cc-viewer 1.9.15 → 1.9.17

package/server/lib/target-scope.js

@@ -0,0 +1,174 @@
+// Shared resolution of a "target" (CLAUDE.md / skill folder) into the
+// navigation root the file browser walks, plus the path validation both the
+// read route (/api/target-files in routes/files-content.js) and the write
+// routes (/api/target-* in routes/target-files-fs.js) rely on.
+//
+// These helpers were moved verbatim out of routes/files-content.js so the new
+// target write routes resolve the EXACT same root as the read route — never
+// trust a client-supplied absolute root, always re-derive it from the target
+// identity (kind + id, or source + targetPath) via resolveTargetRoot.
+//
+// Layering: this is L1 (lib). It must NOT import from routes/ — routes import
+// lib, never the reverse (enforced by pnpm run verify:boundaries).
+import { realpathSync, statSync } from 'node:fs';
+import { basename, dirname, join, relative, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { isReadAllowed, reasonToStatus } from './file-access-policy.js';
+import { listSkills } from './skills-api.js';
+import { discoverClaudeMdCandidates } from './claude-md-discovery.js';
+import { getClaudeConfigDir } from '../../findcc.js';
+
+export function targetError(status, message) {
+  return Object.assign(new Error(message), { status });
+}
+
+// Map fs errno to a sensible HTTP status: missing → 404, permission → 403,
+// symlink loop → 400 (treat as malformed), anything else → 404 (don't leak).
+export function errnoToStatus(err) {
+  const code = err?.code;
+  if (code === 'EACCES' || code === 'EPERM') return 403;
+  if (code === 'ELOOP') return 400;
+  return 404;
+}
+
+export function realDirectory(path, label) {
+  let real;
+  try { real = realpathSync(path); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  let st;
+  try { st = statSync(real); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  if (!st.isDirectory()) throw targetError(400, `${label} is not a directory`);
+  return real;
+}
+
+export function checkedDirectory(path, label) {
+  const real = realDirectory(path, label);
+  const policy = isReadAllowed(real);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), `${label} not readable`);
+  return policy.real;
+}
+
+export function insidePath(path, root) {
+  return path === root || path.startsWith(root + sep);
+}
+
+export function targetNavigation(targetReal, cwd) {
+  const projectReal = realDirectory(cwd, 'Project');
+  if (insidePath(targetReal, projectReal)) return { rootReal: projectReal, rootKind: 'project' };
+  // $HOME becomes the navigation root for home-resident targets (user skills,
+  // plugins, the global CLAUDE.md). Entries outside the allowlist (e.g. ~/.ssh,
+  // ~/.aws) are filtered per-entry by isReadAllowed, and sensitive paths inside
+  // ~/.claude are covered by file-access-policy's denylist. The /api/target-files
+  // handler additionally gates this endpoint behind isAdminReq + same-origin so
+  // a cross-site page cannot enumerate the user's home tree.
+  const homeReal = realDirectory(homedir(), 'Home');
+  if (insidePath(targetReal, homeReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: homeReal, rootKind: 'home' };
+  }
+  const configReal = realDirectory(getClaudeConfigDir(), 'Claude config');
+  if (insidePath(targetReal, configReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: realDirectory(dirname(configReal), 'Config root'), rootKind: 'config' };
+  }
+  // Allowlist fallback: targets that live inside another allowlisted root
+  // (registered workspaces, /tmp/cc-viewer-uploads, etc.) are reachable via
+  // /api/claude-md's discovery (which uses isReadAllowed), so we must not
+  // 403 them here. Use the target's own directory as the navigation root —
+  // no parent browsing, but at least the entry the user clicked actually opens.
+  const policy = isReadAllowed(targetReal);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), 'Target not readable');
+  return { rootReal: realDirectory(targetReal, 'Target'), rootKind: 'target' };
+}
+
+export function targetScope(targetReal, cwd) {
+  const navigation = targetNavigation(targetReal, cwd);
+  return { ...navigation, targetPath: relative(navigation.rootReal, targetReal).split(sep).join('/') };
+}
+
+export function targetRelPath(raw) {
+  if (raw == null) return null;
+  if (raw === '') return [];
+  if (typeof raw !== 'string' || raw.length > 2048 || raw.includes('\0') || raw.includes('\\')
+    || raw.startsWith('/') || /^[a-zA-Z]:/.test(raw)) {
+    throw targetError(400, 'Invalid path');
