cc-viewer 1.9.17 → 1.9.18

package/server/proxy.js

@@ -1,5 +1,6 @@
 
 import { createServer } from 'node:http';
+import { Readable, Transform, pipeline } from 'node:stream';
 import { readFileSync, existsSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
@@ -11,7 +12,7 @@ import { getClaudeConfigDir } from '../findcc.js';
 import { isAnthropicApiPath, classifyProxyRole } from './lib/interceptor-core.js';
 import { parseAgentId, findHeader } from './lib/v2/agent-id.js';
 import { liveSystemPromptEnabled } from './lib/system-prompt-live.js';
-import { executeRequest, extractModel } from './lib/proxy/proxy-retry.js';
+import { executeRequest, extractModel, isStreamResponse } from './lib/proxy/proxy-retry.js';
 import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy/proxy-stats.js';
 import { reportSwallowed } from './lib/error-report.js';
 import { LOG_DIR } from '../findcc.js';
@@ -231,7 +232,6 @@ export function startProxy() {
         res.writeHead(response.status, responseHeaders);
 
         if (response.body) {
-          const { Readable, pipeline } = await import('node:stream');
           // @ts-ignore
           const nodeStream = Readable.fromWeb(response.body);
           // 持久 error handler 兜底：防止 pipeline 清理后延迟到达的 error 事件导致进程崩溃
@@ -388,15 +388,59 @@ async function handleLlmApiRequest(req, res, fullUrl, fetchOptions, body, proxyD
   res.writeHead(finalStatus, responseHeaders);
 
   if (response.body) {
-    const { Readable, pipeline } = await import('node:stream');
     // @ts-ignore
     const nodeStream = Readable.fromWeb(response.body);
     nodeStream.on('error', () => {});
-    pipeline(nodeStream, res, (err) => {
-      if (err && process.env.CCV_DEBUG) {
-        console.error('[CC-Viewer Proxy] Stream pipeline error:', err.message);
-      }
-    });
+    const streamIdleMs = retryConfig && retryConfig.mode === 'off'
+      ? (retryConfig.streamIdleTimeoutMs ?? 0)
+      : 0;
+    // Only gate SSE (streaming) responses: a non-stream body legitimately arrives as one
+    // whole payload after a long upstream think, and must not be truncated mid-wait.
+    if (streamIdleMs > 0 && isStreamResponse(response)) {
+      // Off-mode-only idle watchdog: retry modes already attach the equivalent
+      // guard on the Web-stream side upstream (applyStreamIdleWatchdog). That
+      // variant cannot run for off mode — its pipeThrough races the
+      // interceptor's getReader() body reconstruction (spurious `fetch failed`).
+      // This Node-side Transform sits after Readable.fromWeb, so it is immune
+      // to that race. The timer arms at construction, BEFORE the first chunk,
+      // so a stream that never sends its first byte is still bounded.
+      let watchdog = null;
+      let idleTimer = null;
+      const disarmIdle = () => {
+        if (idleTimer) {
+          clearTimeout(idleTimer);
+          idleTimer = null;
+        }
+      };
+      const armIdle = () => {
+        disarmIdle();
+        idleTimer = setTimeout(() => {
+          idleTimer = null;
+          // Log unconditionally: a destroyed stream surfaces downstream as an unexplained
+          // `fetch failed`; without this line there is no way to attribute it.
+          console.warn(`[CC-Viewer Proxy] off-mode stream idle timeout (${streamIdleMs}ms) — destroying upstream stream`);
+          watchdog.destroy(new Error(`proxy stream idle timeout (${streamIdleMs}ms)`));
+        }, streamIdleMs);
+        if (typeof idleTimer.unref === 'function') idleTimer.unref();
+      };
+      watchdog = new Transform({
+        transform(chunk, _enc, cb) { armIdle(); cb(null, chunk); },
+        flush(cb) { disarmIdle(); cb(); },
+        destroy(err, cb) { disarmIdle(); cb(err); },
+      });
+      armIdle();
+      pipeline(nodeStream, watchdog, res, (err) => {
+        if (err && process.env.CCV_DEBUG) {
+          console.error('[CC-Viewer Proxy] Stream pipeline error:', err.message);
+        }
+      });
+    } else {
+      pipeline(nodeStream, res, (err) => {
+        if (err && process.env.CCV_DEBUG) {
+          console.error('[CC-Viewer Proxy] Stream pipeline error:', err.message);
+        }
+      });
+    }
   } else if (response.text) {
     // 竞速失败兜底 response：用 text() 取 body
     const text = await response.text();

