cc-viewer 1.9.16 → 1.9.18

package/server/lib/os-open.js

@@ -0,0 +1,66 @@
+// Shared OS-integration helpers (open in file manager / terminal) used by both
+// the project-scoped routes (files-fs.js) and the target-mode write routes
+// (target-files-fs.js). Centralizing the platform branches keeps the two call
+// surfaces from drifting apart (a Windows quoting or Linux terminal-fallback fix
+// must apply to both). Pure argv spawning — no shell — so no metachar injection.
+//
+// L1 (lib): must NOT import from routes/ (verify:boundaries).
+import { execFile, spawn } from 'node:child_process';
+import { dirname } from 'node:path';
+import { reportSwallowed } from './error-report.js';
+
+// Reveal a file (select it) or open a directory in the OS file manager.
+// - macOS: `open -R <path>` selects files AND opens directories in place.
+// - Windows: `explorer /select,"<path>"` (verbatim args; a dir path opens it).
+// - Linux: no select concept — open the path itself when it is a directory,
+//   otherwise its parent. (xdg-open on a FILE would launch the default app, so
+//   callers pass `isDir` to pick the directory to show.)
+export function revealInOs(fullPath, { isDir = false } = {}) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    execFile('open', ['-R', fullPath], () => {});
+  } else if (plat === 'win32') {
+    // windowsVerbatimArguments: Node would otherwise re-quote the spaced path into
+    // a form explorer cannot parse. No cmd.exe is involved, so no metachar risk;
+    // Windows filenames cannot contain `"`.
+    const child = spawn('explorer.exe', [`/select,"${fullPath}"`], { windowsVerbatimArguments: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.reveal', err); });
+  } else {
+    execFile('xdg-open', [isDir ? fullPath : dirname(fullPath)], () => {});
+  }
+}
+
+// Open an OS terminal with cwd = dir. Linux probes common emulators with piped
+// stdio so the next candidate is tried after ENOENT, falling back to xdg-open.
+export function openTerminalAt(dir) {
+  const plat = process.platform;
+  if (plat === 'darwin') {
+    const child = spawn('open', ['-a', 'Terminal', dir], { stdio: 'ignore', detached: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'Terminal.app' }); });
+    child.unref();
+  } else if (plat === 'win32') {
+    const child = spawn('cmd.exe', ['/c', 'start', 'cmd.exe'], { cwd: dir, stdio: 'ignore', detached: true, windowsHide: true });
+    child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'cmd.exe' }); });
+    child.unref();
+  } else {
+    const terminals = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
+    const tryTerminal = (index) => {
+      if (index >= terminals.length) {
+        const child = spawn('xdg-open', [dir], { stdio: 'ignore', detached: true });
+        child.on('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: 'xdg-open' }); });
+        child.unref();
+        return;
+      }
+      const term = terminals[index];
+      let child;
+      try {
+        if (term === 'gnome-terminal') child = spawn(term, ['--working-directory=' + dir], { stdio: 'pipe' });
+        else if (term === 'konsole') child = spawn(term, ['--workdir', dir], { stdio: 'pipe' });
+        else child = spawn(term, [], { cwd: dir, stdio: 'pipe' });
+      } catch { tryTerminal(index + 1); return; }
+      child.once('error', (err) => { reportSwallowed('osOpen.terminal', err, { terminal: term }); tryTerminal(index + 1); });
+      child.once('spawn', () => { for (const s of [child.stdin, child.stdout, child.stderr]) s?.destroy(); child.unref(); });
+    };
+    tryTerminal(0);
+  }
+}

package/server/lib/plugin-loader.js

@@ -33,6 +33,13 @@ const HOOK_TYPES = {
   onStreamChunk: 'parallel',
 };
 
+// Approval hooks gate an interactive UI modal, so a hung plugin must not park the approval
+// forever: each invocation times out and falls back to the normal approval modal.
+// Non-approval waterfall hooks (beforeRequest/httpsOptions/localUrl) are startup/auth-critical
+// and stay UNTIMED.
+const APPROVAL_HOOK_TIMEOUT_MS = 15 * 1000;
+const APPROVAL_HOOKS = new Set(['onPlanRequest', 'onAskRequest', 'onPermRequest']);
+
 let _plugins = [];
 // Full result of the last loadPlugins (directory service/panel plugins and failures included)
 let _entries = [];
@@ -312,14 +319,39 @@ export async function loadPlugins(opts = {}) {
 
 /**
  * waterfall hook：串行管道执行，前一个的返回值传给下一个
+ * `timeoutMsOverride` is test-only; approval hooks default to APPROVAL_HOOK_TIMEOUT_MS.
  */
-export async function runWaterfallHook(name, initialValue) {
+export async function runWaterfallHook(name, initialValue, timeoutMsOverride) {
   let value = initialValue;
+  // Only approval hooks are timed out; the override is ignored for the other hooks.
+  const timeoutMs = APPROVAL_HOOKS.has(name)
+    ? (timeoutMsOverride ?? APPROVAL_HOOK_TIMEOUT_MS)
+    : undefined;
   for (const plugin of _plugins) {
     const hookFn = plugin.hooks[name];
     if (typeof hookFn !== 'function') continue;
     try {
-      const result = await hookFn(value);
+      let result;
+      if (timeoutMs !== undefined) {
+        // A timed-out hook promise itself is not cancellable (bounded leak: it may keep
+        // running in the background); the timer is cleared as soon as the hook settles.
+        let timer;
+        try {
+          result = await Promise.race([
+            Promise.resolve().then(() => hookFn(value)),
+            new Promise((_, reject) => {
+              timer = setTimeout(
+                () => reject(new Error(`hook timed out after ${timeoutMs} ms`)),
+                timeoutMs
+              );
+            }),
+          ]);
+        } finally {
+          clearTimeout(timer);
+        }
+      } else {
+        result = await hookFn(value);
+      }
       if (result != null && typeof result === 'object') {
         value = { ...value, ...result };
       }