cc-viewer 1.9.3 → 1.9.4

package/server/routes/events.js

@@ -50,6 +50,11 @@ function turnEndNotify(req, res, parsedUrl, isLocal, deps) {
       return;
     }
     deps.scheduleTurnEndBroadcast(payload.sessionId || null, payload.ts || Date.now(), payload.transcriptPath || null);
+    // Turn-level loading clears on the RAW Stop POST arrival — the debounced
+    // `turn_end` SSE frame (voice-pack semantics) would keep the spinner up for
+    // the whole debounce window. Idempotent on the server side.
+    try { deps.onTurnActiveClear?.(); }
+    catch (err) { reportSwallowed('turn-end-notify.turn-active-clear', err); }
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: true }));
   });
@@ -578,6 +583,21 @@ async function events(req, res, parsedUrl, isLocal, deps) {
     if (snap) sseWrite(res, `event: task_update\ndata: ${JSON.stringify({ sessionId: snap.sessionId, tasks: snap.tasks, ts: Date.now() })}\n\n`);
   } catch (err) { reportSwallowed('sse.task_update.snapshot', err); }
 
+  // Turn-level loading replay: a page refresh mid-turn restores the spinner in the
+  // same connect block (turn-level state is in-memory only, not in the cold load).
+  // The flag is a bound-project global (same constraint as streamingState), so the
+  // replay only goes to viewers of the bound project — a chip-switched parallel view
+  // must not latch the bound project's spinner. NOTE: this makes turn_active MORE
+  // filtered than streaming_status/turn_end (which broadcast to all); the parallel
+  // view simply shows no spinner for its own project, matching the pre-multi-PTY
+  // single-project posture documented at the streaming_status timer.
+  try {
+    const viewedIsBound = !viewedProject || viewedProject === (_projectName || '');
+    if (viewedIsBound && deps.getPtyTurnActive?.()) {
+      sseWrite(res, `event: turn_active\ndata: ${JSON.stringify({ active: true, sessionId: null, ts: Date.now() })}\n\n`);
+    }
+  } catch (err) { reportSwallowed('sse.turn_active.replay', err); }
+
   // req.on('close') 在某些异常断连时不一定立即触发；res 端 close/error 兜底保证
   // 不会在 clients 数组里留下幽灵 res，防止 sendToClients 后续写入触发慢泄漏。
   const removeFromClients = () => {

package/server/routes/resume.js

@@ -38,6 +38,8 @@
 // The aggregation itself lives in lib/v2/resume-list.js (pure, unit-tested);
 // this handler is a thin HTTP wrapper.
 
+import { realpathSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
 import { LOG_DIR } from '../../findcc.js';
 import { _projectName, _v2Writer, initForWorkspace } from '../interceptor.js';
 // Static import (not the route-local dynamic import) so the close-rebind helper
@@ -121,6 +123,30 @@ async function getLiveProcessesHandler(req, res, parsedUrl) {
       });
     }
   } catch (err) { reportSwallowed('resume-route.live-main', err); }
+  // SDK mode (2026-10-12): SDK sessions are NOT PTYs, so listLivePtys() never contains them —
+  // without an entry the header's tab/chip source has no anchor for an SDK workspace, and the
+  // first launch's PTY-less list collapsed to just the new project. Enumerate the per-cwd SDK
+  // session registry (multi-session) as `kind:'main'` entries so each launched workspace shows
+  // up exactly like a PTY project. `active` marks the session the SDK composer is bound to;
+  // `closable:false` (no PTY to kill) tells the header to suppress the ×.
+  if (process.env.CCV_SDK_MODE === '1') {
+    try {
+      const sdk = await import('../lib/sdk-manager.js');
+      for (const e of sdk.listSdkSessions()) {
+        if (!e || !e.cwd) continue;
+        if (processes.some((p) => p && p.cwd === e.cwd)) continue; // a real PTY already covers this cwd
+        processes.push({
+          kind: 'main',
+          project: projectKeyForCwd(e.cwd),
+          cwd: e.cwd,
+          pid: null,
+          active: e.active === true,
+          instanceKey: null,
+          closable: false, // SDK resident query — killed via session switch, not the × close path
+        });
+      }
+    } catch (err) { reportSwallowed('resume-route.live-sdk', err); }
+  }
   sendJson(res, 200, { processes, currentProject: _projectName || '', currentInstanceKey });
 }
 