package/server/routes/files-content.js

@@ -548,6 +548,29 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
   // encoding. Normalize only this mutation's containment comparisons.
   let writeRoot;
   const isInsideWriteRoot = (path) => isPathContained(path, writeRoot);
+  // isPathContained realpaths its target, so it returns false for a not-yet-existing
+  // file — which wrongly 403s every new-file save in target mode. For a missing leaf,
+  // realpath the nearest existing ancestor, re-append the descent, then prefix-compare
+  // against the (already-real) write root; an existing path keeps the strict realpath.
+  const isInsideWriteRootAllowNew = (path) => {
+    if (isInsideWriteRoot(path)) return true;
+    if (existsSync(path)) return false; // exists but resolves outside → strict deny
+    const root = writeRoot.endsWith(sep) ? writeRoot : writeRoot + sep;
+    let cursor = resolve(path, '..');
+    const descent = [basename(path)];
+    for (let depth = 0; depth < 32; depth++) {
+      if (existsSync(cursor)) {
+        let rebuilt;
+        try { rebuilt = join(realpathSync(cursor), ...descent); } catch { return false; }
+        return rebuilt === writeRoot || rebuilt.startsWith(root);
+      }
+      const parent = resolve(cursor, '..');
+      if (parent === cursor) return false;
+      descent.unshift(basename(cursor));
+      cursor = parent;
+    }
+    return false;
+  };
   const MAX_BODY = 5 * 1024 * 1024; // 5MB，与 GET 路由限制对齐
   let body = '';
   let overflow = false;
@@ -685,7 +708,7 @@ function fileContentPost(req, res, parsedUrl, isLocal) {
       // exists OR is being created — otherwise a crafted relative path could write
       // outside the navigation root (isWriteAllowed only bounds by the allowlist).
       // Project mode keeps the legacy existing-file-only check.
-      if (!editorSession && targetNavRoot && !isInsideWriteRoot(targetReal)) {
+      if (!editorSession && targetNavRoot && !isInsideWriteRootAllowNew(targetReal)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden', reason: 'outside-view-root' }));
         return;

