cc-viewer 1.9.16 → 1.9.17

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-sgW8MlD3.js"></script>
+  <script type="module" crossorigin src="./assets/index-B4J-uwYG.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-I6I2F7Rv.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-Zkm6UHQg.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-CC09MDyZ.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.9.16",
+  "version": "1.9.17",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/file-access-policy.js

@@ -10,8 +10,8 @@
  *
  * 不替代写路径的业务校验(见 server/lib/file-api.js writeFileContent),但同样会被 endpoint 用作首道关卡。
  */
-import { realpathSync } from 'node:fs';
-import { resolve, basename, sep, join } from 'node:path';
+import { realpathSync, lstatSync } from 'node:fs';
+import { resolve, basename, dirname, sep, join } from 'node:path';
 import { homedir, platform, tmpdir } from 'node:os';
 import { getClaudeConfigDir, onLogDirChange, LOG_DIR } from '../../findcc.js';
 import { loadWorkspaces } from '../workspace-registry.js';
@@ -122,7 +122,14 @@ function _logDirSensitiveFiles() {
     files.add(norm(join(LOG_DIR, name)));
     files.add(norm(join(rootReal, name)));
   }
-  _logDirSensitiveCache = { root: norm(withSep(LOG_DIR)), rootReal: norm(withSep(rootReal)), files };
+  // `root`/`rootReal` keep a trailing separator for startsWith() prefix matching;
+  // `rootBare`/`rootRealBare` (no trailing sep) let isWriteAllowed also deny the
+  // LOG_DIR directory ITSELF (delete/rename), which the prefix match would miss.
+  _logDirSensitiveCache = {
+    root: norm(withSep(LOG_DIR)), rootReal: norm(withSep(rootReal)),
+    rootBare: norm(LOG_DIR), rootRealBare: norm(rootReal),
+    files,
+  };
   return _logDirSensitiveCache;
 }
 onLogDirChange(() => { _logDirSensitiveCache = null; });
@@ -215,6 +222,16 @@ export function isReadAllowed(absPath) {
   let real;
   try { real = realpathSync(absPath); } catch { return { ok: false, reason: 'realpath-failed' }; }
 
+  return evaluateResolvedPath(real);
+}
+
+// Shared verdict for a realpath-resolved path — the allowlist + sensitive-file
+// + sensitive-prefix checks that isReadAllowed (existing files) and
+// isWriteAllowed (existing or to-be-created files) both apply. Keeping this the
+// single implementation prevents read/write policy drift: a path the user can
+// read but must not overwrite (e.g. ~/.claude/settings.json) is denied here for
+// both directions.
+function evaluateResolvedPath(real) {
   // 1) Allowlist 命中
   const roots = getAllowedRoots();
   let hitRoot = null;
@@ -310,6 +327,94 @@ export function isReadAllowed(absPath) {
   return { ok: true, real };
 }
 
+/**
+ * Write-access verdict for the file browser's target mode (the CLAUDE.md / skill
+ * folder modal, where the user may browse up to an ancestor of the target). The
+ * target file itself may not exist yet (create-file / create-dir / rename
+ * destination), so unlike isReadAllowed we cannot realpath it directly. Instead:
+ * the parent directory must exist and pass the read policy, and the candidate
+ * path (parent's real path + basename) must pass the SAME shared verdict — so a
+ * location the user can read but must not overwrite (settings.json, credentials,
+ * master.key, backups) is rejected identically in both directions.
+ *
+ * SECURITY / INTENTIONAL DESIGN (do NOT weaken or remove in review): the write
+ * surface intentionally spans the whole navigation root (see
+ * lib/target-scope.js resolveTargetWriteScope). This function is the backstop
+ * that keeps secrets unwritable inside that wider surface.
+ *
+ * Two write-only denials layered on top of the read policy:
+ *  - The ENTIRE LOG_DIR tree (~/.claude/cc-viewer/**): the read policy only
+ *    blocks specific data files in it, but a write/delete could rmdir the whole
+ *    dir (wiping the preferences + scheduled-task store), so writes deny the
+ *    whole subtree.
