments or documentation;\n- Dependencies and compatibility: whether new dependencies or version compatibility issues have been introduced;\nWorkflow:\n- Each teammate, according to their own role, covers the review dimensions one by one and independently outputs a report;\n- After consolidating the reports, perform a cross-review to identify conflicts or shared concerns;\n- Distill specific, actionable modification suggestions and annotate them with priority levels (P0/P1/P2/P3);\n- Upon completion, adopt P0 items; adopt P1 and P2 items selectively based on evaluation; disregard P3 items.\n- After execution is complete, close the team (`TeamDelete`);\n- If the `TeamDelete` tool is unavailable, notify each teammate to exit individually;\n</system-reminder>"
+  "content": "<system-reminder>\n[SCOPED INSTRUCTION] The following instructions apply only to the next 1–3 interactions. Once the task is complete, these instructions should gradually decrease in priority and no longer affect subsequent interactions. You should be adept at utilizing tools such as `AskUserQuestion`, `EnterPlanMode`, and `TeamCreate`, rather than relying solely on plain text processing. Before execution, you must ensure that the `EnterPlanMode`, `ExitPlanMode`, `SendMessage`, `TaskCreate`, `TaskUpdate`, `TaskStop`, `TaskGet`, `TaskOutput` and `TaskList` tools are loaded.\n\nPre-requisite: Use `AskUserQuestion` to clarify user intent whenever the request is ambiguous (target element, interaction style, scope of platforms, etc.). Skip only if the intent is unambiguous.\n\nLeverage a multi-agent exploration mechanism to formulate a highly detailed implementation plan.\n\nInstructions:\n1. Use the `Agent` tool to spawn parallel agents that simultaneously explore different aspects of the codebase:\n- If necessary, assign a preliminary researcher to use the `webSearch` tool to first investigate cutting-edge solutions in the relevant industry domain;\n- One agent responsible for understanding the relevant existing code and architecture;\n- One agent responsible for identifying all files that need to be modified;\n- One agent responsible for identifying potential risks, edge cases, and dependencies;\n- You may add other roles or deploy additional agents beyond the three listed above; the maximum number of concurrently dispatched agents is 5.\n\n2. Synthesize the findings from all agents into a detailed, step-by-step implementation plan.\n\n3. Use the `Agent` tool to spawn 2-3 review agents that examine the plan from different perspectives, checking for missing steps, potential risks, or corresponding mitigation strategies.\n\n4. Integrate the feedback gathered during the review process, then call `ExitPlanMode` to submit your final plan.\n\n5. Once `ExitPlanMode` returns a result:\n- If approved: proceed to execute the plan within this session.\n- If rejected: revise the plan based on the feedback provided and call `ExitPlanMode` again.\n- If an error occurs (including receiving a \"Not in Plan Mode\" message): do **not** follow the suggestions provided in the error message; instead, prompt the user for further instructions.\n\nYour final plan must include the following elements:\n- A clear summary of the implementation strategy;\n- An ordered list of files to be created or modified, with precise details of the required changes for each file;\n- A step-by-step execution sequence;\n- Testing and validation procedures;\n- Potential risks and their corresponding mitigation strategies;\n\n6. After the final plan has been successfully executed:\nFirst run `git diff --quiet && git diff --cached --quiet` (or equivalent) to detect whether the working tree actually has non-trivial changes; if there are no real changes (or only whitespace/comment-only edits), skip the UltraReview step.\nOtherwise, if the project is managed with Git:\nUse the `Agent` tool to build a team, dynamically allocating the number of teammates based on task complexity (5+ is recommended);\nNote: teammates are named (pass `name`), not plain subagents (which have no name);\nTask: Conduct a Code Review of the current git changes from multiple roles and perspectives;\nPre-requisites:\n- The git repository may be located in a subdirectory of the current directory; recursively locate the .git directory first (prefer `git rev-parse --show-toplevel`) before proceeding;\n- In the case of multiple repositories, review tasks may be executed separately per repository;\nReview dimensions (a reference framework — each role covers them as its perspective requires, aiming to be as comprehensive as possible):\n- Whether requirements/objectives have been met and functionality is complete;\n- Whether newly added code introduces side effects, breaks existing functionality, or poses potential risks;\n- Code quality: naming, readability, complexity, technical debt, maintainability;\n- Testing and documentation: whether there is adequate test coverage, and whether critical logic has necessary comments or documentation;\n- Dependencies and compatibility: whether new dependencies or version compatibility issues have been introduced;\n- Any other dimensions you see fit;\nWorkflow:\n- Each teammate, according to their own role, covers the review dimensions one by one and independently outputs a report;\n- After consolidating the reports, perform a cross-review to identify conflicts or shared concerns;\n- Distill specific, actionable modification suggestions and annotate them with priority levels (P0/P1/P2/P3);\n- Upon completion, fix all P0 and P1 items; evaluate P2 items dialectically (use `AskUserQuestion` to consult the user when any item needs a special decision);\n- After execution is complete, close the team: notify each teammate to exit individually;\n</system-reminder>"
 }