cc-viewer 1.9.15 → 1.9.17

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-Sp3JYYKo.js"></script>
+  <script type="module" crossorigin src="./assets/index-B4J-uwYG.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-I6I2F7Rv.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-Zkm6UHQg.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-CC09MDyZ.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.9.15",
+  "version": "1.9.17",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/ask/perm-bridge.js

@@ -164,7 +164,10 @@ const TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 
 function postToViewer() {
   return new Promise((resolve, reject) => {
-    const body = JSON.stringify({ toolName, input: toolInput });
+    // Forward the session cwd so the server can resolve the project-forked
+    // autoApproveSeconds for the right workspace (falls back to the server's
+    // current project key when absent — backward compatible).
+    const body = JSON.stringify({ toolName, input: toolInput, cwd: typeof payload?.cwd === 'string' ? payload.cwd : undefined });
     const req = httpClient.request({
       hostname: '127.0.0.1',
       port: Number(port),

package/server/lib/auto-approve.js

@@ -0,0 +1,160 @@
+// Server-side auto-approve countdown for plan/permission approvals.
+//
+// The auto-approve countdown used to live entirely in the web client: when the
+// browser tab was closed, backgrounded (timer throttling), or disconnected, no
+// approval ever fired and the pending request degraded to the 5-minute deny
+// timeout. This module moves the deadline to the server: the countdown is armed
+// from the moment the approval request arrives (wall-clock), and the server
+// resolves the pending approval itself at deadline + AUTO_APPROVE_BUFFER_MS.
+// The buffer gives a connected client whose own countdown fires at the exact
+// deadline a head start, so a watched approval is still answered by the client
+// and the server timer is only the fallback.
+//
+// Cancellation is durable while the approval is pending: a client cancel marks
+// the entry (autoCancelled) and clears the server timer, the approval stays
+// pending for a manual decision, and the cancelled state is replayed to newly
+// connected clients so they never re-arm a countdown.
+//
+// Semantics of the settings (shared with the client):
+//   plan: prefs.approvalModal.planAutoApproveSeconds (default 0 = off)
+//   perm: prefs.autoApproveSeconds                  (default 3 when unset)
+//   0/off, N>0 = N seconds, -1 = instant (resolve immediately, no buffer).
+// AskUserQuestion approvals are never auto-approved.
+
+import { readPrefsRaw } from './prefs-store.js';
+import { getCurrentProjectKey, hasFork, resolveScoped } from './project-prefs.js';
+import { reportSwallowed } from './error-report.js';
+
+export const AUTO_APPROVE_BUFFER_MS = 1000;
+export const DEFAULT_PERM_AUTO_APPROVE_SECONDS = 3;
+export const AUTO_APPROVE_INSTANT = -1;
+// A hand-edited preferences.json can hold an absurdly large value. Besides being
+// pointless, a value above the 5-minute hard approval timeout would advertise an
+// autoApproveAt the deny timeout always beats (a lying countdown); and beyond
+// 2^31-1 ms Node's setTimeout clamps the delay to 1ms (instant approval). Cap the
+// countdown at the approval timeout so the advertised deadline is always reachable.
+export const MAX_AUTO_APPROVE_SECONDS = 300;
+
+/**
+ * Extract the configured seconds for a kind ('plan' | 'perm') from an effective
+ * prefs object. Returns null when disabled (0 / invalid / negative other than -1 /
+ * absurdly large).
+ */
+export function effectiveAutoApproveSeconds(kind, prefs) {
+  const raw = kind === 'plan'
+    ? prefs?.approvalModal?.planAutoApproveSeconds
+    : (prefs?.autoApproveSeconds ?? DEFAULT_PERM_AUTO_APPROVE_SECONDS);
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds)) return null;
+  if (seconds === AUTO_APPROVE_INSTANT) return AUTO_APPROVE_INSTANT;