+ *  - The config-backup root is already denied for reads (2b) and stays denied.
+ */
+export function isWriteAllowed(absPath) {
+  if (typeof absPath !== 'string' || !absPath) return { ok: false, reason: 'invalid' };
+  if (absPath.indexOf('\x00') !== -1) return { ok: false, reason: 'null-byte' };
+
+  // Existing file: realpath it and run the shared verdict directly.
+  // New file: realpath the nearest existing parent, then re-evaluate the
+  // candidate (parentReal + basename) so symlink/denylist checks apply to the
+  // resolved location, not the spelled path.
+  let real;
+  let existed = true;
+  try { real = realpathSync(absPath); } catch { existed = false; }
+  if (!existed) {
+    // Dangling-symlink guard: realpath failed but the leaf may still be a symlink
+    // whose target is missing/outside the allowlist. writeFileSync would FOLLOW it
+    // and create/overwrite the link's target outside the navigation root — a
+    // containment bypass. lstat does not follow the link, so an isSymbolicLink()
+    // hit here refuses the write. Do NOT remove (TOCTOU-class escape).
+    try { if (lstatSync(absPath).isSymbolicLink()) return { ok: false, reason: 'symlink' }; } catch { /* truly absent leaf */ }
+    let cursor = resolve(absPath, '..');
+    const descent = [basename(absPath)];
+    let parentReal = null;
+    for (let depth = 0; depth < 32; depth++) {
+      try { parentReal = realpathSync(cursor); break; } catch {
+        const parent = resolve(cursor, '..');
+        if (parent === cursor) break;
+        descent.unshift(basename(cursor));
+        cursor = parent;
+      }
+    }
+    if (parentReal === null) return { ok: false, reason: 'realpath-failed' };
+    // Every ancestor on the way down must be inside the allowlist / not denied;
+    // evaluate the nearest existing ancestor, then rebuild the candidate.
+    const ancestorVerdict = evaluateResolvedPath(parentReal);
+    if (!ancestorVerdict.ok) return ancestorVerdict;
+    real = join(parentReal, ...descent);
+  }
+
+  const verdict = evaluateResolvedPath(real);
+  if (!verdict.ok) return verdict;
+
+  // Write-only: deny the whole LOG_DIR subtree (read policy only blocks named
+  // data files in it). Matches both the raw and realpath'd spellings, both the
+  // prefix (children) AND the directory itself (bare), so a delete/rename cannot
+  // rmdir the whole task/preferences store.
+  const sens = _logDirSensitiveFiles();
+  const realNorm = norm(real);
+  if (realNorm.startsWith(sens.root) || realNorm.startsWith(sens.rootReal)
+    || realNorm === sens.rootBare || realNorm === sens.rootRealBare) {
+    return { ok: false, reason: 'sensitive-ccv-data' };
+  }
+
+  // Write-only: deny a sensitive-PREFIX directory itself (~/.ssh, ~/.aws, …), not
+  // just its contents. The read policy only matches children (startsWith withSep),
+  // so renaming the directory to a benign name would expose the whole prefix's
+  // contents. Renaming/deleting the dir root is refused here. (Only meaningful
+  // outside the project root, matching the prefix rule's own scope.)
+  const projectRoot = getProjectRoot();
+  if (!isInsideRoot(real, projectRoot)) {
+    for (const prefix of SENSITIVE_PATH_PREFIXES) {
+      if (realNorm === norm(prefix)) return { ok: false, reason: 'sensitive-prefix' };
+    }
+  }
+
+  return { ok: true, real };
+}
+
 /**
  * 给 endpoint 用的 reason → HTTP status code 映射。
  * - 路径不存在/realpath 失败 → 404(更友好,不暴露"路径合法但不存在")

package/server/lib/os-open.js

@@ -0,0 +1,66 @@
+// Shared OS-integration helpers (open in file manager / terminal) used by both
+// the project-scoped routes (files-fs.js) and the target-mode write routes
+// (target-files-fs.js). Centralizing the platform branches keeps the two call
+// surfaces from drifting apart (a Windows quoting or Linux terminal-fallback fix
+// must apply to both). Pure argv spawning — no shell — so no metachar injection.
