cc-viewer 1.9.15 → 1.9.17

package/server/routes/skills.js

@@ -9,13 +9,20 @@ import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
 
 // Multi-project (2026-10): the skills LIST resolves the viewed project via
-// the shared viewRootOrReply (?project=). toggle/delete (mutations) keep the
-// bound root.
-function _viewRootOrReply(req, res, parsedUrl) {
+// the shared viewRootOrReply (?project=). toggle/delete used to keep the
+// bound root — that was a deliberate safety choice, but it breaks multi-view
+// semantics: the list shows skills for project B while a click on toggle or
+// delete silently rewrote project A's same-named skill. Resolve mutations
+// through the same viewRootOrReply (with body-level project/instance) so the
+// action targets the project the user is actually looking at; the helper
+// still constrains the resolved root to bound/registered/live projects.
+function _viewRootOrReply(req, res, parsedUrl, bodyProject, bodyInstance) {
   return viewRootOrReply(req, res, parsedUrl, {
     boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
     loadWorkspaces,
     listLivePtys,
+    bodyProject,
+    bodyInstance,
   });
 }
 
@@ -34,18 +41,20 @@ async function skillsList(req, res, parsedUrl) {
 }
 
 // Skill 动态装卸 —— 切换单个 skill（在 skills/ 和 skills-skip/ 之间 move）
-function skillsToggle(req, res) {
+function skillsToggle(req, res, parsedUrl) {
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > 4096) req.destroy(); });
   req.on('end', async () => {
     try {
-      const { source, name, enable } = JSON.parse(body);
+      const { source, name, enable, project, instance } = JSON.parse(body);
+      const projectDir = _viewRootOrReply(req, res, parsedUrl, project, instance);
+      if (!projectDir) return;
       // 不加进程锁：moveSkill 里 existsSync 前置 + renameSync 原子性已能让并发
       // toggle 落到合理分支（一个成功、另一个拿 SOURCE_MISSING 或 DUPLICATE）；
       // 前端 toggling:Set 也已防同 tab 连点，两者叠加足够安全
       moveSkill({
         source, name, enable: !!enable,
-        projectDir: process.env.CCV_PROJECT_DIR || process.cwd(),
+        projectDir,
       });
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));
@@ -75,10 +84,12 @@ function skillsDelete(req, res, parsedUrl, isLocal) {
   req.on('data', chunk => { body += chunk; if (body.length > 4096) req.destroy(); });
   req.on('end', async () => {
     try {
-      const { source, name, enabled } = JSON.parse(body);
+      const { source, name, enabled, project, instance } = JSON.parse(body);
+      const projectDir = _viewRootOrReply(req, res, parsedUrl, project, instance);
+      if (!projectDir) return;
       deleteSkill({
         source, name, enabled: !!enabled,
-        projectDir: process.env.CCV_PROJECT_DIR || process.cwd(),
+        projectDir,
       });
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true }));