+  if (seconds <= 0) return null;
+  if (seconds > MAX_AUTO_APPROVE_SECONDS) return null;
+  return seconds;
+}
+
+/**
+ * Read prefs (project-fork aware) and compute the auto-approve deadline for a
+ * pending approval. `projectKey` is the session cwd (SDK) or hook-reported cwd
+ * (PTY hook); falls back to the server's current project key.
+ *
+ * Returns:
+ *   { enabled:false }                                      — no auto-approve
+ *   { enabled:true, instant, seconds, autoApproveAt }      — absolute epoch ms deadline
+ */
+export function computeAutoApprove(kind, projectKey, { now = Date.now(), readPrefs = readPrefsRaw, file } = {}) {
+  let prefs = {};
+  try {
+    prefs = readPrefs(file) || {};
+  } catch (err) {
+    reportSwallowed('auto-approve.read-prefs', err);
+    return { enabled: false };
+  }
+  const key = typeof projectKey === 'string' && projectKey ? projectKey : getCurrentProjectKey();
+  const effective = hasFork(prefs, key) ? resolveScoped(prefs, prefs.prefsByProject[key]) : prefs;
+  const seconds = effectiveAutoApproveSeconds(kind, effective);
+  if (seconds === null) return { enabled: false };
+  const instant = seconds === AUTO_APPROVE_INSTANT;
+  return {
+    enabled: true,
+    instant,
+    seconds,
+    autoApproveAt: instant ? now : now + seconds * 1000,
+  };
+}
+
+/**
+ * Delay for the server-side fallback timer: the user-visible deadline plus the
+ * request buffer, never negative. Instant fires on the same tick (0).
+ */
+export function autoApproveFireDelayMs(computed, now = Date.now()) {
+  if (!computed?.enabled) return null;
+  if (computed.instant) return 0;
+  return Math.max(0, computed.autoApproveAt - now) + AUTO_APPROVE_BUFFER_MS;
+}
+
+/**
+ * Arm the server-side fallback timer. Returns the auto state stored on the
+ * pending entry: { autoApproveAt, seconds, cancelled, timer }.
+ * `onFire` is invoked once when the deadline (+buffer) passes; callers must
+ * re-check the entry is still pending and not cancelled inside onFire.
+ * Instant (-1) fires SYNCHRONOUSLY — the caller MUST register the pending entry
+ * (and emit the pending frame) before calling this.
+ */
+export function createAutoApproveState(computed, onFire) {
+  const delay = autoApproveFireDelayMs(computed);
+  if (delay === null) return null; // disabled — never arm
+  const state = {
+    autoApproveAt: computed.autoApproveAt,
+    seconds: computed.seconds,
+    cancelled: false,
+    timer: null,
+  };
+  if (delay === 0) {
+    onFire();
+    return state;
+  }
+  state.timer = setTimeout(onFire, delay);
+  return state;
+}
+
+/**
+ * Cancel an armed auto-approve state: clears the timer and marks it cancelled.
+ * Accepts either the auto state itself or the whole pending entry ({ auto,
+ * autoCancelled }) — the entry form also stamps the durable entry-level flag so
+ * replays never re-arm. Returns true only on the first cancellation (so callers
+ * broadcast once).
+ */
+export function cancelAutoApproveState(autoOrEntry) {
+  if (!autoOrEntry) return false;
+  // Entry form: { auto, autoCancelled }
+  if (Object.prototype.hasOwnProperty.call(autoOrEntry, 'autoCancelled')) {
+    const entry = autoOrEntry;
+    if (entry.autoCancelled) return false;
+    entry.autoCancelled = true;
+    if (entry.auto) {
+      entry.auto.cancelled = true;
+      if (entry.auto.timer) {
+        clearTimeout(entry.auto.timer);
+        entry.auto.timer = null;
+      }
+    }
+    return true;
+  }
+  const auto = autoOrEntry;
+  if (auto.cancelled) return false;
+  auto.cancelled = true;
+  if (auto.timer) {
+    clearTimeout(auto.timer);
+    auto.timer = null;
+  }
+  return true;
+}
+
+/** Fields merged into pending/replay frames for the client countdown UI. */
+export function replayAutoApproveFields(auto, autoCancelled) {
+  return {
+    autoApproveAt: autoCancelled ? null : (auto?.autoApproveAt ?? null),
+    autoApproveSeconds: auto?.seconds ?? null,
+    autoCancelled: autoCancelled === true,
+  };
+}