+//
+// L1 (lib): must NOT import from routes/ (verify:boundaries).
+import { execFile, spawn } from 'node:child_process';
+import { dirname } from 'node:path';
+import { reportSwallowed } from './error-report.js';
+
+// Reveal a file (select it) or open a directory in the OS file manager.
+// - macOS: `open -R <path>` selects files AND opens directories in place.
+// - Windows: `explorer /select,"<path>"` (verbatim args; a dir path opens it).
+// - Linux: no select concept — open the path itself when it is a directory,
+//   otherwise its parent. (xdg-open on a FILE would launch the default app, so
+//   callers pass `isDir` to pick the directory to show.)
+export function revealInOs(fullPath, { isDir = false } = {}) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    execFile('open', ['-R', fullPath], () => {});
+  } else if (plat === 'win32') {
+    // windowsVerbatimArguments: Node would otherwise re-quote the spaced path into
+    // a form explorer cannot parse. No cmd.exe is involved, so no metachar risk;
+    // Windows filenames cannot contain `"`.
+    const child = spawn('explorer.exe', [`/select,"${fullPath}"`], { windowsVerbatimArguments: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.reveal', err); });
+  } else {
+    execFile('xdg-open', [isDir ? fullPath : dirname(fullPath)], () => {});
+  }
+}
+
+// Open an OS terminal with cwd = dir. Linux probes common emulators with piped
+// stdio so the next candidate is tried after ENOENT, falling back to xdg-open.
+export function openTerminalAt(dir) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    const child = spawn('open', ['-a', 'Terminal', dir], { stdio: 'ignore', detached: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'Terminal.app' }); });
+    child.unref();
+  } else if (plat === 'win32') {
+    const child = spawn('cmd.exe', ['/c', 'start', 'cmd.exe'], { cwd: dir, stdio: 'ignore', detached: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'cmd.exe' }); });
+    child.unref();
+  } else {
+    const terminals = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
+    const tryTerminal = (index) => {
+      if (index >= terminals.length) {
+        const child = spawn('xdg-open', [dir], { stdio: 'ignore', detached: true });
+        child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'xdg-open' }); });
+        child.unref();
+        return;
+      }
+      const term = terminals[index];
+      let child;
+      try {
+        if (term === 'gnome-terminal') child = spawn(term, ['--working-directory=' + dir], { stdio: 'pipe' });
+        else if (term === 'konsole') child = spawn(term, ['--workdir', dir], { stdio: 'pipe' });
+        else child = spawn(term, [], { cwd: dir, stdio: 'pipe' });
+      } catch { tryTerminal(index + 1); return; }
+      child.once('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: term }); tryTerminal(index + 1); });
+      child.once('spawn', () => { for (const s of [child.stdin, child.stdout, child.stderr]) s?.destroy(); child.unref(); });
+    };
+    tryTerminal(0);
+  }
+}

package/server/lib/target-scope.js

@@ -0,0 +1,174 @@
+// Shared resolution of a "target" (CLAUDE.md / skill folder) into the
+// navigation root the file browser walks, plus the path validation both the
+// read route (/api/target-files in routes/files-content.js) and the write
+// routes (/api/target-* in routes/target-files-fs.js) rely on.
+//
+// These helpers were moved verbatim out of routes/files-content.js so the new
+// target write routes resolve the EXACT same root as the read route — never
+// trust a client-supplied absolute root, always re-derive it from the target
+// identity (kind + id, or source + targetPath) via resolveTargetRoot.
+//
+// Layering: this is L1 (lib). It must NOT import from routes/ — routes import
+// lib, never the reverse (enforced by pnpm run verify:boundaries).
+import { realpathSync, statSync } from 'node:fs';
+import { basename, dirname, join, relative, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { isReadAllowed, reasonToStatus } from './file-access-policy.js';
+import { listSkills } from './skills-api.js';
+import { discoverClaudeMdCandidates } from './claude-md-discovery.js';
+import { getClaudeConfigDir } from '../../findcc.js';
+
+export function targetError(status, message) {
+  return Object.assign(new Error(message), { status });
+}
+
+// Map fs errno to a sensible HTTP status: missing → 404, permission → 403,
+// symlink loop → 400 (treat as malformed), anything else → 404 (don't leak).