@@ -236,6 +262,38 @@ function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
       try {
         rebound = _maybeRebindAfterClose(r, deps);
       } catch (err) { reportSwallowed('resume-route.close-rebind', err); }
+      // Closing a project/instance must also reap its scratch (mini-terminal) shells, or
+      // the viewed-then-switched-away workspace's shells stay alive as orphans until a
+      // full workspacesStop/process exit. The killed record's original spawn cwd keys
+      // the scratch buckets; scratch cwds were realpathSync-normalized at the upgrade,
+      // so match BOTH path spaces — when the workspace dir was later deleted,
+      // realpathSync(raw) throws and the raw spawn cwd is the only way to still hit the
+      // (realpath-keyed) bucket. Skip the reap when a surviving live claude record shares
+      // the cwd (a deliberate same-cwd second instance): its viewers still use those
+      // shared scratch shells.
+      try {
+        if (r.cwd) {
+          // listLivePtys() already only yields LIVE records (ptyProcess non-null), so a
+          // cwd match here is a surviving instance sharing the dir.
+          const survivorSharesCwd = listLivePtys().some((p) => p && p.cwd === r.cwd);
+          if (!survivorSharesCwd) {
+            // Build the candidate set in BOTH path spaces (raw spawn cwd + realpath).
+            // A deleted workspace dir makes realpathSync(raw) throw — then fall back to
+            // realpath(dirname)+basename, which still resolves a deleted LEAF dir through
+            // macOS's /tmp→/private/tmp and /var→/private/var symlinks (the exact case
+            // where the realpath-keyed bucket would otherwise be missed and leak).
+            const cands = [r.cwd];
+            const add = (p) => { if (p && !cands.includes(p)) cands.push(p); };
+            try {
+              add(realpathSync(r.cwd));
+            } catch {
+              try { add(join(realpathSync(dirname(r.cwd)), basename(r.cwd))); } catch { /* give up */ }
+            }
+            const { killScratchForCwd } = await import('../scratch-pty-manager.js');
+            killScratchForCwd(cands);
+          }
+        }
+      } catch (err) { reportSwallowed('resume-route.close-kill-scratch', err); }
       sendJson(res, 200, { ok: true, project, instanceKey: r.key || instanceKey || null, killedActive: r.killedActive === true, rebound });
     } catch (err) {
       reportSwallowed('resume-route.close', err);
@@ -415,7 +473,10 @@ function postResumeSessionHandler(req, res, parsedUrl, isLocal, deps) {
       // Read the env at request time (not module top) so tests can flip it per case.
       if (process.env.CCV_SDK_MODE === '1') {
         const sdk = await import('../lib/sdk-manager.js');
-        const r = sdk.switchToSession(sessionUuid);
+        // Multi-session (2026-10-12): honor the requested workspace — resume the VIEWED
+        // session, not always the active one. project is the workspace name from the client.
+        const anchor = (typeof project === 'string' && project) ? { project } : undefined;
+        const r = sdk.switchToSession(sessionUuid, anchor);
         if (r.ok) { sendJson(res, 200, { ok: true }); return; }
         if (r.reason === 'busy') { sendJson(res, 409, { ok: false, reason: 'busy' }); return; }
         if (r.reason === 'unavailable') { sendJson(res, 409, { ok: false, reason: 'unavailable' }); return; }

package/server/routes/sdk-context.js

@@ -0,0 +1,24 @@
+// SDK-mode "Context usage" on-demand route. The panel opens/refreshes via this HTTP pull;
+// the automatic turn-end/compact refreshes flow over the WS broadcast instead. A
+// `session-inactive` outcome is a NORMAL state (no turn run yet / query dead), so it
+// returns 200 with { ok:false, reason } rather than an HTTP error.
+import { reportSwallowed } from '@ccv/core/error-report';
+
+async function sdkContextUsage(req, res) {
+  try {
+    // Dynamic import: sdk-manager is only loaded in SDK mode (resume.js parity). The
+    // literal specifier satisfies the boundary verifier's R7 rule.
+    const sdk = await import('../lib/sdk-manager.js');
+    const r = await sdk.fetchContextUsage();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(r.ok ? { ok: true, snapshot: r.snapshot } : { ok: false, reason: r.reason }));
+  } catch (err) {
+    reportSwallowed('sdk-context-route', err);
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: String(err?.message || err) }));
+  }
+}
+
+export const sdkContextRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/sdk-context-usage', handler: sdkContextUsage },
+];

package/server/routes/sdk-mcp-status.js

@@ -0,0 +1,24 @@
+// SDK-mode "MCP server status" on-demand route. The panel opens/refreshes via this HTTP
+// pull; there is no turn-driven refresh (MCP status is not turn-correlated). A
+// `session-inactive` outcome is a NORMAL state (no turn run yet / query dead), so it
+// returns 200 with { ok:false, reason } rather than an HTTP error.
+import { reportSwallowed } from '@ccv/core/error-report';
+
+async function sdkMcpStatus(req, res) {
+  try {
+    // Dynamic import: sdk-manager is only loaded in SDK mode (resume.js parity). The
+    // literal specifier satisfies the boundary verifier's R7 rule.
+    const sdk = await import('../lib/sdk-manager.js');
+    const r = await sdk.fetchMcpStatus();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(r.ok ? { ok: true, snapshot: r.snapshot } : { ok: false, reason: r.reason }));
+  } catch (err) {
+    reportSwallowed('sdk-mcp-status-route', err);
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: String(err?.message || err) }));
+  }
+}
+
+export const sdkMcpStatusRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/sdk-mcp-server-status', handler: sdkMcpStatus },
+];

package/server/routes/workspaces.js

@@ -85,9 +85,26 @@ function workspacesLaunch(req, res, parsedUrl, isLocal, deps) {
       // it to the latest main session.
       if (mergedArgs.some((a) => RESUME_FLAGS.has(a))) markResumeSession();
 
+      // SDK mode (2026-10-12, per-cwd multi-session): launch = register/activate this cwd's
+      // resident SDK session — NOT a phantom claude PTY the SDK UI never consumes. PTY mode is
+      // untouched (the proxyPort branch below stays PTY-only).
+      if (deps.isSdkMode) {
+        try {
+          const sdk = await import('../lib/sdk-manager.js');
+          if (!sdk.setActiveSdkSession(wsPath)) {
+            // New cwd: register a session carrying the PROCESS-LEVEL launch config template
+            // (registered by cli.js at boot) so its query gets the proxy env / model /
+            // permission / executable — without it the child would bypass the ccv proxy
+            // (no transcript) and skip the per-cwd routing header. Process-global callbacks
+            // (broadcast/turn-end) are reused via initSdkSession's only-if-provided guard.
+            sdk.initSdkSession(wsPath, result.projectName, sdk.getSdkLaunchConfig() || undefined);
+          }
+        } catch (err) { reportSwallowed('workspaces.sdk-launch', err); }
+      }
+
       // 启动 PTY
       const proxyPort = process.env.CCV_PROXY_PORT;
-      if (proxyPort) {
+      if (proxyPort && !deps.isSdkMode) {
         // Multi-instance (2026-10-06): spawnClaude now mints a fresh instanceKey per call and
         // no longer kills an existing same-cwd record, so re-launching an ALREADY-LIVE cwd
         // here would silently start a duplicate claude. ensurePtyForCwd restores the intended
@@ -186,6 +203,12 @@ function workspacesStop(req, res, parsedUrl, isLocal, deps) {
     // old project's claude leaks past the workspace session.
     import('../pty-manager.js').then(({ killAllMain }) => killAllMain()),
     import('../scratch-pty-manager.js').then(({ killAllScratch }) => killAllScratch()).catch(() => {}),
+    // SDK multi-session (2026-10-12): returning to the workspace list must also stop every
+    // resident SDK session, or they (and their child claude processes) accumulate for the
+    // whole process lifetime.
+    deps.isSdkMode
+      ? import('../lib/sdk-manager.js').then((m) => m.stopSession()).catch((err) => reportSwallowed('workspaces.sdk-stop', err))
+      : Promise.resolve(),
   ]).then(() => {
     // 接续原有清理流程
 

package/server/scratch-pty-manager.js

@@ -25,9 +25,23 @@ const MAX_BUFFER = 50000;
 // 裁剪滞回：超 MAX_BUFFER 后一次裁到 TRIM_TO，降低每 chunk slice 重分配频率（同 pty-manager.js）
 const BUFFER_TRIM_TO = 45000;
 