package/server/lib/file-access-policy.js

@@ -10,8 +10,8 @@
  *
  * 不替代写路径的业务校验(见 server/lib/file-api.js writeFileContent),但同样会被 endpoint 用作首道关卡。
  */
-import { realpathSync } from 'node:fs';
-import { resolve, basename, sep, join } from 'node:path';
+import { realpathSync, lstatSync } from 'node:fs';
+import { resolve, basename, dirname, sep, join } from 'node:path';
 import { homedir, platform, tmpdir } from 'node:os';
 import { getClaudeConfigDir, onLogDirChange, LOG_DIR } from '../../findcc.js';
 import { loadWorkspaces } from '../workspace-registry.js';
@@ -122,7 +122,14 @@ function _logDirSensitiveFiles() {
     files.add(norm(join(LOG_DIR, name)));
     files.add(norm(join(rootReal, name)));
   }
-  _logDirSensitiveCache = { root: norm(withSep(LOG_DIR)), rootReal: norm(withSep(rootReal)), files };
+  // `root`/`rootReal` keep a trailing separator for startsWith() prefix matching;
+  // `rootBare`/`rootRealBare` (no trailing sep) let isWriteAllowed also deny the
+  // LOG_DIR directory ITSELF (delete/rename), which the prefix match would miss.
+  _logDirSensitiveCache = {
+    root: norm(withSep(LOG_DIR)), rootReal: norm(withSep(rootReal)),
+    rootBare: norm(LOG_DIR), rootRealBare: norm(rootReal),
+    files,
+  };
   return _logDirSensitiveCache;
 }
 onLogDirChange(() => { _logDirSensitiveCache = null; });
@@ -215,6 +222,16 @@ export function isReadAllowed(absPath) {
   let real;
   try { real = realpathSync(absPath); } catch { return { ok: false, reason: 'realpath-failed' }; }
 
+  return evaluateResolvedPath(real);
+}
+
+// Shared verdict for a realpath-resolved path — the allowlist + sensitive-file
+// + sensitive-prefix checks that isReadAllowed (existing files) and
+// isWriteAllowed (existing or to-be-created files) both apply. Keeping this the
+// single implementation prevents read/write policy drift: a path the user can
+// read but must not overwrite (e.g. ~/.claude/settings.json) is denied here for
+// both directions.
+function evaluateResolvedPath(real) {
   // 1) Allowlist 命中
   const roots = getAllowedRoots();
   let hitRoot = null;
@@ -233,8 +250,30 @@ export function isReadAllowed(absPath) {
     if (SENSITIVE_CLAUDE_FILES.has(last)) {
       return { ok: false, reason: 'sensitive-claude-config' };
     }
-    // 任意子目录下的 settings.json / settings.local.json 也拦
-    if (/^settings(\.local)?\.json$/i.test(last)) {
+    // settings.json / settings.local.json at any depth, plus all backups/variants
+    // (settings.json.bk*, settings_*.json, etc.) — rolling backup files carry the
+    // same env/api-key content and must not slip past the exact-name match.
+    if (/^settings(\.local)?\.json($|\.)|^settings_.*\.json$/i.test(last)) {
+      return { ok: false, reason: 'sensitive-claude-config' };
+    }
+    // Prompt history, project transcripts, shell snapshots, file history, and
+    // paste cache contain user prompt content and (in the case of shell snapshots)
+    // live env vars. Block the whole subtree EXCEPT projects/<encoded>/memory/**,
+    // which is the documented per-project memory dir served by /api/project-memory.
+    const rel = norm(real.slice(norm(withSep(claudeReal)).length));
+    const firstSeg = rel.split(sep)[0];
+    if (firstSeg === 'todos' || firstSeg === 'shell-snapshots'
+      || firstSeg === 'file-history' || firstSeg === 'paste-cache' || firstSeg === 'session-env') {
+      return { ok: false, reason: 'sensitive-claude-config' };
+    }
+    if (firstSeg === 'projects') {
+      const parts = rel.split(sep);
+      const isMemoryDir = parts.length >= 3 && parts[2] === 'memory';
+      if (!isMemoryDir) {
+        return { ok: false, reason: 'sensitive-claude-config' };
+      }
+    }
+    if (last === 'history.jsonl') {
       return { ok: false, reason: 'sensitive-claude-config' };
     }
   }
@@ -288,6 +327,94 @@ export function isReadAllowed(absPath) {
   return { ok: true, real };
 }
 