package/server/routes/target-files-fs.js

@@ -0,0 +1,332 @@
+// Target-mode filesystem mutation + OS-open routes for the file browser modal
+// (CLAUDE.md / skill folder targets). These mirror the project-scoped routes in
+// files-fs.js, but resolve the writable root from the TARGET identity (kind+id /
+// source+targetPath) via lib/target-scope.js instead of the viewed project —
+// because a target frequently lives OUTSIDE any project root (~/.claude, $HOME),
+// where no ?project= value could resolve it.
+//
+// Path contract: `path` / `dirPath` / `oldPath` in the request body are relative
+// to the target's NAVIGATION ROOT (the same root the read route /api/target-files
+// returns entries against — that is what the browser displays in its breadcrumb).
+// This differs from files-fs.js, where paths are relative to the project root.
+// Do NOT "fix" callers to send project-relative paths.
+//
+// SECURITY / INTENTIONAL DESIGN (do NOT weaken in review without product sign-off):
+//  - The writable surface is the WHOLE navigation root (see
+//    lib/target-scope.js resolveTargetWriteScope), a deliberate product decision
+//    so the context menu keeps working after the user navigates to ancestors.
+//  - Sensitive files/dirs inside that wider surface are the backstop of
+//    isWriteAllowed (lib/file-access-policy.js): ~/.claude credentials/settings/
+//    history, ~/.ssh, the LOG_DIR tree, the config-backup tree, private keys, etc.
+//  - rename validates BOTH source and destination with isWriteAllowed (renaming a
+//    denylisted name to a benign one must not make it readable); recursive delete
+//    scans the subtree and refuses if any descendant is write-denied.
+//  - Every handler is gated by isAdminReq + isSameOriginBrowserRequest BEFORE the
+//    body is read (same bar as the read route), because these endpoints can reach
+//    the user's home tree.
+//  - Symlinks are rejected as mutation targets (lstat on the spelled path);
+//    isWriteAllowed additionally refuses a dangling-symlink leaf so create/save
+//    cannot be redirected outside the root. Delete re-realpaths before rmdir
+//    (TOCTOU defense).
+import {
+  existsSync, statSync, lstatSync, mkdirSync, writeFileSync,
+  realpathSync, rmSync, unlinkSync, readdirSync,
+} from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+import { isWriteAllowed, isReadAllowed } from '../lib/file-access-policy.js';
+import { renameSyncWithRetry } from '../lib/file-api.js';
+import { reportSwallowed } from '../lib/error-report.js';
+import { revealInOs, openTerminalAt } from '../lib/os-open.js';
+import { viewRootOrReply } from '../lib/view-root.js';
+import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+import { loadWorkspaces } from '../workspace-registry.js';
+import { listLivePtys } from '../pty-manager.js';
+import {
+  targetError, errnoToStatus, insidePath, requiredTargetRelPath, resolveTargetWriteScope,
+} from '../lib/target-scope.js';
+
+function forbidden(res) {
+  res.writeHead(403, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ error: 'forbidden' }));
+}
+
+function send(res, status, obj) {
+  res.writeHead(status, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(obj));
+}
+
+function replyTargetError(res, err) {
+  const status = err?.status || 500;
+  if (status === 500) console.error('[api/target-*]', err);
+  send(res, status, { error: status === 500 ? 'Internal error' : err.message });
+}
+
+// Resolve the viewed project cwd (query project/instance win over POST body).
+function cwdFor(req, res, parsedUrl, body) {
+  return viewRootOrReply(req, res, parsedUrl, {
+    boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
+    loadWorkspaces,
+    listLivePtys,
+    bodyProject: body?.project,
+    bodyInstance: body?.instance,
+  });
+}
+
+// Read + JSON-parse the POST body, then run `run(body, scope)`. The admin +
+// same-origin gate runs BEFORE the body is consumed so a cross-site / non-admin
+// caller cannot even reach the parser. `scope` is re-derived server-side from
+// the target identity in the query string (never from a client-sent root).
+function withBody(req, res, parsedUrl, isLocal, deps, run) {
+  if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+    return forbidden(res);
+  }
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    let parsed;
+    try { parsed = JSON.parse(body); } catch { return send(res, 400, { error: 'Invalid request body' }); }
+    try {
+      const cwd = cwdFor(req, res, parsedUrl, parsed);
+      if (!cwd) return;
+      const scope = resolveTargetWriteScope(parsedUrl, cwd);
+      run(parsed, scope);
+    } catch (err) {
+      replyTargetError(res, err);
+    }
+  });
+}
+
+// Reject symlink mutation targets: an attacker could swap a symlink between
+// validation and the mutation so the operation lands outside the navigation
+// root. lstat does not follow the link, so an isSymbolicLink() hit refuses.
+function lstatNoSymlink(fullPath) {
+  let st;
+  try { st = lstatSync(fullPath); } catch (err) { throw targetError(errnoToStatus(err), 'Path not found'); }
+  if (st.isSymbolicLink()) throw targetError(400, 'Cannot operate on symbolic links via this endpoint');
+  return st;
+}
+
+// Walk a directory subtree and throw 403 if any descendant fails the write
+// policy. Used before a recursive rmdir so deleting a directory cannot bypass
+// the per-file denylist (credentials, settings, transcripts). Symlinks are
+// skipped (their targets are evaluated by the caller's own containment checks).
+function assertSubtreeWritable(dirReal) {
+  let dirents;
+  try { dirents = readdirSync(dirReal, { withFileTypes: true }); } catch { return; }