+  }
+  const segments = raw.split('/');
+  if (segments.some(segment => !segment || segment === '.' || segment === '..')) {
+    throw targetError(400, 'Invalid path');
+  }
+  // Hard cap on navigation depth: each segment triggers at least one
+  // synchronous readdir + per-entry realpath/stat in `ancestors`, and a 2KB
+  // free-form path could otherwise fan out into hundreds of syscalls per
+  // request. 32 is far deeper than any realistic skill / CLAUDE.md location.
+  if (segments.length > 32) throw targetError(400, 'Path too deep');
+  return segments;
+}
+
+export function resolveTargetRoot(parsedUrl, cwd) {
+  const kind = parsedUrl.searchParams.get('kind');
+  if (kind === 'claude-md') {
+    const id = parsedUrl.searchParams.get('id') || '';
+    if (!/^[0-9a-f]{12}$/i.test(id)) throw targetError(400, 'Invalid id');
+    const candidate = discoverClaudeMdCandidates({
+      cwd,
+      claudeConfigDir: getClaudeConfigDir(),
+      isReadAllowedFn: isReadAllowed,
+    }).find(entry => entry.id === id);
+    if (!candidate || basename(candidate.realPath) !== 'CLAUDE.md') throw targetError(404, 'Target not found');
+    return { ...targetScope(realDirectory(dirname(candidate.realPath), 'Directory'), cwd), targetKind: 'claude-md' };
+  }
+  if (kind !== 'skill') throw targetError(400, 'Invalid target kind');
+  const source = parsedUrl.searchParams.get('source');
+  const targetPath = parsedUrl.searchParams.get('targetPath');
+  if (!['user', 'project', 'plugin'].includes(source)) throw targetError(400, 'Invalid skill source');
+  if (typeof targetPath !== 'string' || !targetPath || targetPath.length > 4096 || targetPath.includes('\0')) {
+    throw targetError(400, 'Invalid skill path');
+  }
+  const skill = listSkills({ projectDir: cwd })
+    .find(entry => entry.source === source && entry.path === targetPath);
+  if (!skill) throw targetError(404, 'Target not found');
+  const rootReal = realDirectory(skill.path, 'Directory');
+  const scope = targetScope(rootReal, cwd);
+  const anchor = source === 'project'
+    ? scope.rootReal
+    : dirname(dirname(skill.path));
+  const anchorReal = realDirectory(anchor, 'Skill root');
+  if (!insidePath(rootReal, anchorReal)) throw targetError(403, 'Target outside skill root');
+  // Plugin root must follow the configured Claude config dir, not the default
+  // homedir()/.claude — otherwise plugin skills break under CLAUDE_CONFIG_DIR.
+  if (source === 'plugin' && !insidePath(rootReal, realDirectory(join(getClaudeConfigDir(), 'plugins'), 'Plugin root'))) {
+    throw targetError(403, 'Target outside plugin root');
+  }
+  return { ...scope, targetKind: 'skill' };
+}
+
+// ===========================================================================
+// Write-side scope resolution (used only by the /api/target-* write routes).
+// ===========================================================================
+
+// SECURITY / INTENTIONAL DESIGN (do NOT tighten in review without product sign-off):
+// the writable area for a target browser is the WHOLE navigation root returned by
+// targetNavigation (project / home / config / target), NOT just the target's own
+// subtree. This is a deliberate product decision — the user navigates the browser
+// up to ancestors (e.g. from a skill folder to ~ or ~/.claude) and expects the
+// context menu to keep working there. The sensitive-file / sensitive-directory
+// backstop for that wider surface is isWriteAllowed (lib/file-access-policy.js),
+// which every mutation runs through; containment in the navigation root plus
+// isWriteAllowed is the boundary, not the target subtree.
+export function resolveTargetWriteScope(parsedUrl, cwd) {
+  // Re-derive the target identity server-side (never trust a client-sent root).
+  // The writable surface is the WHOLE navigation root (scope.rootReal) — the
+  // target's own directory is NOT separately resolved here because the product
+  // decision is to allow writes anywhere in the navigation root, with the
+  // sensitive-file backstop living in isWriteAllowed (see file-access-policy.js).
+  return resolveTargetRoot(parsedUrl, cwd);
+}
+
+// targetRelPath treats null as "caller omitted path" (the read route uses that
+// to default to the target's own directory). The write routes always need an
+// explicit path, so this is the required variant: omitted → 400.
+export function requiredTargetRelPath(raw) {
+  const segs = targetRelPath(raw);
+  if (segs === null) throw targetError(400, 'Missing path');
+  return segs;
+}