-// id -> { ptyProcess, dataListeners, exitListeners, lastExitCode, outputBuffer, lastCols, lastRows, batchBuffer, batchScheduled }
+// Multi-project (2026-10-12): scratch PTYs are keyed by (tab id, resolved workspace
+// cwd) so each viewed workspace owns an isolated shell group; switching away keeps the
+// old group's processes alive and switching back re-attaches them. Callers that omit
+// cwd fall back to STARTUP_CWD (pre-multi-project API shape — keeps older tests and
+// any un-updated call site on a single, well-defined bucket).
+function effCwd(opts) {
+  return (opts && typeof opts.cwd === 'string' && opts.cwd) ? opts.cwd : STARTUP_CWD;
+}
+function keyFor(id, cwd) {
+  // Space separator is collision-free: the id charset (SCRATCH_ID_RE, [A-Za-z0-9_-])
+  // excludes spaces, so the first space always delimits even when the cwd contains them.
+  return `${id} ${cwd || STARTUP_CWD}`;
+}
+
+// composite key -> { ptyProcess, dataListeners, exitListeners, lastExitCode, outputBuffer, lastCols, lastRows, batchBuffer, batchScheduled, cwd }
 const ptys = new Map();
-// id -> in-flight spawn Promise，防同 id 并发 spawn 双开
+// composite key -> in-flight spawn Promise; dedupes concurrent spawns for the same id+cwd
 const _spawnInflight = new Map();
 let _ptyImportForTests = null;
 
@@ -43,7 +57,7 @@ async function getPty() {
   return ptyMod.default || ptyMod;
 }
 
-function newState() {
+function newState(cwd) {
   return {
     ptyProcess: null,
     dataListeners: [],
@@ -54,23 +68,28 @@ function newState() {
     lastRows: 24,
     batchBuffer: '',
     batchScheduled: false,
+    cwd: cwd || STARTUP_CWD,
   };
 }
 
 // 仅在确实有消费方时才创建条目；为 onScratchData/onScratchExit 与 spawnScratch 复用
-function getOrInit(id) {
-  let s = ptys.get(id);
+function getOrInit(id, cwd) {
+  const k = keyFor(id, cwd);
+  let s = ptys.get(k);
   if (!s) {
-    s = newState();
-    ptys.set(id, s);
+    s = newState(cwd);
+    ptys.set(k, s);
   }
-  return s;
+  return { k, s };
 }
 
-// 当某 id 既无 pty 又无监听器时清掉空记录，防止懒注册场景下 Map 长尾膨胀
-function maybeReap(id, s) {
+// 当某 key 既无 pty 又无监听器时清掉空记录，防止懒注册场景下 Map 长尾膨胀。
+// Identity check: a kill+quick-respawn replaces the entry under the same key — the old
+// process's async onExit must not delete the NEW live record (leaks an unreachable
+// shell and desyncs the caps).
+function maybeReap(k, s) {
   if (!s.ptyProcess && s.dataListeners.length === 0 && s.exitListeners.length === 0) {
-    ptys.delete(id);
+    if (ptys.get(k) === s) ptys.delete(k);
   }
 }
 
@@ -117,14 +136,24 @@ function fixSpawnHelperPermissions() {
 // 注：spawn 失败时 s 留在 Map 但 s.ptyProcess 仍为 null。server connection handler 在
 // 失败后仍会通过 onScratchData/onScratchExit 注册 listener；ws.close 时它们通过 maybeReap
 // 清空记录，所以无长期泄漏。已知降级体验：用户看到空终端，下次 input 会再试一次 spawn。
-export async function spawnScratch(id) {
+// Multi-project: the shell's cwd comes from the viewed-workspace resolution threaded
+// through opts.cwd (server.js upgrade handler); STARTUP_CWD remains the fallback.
+export async function spawnScratch(id, opts) {
   if (!id || typeof id !== 'string') throw new Error('spawnScratch requires id');
-  const s = getOrInit(id);
+  const cwd = effCwd(opts);
+  const { k, s } = getOrInit(id, cwd);
   if (s.ptyProcess) return s.ptyProcess;
-  if (_spawnInflight.has(id)) return _spawnInflight.get(id);
+  if (_spawnInflight.has(k)) return _spawnInflight.get(k);
   const p = (async () => {
     const pty = await getPty();
     fixSpawnHelperPermissions();
+    // Stale-record guard: a killAll/killForCwd during the async getPty() window deletes
+    // the record from ptys. Without this check the freshly spawned process below would
+    // be assigned to an orphaned state object — a live shell no Map entry can reach
+    // (invisible to getScratchPid/writeScratch/kill, uncounted against the caps).
+    if (ptys.get(k) !== s) {
+      throw new Error('scratch record reaped during spawn');
+    }
 