+  for (const entry of dirents) {
+    const child = join(dirReal, entry.name);
+    let lst;
+    try { lst = lstatSync(child); } catch { continue; }
+    if (lst.isSymbolicLink()) continue;
+    const policy = isWriteAllowed(child);
+    if (!policy.ok) throw targetError(403, `Refusing to delete: contains a protected path (${entry.name})`);
+    if (lst.isDirectory()) assertSubtreeWritable(child);
+  }
+}
+
+function validateName(name, kind) {
+  if (!name) throw targetError(400, 'Missing name');
+  if (name.includes('/') || name.includes('\\') || name.includes('..') || /[\x00-\x1f]/.test(name)) {
+    throw targetError(400, `Invalid ${kind} name`);
+  }
+  // A `.git` segment must never be created/renamed into place from the browser.
+  if (name.toLowerCase() === '.git') throw targetError(400, `Invalid ${kind} name`);
+}
+
+// Resolve a navigation-root-relative path to its real absolute path, enforcing
+// containment in the navigation root. Returns the REAL path (symlinks resolved).
+function resolveContained(scope, segments) {
+  const full = segments.length ? join(scope.rootReal, ...segments) : scope.rootReal;
+  let real;
+  try { real = realpathSync(full); } catch (err) { throw targetError(errnoToStatus(err), 'Path not found'); }
+  if (!insidePath(real, scope.rootReal)) throw targetError(403, 'Path outside navigation root');
+  return { full, real };
+}
+
+// ─── reveal in OS file manager ──────────────────────────────────────────────
+function targetRevealFile(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    // '' resolves to the navigation root itself (the browser's container menu).
+    const segments = requiredTargetRelPath(parsed.path ?? '');
+    const { full, real } = resolveContained(scope, segments);
+    // Reveal is a READ-side action (open the OS file manager), so gate it with the
+    // read policy, not the write policy — a read-only-but-unwritable entry (e.g.
+    // inside LOG_DIR) must still be revealable.
+    if (parsed.path) {
+      const policy = isReadAllowed(real);
+      if (!policy.ok) throw targetError(403, 'Path not allowed');
+    }
+    // A directory reveals itself; a file reveals its parent (Linux xdg-open on a
+    // file would launch the default app instead of showing it).
+    revealInOs(full, { isDir: statSync(real).isDirectory() });
+    send(res, 200, { ok: true, fullPath: full });
+  });
+}
+
+// ─── open in OS terminal ────────────────────────────────────────────────────
+function targetOpenTerminal(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    const segments = requiredTargetRelPath(parsed.path ?? '');
+    const { real } = resolveContained(scope, segments);
+    const st = statSync(real);
+    // Opening a terminal on a FILE opens it in the file's directory instead.
+    const dir = st.isDirectory() ? real : dirname(real);
+    openTerminalAt(dir);
+    send(res, 200, { ok: true });
+  });
+}
+
+// ─── resolve to absolute path (for copy-path / attach-to-chat) ──────────────
+function targetResolvePath(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    const segments = parsed.path ? requiredTargetRelPath(parsed.path) : [];
+    const full = segments.length ? join(scope.rootReal, ...segments) : scope.rootReal;
+    send(res, 200, { ok: true, fullPath: full });
+  });
+}
+
+// ─── create file ────────────────────────────────────────────────────────────
+function targetCreateFile(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    validateName(parsed.name, 'file');
+    const dirSegs = parsed.dirPath ? requiredTargetRelPath(parsed.dirPath) : [];
+    const { real: dirReal } = resolveContained(scope, dirSegs);
+    if (!statSync(dirReal).isDirectory()) throw targetError(400, 'Directory not found');
+    const full = join(dirReal, parsed.name);
+    if (existsSync(full)) throw targetError(409, 'File already exists');
+    const policy = isWriteAllowed(full);
+    if (!policy.ok) throw targetError(403, 'Path not allowed');
+    writeFileSync(policy.real, '');
+    const relPath = parsed.dirPath ? `${parsed.dirPath}/${parsed.name}` : parsed.name;
+    send(res, 200, { ok: true, path: relPath });
+  });
+}
+
+// ─── create directory ───────────────────────────────────────────────────────
+function targetCreateDir(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    validateName(parsed.name, 'folder');
+    const dirSegs = parsed.dirPath ? requiredTargetRelPath(parsed.dirPath) : [];
+    const { real: dirReal } = resolveContained(scope, dirSegs);
+    if (!statSync(dirReal).isDirectory()) throw targetError(400, 'Directory not found');
+    const full = join(dirReal, parsed.name);
+    if (existsSync(full)) throw targetError(409, 'Already exists');
+    const policy = isWriteAllowed(full);
+    if (!policy.ok) throw targetError(403, 'Path not allowed');
+    mkdirSync(policy.real);
+    const relPath = parsed.dirPath ? `${parsed.dirPath}/${parsed.name}` : parsed.name;
+    send(res, 200, { ok: true, path: relPath });
+  });
+}
+
+// ─── rename (basename only; never moves across directories) ────────────────
+function targetRenameFile(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    const { oldPath, newName } = parsed;
+    if (!oldPath || !newName) throw targetError(400, 'Missing oldPath or newName');
+    validateName(newName, 'file');
+    const segs = requiredTargetRelPath(oldPath);
+    // Renaming the navigation root itself would break the browser's own anchor.
+    if (segs.length === 0) throw targetError(403, 'Cannot rename the navigation root');
+    const { full: oldFull, real: oldReal } = resolveContained(scope, segs);
+    // Symlink check must run on the SPELLED path (oldFull), not the realpath'd