package/server/server.js

@@ -2216,11 +2216,10 @@ async function setupTerminalWebSocket(httpServer) {
         const fproj = (typeof frame.cwd === 'string' && frame.cwd) ? (projectKeyForCwd(frame.cwd) || null) : null;
         return !fproj || fproj === viewProject;                    // no-cwd frame → replay; else must match
       };
-      const replaySdkPendingApprovals = ({ planOnly = false } = {}) => {
+      const replaySdkPendingApprovals = () => {
         if (!_sdkGetPendingApprovals) return;
         for (const p of _sdkGetPendingApprovals() || []) {
           if (!p || !p.replay || !p.id) continue;
-          if (planOnly && p.kind !== 'plan') continue;
           const payload = { ...p.replay };
           if (!_sdkFrameForView(payload)) continue;
           // The generic replay filter is project-scoped. When an exact instance
@@ -2459,9 +2458,24 @@ async function setupTerminalWebSocket(httpServer) {
                 }
               }
               // View changes use attach rather than a new connection: restore that view's
-              // pending approvals too, so a plan cleared on switch-away can be answered
-              // after switching back instead of waiting for the server timeout.
-              replaySdkPendingApprovals({ planOnly: true });
+              // pending approvals too, so a plan/ask/perm cleared on switch-away can be
+              // answered after switching back instead of waiting for the server timeout.
+              // (Was plan-only; ask/perm were orphaned into a timeout deny on re-attach.
+              // The replay helpers already filter by the just-stamped view project+instance,
+              // and the frontend dedupes by id, so a full replay never double-opens a modal.)
+              replaySdkPendingApprovals();
+              // Re-announce the just-viewed workspace's turn state so the spinner / Stop
+              // button reflects it immediately (otherwise a long-running turn shows idle
+              // until the next state change or heartbeat).
+              if (_sdkGetSessionStateSnapshot) {
+                const stateAnchor = ws._ccvViewInstance
+                  ? { instanceKey: ws._ccvViewInstance }
+                  : (ws._ccvViewProject ? { project: ws._ccvViewProject } : null);
+                const stateSnap = stateAnchor ? _sdkGetSessionStateSnapshot(stateAnchor) : _sdkGetSessionStateSnapshot();
+                if (stateSnap && (!ws._ccvViewInstance || stateSnap.instanceKey === ws._ccvViewInstance)) {
+                  try { ws.send(JSON.stringify(stateSnap)); } catch (err) { reportSwallowed('sdk.session-state-replay', err); }
+                }
+              }
               replayQueueSnapshot();
               return;
             }
@@ -2879,7 +2893,11 @@ async function setupTerminalWebSocket(httpServer) {
             if (_sdkSendUserMessage && msg.text) {
               const anchor = ((typeof msg.project === 'string' && msg.project) || (typeof msg.instanceKey === 'string' && msg.instanceKey)) ? { project: msg.project, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined } : undefined;
               _sdkSendUserMessage(msg.text, anchor).catch(err => {
-                console.error('[SDK] sendUserMessage error:', err.message);
+                reportSwallowed('server.sdk-send', err);
+                // Directed back to the initiator ONLY (a global broadcast would show every
+                // viewer a send failure for a message only one of them typed).
+                try { ws.send(JSON.stringify({ type: 'sdk-send-failed', reason: err?.code === 'not-delivered' ? 'not-delivered' : 'error', detail: String(err?.message || err), ts: Date.now() })); }
+                catch (e2) { reportSwallowed('server.sdk-send-failed-send', e2); }
               });
             }
           } else if (msg.type === 'sdk-interrupt') {
@@ -2897,6 +2915,25 @@ async function setupTerminalWebSocket(httpServer) {
               // 切非运行态并等 4s 兜底才翻回，输出仍在流 —— 打日志让这类错配可观测。
               console.warn('[SDK] sdk-interrupt ignored: isSdkMode=%s, handler=%s', isSdkMode, !!_sdkInterruptTurn);
             }
+          } else if (msg.type === 'sdk-retry-turn') {
+            // Manual [retry] of the last failed (retryable) turn: pushes a synthetic
+            // continue instruction instead of resending the user's original message.
+            // Refusals go back ONLY to the initiating ws (a global broadcast would show
+            // every viewer a reject for an action only one of them took).
+            if (isSdkMode && _sdkRetryTurn) {
+              const anchor = ((typeof msg.project === 'string' && msg.project) || (typeof msg.instanceKey === 'string' && msg.instanceKey)) ? { project: msg.project, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined } : undefined;
+              _sdkRetryTurn(typeof msg.turnId === 'string' ? msg.turnId : null, anchor).then((r) => {
+                if (!r || r.ok) return;
+                // Echo the view stamps so a user who switched views before the reply
+                // lands doesn't see the rejection (and its sdkRetry clear) in the new view.
+                try { ws.send(JSON.stringify({ type: 'sdk-retry-state', phase: 'rejected', reason: r.reason || 'unavailable', turnId: msg.turnId || null, project: msg.project, instanceKey: msg.instanceKey, ts: Date.now() })); }
+                catch (err) { reportSwallowed('server.sdk-retry-reject', err); }
+              }).catch((err) => {
+                reportSwallowed('server.sdk-retry-turn', err);
+                try { ws.send(JSON.stringify({ type: 'sdk-retry-state', phase: 'rejected', reason: 'unavailable', turnId: msg.turnId || null, project: msg.project, instanceKey: msg.instanceKey, ts: Date.now() })); }
+                catch (e2) { reportSwallowed('server.sdk-retry-reject', e2); }
+              });
+            }
           } else if (msg.type === 'queue-message') {
             // Chat-composer busy-queue enqueue (terminal-hidden PTY mode). These queue-* types
             // are deliberately NOT in the SDK no-op gate above: each branch routes by mode.
@@ -2907,7 +2944,9 @@ async function setupTerminalWebSocket(httpServer) {
                 if (_sdkSendUserMessage) {
                   const anchor = ((typeof msg.project === 'string' && msg.project) || (typeof msg.instanceKey === 'string' && msg.instanceKey)) ? { project: msg.project, instanceKey: typeof msg.instanceKey === 'string' ? msg.instanceKey : undefined } : undefined;
                   _sdkSendUserMessage(msg.text, anchor).catch(err => {
-                    console.error('[SDK] queue-message relay error:', err.message);
+                    reportSwallowed('server.sdk-queue-relay', err);
+                    try { ws.send(JSON.stringify({ type: 'sdk-send-failed', reason: err?.code === 'not-delivered' ? 'not-delivered' : 'error', detail: String(err?.message || err), ts: Date.now() })); }
+                    catch (e2) { reportSwallowed('server.sdk-send-failed-send', e2); }
                   });
                 }
               } else {
@@ -3007,7 +3046,7 @@ async function setupTerminalWebSocket(httpServer) {
               _armRedrawRetries();
             }
           }
-        } catch {}
+        } catch (err) { reportSwallowed('server.ws-dispatch', err); }
       });
 
       ws.on('close', () => {
@@ -3805,6 +3844,10 @@ export function setSdkSendUserMessage(fn) { _sdkSendUserMessage = fn; }
 let _sdkInterruptTurn = null;
 export function setSdkInterruptTurn(fn) { _sdkInterruptTurn = fn; }
 
+/** Reference to sdk-manager's retryInterruptedTurn (set by cli.js after import). */
+let _sdkRetryTurn = null;
+export function setSdkRetryTurn(fn) { _sdkRetryTurn = fn; }
+
 /** Reference to sdk-manager's getPendingApprovals (set by cli.js after import). */
 let _sdkGetPendingApprovals = null;
 export function setSdkGetPendingApprovals(fn) { _sdkGetPendingApprovals = fn; }