     const shell = process.env.SHELL || (process.platform === 'win32' ? (process.env.ComSpec || 'cmd.exe') : '/bin/sh');
     const env = { ...process.env };
@@ -142,16 +171,23 @@ export async function spawnScratch(id) {
     applyClaudeAltScreenPref(env);
     const shellSpawn = prepareEmbeddedShellSpawn(shell, env);
 
-    s.lastExitCode = null;
-    s.outputBuffer = '';
-
-    s.ptyProcess = pty.spawn(shellSpawn.command, shellSpawn.args, {
+    const proc = pty.spawn(shellSpawn.command, shellSpawn.args, {
       name: 'xterm-256color',
       cols: s.lastCols,
       rows: s.lastRows,
-      cwd: STARTUP_CWD,
+      cwd: s.cwd,
       env: shellSpawn.env,
     });
+    // The synchronous spawn above cannot interleave with a reap, but belt-and-braces:
+    // re-check before publishing so a process is never attached to a reaped record.
+    if (ptys.get(k) !== s) {
+      try { proc.kill(); } catch { }
+      throw new Error('scratch record reaped during spawn');
+    }
+
+    s.lastExitCode = null;
+    s.outputBuffer = '';
+    s.ptyProcess = proc;
 
     s.ptyProcess.onData((data) => {
       s.outputBuffer += data;
@@ -174,20 +210,23 @@ export async function spawnScratch(id) {
       for (const cb of [...s.exitListeners]) {
         try { cb(exitCode); } catch { }
       }
+      // A shell that exits while its page is away (switch-away already removed
+      // listeners) would otherwise linger as a dead entry against the caps.
+      maybeReap(k, s);
     });
 
     return s.ptyProcess;
   })();
-  _spawnInflight.set(id, p);
+  _spawnInflight.set(k, p);
   try {
     return await p;
   } finally {
-    _spawnInflight.delete(id);
+    _spawnInflight.delete(k);
   }
 }
 
-export function writeScratch(id, data) {
-  const s = ptys.get(id);
+export function writeScratch(id, data, opts) {
+  const s = ptys.get(keyFor(id, effCwd(opts)));
   if (s?.ptyProcess) {
     s.ptyProcess.write(data);
     return true;
@@ -203,8 +242,8 @@ function _clampScratchDim(v, min, max, fallback) {
   return Math.max(min, Math.min(max, n));
 }
 
-export function resizeScratch(id, cols, rows) {
-  const s = ptys.get(id);
+export function resizeScratch(id, cols, rows, opts) {
+  const s = ptys.get(keyFor(id, effCwd(opts)));
   if (!s) return;
   s.lastCols = _clampScratchDim(cols, 2, 1000, s.lastCols);
   s.lastRows = _clampScratchDim(rows, 1, 1000, s.lastRows);
@@ -213,8 +252,10 @@ export function resizeScratch(id, cols, rows) {
   }
 }
 
-export function killScratch(id) {
-  const s = ptys.get(id);
+// Shared teardown for killScratch/killAllScratch: kill the process tree, flush the
+// batch pipeline, then drop the record entirely (listeners included — the frontend
+// ws.close path unsubscribes separately).
+function _killEntry(k, s) {
   if (!s) return;
   if (s.ptyProcess) {
     flushBatch(s, true);
@@ -227,50 +268,80 @@ export function killScratch(id) {
     }
     s.ptyProcess = null;
   }
-  // 显式 kill 后整条记录清掉，监听器一并丢弃（前端 ws.close 也会清）
-  ptys.delete(id);
+  ptys.delete(k);
+}
+
+export function killScratch(id, opts) {
+  _killEntry(keyFor(id, effCwd(opts)), ptys.get(keyFor(id, effCwd(opts))));
 }
 
 export function killAllScratch() {
-  for (const id of [...ptys.keys()]) {
-    killScratch(id);
+  for (const [k, s] of [...ptys.entries()]) {
+    _killEntry(k, s);
   }
 }
 
-export function onScratchData(id, cb) {
-  const s = getOrInit(id);
+// Kill every scratch PTY belonging to ONE workspace cwd (closing a project/instance via
+// /api/live-processes/close). The match is against the record's stored spawn cwd, which
+// was realpathSync-normalized at the upgrade — so callers pass candidates in BOTH path
+// spaces (raw spawn cwd + its realpath): when the workspace dir was later deleted,
+// realpathSync(raw) throws and only the raw candidate can match, while the bucket key
+// may be the realpath. Same-basename twins have distinct cwds, so this never reaps a
+// sibling workspace's shells. Accepts a single cwd string or an array of candidates.
+// Returns the number reaped.
+export function killScratchForCwd(cwd) {
+  const cands = (Array.isArray(cwd) ? cwd : [cwd]).filter((c) => typeof c === 'string' && c);
+  if (cands.length === 0) return 0;
+  let n = 0;
+  for (const [k, s] of [...ptys.entries()]) {
+    if (s && cands.includes(s.cwd)) {
+      _killEntry(k, s);
+      n++;
+    }
+  }
+  return n;
+}
+
+export function onScratchData(id, cb, opts) {
+  const cwd = effCwd(opts);
+  const { k, s } = getOrInit(id, cwd);
   s.dataListeners.push(cb);
   return () => {
     s.dataListeners = s.dataListeners.filter(l => l !== cb);
-    maybeReap(id, s);
+    maybeReap(k, s);
   };
 }
 
-export function onScratchExit(id, cb) {
-  const s = getOrInit(id);
+export function onScratchExit(id, cb, opts) {
+  const cwd = effCwd(opts);
+  const { k, s } = getOrInit(id, cwd);
   s.exitListeners.push(cb);
   return () => {
     s.exitListeners = s.exitListeners.filter(l => l !== cb);
-    maybeReap(id, s);
+    maybeReap(k, s);
   };
 }
 
-export function getScratchPid(id) {
-  const s = ptys.get(id);
+export function getScratchPid(id, opts) {
+  const s = ptys.get(keyFor(id, effCwd(opts)));
   return s?.ptyProcess ? s.ptyProcess.pid : null;
 }
 
-export function getScratchState(id) {
-  const s = ptys.get(id);
+export function getScratchState(id, opts) {
+  const cwd = effCwd(opts);
+  const s = ptys.get(keyFor(id, cwd));
   return {
     running: !!(s?.ptyProcess),
     exitCode: s?.lastExitCode ?? null,
-    cwd: STARTUP_CWD,
+    // The record always carries its real spawn cwd; only a missing record falls back to
+    // the requested cwd (pre-spawn probe). No `|| cwd` blur — a corrupted record must
+    // surface, not silently report the requester's cwd.
+    cwd: s ? s.cwd : cwd,
   };
 }
 
-export function getScratchOutputBuffer(id) {
-  return ptys.get(id)?.outputBuffer ?? '';
+export function getScratchOutputBuffer(id, opts) {
+  return ptys.get(keyFor(id, effCwd(opts)))?.outputBuffer ?? '';
 }
 
 export function getScratchStartupCwd() {
@@ -288,9 +359,19 @@ export function getScratchPtyCount() {
   return ptys.size;
 }
 
+// Per-workspace cap companion to the global count above: entries belonging to one
+// resolved cwd (hidden workspaces keep their PTYs alive by design, so the global cap
+// alone would starve multi-workspace use).
+export function getScratchPtyCountForCwd(cwd) {
+  const target = effCwd({ cwd });
+  let n = 0;
+  for (const s of ptys.values()) if (s.cwd === target) n++;
+  return n;
+}
+
 // 服务端 upgrade 阶段判断 id 是否是"已有重连"，避免 cap 误伤老 tab 重连
-export function hasScratchPty(id) {
-  return ptys.has(id);
+export function hasScratchPty(id, opts) {
+  return ptys.has(keyFor(id, effCwd(opts)));
 }
 
 // 当前 spawn 用的 shell basename（zsh / bash / fish 等），供前端渲染 tab 标签