+/**
+ * Write-access verdict for the file browser's target mode (the CLAUDE.md / skill
+ * folder modal, where the user may browse up to an ancestor of the target). The
+ * target file itself may not exist yet (create-file / create-dir / rename
+ * destination), so unlike isReadAllowed we cannot realpath it directly. Instead:
+ * the parent directory must exist and pass the read policy, and the candidate
+ * path (parent's real path + basename) must pass the SAME shared verdict — so a
+ * location the user can read but must not overwrite (settings.json, credentials,
+ * master.key, backups) is rejected identically in both directions.
+ *
+ * SECURITY / INTENTIONAL DESIGN (do NOT weaken or remove in review): the write
+ * surface intentionally spans the whole navigation root (see
+ * lib/target-scope.js resolveTargetWriteScope). This function is the backstop
+ * that keeps secrets unwritable inside that wider surface.
+ *
+ * Two write-only denials layered on top of the read policy:
+ *  - The ENTIRE LOG_DIR tree (~/.claude/cc-viewer/**): the read policy only
+ *    blocks specific data files in it, but a write/delete could rmdir the whole
+ *    dir (wiping the preferences + scheduled-task store), so writes deny the
+ *    whole subtree.
+ *  - The config-backup root is already denied for reads (2b) and stays denied.
+ */
+export function isWriteAllowed(absPath) {
+  if (typeof absPath !== 'string' || !absPath) return { ok: false, reason: 'invalid' };
+  if (absPath.indexOf('\x00') !== -1) return { ok: false, reason: 'null-byte' };
+
+  // Existing file: realpath it and run the shared verdict directly.
+  // New file: realpath the nearest existing parent, then re-evaluate the
+  // candidate (parentReal + basename) so symlink/denylist checks apply to the
+  // resolved location, not the spelled path.
+  let real;
+  let existed = true;
+  try { real = realpathSync(absPath); } catch { existed = false; }
+  if (!existed) {
+    // Dangling-symlink guard: realpath failed but the leaf may still be a symlink
+    // whose target is missing/outside the allowlist. writeFileSync would FOLLOW it
+    // and create/overwrite the link's target outside the navigation root — a
+    // containment bypass. lstat does not follow the link, so an isSymbolicLink()
+    // hit here refuses the write. Do NOT remove (TOCTOU-class escape).
+    try { if (lstatSync(absPath).isSymbolicLink()) return { ok: false, reason: 'symlink' }; } catch { /* truly absent leaf */ }
+    let cursor = resolve(absPath, '..');
+    const descent = [basename(absPath)];
+    let parentReal = null;
+    for (let depth = 0; depth < 32; depth++) {
+      try { parentReal = realpathSync(cursor); break; } catch {
+        const parent = resolve(cursor, '..');
+        if (parent === cursor) break;
+        descent.unshift(basename(cursor));
+        cursor = parent;
+      }
+    }
+    if (parentReal === null) return { ok: false, reason: 'realpath-failed' };
+    // Every ancestor on the way down must be inside the allowlist / not denied;
+    // evaluate the nearest existing ancestor, then rebuild the candidate.
+    const ancestorVerdict = evaluateResolvedPath(parentReal);
+    if (!ancestorVerdict.ok) return ancestorVerdict;
+    real = join(parentReal, ...descent);
+  }
+
+  const verdict = evaluateResolvedPath(real);
+  if (!verdict.ok) return verdict;
+
+  // Write-only: deny the whole LOG_DIR subtree (read policy only blocks named
+  // data files in it). Matches both the raw and realpath'd spellings, both the
+  // prefix (children) AND the directory itself (bare), so a delete/rename cannot
+  // rmdir the whole task/preferences store.
+  const sens = _logDirSensitiveFiles();
+  const realNorm = norm(real);
+  if (realNorm.startsWith(sens.root) || realNorm.startsWith(sens.rootReal)
+    || realNorm === sens.rootBare || realNorm === sens.rootRealBare) {
+    return { ok: false, reason: 'sensitive-ccv-data' };
+  }
+
+  // Write-only: deny a sensitive-PREFIX directory itself (~/.ssh, ~/.aws, …), not
+  // just its contents. The read policy only matches children (startsWith withSep),
+  // so renaming the directory to a benign name would expose the whole prefix's
+  // contents. Renaming/deleting the dir root is refused here. (Only meaningful
+  // outside the project root, matching the prefix rule's own scope.)
+  const projectRoot = getProjectRoot();
+  if (!isInsideRoot(real, projectRoot)) {
+    for (const prefix of SENSITIVE_PATH_PREFIXES) {
+      if (realNorm === norm(prefix)) return { ok: false, reason: 'sensitive-prefix' };
+    }
+  }
+
+  return { ok: true, real };
+}
+
 /**
  * 给 endpoint 用的 reason → HTTP status code 映射。
  * - 路径不存在/realpath 失败 → 404(更友好,不暴露"路径合法但不存在")