package/server/routes/ask-perm.js

@@ -7,6 +7,8 @@ import { _projectName } from '../interceptor.js';
 import { readPrefsRaw } from '../lib/prefs-store.js';
 import { getCurrentProjectKey, hasFork, resolveScoped } from '../lib/project-prefs.js';
 import { reportSwallowed } from '../lib/error-report.js';
+import { computeAutoApprove, createAutoApproveState } from '../lib/auto-approve.js';
+import { isPublishCommand } from '../lib/approval-policy.js';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {
@@ -394,7 +396,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
       return;
     }
     try {
-      const { toolName, input } = JSON.parse(body);
+      const { toolName, input, cwd } = JSON.parse(body);
       if (!toolName) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Missing toolName' }));
@@ -407,6 +409,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         const oldest = deps.pendingPermHooks.get(oldestId);
         if (oldest) {
           clearTimeout(oldest.timer);
+          if (oldest.auto?.timer) clearTimeout(oldest.auto.timer);
           try { if (!oldest.res.headersSent) { oldest.res.writeHead(429, { 'Content-Type': 'application/json' }); oldest.res.end(JSON.stringify({ error: 'Too many concurrent requests' })); } } catch {}
           deps.pendingPermHooks.delete(oldestId);
         }
@@ -431,6 +434,7 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
       const timer = setTimeout(() => {
         const entry = deps.pendingPermHooks.get(id);
         if (entry) {
+          if (entry.auto?.timer) clearTimeout(entry.auto.timer);
           deps.pendingPermHooks.delete(id);
           try {
             if (!entry.res.headersSent) {
@@ -447,11 +451,33 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         }
       }, PERM_HOOK_TIMEOUT);
 
-      deps.pendingPermHooks.set(id, { toolName, input, res, timer, createdAt: Date.now() });
+      // Server-side auto-approve countdown (same semantics as the SDK path in
+      // sdk-manager.js): armed from request arrival; the server answers the hook
+      // itself at deadline + 1s buffer when no client did. autoCancelled is set by
+      // the perm-hook-auto-cancel WS handler (the approval then stays pending for
+      // a manual decision) and replayed to fresh clients.
+      // npm publish is a hard safety floor: always wait for a human decision, never
+      // the server-side auto-approve fallback (SDK path parity: sdk-manager.js).
+      const autoMeta = isPublishCommand(toolName, input)
+        ? { enabled: false }
+        : computeAutoApprove('perm', typeof cwd === 'string' && cwd ? cwd : undefined, { file: deps.getPrefsFile?.() });
+
+      const hookEntry = {
+        toolName, input, res, timer, createdAt: Date.now(),
+        autoCancelled: false,
+        auto: null,
+      };
+      deps.pendingPermHooks.set(id, hookEntry);
 