+export function errnoToStatus(err) {
+  const code = err?.code;
+  if (code === 'EACCES' || code === 'EPERM') return 403;
+  if (code === 'ELOOP') return 400;
+  return 404;
+}
+
+export function realDirectory(path, label) {
+  let real;
+  try { real = realpathSync(path); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  let st;
+  try { st = statSync(real); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
+  if (!st.isDirectory()) throw targetError(400, `${label} is not a directory`);
+  return real;
+}
+
+export function checkedDirectory(path, label) {
+  const real = realDirectory(path, label);
+  const policy = isReadAllowed(real);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), `${label} not readable`);
+  return policy.real;
+}
+
+export function insidePath(path, root) {
+  return path === root || path.startsWith(root + sep);
+}
+
+export function targetNavigation(targetReal, cwd) {
+  const projectReal = realDirectory(cwd, 'Project');
+  if (insidePath(targetReal, projectReal)) return { rootReal: projectReal, rootKind: 'project' };
+  // $HOME becomes the navigation root for home-resident targets (user skills,
+  // plugins, the global CLAUDE.md). Entries outside the allowlist (e.g. ~/.ssh,
+  // ~/.aws) are filtered per-entry by isReadAllowed, and sensitive paths inside
+  // ~/.claude are covered by file-access-policy's denylist. The /api/target-files
+  // handler additionally gates this endpoint behind isAdminReq + same-origin so
+  // a cross-site page cannot enumerate the user's home tree.
+  const homeReal = realDirectory(homedir(), 'Home');
+  if (insidePath(targetReal, homeReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: homeReal, rootKind: 'home' };
+  }
+  const configReal = realDirectory(getClaudeConfigDir(), 'Claude config');
+  if (insidePath(targetReal, configReal)) {
+    checkedDirectory(targetReal, 'Directory');
+    return { rootReal: realDirectory(dirname(configReal), 'Config root'), rootKind: 'config' };
+  }
+  // Allowlist fallback: targets that live inside another allowlisted root
+  // (registered workspaces, /tmp/cc-viewer-uploads, etc.) are reachable via
+  // /api/claude-md's discovery (which uses isReadAllowed), so we must not
+  // 403 them here. Use the target's own directory as the navigation root —
+  // no parent browsing, but at least the entry the user clicked actually opens.
+  const policy = isReadAllowed(targetReal);
+  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), 'Target not readable');
+  return { rootReal: realDirectory(targetReal, 'Target'), rootKind: 'target' };
+}
+
+export function targetScope(targetReal, cwd) {
+  const navigation = targetNavigation(targetReal, cwd);
+  return { ...navigation, targetPath: relative(navigation.rootReal, targetReal).split(sep).join('/') };
+}
+
+export function targetRelPath(raw) {
+  if (raw == null) return null;
+  if (raw === '') return [];
+  if (typeof raw !== 'string' || raw.length > 2048 || raw.includes('\0') || raw.includes('\\')
+    || raw.startsWith('/') || /^[a-zA-Z]:/.test(raw)) {
+    throw targetError(400, 'Invalid path');
+  }
+  const segments = raw.split('/');
+  if (segments.some(segment => !segment || segment === '.' || segment === '..')) {
+    throw targetError(400, 'Invalid path');
+  }
+  // Hard cap on navigation depth: each segment triggers at least one
+  // synchronous readdir + per-entry realpath/stat in `ancestors`, and a 2KB
+  // free-form path could otherwise fan out into hundreds of syscalls per
+  // request. 32 is far deeper than any realistic skill / CLAUDE.md location.