package/server/lib/os-open.js

@@ -0,0 +1,66 @@
+// Shared OS-integration helpers (open in file manager / terminal) used by both
+// the project-scoped routes (files-fs.js) and the target-mode write routes
+// (target-files-fs.js). Centralizing the platform branches keeps the two call
+// surfaces from drifting apart (a Windows quoting or Linux terminal-fallback fix
+// must apply to both). Pure argv spawning — no shell — so no metachar injection.
+//
+// L1 (lib): must NOT import from routes/ (verify:boundaries).
+import { execFile, spawn } from 'node:child_process';
+import { dirname } from 'node:path';
+import { reportSwallowed } from './error-report.js';
+
+// Reveal a file (select it) or open a directory in the OS file manager.
+// - macOS: `open -R <path>` selects files AND opens directories in place.
+// - Windows: `explorer /select,"<path>"` (verbatim args; a dir path opens it).
+// - Linux: no select concept — open the path itself when it is a directory,
+//   otherwise its parent. (xdg-open on a FILE would launch the default app, so
+//   callers pass `isDir` to pick the directory to show.)
+export function revealInOs(fullPath, { isDir = false } = {}) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    execFile('open', ['-R', fullPath], () => {});
+  } else if (plat === 'win32') {
+    // windowsVerbatimArguments: Node would otherwise re-quote the spaced path into
+    // a form explorer cannot parse. No cmd.exe is involved, so no metachar risk;
+    // Windows filenames cannot contain `"`.
+    const child = spawn('explorer.exe', [`/select,"${fullPath}"`], { windowsVerbatimArguments: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.reveal', err); });
+  } else {
+    execFile('xdg-open', [isDir ? fullPath : dirname(fullPath)], () => {});
+  }
+}
+
+// Open an OS terminal with cwd = dir. Linux probes common emulators with piped
+// stdio so the next candidate is tried after ENOENT, falling back to xdg-open.
+export function openTerminalAt(dir) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    const child = spawn('open', ['-a', 'Terminal', dir], { stdio: 'ignore', detached: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'Terminal.app' }); });
+    child.unref();
+  } else if (plat === 'win32') {
+    const child = spawn('cmd.exe', ['/c', 'start', 'cmd.exe'], { cwd: dir, stdio: 'ignore', detached: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'cmd.exe' }); });
+    child.unref();
+  } else {
+    const terminals = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
+    const tryTerminal = (index) => {
+      if (index >= terminals.length) {
+        const child = spawn('xdg-open', [dir], { stdio: 'ignore', detached: true });
+        child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'xdg-open' }); });
+        child.unref();
+        return;
+      }
+      const term = terminals[index];
+      let child;
+      try {
+        if (term === 'gnome-terminal') child = spawn(term, ['--working-directory=' + dir], { stdio: 'pipe' });
+        else if (term === 'konsole') child = spawn(term, ['--workdir', dir], { stdio: 'pipe' });
+        else child = spawn(term, [], { cwd: dir, stdio: 'pipe' });
+      } catch { tryTerminal(index + 1); return; }
+      child.once('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: term }); tryTerminal(index + 1); });
+      child.once('spawn', () => { for (const s of [child.stdin, child.stdout, child.stderr]) s?.destroy(); child.unref(); });
+    };
+    tryTerminal(0);
+  }
+}