       // Broadcast to all terminal WS clients
       if (deps.terminalWss) {
-        const pmsg = JSON.stringify({ type: 'perm-hook-pending', id, toolName, input });
+        const pmsg = JSON.stringify({
+          type: 'perm-hook-pending', id, toolName, input,
+          // Always stamp autoApproveSeconds (0 = server says OFF) so a client whose
+          // global pref disagrees with the fork-resolved value never re-arms locally.
+          autoApproveSeconds: autoMeta.enabled ? autoMeta.seconds : 0,
+          ...(autoMeta.enabled ? { autoApproveAt: autoMeta.autoApproveAt } : {}),
+        });
         deps.terminalWss.clients.forEach((client) => {
           if (client.readyState === 1) {
             try { client.send(pmsg); } catch {}
@@ -459,11 +485,36 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
         });
       }
 
+      // Arm AFTER the entry is in the map AND the pending frame is out: instant (-1)
+      // fires synchronously and resolves through the entry, so clients observe the
+      // order pending → resolved (never a ghost panel for an already-answered hook).
+      if (autoMeta.enabled) {
+        hookEntry.auto = createAutoApproveState(autoMeta, () => {
+          const entry = deps.pendingPermHooks.get(id);
+          if (!entry || entry.autoCancelled) return;
+          clearTimeout(entry.timer);
+          deps.pendingPermHooks.delete(id);
+          try {
+            if (!entry.res.headersSent) {
+              entry.res.writeHead(200, { 'Content-Type': 'application/json' });
+              entry.res.end(JSON.stringify({ decision: 'allow' }));
+            }
+          } catch {}
+          if (deps.terminalWss) {
+            const rmsg = JSON.stringify({ type: 'perm-hook-resolved', id, reason: 'auto-approved' });
+            deps.terminalWss.clients.forEach((c) => {
+              if (c.readyState === 1) try { c.send(rmsg); } catch {}
+            });
+          }
+        });
+      }
+
       // Handle perm-bridge.js disconnection
       res.on('close', () => {
         const entry = deps.pendingPermHooks.get(id);
         if (entry) {
           clearTimeout(entry.timer);
+          if (entry.auto?.timer) clearTimeout(entry.auto.timer);
           deps.pendingPermHooks.delete(id);
           if (deps.terminalWss) {
             const tmsg = JSON.stringify({ type: 'perm-hook-timeout', id });

package/server/routes/files-content.js

@@ -1,7 +1,7 @@
 // Read-oriented file-access routes (moved verbatim from server.js handleRequest).
-import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream, readdirSync } from 'node:fs';
 import { join, basename, dirname, resolve, sep } from 'node:path';
-import { isReadAllowed, reasonToStatus } from '../lib/file-access-policy.js';
+import { isReadAllowed, isWriteAllowed, reasonToStatus } from '../lib/file-access-policy.js';
 import { ERROR_STATUS_MAP, isPathContained } from '../lib/file-api.js';
 import { viewRootOrReply, resolveViewRoot } from '../lib/view-root.js';
 import { findSdkSessionByInstance } from '../lib/sdk-session-index.js';
@@ -12,6 +12,12 @@ import { reportSwallowed } from '../lib/error-report.js';
 import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-discovery.js';
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
+import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+import {
+  targetError, errnoToStatus, realDirectory, checkedDirectory, insidePath,
+  targetRelPath, resolveTargetRoot,
+} from '../lib/target-scope.js';
 
 // Multi-project file operations use the same viewed root for reads and writes.
 // Every file-browser mutation enforces realpath containment in that root;
@@ -537,7 +543,7 @@ function fileDownloadWithRoot(req, res, parsedUrl, reqPath, cwd) {
   }
 }
 
-function fileContentPost(req, res, parsedUrl) {
+function fileContentPost(req, res, parsedUrl, isLocal) {
   // The shared read root keeps its raw cwd for projectMemory's store-key
   // encoding. Normalize only this mutation's containment comparisons.
   let writeRoot;
@@ -559,7 +565,36 @@ function fileContentPost(req, res, parsedUrl) {
       const { path: reqPath, content, editorSession } = JSON.parse(body);
       const cwd = _viewRootOrReply(req, res, parsedUrl);
       if (!cwd) return;
-      try { writeRoot = realpathSync(cwd); } catch { writeRoot = cwd; }
+      // Target mode (the CLAUDE.md / skill browser modal) edits files that live in
+      // the target's NAVIGATION ROOT, which is frequently OUTSIDE the viewed project
+      // (~/.claude, $HOME). When the request carries a target identity
+      // (kind + id / source + targetPath, same as /api/target-files), resolve the
+      // write root to that navigation root instead of the project view root, so
+      // isInsideWriteRoot no longer 403s the file the user is explicitly editing.
+      // The target root is re-derived server-side (never trusted from the client),
+      // and the isWriteAllowed policy below still runs unchanged.
+      // SECURITY / INTENTIONAL DESIGN (do NOT tighten in review without product
+      // sign-off): in target mode the write policy is the WHOLE navigation root,
+      // and writes go through isWriteAllowed (NOT isReadAllowed) — so the LOG_DIR
+      // tree, ~/.claude credentials/settings, ~/.ssh, and the config-backup tree
+      // stay unwritable even though the wider surface is editable. This path is
+      // gated to admin + same-origin browser requests, the same bar as
+      // /api/target-files, because it can reach the user's home tree. A relative
+      // path in target mode is anchored at the navigation root, not the project.
+      const targetKind = parsedUrl.searchParams.get('kind');
+      let targetNavRoot = null;
+      if (targetKind) {
+        if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'forbidden' }));
+          return;
+        }
+        const scope = resolveTargetRoot(parsedUrl, cwd);
+        writeRoot = scope.rootReal;
+        targetNavRoot = scope.rootReal;
+      } else {
+        try { writeRoot = realpathSync(cwd); } catch { writeRoot = cwd; }
+      }
       if (!reqPath) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Invalid path' }));
@@ -571,12 +606,18 @@ function fileContentPost(req, res, parsedUrl) {
         return;
       }
       const isAbs = /^([a-zA-Z]:[\\/]|[\\/])/.test(reqPath);
-      const absPath = isAbs ? reqPath : resolve(cwd, reqPath);
+      // In target mode a relative path is anchored at the navigation root; in
+      // project mode at the project view root (unchanged legacy behavior).
+      const absPath = isAbs ? reqPath : resolve(targetNavRoot || cwd, reqPath);
       // 写路径同样走 policy(收敛 editorSession 后门):允许覆盖现有文件;
       // 新文件场景递归向上找最近存在的祖先目录,只要它在 allowlist 内即放行。
       // (旧实现只查 immediate parent,父目录也不存在时误拒嵌套新建。)
+      // Target mode uses the WRITE policy (isWriteAllowed) so the LOG_DIR tree,
+      // ~/.claude credentials and other sensitive targets stay unwritable even
+      // though the navigation root is editable; project mode keeps isReadAllowed.
+      const policyFn = targetNavRoot ? isWriteAllowed : isReadAllowed;
       let targetReal;
-      const policy = isReadAllowed(absPath);
+      const policy = policyFn(absPath);
       if (policy.ok) {
         targetReal = policy.real;
       } else if (policy.reason === 'realpath-failed') {
@@ -609,6 +650,13 @@ function fileContentPost(req, res, parsedUrl) {
         }
         // Check containment before creating any missing parent directories.
         // Explicit $EDITOR sessions retain their allowlisted external paths.
+        // editorSession is client-claimed — require admin to honor it, otherwise
+        // any caller could use it as a write-root bypass (see /api/target-files).
+        if (editorSession && !isAdminReq(req, isLocal)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Forbidden', reason: 'editor-session-requires-admin' }));
+          return;
+        }
         if (!editorSession && !isInsideWriteRoot(ancestorPolicy.real)) {
           res.writeHead(403, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
@@ -628,7 +676,21 @@ function fileContentPost(req, res, parsedUrl) {
         return;
       }
 
-      if (!editorSession && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
+      if (editorSession && !isAdminReq(req, isLocal)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Forbidden', reason: 'editor-session-requires-admin' }));
+        return;
+      }
+      // Target mode: containment in the navigation root must hold whether the file
+      // exists OR is being created — otherwise a crafted relative path could write
+      // outside the navigation root (isWriteAllowed only bounds by the allowlist).
+      // Project mode keeps the legacy existing-file-only check.
+      if (!editorSession && targetNavRoot && !isInsideWriteRoot(targetReal)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
+        return;
+      }
+      if (!editorSession && !targetNavRoot && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
         return;
@@ -638,7 +700,9 @@ function fileContentPost(req, res, parsedUrl) {
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true, size: stat.size }));
     } catch (err) {
-      const status = ERROR_STATUS_MAP[err.code] || 500;
+      // targetError carries `.status` (400/403/404); fs errnos carry `.code`.
+      // Honor both so an invalid/stale target identity is not reported as 500.
+      const status = err.status || ERROR_STATUS_MAP[err.code] || 500;
       const message = status === 500 ? `Cannot save file: ${err.message}` : err.message;
       res.writeHead(status, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: message }));
@@ -646,6 +710,107 @@ function fileContentPost(req, res, parsedUrl) {
   });
 }
 