+  if (segments.length > 32) throw targetError(400, 'Path too deep');
+  return segments;
+}
+
+export function resolveTargetRoot(parsedUrl, cwd) {
+  const kind = parsedUrl.searchParams.get('kind');
+  if (kind === 'claude-md') {
+    const id = parsedUrl.searchParams.get('id') || '';
+    if (!/^[0-9a-f]{12}$/i.test(id)) throw targetError(400, 'Invalid id');
+    const candidate = discoverClaudeMdCandidates({
+      cwd,
+      claudeConfigDir: getClaudeConfigDir(),
+      isReadAllowedFn: isReadAllowed,
+    }).find(entry => entry.id === id);
+    if (!candidate || basename(candidate.realPath) !== 'CLAUDE.md') throw targetError(404, 'Target not found');
+    return { ...targetScope(realDirectory(dirname(candidate.realPath), 'Directory'), cwd), targetKind: 'claude-md' };
+  }
+  if (kind !== 'skill') throw targetError(400, 'Invalid target kind');
+  const source = parsedUrl.searchParams.get('source');
+  const targetPath = parsedUrl.searchParams.get('targetPath');
+  if (!['user', 'project', 'plugin'].includes(source)) throw targetError(400, 'Invalid skill source');
+  if (typeof targetPath !== 'string' || !targetPath || targetPath.length > 4096 || targetPath.includes('\0')) {
+    throw targetError(400, 'Invalid skill path');
+  }
+  const skill = listSkills({ projectDir: cwd })
+    .find(entry => entry.source === source && entry.path === targetPath);
+  if (!skill) throw targetError(404, 'Target not found');
+  const rootReal = realDirectory(skill.path, 'Directory');
+  const scope = targetScope(rootReal, cwd);
+  const anchor = source === 'project'
+    ? scope.rootReal
+    : dirname(dirname(skill.path));
+  const anchorReal = realDirectory(anchor, 'Skill root');
+  if (!insidePath(rootReal, anchorReal)) throw targetError(403, 'Target outside skill root');
+  // Plugin root must follow the configured Claude config dir, not the default
+  // homedir()/.claude — otherwise plugin skills break under CLAUDE_CONFIG_DIR.
+  if (source === 'plugin' && !insidePath(rootReal, realDirectory(join(getClaudeConfigDir(), 'plugins'), 'Plugin root'))) {
+    throw targetError(403, 'Target outside plugin root');
+  }
+  return { ...scope, targetKind: 'skill' };
+}
+
+// ===========================================================================
+// Write-side scope resolution (used only by the /api/target-* write routes).
+// ===========================================================================
+
+// SECURITY / INTENTIONAL DESIGN (do NOT tighten in review without product sign-off):
+// the writable area for a target browser is the WHOLE navigation root returned by
+// targetNavigation (project / home / config / target), NOT just the target's own
+// subtree. This is a deliberate product decision — the user navigates the browser
+// up to ancestors (e.g. from a skill folder to ~ or ~/.claude) and expects the
+// context menu to keep working there. The sensitive-file / sensitive-directory
+// backstop for that wider surface is isWriteAllowed (lib/file-access-policy.js),
+// which every mutation runs through; containment in the navigation root plus
+// isWriteAllowed is the boundary, not the target subtree.
+export function resolveTargetWriteScope(parsedUrl, cwd) {
+  // Re-derive the target identity server-side (never trust a client-sent root).
+  // The writable surface is the WHOLE navigation root (scope.rootReal) — the
+  // target's own directory is NOT separately resolved here because the product
+  // decision is to allow writes anywhere in the navigation root, with the
+  // sensitive-file backstop living in isWriteAllowed (see file-access-policy.js).
+  return resolveTargetRoot(parsedUrl, cwd);
+}
+
+// targetRelPath treats null as "caller omitted path" (the read route uses that
+// to default to the target's own directory). The write routes always need an
+// explicit path, so this is the required variant: omitted → 400.