package/server/lib/sdk-manager.js

@@ -36,6 +36,12 @@ import { createHash, randomBytes } from 'node:crypto';
 import { registerSdkSessionLister } from './sdk-session-index.js';
 import { readPrefsRaw } from './prefs-store.js';
 import { projectKeyForCwd } from './system-prompt-snapshots.js';
+import {
+  computeAutoApprove,
+  createAutoApproveState,
+  cancelAutoApproveState,
+  replayAutoApproveFields,
+} from './auto-approve.js';
 
 let _query;
 try {
@@ -1489,11 +1495,24 @@ function _createSession(key, cwd) {
           }
         } catch (err) { reportSwallowed('sdk-manager.waterfall.plan', err); }
       }
-      const planPayload = { type: 'sdk-plan-pending', id, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin };
+      // Server-side auto-approve countdown (armed from request arrival, wall-clock):
+      // the pending frame carries the absolute deadline so clients render the remaining
+      // time instead of arming their own full-length timer; the server resolves the
+      // approval itself at deadline + 1s buffer when no client answered.
+      // Unattended scheduled-task runs (ctx != null → origin 'scheduled-task') are exempt
+      // from the server-side auto-approve fallback — with no human watching, an ephemeral
+      // run must wait for a decision (5-min deny), symmetric to the npm-publish floor below.
+      const planAuto = ctx ? { enabled: false } : computeAutoApprove('plan', _cwd);
+      // Always stamp autoApproveSeconds (0 = server says OFF): the client's local pref
+      // can disagree with the fork-resolved server value, and absence would make the
+      // client fall back to its own countdown and defeat a fork-level off.
+      const planPayload = { type: 'sdk-plan-pending', id, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin,
+        autoApproveSeconds: planAuto.enabled ? planAuto.seconds : 0,
+        ...(planAuto.enabled ? { autoApproveAt: planAuto.autoApproveAt } : {}) };
       if (_broadcastWs) {
         _broadcastWs(planPayload);
       }
-      const result = await _waitForApproval(id, 5 * 60 * 1000, 'plan', planPayload, options?.signal, ctx);
+      const result = await _waitForApproval(id, 5 * 60 * 1000, 'plan', planPayload, options?.signal, ctx, planAuto);
       if (result === null) {
         return { behavior: 'deny', message: 'Timeout waiting for plan approval' };
       }
@@ -1523,7 +1542,7 @@ function _createSession(key, cwd) {
       // server/lib/ask/ask-constants.js.
       const askTimeoutMs = ASK_TIMEOUT_MS;
       const askStartedAt = Date.now();
-      const askPayload = { type: 'sdk-ask-pending', id, questions: input.questions, startedAt: askStartedAt, timeoutMs: askTimeoutMs, cwd: _cwd, sessionId: effSessionId(), ...origin };
+      const askPayload = { type: 'sdk-ask-pending', id, questions: input.questions, startedAt: askStartedAt, timeoutMs: askTimeoutMs, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin };
       if (_broadcastWs) {
         _broadcastWs(askPayload);
       }
@@ -1599,12 +1618,18 @@ function _createSession(key, cwd) {
         // unknown decision → fall through to normal approval flow
       } catch (err) { reportSwallowed('sdk-manager.waterfall.perm', err); }
     }
-    const permPayload = { type: 'perm-hook-pending', id, toolName, input, cwd: _cwd, sessionId: effSessionId(), ...origin };
+    // npm publish is a hard safety floor: it must always wait for a HUMAN decision
+    // (the 5-minute deny timeout applies), never the server-side auto-approve fallback.
+    // Same exemption for unattended scheduled-task runs (ctx != null).
+    const permAuto = (isPublish || ctx) ? { enabled: false } : computeAutoApprove('perm', _cwd);
+    const permPayload = { type: 'perm-hook-pending', id, toolName, input, cwd: _cwd, sessionId: effSessionId(), instanceKey, ...origin,
+      autoApproveSeconds: permAuto.enabled ? permAuto.seconds : 0,
+      ...(permAuto.enabled ? { autoApproveAt: permAuto.autoApproveAt } : {}) };
     if (_broadcastWs) {
       _broadcastWs(permPayload);
     }
 