+function listTargetDirectory(rootReal, segments, deps, requireReadable = true) {
+  const dirReal = requireReadable
+    ? checkedDirectory(segments.length ? join(rootReal, ...segments) : rootReal, 'Directory')
+    : realDirectory(segments.length ? join(rootReal, ...segments) : rootReal, 'Directory');
+  if (!isPathContained(dirReal, rootReal)) throw targetError(403, 'Path outside target');
+  const ignored = deps?.IGNORED_PATTERNS || new Set();
+  const entries = [];
+  let dirents;
+  try {
+    dirents = readdirSync(dirReal, { withFileTypes: true });
+  } catch (err) {
+    // EACCES → 403 (permission), ENOENT/ENOTDIR → 404 (race with rename/delete),
+    // anything else falls back to 404 so we don't leak internal state via 500.
+    throw targetError(errnoToStatus(err), 'Directory not readable');
+  }
+  // Hard cap on returned entries: this is a synchronous loop with realpath +
+  // stat + isReadAllowed per entry, and the endpoint fans out via `ancestors`,
+  // so an unbounded listing of a huge dir (e.g. ~/.claude/projects/<hash>/)
+  // would block the event loop and return a giant JSON payload. 5000 is well
+  // past any realistic skill/CLAUDE.md folder.
+  const MAX_ENTRIES = 5000;
+  for (const entry of dirents) {
+    if (entries.length >= MAX_ENTRIES) break;
+    if (ignored.has(entry.name)) continue;
+    const fullPath = join(dirReal, entry.name);
+    let real;
+    try { real = realpathSync(fullPath); } catch (err) { reportSwallowed('targetFiles.entry.realpath', err); continue; }
+    if (!insidePath(real, rootReal)) continue;
+    const policy = isReadAllowed(real);
+    if (!policy.ok) continue;
+    let st;
+    try { st = statSync(policy.real); } catch (err) { reportSwallowed('targetFiles.entry.stat', err); continue; }
+    if (!st.isDirectory() && !st.isFile()) continue;
+    entries.push({ name: entry.name, type: st.isDirectory() ? 'directory' : 'file', absPath: policy.real });
+  }
+  entries.sort((a, b) => a.type !== b.type
+    ? (a.type === 'directory' ? -1 : 1)
+    : a.name.localeCompare(b.name));
+  return entries;
+}
+
+function targetFiles(req, res, parsedUrl, isLocal, deps) {
+  try {
+    // /api/target-files exposes directory listings under the user's home and
+    // ~/.claude (which contains transcripts, prompt history, env snapshots).
+    // Combined with the global `Access-Control-Allow-Origin: *` and loopback's
+    // no-auth path, a bare GET would let any web page enumerate the user's
+    // ~/.claude tree. Require admin AND a same-origin browser request.
+    if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'forbidden' }));
+      return;
+    }
+    const cwd = _viewRootOrReply(req, res, parsedUrl);
+    if (!cwd) return;
+    const scope = resolveTargetRoot(parsedUrl, cwd);
+    const rawPath = parsedUrl.searchParams.get('path');
+    const requestedSegments = targetRelPath(rawPath);
+    const segments = requestedSegments === null ? scope.targetPath.split('/').filter(Boolean) : requestedSegments;
+    const entries = listTargetDirectory(scope.rootReal, segments, deps, segments.length > 0 || scope.rootKind !== 'home');
+    const rootEntries = requestedSegments === null && segments.length > 0
+      ? listTargetDirectory(scope.rootReal, [], deps, scope.rootKind === 'project')
+      : entries;
+    const targetEntries = requestedSegments === null
+      ? entries.filter(entry => insidePath(entry.absPath, join(scope.rootReal, ...segments)))
+      : entries;
+    const targetSegments = scope.targetPath ? scope.targetPath.split('/') : [];
+    const ancestors = [];
+    // Ancestors are the chain from the navigation root down to the directory
+    // being listed. When the caller passed no `path` that's the chain leading
+    // to the target itself; when they passed `path`, the chain is the requested
+    // segments. We deliberately DO NOT use path.relative(targetPath, rawPath)
+    // here — that helper happily produces "../.." for sibling branches, which
+    // would pollute the cache with pseudo-paths and re-list directories the
+    // user never navigated into.
+    const chainSegments = requestedSegments === null ? targetSegments : segments;
+    // Request-scoped memo: targetFiles lists the same directory multiple times
+    // (entries + ancestors chain often share prefixes), so we cache by dir key
+    // to avoid duplicate readdirSync storms on large directories.
+    const listMemo = new Map();
+    const listOnce = (segs, requireReadable) => {
+      const key = segs.join('/') + (requireReadable ? '|r' : '|n');
+      if (!listMemo.has(key)) listMemo.set(key, listTargetDirectory(scope.rootReal, segs, deps, requireReadable));
+      return listMemo.get(key);
+    };
+    const ancestorCount = Math.max(0, chainSegments.length - (requestedSegments === null ? 0 : 1));
+    for (let i = 0; i <= ancestorCount; i++) {
+      const path = chainSegments.slice(0, i).join('/');
+      ancestors.push({ path, entries: listOnce(path ? path.split('/') : [], false) });
+    }
+    const { rootReal, ...response } = scope;
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ...response, targetPath: segments.join('/'), entries: rootEntries, targetEntries, ancestors }));
+  } catch (err) {
+    const status = err.status || ERROR_STATUS_MAP[err.code] || 500;
+    if (status === 500) console.error('[api/target-files]', err);
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: status === 500 ? 'Internal error' : err.message }));
+  }
+}
+
 export const filesContentRoutes = [
   { method: 'GET', match: 'exact', path: '/api/plan-file', handler: planFile },
   { method: 'GET', match: 'exact', path: '/api/file-content', handler: fileContentGet },
@@ -654,4 +819,5 @@ export const filesContentRoutes = [
   { predicate: (url, method) => (url === '/api/file-raw' || url.startsWith('/api/file-raw/')) && (method === 'GET' || method === 'HEAD'), handler: fileRaw },
   { predicate: (url, method) => url === '/api/download-file' && (method === 'GET' || method === 'HEAD'), handler: fileDownload },
   { method: 'POST', match: 'exact', path: '/api/file-content', handler: fileContentPost },
+  { method: 'GET', match: 'exact', path: '/api/target-files', handler: targetFiles },
 ];

package/server/routes/files-fs.js

@@ -5,11 +5,12 @@ import {
 } from 'node:fs';
 import { join, dirname, basename, resolve, sep } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
-import { execFile, spawn } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { bumpWorkspacesVersion, isReadAllowed } from '../lib/file-access-policy.js';
 import { isPathContained, validateImportDir, renameSyncWithRetry } from '../lib/file-api.js';
 import { reportSwallowed } from '../lib/error-report.js';
 import { viewRootOrReply } from '../lib/view-root.js';
+import { revealInOs, openTerminalAt } from '../lib/os-open.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
 import { PROFILE_PATH, _projectName, _logDir } from '../interceptor.js';
@@ -645,17 +646,12 @@ function revealFile(req, res, parsedUrl, isLocal, deps) {
         return;
       }
       const plat = process.platform;
-      if (plat === 'darwin') {
-        execFile('open', ['-R', fullPath], () => {});
-      } else if (plat === 'win32') {
-        // explorer /select 的规范形式是 /select,"<path>"（仅路径部分加引号、整体一个 arg）。
-        // 必须 windowsVerbatimArguments 透传：否则 Node 对含空格 arg 整体加引号生成
-        // explorer.exe "/select,C:\My Proj\x.txt"，explorer 解析不了 → 功能失效。
-        // Windows 文件名不允许 "，且不经 cmd.exe，无元字符注入面。
-        const child = spawn('explorer.exe', [`/select,"${fullPath}"`], { windowsVerbatimArguments: true, windowsHide: true });
-        child.on('error', () => {}); // 防 async ENOENT 变 uncaughtException 砸进程
+      if (plat === 'darwin' || plat === 'win32') {
+        revealInOs(fullPath);
       } else {
-        execFile('xdg-open', [dirname(fullPath)], () => {});
+        // Linux: a directory reveals itself; a file reveals its parent (xdg-open on
+        // a file would launch the default app). Shared helper, see lib/os-open.js.
+        revealInOs(fullPath, { isDir: statSync(fullPath).isDirectory() });
       }
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true, fullPath }));
@@ -919,49 +915,7 @@ function openTerminal(req, res, parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
         return;
       }
-      const plat = process.platform;
-      if (plat === 'darwin') {
-        spawn('open', ['-a', 'Terminal', fullDir], { stdio: 'ignore', detached: true }).unref();
-      } else if (plat === 'win32') {
-        spawn('cmd.exe', ['/c', 'start', 'cmd.exe'], { cwd: fullDir, stdio: 'ignore', detached: true, windowsHide: true }).unref();
-      } else {
-        // Linux: try common terminal emulators
-        const terminals = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
-        // spawn reports a missing executable asynchronously, outside try/catch.
-        // Probe each candidate with piped stdio so the next one can be attempted
-        // after ENOENT; detach only after a successful spawn.
-        const tryTerminal = (index) => {
-          if (index >= terminals.length) {
-            const child = spawn('xdg-open', [fullDir], { stdio: 'ignore', detached: true });
-            child.on('error', (err) => { reportSwallowed('filesFs.openTerminal', err, { terminal: 'xdg-open' }); });
-            child.unref();
-            return;
-          }
-          const term = terminals[index];
-          let child;
-          try {
-            if (term === 'gnome-terminal') {
-              child = spawn(term, ['--working-directory=' + fullDir], { stdio: 'pipe' });
-            } else if (term === 'konsole') {
-              child = spawn(term, ['--workdir', fullDir], { stdio: 'pipe' });
-            } else {
-              child = spawn(term, [], { cwd: fullDir, stdio: 'pipe' });
-            }
-          } catch {
-            tryTerminal(index + 1);
-            return;
-          }
-          child.once('error', (err) => {
-            reportSwallowed('filesFs.openTerminal', err, { terminal: term });
-            tryTerminal(index + 1);
-          });
-          child.once('spawn', () => {
-            for (const stream of [child.stdin, child.stdout, child.stderr]) stream?.destroy();
-            child.unref();
-          });
-        };
-        tryTerminal(0);
-      }
+      openTerminalAt(fullDir);
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));
     } catch (err) {