+export function requiredTargetRelPath(raw) {
+  const segs = targetRelPath(raw);
+  if (segs === null) throw targetError(400, 'Missing path');
+  return segs;
+}

package/server/routes/files-content.js

@@ -1,10 +1,8 @@
 // Read-oriented file-access routes (moved verbatim from server.js handleRequest).
 import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync, createReadStream, readdirSync } from 'node:fs';
-import { join, basename, dirname, resolve, relative, sep } from 'node:path';
-import { homedir } from 'node:os';
-import { isReadAllowed, reasonToStatus } from '../lib/file-access-policy.js';
+import { join, basename, dirname, resolve, sep } from 'node:path';
+import { isReadAllowed, isWriteAllowed, reasonToStatus } from '../lib/file-access-policy.js';
 import { ERROR_STATUS_MAP, isPathContained } from '../lib/file-api.js';
-import { listSkills } from '../lib/skills-api.js';
 import { viewRootOrReply, resolveViewRoot } from '../lib/view-root.js';
 import { findSdkSessionByInstance } from '../lib/sdk-session-index.js';
 import { projectKeyForCwd } from '../lib/system-prompt-snapshots.js';
@@ -16,6 +14,10 @@ import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';
 import { isAdminReq } from '../lib/is-admin.js';
 import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+import {
+  targetError, errnoToStatus, realDirectory, checkedDirectory, insidePath,
+  targetRelPath, resolveTargetRoot,
+} from '../lib/target-scope.js';
 
 // Multi-project file operations use the same viewed root for reads and writes.
 // Every file-browser mutation enforces realpath containment in that root;
@@ -563,7 +565,36 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
       const { path: reqPath, content, editorSession } = JSON.parse(body);
       const cwd = _viewRootOrReply(req, res, parsedUrl);
       if (!cwd) return;
-      try { writeRoot = realpathSync(cwd); } catch { writeRoot = cwd; }
+      // Target mode (the CLAUDE.md / skill browser modal) edits files that live in
+      // the target's NAVIGATION ROOT, which is frequently OUTSIDE the viewed project
+      // (~/.claude, $HOME). When the request carries a target identity
+      // (kind + id / source + targetPath, same as /api/target-files), resolve the
+      // write root to that navigation root instead of the project view root, so
+      // isInsideWriteRoot no longer 403s the file the user is explicitly editing.
+      // The target root is re-derived server-side (never trusted from the client),
+      // and the isWriteAllowed policy below still runs unchanged.
+      // SECURITY / INTENTIONAL DESIGN (do NOT tighten in review without product
+      // sign-off): in target mode the write policy is the WHOLE navigation root,
+      // and writes go through isWriteAllowed (NOT isReadAllowed) — so the LOG_DIR
+      // tree, ~/.claude credentials/settings, ~/.ssh, and the config-backup tree
+      // stay unwritable even though the wider surface is editable. This path is
+      // gated to admin + same-origin browser requests, the same bar as
+      // /api/target-files, because it can reach the user's home tree. A relative
+      // path in target mode is anchored at the navigation root, not the project.
+      const targetKind = parsedUrl.searchParams.get('kind');
+      let targetNavRoot = null;
+      if (targetKind) {
+        if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'forbidden' }));
+          return;
+        }
+        const scope = resolveTargetRoot(parsedUrl, cwd);
+        writeRoot = scope.rootReal;
+        targetNavRoot = scope.rootReal;
+      } else {
+        try { writeRoot = realpathSync(cwd); } catch { writeRoot = cwd; }
+      }
       if (!reqPath) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Invalid path' }));
@@ -575,12 +606,18 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
         return;
       }
       const isAbs = /^([a-zA-Z]:[\\/]|[\\/])/.test(reqPath);
-      const absPath = isAbs ? reqPath : resolve(cwd, reqPath);
+      // In target mode a relative path is anchored at the navigation root; in
+      // project mode at the project view root (unchanged legacy behavior).
+      const absPath = isAbs ? reqPath : resolve(targetNavRoot || cwd, reqPath);
       // 写路径同样走 policy(收敛 editorSession 后门):允许覆盖现有文件;
       // 新文件场景递归向上找最近存在的祖先目录,只要它在 allowlist 内即放行。
       // (旧实现只查 immediate parent,父目录也不存在时误拒嵌套新建。)
+      // Target mode uses the WRITE policy (isWriteAllowed) so the LOG_DIR tree,
+      // ~/.claude credentials and other sensitive targets stay unwritable even
+      // though the navigation root is editable; project mode keeps isReadAllowed.
+      const policyFn = targetNavRoot ? isWriteAllowed : isReadAllowed;
       let targetReal;
-      const policy = isReadAllowed(absPath);
+      const policy = policyFn(absPath);
       if (policy.ok) {
         targetReal = policy.real;
       } else if (policy.reason === 'realpath-failed') {
@@ -644,7 +681,16 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
         res.end(JSON.stringify({ error: 'Forbidden', reason: 'editor-session-requires-admin' }));
         return;
       }
-      if (!editorSession && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
+      // Target mode: containment in the navigation root must hold whether the file
+      // exists OR is being created — otherwise a crafted relative path could write
+      // outside the navigation root (isWriteAllowed only bounds by the allowlist).
+      // Project mode keeps the legacy existing-file-only check.
+      if (!editorSession && targetNavRoot && !isInsideWriteRoot(targetReal)) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
+        return;
+      }
+      if (!editorSession && !targetNavRoot && existsSync(targetReal) && !isInsideWriteRoot(targetReal)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
         return;
@@ -654,7 +700,9 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ ok: true, size: stat.size }));
     } catch (err) {
-      const status = ERROR_STATUS_MAP[err.code] || 500;
+      // targetError carries `.status` (400/403/404); fs errnos carry `.code`.
+      // Honor both so an invalid/stale target identity is not reported as 500.
+      const status = err.status || ERROR_STATUS_MAP[err.code] || 500;
       const message = status === 500 ? `Cannot save file: ${err.message}` : err.message;
       res.writeHead(status, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: message }));
@@ -662,130 +710,6 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
   });
 }
 
-function targetError(status, message) {
-  return Object.assign(new Error(message), { status });
-}
-
-// Map fs errno to a sensible HTTP status: missing → 404, permission → 403,
-// symlink loop → 400 (treat as malformed), anything else → 404 (don't leak).
-function errnoToStatus(err) {
-  const code = err?.code;
-  if (code === 'EACCES' || code === 'EPERM') return 403;
-  if (code === 'ELOOP') return 400;
-  return 404;
-}
-
-function realDirectory(path, label) {
-  let real;
-  try { real = realpathSync(path); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
-  let st;
-  try { st = statSync(real); } catch (err) { throw targetError(errnoToStatus(err), `${label} not found`); }
-  if (!st.isDirectory()) throw targetError(400, `${label} is not a directory`);
-  return real;
-}
-
-function checkedDirectory(path, label) {
-  const real = realDirectory(path, label);
-  const policy = isReadAllowed(real);
-  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), `${label} not readable`);
-  return policy.real;
-}
-
-function insidePath(path, root) {
-  return path === root || path.startsWith(root + sep);
-}
-
-function targetNavigation(targetReal, cwd) {
-  const projectReal = realDirectory(cwd, 'Project');
-  if (insidePath(targetReal, projectReal)) return { rootReal: projectReal, rootKind: 'project' };
-  // $HOME becomes the navigation root for home-resident targets (user skills,
-  // plugins, the global CLAUDE.md). Entries outside the allowlist (e.g. ~/.ssh,
-  // ~/.aws) are filtered per-entry by isReadAllowed, and sensitive paths inside
-  // ~/.claude are covered by file-access-policy's denylist. The /api/target-files
-  // handler additionally gates this endpoint behind isAdminReq + same-origin so
-  // a cross-site page cannot enumerate the user's home tree.
-  const homeReal = realDirectory(homedir(), 'Home');
-  if (insidePath(targetReal, homeReal)) {
-    checkedDirectory(targetReal, 'Directory');
-    return { rootReal: homeReal, rootKind: 'home' };
-  }
-  const configReal = realDirectory(getClaudeConfigDir(), 'Claude config');
-  if (insidePath(targetReal, configReal)) {
-    checkedDirectory(targetReal, 'Directory');
-    return { rootReal: realDirectory(dirname(configReal), 'Config root'), rootKind: 'config' };
-  }
-  // Allowlist fallback: targets that live inside another allowlisted root
-  // (registered workspaces, /tmp/cc-viewer-uploads, etc.) are reachable via
-  // /api/claude-md's discovery (which uses isReadAllowed), so we must not
-  // 403 them here. Use the target's own directory as the navigation root —
-  // no parent browsing, but at least the entry the user clicked actually opens.