-    const result = await _waitForApproval(id, 5 * 60 * 1000, 'perm', permPayload, options?.signal, ctx);
+    const result = await _waitForApproval(id, 5 * 60 * 1000, 'perm', permPayload, options?.signal, ctx, permAuto);
     if (result === null) {
       return { behavior: 'deny', message: 'Timeout waiting for user approval' };
     }
@@ -1645,30 +1670,52 @@ function _createSession(key, cwd) {
     } catch (err) { console.warn('[sdk-manager] approval-dismiss broadcast threw:', err?.message); }
   }
 
-  function _waitForApproval(id, timeoutMs, kind, replay = null, signal = null, ctx = null) {
+  function _waitForApproval(id, timeoutMs, kind, replay = null, signal = null, ctx = null, autoMeta = null) {
     // Record the id on the ephemeral run's ctx ONLY when it actually parks (the three
     // callers below sit after every auto-allow/hard-deny early-return, so an auto-allowed
     // tool never lands here) — keeps ctx.approvalIds bounded (review P3: no unbounded growth).
     if (ctx && Array.isArray(ctx.approvalIds)) ctx.approvalIds.push(id);
     return new Promise((resolve) => {
       const timer = setTimeout(() => {
+        const cur = _pendingApprovals.get(id);
+        if (cur?.auto) cancelAutoApproveState(cur.auto);
         _pendingApprovals.delete(id);
         // Close the modal on every client — a silent deny would leave it hanging forever.
         _broadcastApprovalDismiss(kind, id, 'timeout');
         resolve(null);
       }, timeoutMs);
-      _pendingApprovals.set(id, {
+      const entry = {
         kind,  // 'ask' | 'plan' | 'perm' — lets cancelApproval distinguish types so an
         // ask-cancel does not collide with a plan/perm id
         replay,  // exact broadcast payload announced to clients — replayed to a fresh WS connection
         startedAt: Date.now(),
         timeoutMs,
+        // Durable auto-approve cancellation: a client cancel marks this and clears the
+        // server fallback timer, the approval stays pending for a manual decision, and
+        // the flag is replayed to fresh clients so they never re-arm the countdown.
+        autoCancelled: false,
+        auto: null,
         resolve: (value) => {
           clearTimeout(timer);
+          const cur = _pendingApprovals.get(id);
+          if (cur?.auto) cancelAutoApproveState(cur.auto);
           _pendingApprovals.delete(id);
           resolve(value);
         },
-      });
+      };
+      _pendingApprovals.set(id, entry);
+      // Arm the server-side fallback AFTER the entry is in the map: instant (-1) fires
+      // synchronously and resolves through the same first-wins wrapper.
+      if (autoMeta?.enabled) {
+        entry.auto = createAutoApproveState(autoMeta, () => {
+          const p = _pendingApprovals.get(id);
+          if (!p || p.autoCancelled) return;
+          p.resolve(kind === 'plan' ? { approve: true, feedback: '' } : { decision: 'allow' });
+          try {
+            _broadcastWs?.({ type: kind === 'plan' ? 'sdk-plan-resolved' : 'perm-hook-resolved', id, reason: 'auto-approved', cwd: _cwd, sessionId: _sessionId || null, instanceKey });
+          } catch (err) { reportSwallowed('sdk-manager.auto-approve-broadcast', err); }
+        });
+      }
       // CLI-side abort of the in-flight control request (e.g. interrupt while the modal is
       // open): settle through the same first-wins path as a timeout so the promise resolves
       // to deny and the modal closes everywhere. { once: true } prevents listener leaks.
@@ -1711,11 +1758,37 @@ function _createSession(key, cwd) {
     for (const [id, p] of _pendingApprovals) {
       const remaining = (p.timeoutMs ?? 0) - (now - (p.startedAt ?? now));
       if (remaining <= 0) continue;
-      out.push({ id, kind: p.kind || null, replay: p.replay || null, remainingMs: remaining });
+      out.push({
+        id, kind: p.kind || null, replay: p.replay || null, remainingMs: remaining,
+        ...replayAutoApproveFields(p.auto, p.autoCancelled),
+      });
     }
     return out;
   }
 