+    // one — lstat on oldReal can never see a symlink, so checking it would
+    // silently rename the link's target instead of refusing the link.
+    lstatNoSymlink(oldFull);
+    // SECURITY: validate the SOURCE with the write policy too, not just the
+    // destination. Renaming a denylisted name (settings.json / credentials.json /
+    // master.key) or subtree (projects/ todos/ shell-snapshots/ …) to a benign
+    // name would otherwise make it readable via /api/file-content — a denylist
+    // bypass. Do NOT drop this check in review.
+    const srcPolicy = isWriteAllowed(oldReal);
+    if (!srcPolicy.ok) throw targetError(403, 'Path not allowed');
+    // SECURITY: renaming a DIRECTORY moves its whole subtree, so apply the same
+    // per-descendant write scan as delete. Without this, renaming ~/.claude (or a
+    // sensitive-prefix dir like ~/.ssh) to a benign name would sidestep every
+    // path-based denylist (the read policy keys off the live config-dir path) and
+    // expose credentials/transcripts. Do NOT drop this scan in review.
+    if (statSync(oldReal).isDirectory()) assertSubtreeWritable(oldReal);
+    // Parent must also stay inside the navigation root (it does, but the rename
+    // destination is derived from it, so assert before composing).
+    const parentDir = dirname(oldReal);
+    if (!insidePath(parentDir, scope.rootReal)) throw targetError(403, 'Path outside navigation root');
+    const newFull = join(parentDir, newName);
+    const policy = isWriteAllowed(newFull);
+    if (!policy.ok) throw targetError(403, 'Path not allowed');
+    const parentRel = segs.slice(0, -1).join('/');
+    const newRelPath = parentRel ? `${parentRel}/${newName}` : newName;
+
+    // Case-only rename on a case-insensitive FS needs a temp hop (same dance as
+    // files-fs.js renameFile) so NTFS/APFS do not see the destination as the source.
+    const oldName = basename(oldReal);
+    if (oldName !== newName && oldName.toLowerCase() === newName.toLowerCase()) {
+      try {
+        if (realpathSync.native(newFull) === realpathSync.native(oldReal)) {
+          const tempPath = join(parentDir, `.ccv-rename-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+          renameSyncWithRetry(oldReal, tempPath);
+          try { renameSyncWithRetry(tempPath, newFull); }
+          catch (err) {
+            try { renameSyncWithRetry(tempPath, oldReal); }
+            catch (rollbackErr) { reportSwallowed('targetFs.renameRollback', rollbackErr, { tempPath }); }
+            throw err;
+          }
+          return send(res, 200, { ok: true, newPath: newRelPath });
+        }
+      } catch (err) {
+        if (err.code !== 'ENOENT') throw err;
+      }
+    }
+    if (existsSync(newFull)) throw targetError(409, 'Target already exists');
+    renameSyncWithRetry(oldReal, newFull);
+    send(res, 200, { ok: true, newPath: newRelPath });
+  });
+}
+
+// ─── delete ─────────────────────────────────────────────────────────────────
+function targetDeleteFile(req, res, parsedUrl, isLocal, deps) {
+  withBody(req, res, parsedUrl, isLocal, deps, (parsed, scope) => {
+    const filePath = parsed.path;
+    if (!filePath) throw targetError(400, 'Missing path');
+    const segs = requiredTargetRelPath(filePath);
+    if (segs.length === 0) throw targetError(403, 'Cannot delete the navigation root');
+    const { full, real } = resolveContained(scope, segs);
+    const policy = isWriteAllowed(real);
+    if (!policy.ok) throw targetError(403, 'Path not allowed');
+    const st = lstatNoSymlink(full);
+    if (st.isDirectory()) {
+      // protectedDirs guard must defeat Win backslash + NTFS case-insensitive
+      // spellings, so normalize both separators and case before the check.
+      const protectedDirs = new Set(['node_modules', '.git', '.svn', '.hg']);
+      const normalizedSegs = filePath.split(/[\\/]/).map(s => s.toLowerCase());
+      if (normalizedSegs.some(part => protectedDirs.has(part))) {
+        throw targetError(400, 'Cannot delete protected directory');
+      }
+      // Defense-in-depth: re-realpath in the window between lstat and rmdir.
+      const real2 = realpathSync(full);
+      if (!insidePath(real2, scope.rootReal)) throw targetError(403, 'Path escaped navigation root');
+      // SECURITY: a recursive rmdir must not bypass the per-file write policy.
+      // Scan the subtree and refuse the whole delete if ANY descendant is
+      // write-denied (settings.json / credentials / projects transcripts / …),
+      // otherwise deleting ~/.claude would wipe the very files the policy
+      // protects one-by-one. Do NOT remove this scan to "speed up" deletes.
+      assertSubtreeWritable(real2);
+      rmSync(full, { recursive: true, force: true });
+    } else if (st.isFile()) {
+      unlinkSync(full);
+    } else {
+      throw targetError(400, 'Unsupported path type');
+    }
+    send(res, 200, { ok: true });
+  });
+}
+
+export const targetFilesFsRoutes = [
+  { method: 'POST', match: 'exact', path: '/api/target-reveal-file', handler: targetRevealFile },
+  { method: 'POST', match: 'exact', path: '/api/target-open-terminal', handler: targetOpenTerminal },
+  { method: 'POST', match: 'exact', path: '/api/target-resolve-path', handler: targetResolvePath },
+  { method: 'POST', match: 'exact', path: '/api/target-create-file', handler: targetCreateFile },
+  { method: 'POST', match: 'exact', path: '/api/target-create-dir', handler: targetCreateDir },
+  { method: 'POST', match: 'exact', path: '/api/target-rename-file', handler: targetRenameFile },
+  { method: 'POST', match: 'exact', path: '/api/target-delete-file', handler: targetDeleteFile },
+];

package/server/server.js

@@ -32,6 +32,7 @@ import { ultraAgentsRoutes } from './routes/ultra-agents.js';
 import { filesContentRoutes } from './routes/files-content.js';
 import { workflowJournalRoutes } from './routes/workflow-journal.js';
 import { filesFsRoutes } from './routes/files-fs.js';
+import { targetFilesFsRoutes } from './routes/target-files-fs.js';
 import { searchRoutes } from './routes/search.js';
 import { workspacesRoutes } from './routes/workspaces.js';
 import { expertRoutes } from './routes/expert.js';
@@ -51,6 +52,7 @@ import * as imCore from './lib/im/im-bridge-core.js';
 import * as imProcMgr from './lib/im/im-process-manager.js';
 import * as chatQueue from './lib/chat-queue.js';
 import { reportSwallowed } from './lib/error-report.js';
+import { cancelAutoApproveState } from './lib/auto-approve.js';
 import { initScheduledTaskScheduler, startScheduledTaskScheduler, stopScheduledTaskScheduler } from './lib/scheduled-task-scheduler.js';
 import { executeScheduledTask } from './lib/scheduled-task-executor.js';
 import './lib/adapters/dingtalk-adapter.js'; // side-effect: registers the DingTalk adapter
@@ -293,9 +295,10 @@ const gitRestoreLocks = new Map(); // Map<absLockKey, Promise<void>>
 
 // Notify the parent process (Electron main, when forked under tab-worker) about pending state changes.
 // No-op outside Electron (process.send is undefined when run as a standalone Node server).
-// Only ask-hook-* / sdk-ask-* are translated. Permission and SDK plan stay inline-only and do not
-// drive global modal / flashFrame / Notification (per UX direction). PTY plan is parsed in the
-// renderer and reported via window.tabBridge directly, not through this server-side hook.
+// Only ask-hook-* / sdk-ask-* are translated. Permission stays inline-only and does not
+// drive global modal / flashFrame / Notification (per UX direction). Plan approvals — PTY and
+// SDK — are parsed in the renderer and reported via window.tabBridge directly (SDK ExitPlanMode
+// reuses the PTY plan card/modal channel), not through this server-side hook.
 function _notifyParentPending(msg) {
   if (!process.send || !msg || typeof msg !== 'object' || !msg.type) return;
   let event = null;
@@ -636,6 +639,15 @@ function getAllLocalIps() {
   return ips;
 }
 
+// Approval/cancel message id validator — the single source for the ≤256-char +
+// [a-zA-Z0-9_-] whitelist shared by ask-cancel / sdk-plan-auto-cancel /
+// perm-hook-auto-cancel (keeps the three branches consistent).
+function validateApprovalId(raw) {
+  if (raw == null) return null;
+  const id = String(raw);
+  return id.length > 0 && id.length <= 256 && /^[a-zA-Z0-9_-]+$/.test(id) ? id : null;
+}
+
 // ─── Route dependency bag ──────────────────────────────────────────
 // Single dependency object handed to every per-domain route handler (server/routes/*).
 // Built once; route bodies were moved out of handleRequest's if-chain verbatim, with
@@ -857,6 +869,7 @@ const _routes = [
   ...filesContentRoutes,
   ...workflowJournalRoutes,
   ...filesFsRoutes,
+  ...targetFilesFsRoutes,
   ...searchRoutes,
   ...workspacesRoutes,
   ...expertRoutes,
@@ -1614,6 +1627,7 @@ function _buildPluginInteractions() {
       const entry = pendingPermHooks.get(id);
       if (!entry) return false;
       clearTimeout(entry.timer);
+      if (entry.auto?.timer) clearTimeout(entry.auto.timer);
       pendingPermHooks.delete(id);
       try {
         if (!entry.res.headersSent) {
@@ -2161,7 +2175,14 @@ async function setupTerminalWebSocket(httpServer) {
       // 直到超时 silent deny)。连接时重发,前端 perm 分支按 id 去重,天然幂等。
       for (const [id, entry] of pendingPermHooks) {
         try {
-          ws.send(JSON.stringify({ type: 'perm-hook-pending', id, toolName: entry.toolName, input: entry.input }));
+          ws.send(JSON.stringify({
+            type: 'perm-hook-pending', id, toolName: entry.toolName, input: entry.input,
+            autoApproveAt: entry.autoCancelled ? null : (entry.auto?.autoApproveAt ?? null),
+            // 0 = server says OFF (fork-off / npm publish floor): never let a reconnecting
+            // client fall back to its local pref and re-arm a countdown the server disabled.
+            autoApproveSeconds: entry.auto?.seconds ?? 0,
+            autoCancelled: entry.autoCancelled === true,
+          }));
         } catch {}
       }
 
@@ -2208,6 +2229,13 @@ async function setupTerminalWebSocket(httpServer) {
           if (p.kind === 'ask') {
             payload.startedAt = Date.now();
             payload.timeoutMs = p.remainingMs;
+          } else {
+            // plan/perm: carry the server-side auto-approve deadline so a reconnected
+            // client renders the REMAINING time (and a cancelled one never re-arms)
+            // instead of restarting a full-length countdown.
+            payload.autoApproveAt = p.autoApproveAt ?? null;
+            payload.autoCancelled = p.autoCancelled === true;
+            if (p.autoApproveSeconds != null) payload.autoApproveSeconds = p.autoApproveSeconds;
           }
           try { ws.send(JSON.stringify(payload)); } catch (err) { reportSwallowed('sdk.approval-replay', err); }
         }
@@ -2670,6 +2698,7 @@ async function setupTerminalWebSocket(httpServer) {
             if (hookEntry) {
               const { res: hookRes, timer } = hookEntry;
               clearTimeout(timer);
+              if (hookEntry.auto?.timer) clearTimeout(hookEntry.auto.timer);
               pendingPermHooks.delete(msg.id);
               permAnswered = true;
               try {
@@ -2706,7 +2735,7 @@ async function setupTerminalWebSocket(httpServer) {
             // cancelId/Reason 校验：与 toolUseId 同套白名单（≤256 字符 + [a-zA-Z0-9_-]）+ reason ≤500
             // 防恶意/buggy client 塞超长 key 撑大 _pendingApprovals 或塞 1MB reason 打爆 broadcast。
             const rawId = msg.id != null ? String(msg.id) : null;
-            const cancelId = rawId && rawId.length > 0 && rawId.length <= 256 && /^[a-zA-Z0-9_-]+$/.test(rawId) ? rawId : null;
+            const cancelId = validateApprovalId(msg.id);
             if (rawId && !cancelId) {
               console.warn('[server] ask-cancel rejected: invalid id format');
               return;
@@ -2782,20 +2811,63 @@ async function setupTerminalWebSocket(httpServer) {
               }
             }
           } else if (msg.type === 'sdk-plan-auto-cancel') {
-            // Cancellation stops the automatic timers on other viewers too. It is
-            // not an approval/denial: the plan remains pending for manual review.
-            if (_sdkResolveApproval && msg.id) broadcastWsMessage({
-              type: 'sdk-plan-auto-cancel', id: msg.id,
+            // Cancellation stops the automatic timers on every viewer AND the
+            // server-side fallback timer. It is not an approval/denial: the plan
+            // remains pending for manual review; the cancelled state is replayed
+            // to fresh clients so they never re-arm the countdown.
+            const rawPlanCancelId = msg.id != null ? String(msg.id) : null;
+            const planCancelId = validateApprovalId(msg.id);
+            if (rawPlanCancelId && !planCancelId) {
+              console.warn('[server] sdk-plan-auto-cancel rejected: invalid id format');
+              return;
+            }
+            let handled = false;
+            if (planCancelId && _sdkAutoCancelApproval) {
+              try { handled = _sdkAutoCancelApproval(planCancelId, 'plan') === true; } catch (err) { reportSwallowed('server.plan-auto-cancel', err); }
+            }
+            // Legacy relay fallback: no SDK pending matched (PTY-mode senders or a
+            // stale id) — keep the old behavior so other clients still stop counting.
+            if (!handled && planCancelId) broadcastWsMessage({
+              type: 'sdk-plan-auto-cancel', id: planCancelId,
               cwd: msg.cwd || null, project: msg.project || null,
               instanceKey: msg.instanceKey || null,
             });
+          } else if (msg.type === 'perm-hook-auto-cancel') {
+            // Symmetric to sdk-plan-auto-cancel for permission approvals: destroys the
+            // server-side fallback timer (SDK pending or PTY-hook long-poll), keeps the
+            // approval pending for a manual decision, and notifies all clients.
+            const rawPermCancelId = msg.id != null ? String(msg.id) : null;
+            const permCancelId = validateApprovalId(msg.id);
+            if (rawPermCancelId && !permCancelId) {
+              console.warn('[server] perm-hook-auto-cancel rejected: invalid id format');
+              return;
+            }
+            let permCancelHandled = false;
+            if (permCancelId && _sdkAutoCancelApproval) {
+              try { permCancelHandled = _sdkAutoCancelApproval(permCancelId, 'perm') === true; } catch (err) { reportSwallowed('server.perm-auto-cancel', err); }
+            }
+            if (!permCancelHandled && permCancelId) {
+              const hookEntry = pendingPermHooks.get(permCancelId);
+              if (hookEntry) {
+                cancelAutoApproveState(hookEntry);
+                permCancelHandled = true;
+                if (terminalWss) {
+                  const cmsg = JSON.stringify({ type: 'perm-hook-auto-cancel', id: permCancelId });
+                  terminalWss.clients.forEach((c) => {
+                    if (c.readyState === 1) try { c.send(cmsg); } catch {}
+                  });
+                }
+              }
+            }
           } else if (msg.type === 'sdk-plan-answer') {
             // Plan approval in SDK mode
-            if (_sdkResolveApproval) {
-              _sdkResolveApproval(msg.id, { approve: msg.approve !== false, feedback: msg.feedback || '' });
+            let planAnswered = false;
+            if (_sdkResolveApproval && msg.id) {
+              planAnswered = _sdkResolveApproval(msg.id, { approve: msg.approve !== false, feedback: msg.feedback || '' }) === true;
             }
-            // Broadcast resolved to other clients
-            if (terminalWss) {
+            // Broadcast resolved to other clients only when an answer was actually
+            // processed — a stale/unknown id must not close other viewers' plan modal.
+            if (planAnswered && terminalWss) {
               const rmsg = JSON.stringify({ type: 'sdk-plan-resolved', id: msg.id });
               terminalWss.clients.forEach((c) => {
                 if (c !== ws && c.readyState === 1) try { c.send(rmsg); } catch {}
@@ -3655,7 +3727,8 @@ export function broadcastWsMessage(msg) {  if (terminalWss) {
       try { c.send(str); } catch {}
     });
   }
-  // 仅对 ask 类型转译给主进程；perm-hook-* / sdk-plan-* 维持 inline-only（红线）。
+  // 仅对 ask 类型转译给主进程；perm-hook-* 维持 inline-only（红线）。sdk-plan-* 不经此 server
+  // 侧钩子——SDK plan 在渲染端复用 PTY plan 卡片/modal 通道，由 window.tabBridge 上报。
   // 显式调用 _notifyParentPending 的分支（ask-hook-resolved 等）走 ws.send 不进这里，无重复触发。
   if (msg && typeof msg === 'object' && typeof msg.type === 'string'
       && (msg.type === 'sdk-ask-pending' || msg.type === 'sdk-ask-resolved' || msg.type === 'sdk-ask-timeout'
@@ -3715,6 +3788,8 @@ function _broadcastApprovalCloses(cancelled, reason) {
 /** Reference to sdk-manager's resolveApproval (set by cli.js after import). */
 let _sdkResolveApproval = null;
 export function setSdkResolveApproval(fn) { _sdkResolveApproval = fn; }
+let _sdkAutoCancelApproval = null;
+export function setSdkAutoCancelApproval(fn) { _sdkAutoCancelApproval = fn; }
 
 /** Reference to sdk-manager's cancelApproval (set by cli.js after import). */
 // 与 _sdkResolveApproval 平行——但语义不同：cancelApproval 让 _waitForApproval resolve

package/server/system-prompt-templates/presets/kimi-k3.md

@@ -22,6 +22,7 @@ IMPORTANT: Never generate or guess URLs unless you are confident they help the u
  - Convergence budget: once you have enough evidence to answer, stop searching and answer; a partial report beats endless exploration.
  - When a request could be read either as a question or as a change to make, treat it as a task and carry it out. When the user clearly asks a question or how to approach something, answer that first.
  - Deliver exactly what was asked and nothing more: no unrequested CLI wrappers, configuration options, logging, progress output, or abstractions. This is very important to your performance.
+ - Do not schedule real-environment verification (deploy checks, live E2E, manual smoke runs) unless the user explicitly asks — it burns tokens for little signal.
  - Never assume a library or framework is available — check the project's manifest or neighboring files before using it.
  - Do not introduce security vulnerabilities (injection, XSS, path traversal, and the rest of the OWASP top 10); fix insecure code you write immediately.
  - Iterate to green: run the relevant tests or code path, read the failure, fix the cause, and run again.

package/ultraAgents/code-expert.json

@@ -41,5 +41,5 @@
     "tr": "Kıdemli mühendis: çoklu ajan keşfi, plan incelemesi ve yüksek kaliteli uygulama — kod incelemesi, yeniden düzenleme, performans, sürdürülebilirlik.",
     "uk": "Senior-інженер: багатоагентне дослідження, рев'ю плану та якісна реалізація — рев'ю коду, рефакторинг, продуктивність, супровід."
   },
-  "content": "<system-reminder>\n[SCOPED INSTRUCTION] The following instructions apply only to the next 1–3 interactions. Once the task is complete, these instructions should gradually decrease in priority and no longer affect subsequent interactions. You should be adept at utilizing tools such as `AskUserQuestion`, `EnterPlanMode`, and `TeamCreate`, rather than relying solely on plain text processing. Before execution, you must ensure that the `EnterPlanMode`, `ExitPlanMode`, `SendMessage`, `TaskCreate`, `TaskUpdate`, `TaskStop`, `TaskGet`, `TaskOutput` and `TaskList` tools are loaded.\n\nPre-requisite: Use `AskUserQuestion` to clarify user intent whenever the request is ambiguous (target element, interaction style, scope of platforms, etc.). Skip only if the intent is unambiguous.\n\nLeverage a multi-agent exploration mechanism to formulate a highly detailed implementation plan.\n\nInstructions:\n1. Use the `Agent` tool to spawn parallel agents that simultaneously explore different aspects of the codebase:\n- If necessary, assign a preliminary researcher to use the `webSearch` tool to first investigate cutting-edge solutions in the relevant industry domain;\n- One agent responsible for understanding the relevant existing code and architecture;\n- One agent responsible for identifying all files that need to be modified;\n- One agent responsible for identifying potential risks, edge cases, and dependencies;\n- You may add other roles or deploy additional agents beyond the three listed above; the maximum number of concurrently dispatched agents is 5.\n\n2. Synthesize the findings from all agents into a detailed, step-by-step implementation plan.\n\n3. Use the `Agent` tool to spawn 2-3 review agents that examine the plan from different perspectives, checking for missing steps, potential risks, or corresponding mitigation strategies.\n\n4. Integrate the feedback gathered during the review process, then call `ExitPlanMode` to submit your final plan.\n\n5. Once `ExitPlanMode` returns a result:\n- If approved: proceed to execute the plan within this session.\n- If rejected: revise the plan based on the feedback provided and call `ExitPlanMode` again.\n- If an error occurs (including receiving a \"Not in Plan Mode\" message): do **not** follow the suggestions provided in the error message; instead, prompt the user for further instructions.\n\nYour final plan must include the following elements:\n- A clear summary of the implementation strategy;\n- An ordered list of files to be created or modified, with precise details of the required changes for each file;\n- A step-by-step execution sequence;\n- Testing and validation procedures;\n- Potential risks and their corresponding mitigation strategies;\n\n6. After the final plan has been successfully executed:\nFirst run `git diff --quiet && git diff --cached --quiet` (or equivalent) to detect whether the working tree actually has non-trivial changes; if there are no real changes (or only whitespace/comment-only edits), skip the UltraReview step.\nOtherwise, if the project is managed with Git:\nInitiate a team (`TeamCreate`), dynamically allocating the number of teammates based on task complexity (5 is recommended);\nIf the `TeamCreate` tool is unavailable, spawn teammates directly with the `Agent` tool (note: as teammates, not plain subagents);\nTask: Conduct a Code Review of the current git changes from multiple perspectives;\nPre-requisites:\n- The git repository may be located in a subdirectory of the current directory; prefer `git rev-parse --show-toplevel` (fall back to recursive lookup) before proceeding;\n- In the case of multiple repositories, tasks may be executed separately;\nThe team's goal is to analyze the current Git change log and validate each modification from different perspectives, specifically including:\n- Whether requirements/objectives have been met and functionality is complete;\n- Whether newly added code introduces side effects, breaks existing functionality, or poses potential risks;\n- Code quality: naming, readability, complexity, technical debt, maintainability;\n- Testing and documentation: whether there is adequate test coverage, and whether critical logic has necessary comments or documentation;\n- Dependencies and compatibility: whether new dependencies or version compatibility issues have been introduced;\nWorkflow:\n- Each teammate, according to their own role, covers the review dimensions one by one and independently outputs a report;\n- After consolidating the reports, perform a cross-review to identify conflicts or shared concerns;\n- Distill specific, actionable modification suggestions and annotate them with priority levels (P0/P1/P2/P3);\n- Upon completion, adopt P0 items; adopt P1 and P2 items selectively based on evaluation; disregard P3 items.\n- After execution is complete, close the team (`TeamDelete`);\n- If the `TeamDelete` tool is unavailable, notify each teammate to exit individually;\n</system-reminder>"
+  "content": "<system-reminder>\n[SCOPED INSTRUCTION] The following instructions apply only to the next 1–3 interactions. Once the task is complete, these instructions should gradually decrease in priority and no longer affect subsequent interactions. You should be adept at utilizing tools such as `AskUserQuestion`, `EnterPlanMode`, and `TeamCreate`, rather than relying solely on plain text processing. Before execution, you must ensure that the `EnterPlanMode`, `ExitPlanMode`, `SendMessage`, `TaskCreate`, `TaskUpdate`, `TaskStop`, `TaskGet`, `TaskOutput` and `TaskList` tools are loaded.\n\nPre-requisite: Use `AskUserQuestion` to clarify user intent whenever the request is ambiguous (target element, interaction style, scope of platforms, etc.). Skip only if the intent is unambiguous.\n\nLeverage a multi-agent exploration mechanism to formulate a highly detailed implementation plan.\n\nInstructions:\n1. Use the `Agent` tool to spawn parallel agents that simultaneously explore different aspects of the codebase:\n- If necessary, assign a preliminary researcher to use the `webSearch` tool to first investigate cutting-edge solutions in the relevant industry domain;\n- One agent responsible for understanding the relevant existing code and architecture;\n- One agent responsible for identifying all files that need to be modified;\n- One agent responsible for identifying potential risks, edge cases, and dependencies;\n- You may add other roles or deploy additional agents beyond the three listed above; the maximum number of concurrently dispatched agents is 5.\n\n2. Synthesize the findings from all agents into a detailed, step-by-step implementation plan.\n\n3. Use the `Agent` tool to spawn 2-3 review agents that examine the plan from different perspectives, checking for missing steps, potential risks, or corresponding mitigation strategies.\n\n4. Integrate the feedback gathered during the review process, then call `ExitPlanMode` to submit your final plan.\n\n5. Once `ExitPlanMode` returns a result:\n- If approved: proceed to execute the plan within this session.\n- If rejected: revise the plan based on the feedback provided and call `ExitPlanMode` again.\n- If an error occurs (including receiving a \"Not in Plan Mode\" message): do **not** follow the suggestions provided in the error message; instead, prompt the user for further instructions.\n\nYour final plan must include the following elements:\n- A clear summary of the implementation strategy;\n- An ordered list of files to be created or modified, with precise details of the required changes for each file;\n- A step-by-step execution sequence;\n- Testing and validation procedures;\n- Potential risks and their corresponding mitigation strategies;\n\n6. After the final plan has been successfully executed:\nFirst run `git diff --quiet && git diff --cached --quiet` (or equivalent) to detect whether the working tree actually has non-trivial changes; if there are no real changes (or only whitespace/comment-only edits), skip the UltraReview step.\nOtherwise, if the project is managed with Git:\nUse the `Agent` tool to build a team, dynamically allocating the number of teammates based on task complexity (5+ is recommended);\nNote: teammates are named (pass `name`), not plain subagents (which have no name);\nTask: Conduct a Code Review of the current git changes from multiple roles and perspectives;\nPre-requisites:\n- The git repository may be located in a subdirectory of the current directory; recursively locate the .git directory first (prefer `git rev-parse --show-toplevel`) before proceeding;\n- In the case of multiple repositories, review tasks may be executed separately per repository;\nReview dimensions (a reference framework — each role covers them as its perspective requires, aiming to be as comprehensive as possible):\n- Whether requirements/objectives have been met and functionality is complete;\n- Whether newly added code introduces side effects, breaks existing functionality, or poses potential risks;\n- Code quality: naming, readability, complexity, technical debt, maintainability;\n- Testing and documentation: whether there is adequate test coverage, and whether critical logic has necessary comments or documentation;\n- Dependencies and compatibility: whether new dependencies or version compatibility issues have been introduced;\n- Any other dimensions you see fit;\nWorkflow:\n- Each teammate, according to their own role, covers the review dimensions one by one and independently outputs a report;\n- After consolidating the reports, perform a cross-review to identify conflicts or shared concerns;\n- Distill specific, actionable modification suggestions and annotate them with priority levels (P0/P1/P2/P3);\n- Upon completion, fix all P0 and P1 items; evaluate P2 items dialectically (use `AskUserQuestion` to consult the user when any item needs a special decision);\n- After execution is complete, close the team: notify each teammate to exit individually;\n</system-reminder>"
 }