-  const policy = isReadAllowed(targetReal);
-  if (!policy.ok) throw targetError(reasonToStatus(policy.reason), 'Target not readable');
-  return { rootReal: realDirectory(targetReal, 'Target'), rootKind: 'target' };
-}
-
-function targetScope(targetReal, cwd) {
-  const navigation = targetNavigation(targetReal, cwd);
-  return { ...navigation, targetPath: relative(navigation.rootReal, targetReal).split(sep).join('/') };
-}
-
-function targetRelPath(raw) {
-  if (raw == null) return null;
-  if (raw === '') return [];
-  if (typeof raw !== 'string' || raw.length > 2048 || raw.includes('\0') || raw.includes('\\')
-    || raw.startsWith('/') || /^[a-zA-Z]:/.test(raw)) {
-    throw targetError(400, 'Invalid path');
-  }
-  const segments = raw.split('/');
-  if (segments.some(segment => !segment || segment === '.' || segment === '..')) {
-    throw targetError(400, 'Invalid path');
-  }
-  // Hard cap on navigation depth: each segment triggers at least one
-  // synchronous readdir + per-entry realpath/stat in `ancestors`, and a 2KB
-  // free-form path could otherwise fan out into hundreds of syscalls per
-  // request. 32 is far deeper than any realistic skill / CLAUDE.md location.
-  if (segments.length > 32) throw targetError(400, 'Path too deep');
-  return segments;
-}
-
-function resolveTargetRoot(parsedUrl, cwd) {
-  const kind = parsedUrl.searchParams.get('kind');
-  if (kind === 'claude-md') {
-    const id = parsedUrl.searchParams.get('id') || '';
-    if (!/^[0-9a-f]{12}$/i.test(id)) throw targetError(400, 'Invalid id');
-    const candidate = discoverClaudeMdCandidates({
-      cwd,
-      claudeConfigDir: getClaudeConfigDir(),
-      isReadAllowedFn: isReadAllowed,
-    }).find(entry => entry.id === id);
-    if (!candidate || basename(candidate.realPath) !== 'CLAUDE.md') throw targetError(404, 'Target not found');
-    return { ...targetScope(realDirectory(dirname(candidate.realPath), 'Directory'), cwd), targetKind: 'claude-md' };
-  }
-  if (kind !== 'skill') throw targetError(400, 'Invalid target kind');
-  const source = parsedUrl.searchParams.get('source');
-  const targetPath = parsedUrl.searchParams.get('targetPath');
-  if (!['user', 'project', 'plugin'].includes(source)) throw targetError(400, 'Invalid skill source');
-  if (typeof targetPath !== 'string' || !targetPath || targetPath.length > 4096 || targetPath.includes('\0')) {
-    throw targetError(400, 'Invalid skill path');
-  }
-  const skill = listSkills({ projectDir: cwd })
-    .find(entry => entry.source === source && entry.path === targetPath);
-  if (!skill) throw targetError(404, 'Target not found');
-  const rootReal = realDirectory(skill.path, 'Directory');
-  const scope = targetScope(rootReal, cwd);
-  const anchor = source === 'project'
-    ? scope.rootReal
-    : dirname(dirname(skill.path));
-  const anchorReal = realDirectory(anchor, 'Skill root');
-  if (!insidePath(rootReal, anchorReal)) throw targetError(403, 'Target outside skill root');
-  // Plugin root must follow the configured Claude config dir, not the default
-  // homedir()/.claude — otherwise plugin skills break under CLAUDE_CONFIG_DIR.
-  if (source === 'plugin' && !insidePath(rootReal, realDirectory(join(getClaudeConfigDir(), 'plugins'), 'Plugin root'))) {
-    throw targetError(403, 'Target outside plugin root');
-  }
-  return { ...scope, targetKind: 'skill' };
-}
-
 function listTargetDirectory(rootReal, segments, deps, requireReadable = true) {
   const dirReal = requireReadable
     ? checkedDirectory(segments.length ? join(rootReal, ...segments) : rootReal, 'Directory')