+  /**
+   * Cancel the SERVER-SIDE auto-approve countdown for a pending plan/perm approval
+   * (client clicked the countdown-cancel button). Unlike cancelApproval this does NOT
+   * resolve the approval — it stays pending for a manual decision; only the fallback
+   * timer is destroyed and the cancelled flag is replayed to fresh clients so they
+   * never re-arm. Returns true when the id matched a pending approval of that kind
+   * (even on a repeat cancel — the state change is durable while pending); false when
+   * nothing matched (caller falls back to the legacy relay-only behavior).
+   */
+  function _autoCancelApproval(id, kind) {
+    // plan/perm only — ask approvals never arm a server auto-approve timer.
+    if (kind !== 'plan' && kind !== 'perm') return false;
+    const pending = _pendingApprovals.get(id);
+    if (!pending || pending.kind !== kind) return false;
+    const first = cancelAutoApproveState(pending);
+    if (first && _broadcastWs) {
+      try {
+        _broadcastWs({ type: kind === 'plan' ? 'sdk-plan-auto-cancel' : 'perm-hook-auto-cancel', id, cwd: _cwd, sessionId: _sessionId || null, instanceKey });
+      } catch (err) { reportSwallowed('sdk-manager.auto-cancel-broadcast', err); }
+    }
+    return true;
+  }
+
   /**
    * Cancel a pending canUseTool approval — used by ask-cancel WS handler
    * (user clicked Cancel button or typed-interrupt in input bar).
@@ -2021,6 +2094,7 @@ function _createSession(key, cwd) {
     getQueueSnapshot: _getQueueSnapshot,
     resolveApproval: _resolveApproval,
     cancelApproval: _cancelApproval,
+    autoCancelApproval: _autoCancelApproval,
     getPendingApprovals: _getPendingApprovals,
     getSdkInitSnapshot: () => _lastInitSnapshot,
     getSessionStateSnapshot: () => {
@@ -2256,6 +2330,19 @@ export function cancelApproval(id, reason) {
   return false;
 }
 
+/**
+ * Cancel the server-side auto-approve countdown for a plan/perm approval,
+ * scanning EVERY session (auto-cancel WS handlers). The approval stays pending
+ * for a manual decision. Returns false when no pending approval matched, so the
+ * caller can fall back to the legacy relay-only broadcast.
+ */
+export function autoCancelApproval(id, kind) {
+  for (const sess of new Set([..._sessions.values(), ..._ephemeralHosts])) {
+    if (sess.autoCancelApproval(id, kind)) return true;
+  }
+  return false;
+}
+
 /**
  * Snapshot of pending approvals for WS-reconnect replay (server.js connection
  * handler). WITHOUT an anchor: aggregated across ALL sessions; WITH an anchor: