cc-viewer 1.9.5 → 1.9.6

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-CloXv0sm.js"></script>
+  <script type="module" crossorigin src="./assets/index-D0_0_HIv.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-CS_S2mBN.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-B5l-VbBO.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-Cz09a1_I.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/sdk-manager.js

@@ -32,6 +32,8 @@ import { evaluateImDeny } from './im-deny.js';
 import { APPROVAL_TOOLS, isPublishCommand } from './approval-policy.js';
 import { reportSwallowed } from '@ccv/core/error-report';
 import { resolve as _pathResolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { registerSdkSessionLister } from './sdk-session-index.js';
 
 let _query;
 try {
@@ -71,7 +73,13 @@ function _getOrCreateSession(cwd) {
 // The ACTIVE session (the one the composer talks to). May be null before any init.
 function _active() { return _activeKey != null ? _sessions.get(_activeKey) : null; }
 
-// Resolve an anchor { cwd|project } to a Session WITHOUT switching active (read ops).
+function _matchesProject(sess, project) {
+  const rawBase = String(sess.cwd || '').replace(/\\/g, '/').split('/').filter(Boolean).pop();
+  const sanitized = rawBase ? rawBase.replace(/[^a-zA-Z0-9_\-.]/g, '_') : null;
+  return sanitized === project || rawBase === project;
+}
+
+// Resolve an anchor { instanceKey|cwd|project } to a Session WITHOUT switching active (read ops).
 // `cwd` is an absolute path (exact key match); `project` is the SANITIZED project name the
 // web client sends (ChatView stamps `viewProject || projectName`, where projectName =
 // projectKeyForCwd(cwd) — non [a-zA-Z0-9_-] chars become `_`, so a dir with spaces/CJK sends
@@ -80,8 +88,18 @@ function _active() { return _activeKey != null ? _sessions.get(_activeKey) : nul
 // guess). Returns null when the anchor resolves to no registered session.
 function _sessionForAnchor(anchor) {
   if (!anchor || typeof anchor !== 'object') return null;
+  const instanceKey = (typeof anchor.instanceKey === 'string' && anchor.instanceKey) || null;
   const cwd = (typeof anchor.cwd === 'string' && anchor.cwd) || null;
   const project = (typeof anchor.project === 'string' && anchor.project) || null;
+  if (instanceKey) {
+    for (const s of _sessions.values()) {
+      if (s.instanceKey === instanceKey) return s;
+    }
+    // An exact instance that no longer exists must never fall back to a
+    // same-basename sibling — that would execute the user's action in the
+    // wrong workspace. The caller's unknown-anchor path drops + reports it.
+    return null;
+  }
   if (cwd) return _sessions.get(_normalizeCwd(cwd)) || null;
   if (!project) return null;
   // exact-path form of a project (an absolute path was passed as `project`) — try key first.
@@ -89,9 +107,7 @@ function _sessionForAnchor(anchor) {
   if (byKey) return byKey;
   let found = null;
   for (const s of _sessions.values()) {
-    const rawBase = String(s.cwd || '').replace(/\\/g, '/').split('/').filter(Boolean).pop();
-    const sanitized = rawBase ? rawBase.replace(/[^a-zA-Z0-9_\-.]/g, '_') : null;
-    if (sanitized === project || rawBase === project) { if (found) return null; found = s; } // ambiguous → null
+    if (_matchesProject(s, project)) { if (found) return null; found = s; } // ambiguous → null
   }
   return found;
 }
@@ -100,12 +116,17 @@ function _sessionForAnchor(anchor) {
 export function __listSessionsForTests() { return [..._sessions.keys()]; }
 export function __getSessionKeyForTests(cwd) { return _normalizeCwd(cwd); }
 
-/** Enumerate the per-cwd SDK session registry for the header's live list. Each entry:
- * { key, cwd, active }. Read-only. */
+/** Enumerate the per-cwd SDK session registry for live workspace routing. Each entry:
+ * { key, cwd, active, instanceKey }. Read-only. NOTE: `key` is the registry's
+ * normalized-cwd key; attach/close responses instead alias `key` to the instanceKey
+ * for killPtyFor-shape parity (resume.js consumes `r.key === reattachedTo`). Callers
+ * must not mix the two namespaces. */
 export function listSdkSessions() {
-  return [..._sessions.values()].map((s) => ({ key: s.key, cwd: s.cwd, active: s.key === _activeKey }));
+  return [..._sessions.values()].map((s) => ({ key: s.key, cwd: s.cwd, active: s.key === _activeKey, instanceKey: s.instanceKey }));
 }
 
+registerSdkSessionLister(listSdkSessions);
+
 // Silence window for the watchdog. Must stay above the approval ceilings the turn can
 // legally wait on: perm/plan = 5min, AskUserQuestion = 24h ("GUI effectively has no
 // timeout" is a product contract). A pending approval exempts the turn from the
@@ -275,6 +296,7 @@ function _normalizeSdkTask(msg) {
 // `let` (rebinding, not a frozen property) so assignment paths like
 // `_messageQueue = []` keep working.
 function _createSession(key, cwd) {
+  const instanceKey = `ccv-${createHash('sha256').update(key).digest('hex').slice(0, 32)}`;
   // Launch config (per-session identity; adopted on lazy reconstruction)
   let _cwd = cwd;
   let _permissionMode = 'default';
@@ -337,13 +359,14 @@ function _createSession(key, cwd) {
   let _suppressDrain = false;
 
     // Wrap the process-global _broadcastWs so EVERY frame this session emits carries
-    // its routing identity (cwd + sessionId): with concurrent sessions on one WS, the
-    // frontend filters frames by cwd — without it every workspace's clients would see
-    // every other workspace's spinner/queue/modal frames.
+    // its routing identity (cwd + sessionId + instanceKey): with concurrent sessions on
+    // one WS, the frontend/server filter frames by workspace+instance — without it every
+    // workspace's (or same-basename twin's) clients would see every other workspace's
+    // spinner/queue/modal frames.
   function _broadcast(payload) {
     if (!_broadcastWs) return;
     try {
-      _broadcastWs({ cwd: _cwd, sessionId: _sessionId || null, ...payload });
+      _broadcastWs({ cwd: _cwd, sessionId: _sessionId || null, instanceKey, ...payload });
     } catch (err) { reportSwallowed('sdk-manager.broadcast', err); }
   }
 
@@ -440,7 +463,7 @@ function _createSession(key, cwd) {
         // Negative ack: the frontend cleared the composer optimistically — never fail
         // silently. Only the reject frame goes out (no queue-state — nothing changed).
         console.warn('[sdk-manager] queue full, rejecting message');
-        try { if (_broadcastWs) _broadcastWs({ type: 'queue-rejected', reason: 'full', cwd: _cwd, sessionId: _sessionId || null }); }
+        try { if (_broadcastWs) _broadcastWs({ type: 'queue-rejected', reason: 'full', cwd: _cwd, sessionId: _sessionId || null, instanceKey }); }
         catch (err) { reportSwallowed('sdk-manager.reject-broadcast', err); }
         return;
       }
@@ -459,7 +482,7 @@ function _createSession(key, cwd) {
   function _broadcastQueueState() {
     if (!_broadcastWs) return;
     try {
-      _broadcastWs({ type: 'queue-state', cwd: _cwd, sessionId: _sessionId || null, items: _messageQueue.map(({ id, text, ts }) => ({ id, text, ts })) });
+      _broadcastWs({ type: 'queue-state', cwd: _cwd, sessionId: _sessionId || null, instanceKey, items: _messageQueue.map(({ id, text, ts }) => ({ id, text, ts })) });
     } catch (err) { console.warn('[sdk-manager] queue-state broadcast threw:', err?.message); }
   }
 
@@ -531,8 +554,15 @@ function _createSession(key, cwd) {
       const headerCwd = String(_cwd).replace(/[\r\n\x00-\x1f\x7f]/g, '');
       if (headerCwd) {
         const projectHeader = `x-ccv-project-dir: ${headerCwd}`;
+        // Same-name twin isolation (review P2): also self-report this session's stable
+        // instanceKey so the interceptor stamps `_ccvInstance` → v2 meta.instance →
+        // scoped instance routing, exactly like a PTY spawn. Without it, two same-basename
+        // SDK workspaces share project-scoped frames (close teardown kills the twin's
+        // spinner/queue bubbles) and cold-load instance filters never match SDK sessions.
+        const instanceHeader = `x-ccv-instance: ${instanceKey}`;
+        const injected = `${projectHeader}\n${instanceHeader}`;
         options.env.ANTHROPIC_CUSTOM_HEADERS = options.env.ANTHROPIC_CUSTOM_HEADERS
-          ? `${options.env.ANTHROPIC_CUSTOM_HEADERS}\n${projectHeader}` : projectHeader;
+          ? `${options.env.ANTHROPIC_CUSTOM_HEADERS}\n${injected}` : injected;
       }
     }
     if (_settings) options.settings = _settings;
@@ -695,8 +725,8 @@ function _createSession(key, cwd) {
     const valid = state === 'idle' || state === 'running' || state === 'requires_action';
     if (!valid || state === _lastSessionState) return;
     _lastSessionState = state;
-    // _broadcast carries the routing envelope (cwd + sessionId) — every frame needs
-    // it so concurrent sessions' clients filter correctly.
+    // _broadcast carries the routing envelope (cwd + sessionId + instanceKey) — every
+    // frame needs it so concurrent sessions' clients filter correctly.
     _broadcast({ type: 'sdk-session-state', state });
   }
 
@@ -728,6 +758,7 @@ function _createSession(key, cwd) {
             slashCommands: msg.slash_commands,
             tools: msg.tools,
             cwd: _cwd,
+            instanceKey,
           };
           _broadcastWs(_lastInitSnapshot);
         } else if (msg.subtype === 'compact_boundary' && _broadcastWs) {
@@ -739,6 +770,7 @@ function _createSession(key, cwd) {
             postTokens: meta && meta.post_tokens,
             cwd: _cwd,
             sessionId: _sessionId || null,
+            instanceKey,
           });
           // Compaction is the only non-turn event that materially shrinks context — refresh
           // the usage panel. Coalesced with the turn-end refresh via the in-flight gate.
@@ -752,7 +784,7 @@ function _createSession(key, cwd) {
           // failed/stopped/killed terminal states the TODO HUD vocabulary lacks). The
           // server keeps no task table here — pure forward, merge semantics left to the
           // client (task_updated.patch is a wire-safe delta, not a full snapshot).
-          _broadcastWs({ type: 'sdk-task', cwd: _cwd, ..._normalizeSdkTask(msg) });
+          _broadcastWs({ type: 'sdk-task', cwd: _cwd, instanceKey, ..._normalizeSdkTask(msg) });
         }
         break;
 
@@ -837,7 +869,7 @@ function _createSession(key, cwd) {
       ? resultMsg.errors.join('; ')
       : (typeof resultMsg.result === 'string' && resultMsg.result) || resultMsg.subtype || 'unknown error';
     if (_broadcastWs) {
-      try { _broadcastWs({ type: 'sdk-error', message: String(errs), cwd: _cwd, sessionId: _sessionId || null }); } catch (err) { console.warn('[sdk-manager] sdk-error broadcast threw:', err?.message); }
+      try { _broadcastWs({ type: 'sdk-error', message: String(errs), cwd: _cwd, sessionId: _sessionId || null, instanceKey }); } catch (err) { console.warn('[sdk-manager] sdk-error broadcast threw:', err?.message); }
     }
   }
 
@@ -915,7 +947,7 @@ function _createSession(key, cwd) {
     _ctxUsageFetching = false;
     _ctxUsageQueued = false;
     if (had && _broadcastWs) {
-      try { _broadcastWs({ type: 'sdk-context-usage', sessionId: _sessionId, ts: Date.now(), trigger, usage: null, cwd: _cwd }); }
+      try { _broadcastWs({ type: 'sdk-context-usage', sessionId: _sessionId, ts: Date.now(), trigger, usage: null, cwd: _cwd, instanceKey }); }
       catch (err) { reportSwallowed('sdk-manager.context-usage-broadcast', err); }
     }
   }
@@ -963,7 +995,7 @@ function _createSession(key, cwd) {
     const had = _lastMcpStatus !== null;
     _lastMcpStatus = null;
     if (had && _broadcastWs) {
-      try { _broadcastWs({ type: 'sdk-mcp-status', sessionId: _sessionId, ts: Date.now(), trigger, servers: null, cwd: _cwd }); }
+      try { _broadcastWs({ type: 'sdk-mcp-status', sessionId: _sessionId, ts: Date.now(), trigger, servers: null, cwd: _cwd, instanceKey }); }
       catch (err) { reportSwallowed('sdk-manager.mcp-status-broadcast', err); }
     }
   }
@@ -1134,7 +1166,7 @@ function _createSession(key, cwd) {
       : kind === 'plan' ? 'sdk-plan-resolved'
       : 'perm-hook-timeout';
     try {
-      _broadcastWs({ type, id, reason, cwd: _cwd, sessionId: _sessionId || null });
+      _broadcastWs({ type, id, reason, cwd: _cwd, sessionId: _sessionId || null, instanceKey });
     } catch (err) { console.warn('[sdk-manager] approval-dismiss broadcast threw:', err?.message); }
   }
 
@@ -1451,6 +1483,7 @@ function _createSession(key, cwd) {
   // body, now per-session). `init` = config adoption + that teardown/reset pair.
   return {
     key,
+    instanceKey,
     get cwd() { return _cwd; },
     get config() {
       return {
@@ -1503,6 +1536,13 @@ function _createSession(key, cwd) {
     },
     switchToSession: _switchToSession,
     getSessionId: () => _sessionId,
+    close: () => {
+      for (const { id, kind } of _cancelAllApprovals()) {
+        _broadcastApprovalDismiss(kind, id, 'session-closed');
+      }
+      _teardownResident();
+      _resetFullState();
+    },
     teardown: () => {
       _teardownResident();
       _resetFullState();
@@ -1567,20 +1607,19 @@ export function initSdkSession(cwd, projectName, { onTurnEnd, onQueryError, broa
  */
 export async function sendUserMessage(text, anchor) {
   if (!_query) throw new Error('Agent SDK not available');
-  const sess = _active();
-  if (!sess) {
-    // Uninitialized — the old module's state machine only came alive after
-    // initSdkSession; a pre-init send just resolves (the SDK-unavailable guard
-    // above already covered the only documented throw).
-    return;
-  }
-  if (anchor && (anchor.cwd || anchor.project)) {
+  if (anchor && (anchor.cwd || anchor.project || anchor.instanceKey)) {
     const target = _sessionForAnchor(anchor);
     if (!target) {
-      // A mis-resolved anchor must not silently drop the user's message — log + report.
-      const targetName = anchor.cwd || anchor.project;
+      // A mis-resolved anchor must not silently drop the user's message — log + report,
+      // and surface a toast through the same channel query errors use (the composer was
+      // already cleared client-side; without this the text vanishes without a trace).
+      const targetName = anchor.cwd || anchor.project || anchor.instanceKey;
       console.warn(`[sdk-manager] no SDK session registered for "${targetName}" — message dropped`);
       reportSwallowed('sdk-manager.route', new Error(`no SDK session for ${targetName}`));
+      if (_onQueryError) {
+        try { _onQueryError(`Workspace "${targetName}" is no longer available — message not sent.`); }
+        catch (err) { console.warn('[sdk-manager] onQueryError threw:', err?.message); }
+      }
       return;
     }
     if (target.key !== _activeKey) {
@@ -1588,6 +1627,13 @@ export async function sendUserMessage(text, anchor) {
     }
     return target.sendUserMessage(text);
   }
+  const sess = _active();
+  if (!sess) {
+    // Uninitialized — the old module's state machine only came alive after
+    // initSdkSession; a pre-init send just resolves (the SDK-unavailable guard
+    // above already covered the only documented throw).
+    return;
+  }
   return sess.sendUserMessage(text);
 }
 
@@ -1711,6 +1757,80 @@ export function setActiveSdkSession(cwd) {
   return true;
 }
 
+/** Activate a workspace by the same exact instance/cwd/project anchor used by SDK actions. */
+export function attachSdkSession(anchor) {
+  if (anchor && anchor.project && !anchor.instanceKey && !anchor.cwd) {
+    const matches = [..._sessions.values()].filter((s) => _matchesProject(s, anchor.project));
+    if (matches.length > 1) {
+      return {
+        ok: false,
+        reason: 'ambiguous',
+        candidates: matches.map((s) => ({ key: s.instanceKey /* aliases instanceKey for killPtyFor-shape parity */, instanceKey: s.instanceKey, cwd: s.cwd })),
+      };
+    }
+  }
+  const sess = _sessionForAnchor(anchor);
+  if (!sess) return { ok: false, reason: 'not-found' };
+  const switched = sess.key !== _activeKey;
+  _activeKey = sess.key;
+  // `key` aliases instanceKey for killPtyFor-shape parity (NOT the registry cwd key).
+  return { ok: true, key: sess.instanceKey, instanceKey: sess.instanceKey, cwd: sess.cwd, switched };
+}
+
+/**
+ * Close exactly one registered SDK workspace. A name-only anchor refuses
+ * same-basename ambiguity; an exact instance key never falls back to a name.
+ */
+export function closeSdkSession(anchor = {}) {
+  const instanceKey = typeof anchor.instanceKey === 'string' ? anchor.instanceKey : '';
+  let sess = null;
+  if (instanceKey) {
+    sess = _sessionForAnchor({ instanceKey });
+    if (!sess) return { ok: false, reason: 'not-found' };
+  } else if (anchor.cwd) {
+    sess = _sessionForAnchor({ cwd: anchor.cwd });
+  } else if (anchor.project) {
+    const matches = [..._sessions.values()].filter((s) => _matchesProject(s, anchor.project));
+    if (matches.length > 1) {
+      return {
+        ok: false,
+        reason: 'ambiguous',
+        candidates: matches.map((s) => ({ key: s.instanceKey /* aliases instanceKey for killPtyFor-shape parity */, instanceKey: s.instanceKey, cwd: s.cwd })),
+      };
+    }
+    sess = matches[0] || null;
+  }
+  if (!sess) return { ok: false, reason: 'not-found' };
+
+  const killedActive = sess.key === _activeKey;
+  const result = {
+    ok: true,
+    // `key` aliases instanceKey here (killPtyFor-shape parity: resume.js matches
+    // `p.key === killResult.reattachedTo`). It is NOT the registry's cwd key —
+    // the registry key is `sess.key`, a different namespace. Do not conflate.
+    key: sess.instanceKey,
+    instanceKey: sess.instanceKey,
+    cwd: sess.cwd,
+    killedActive,
+    reattachedTo: null,
+  };
+  // Remove the registry identity BEFORE user-callback-facing teardown frames. A
+  // close/relaunch triggered by one of those frames must register a fresh session,
+  // never be deleted by the tail of the older close operation.
+  _sessions.delete(sess.key);
+  if (killedActive) {
+    const survivor = _sessions.values().next().value || null;
+    _activeKey = survivor ? survivor.key : null;
+    result.reattachedTo = survivor ? survivor.instanceKey : null;
+  }
+  try {
+    sess.close();
+  } catch (err) {
+    reportSwallowed('sdk-manager.close', err);
+  }
+  return result;
+}
+
 /** The active session's cwd (header/switch addressing). '' when none. */
 export function getActiveSdkCwd() {
   const sess = _active();

package/server/lib/sdk-session-index.js

@@ -0,0 +1,25 @@
+// Synchronous read-only projection of the SDK session registry. Generic view
+// routing must not import sdk-manager (and eagerly load the Agent SDK) in PTY mode.
+import { reportSwallowed } from '@ccv/core/error-report';
+
+let _listSessions = null;
+
+export function registerSdkSessionLister(lister) {
+  _listSessions = typeof lister === 'function' ? lister : null;
+}
+
+export function listSdkSessionInstances() {
+  if (!_listSessions) return [];
+  try {
+    const rows = _listSessions();
+    return Array.isArray(rows) ? rows : [];
+  } catch (err) {
+    reportSwallowed('sdk-session-index.list', err);
+    return [];
+  }
+}
+
+export function findSdkSessionByInstance(instanceKey) {
+  if (typeof instanceKey !== 'string' || !/^ccv-[0-9a-f]+$/.test(instanceKey)) return null;
+  return listSdkSessionInstances().find((s) => s && s.instanceKey === instanceKey) || null;
+}

package/server/lib/view-root.js

@@ -26,6 +26,7 @@
 
 import { realpathSync, existsSync, statSync } from 'node:fs';
 import { projectKeyForCwd } from './system-prompt-snapshots.js';
+import { listSdkSessionInstances } from './sdk-session-index.js';
 
 // A project name must be sanitizer-stable: projectKeyForCwd maps every legal
 // basename to [a-zA-Z0-9_\-\.] (collapsing only ALL-dot degenerate names to
@@ -49,11 +50,13 @@ function isValidProjectName(name) {
  * @param {string} opts.boundCwd - the bound project root (CCV_PROJECT_DIR || process.cwd()).
  * @param {() => Array<{path:string, projectName:string}>} opts.loadWorkspaces - registry reader.
  * @param {() => Array<{cwd:string, instanceKey?:string}>} opts.listLivePtys - live PTY records.
- * @returns {{ ok:true, root:string, via:'bound'|'registry'|'live'|'live-instance' } | { ok:false, status:number, error:string }}
+ * @returns {{ ok:true, root:string, projectName:string, via:'bound'|'registry'|'live'|'live-instance' } | { ok:false, status:number, error:string }}
+ *   `root` is the realpath'd real dir; `projectName` is the RAW-path store key
+ *   (basename of the matched candidate BEFORE realpath) — the wire/log-store name.
+ *   They differ for a leaf-symlinked workspace, and the store is keyed by the raw name.
  */
-export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWorkspaces, listLivePtys } = {}) {
-  const bound = boundCwd || process.cwd();
-  // Multi-instance (2026-10-06): `instance` is the per-spawn instanceKey, the
+export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWorkspaces, listLivePtys, listSdkSessions = listSdkSessionInstances } = {}) {
+  const bound = boundCwd || process.cwd();// Multi-instance (2026-10-06): `instance` is the per-spawn instanceKey, the
   // authoritative disambiguator when two same-basename projects run at once —
   // the name path below would 400 on that pair as "ambiguous". Resolve it FIRST
   // (before the empty-name bound short-circuit AND name validation): a valid live
@@ -67,13 +70,21 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
       const rec = (listLivePtys() || []).find((p) => p && p.instanceKey === instance);
       if (rec && typeof rec.cwd === 'string' && rec.cwd) {
         if (existsSync(rec.cwd) && statSync(rec.cwd).isDirectory()) {
-          return { ok: true, root: realpathSync(rec.cwd), via: 'live-instance' };
+          return { ok: true, root: realpathSync(rec.cwd), projectName: projectKeyForCwd(rec.cwd), via: 'live-instance' };
         }
       }
     } catch { /* pty map unavailable / fs race → fall through to name path */ }
+    try {
+      const rec = (listSdkSessions() || []).find((s) => s && s.instanceKey === instance);
+      if (rec && typeof rec.cwd === 'string' && rec.cwd) {
+        if (existsSync(rec.cwd) && statSync(rec.cwd).isDirectory()) {
+          return { ok: true, root: realpathSync(rec.cwd), projectName: projectKeyForCwd(rec.cwd), via: 'live-instance' };
+        }
+      }
+    } catch { /* SDK registry unavailable / fs race → fall through to name path */ }
   }
   const name = (typeof projectParam === 'string' && projectParam) || '';
-  if (!name) return { ok: true, root: bound, via: 'bound' };
+  if (!name) return { ok: true, root: bound, projectName: projectKeyForCwd(bound), via: 'bound' };
   if (!isValidProjectName(name)) {
     return { ok: false, status: 400, error: 'invalid project name' };
   }
@@ -103,6 +114,14 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
       }
     }
   } catch { /* pty map unavailable → registry-only */ }
+  try {
+    for (const s of listSdkSessions() || []) {
+      const cwd = s && s.cwd;
+      if (typeof cwd === 'string' && cwd && projectKeyForCwd(cwd) === name) {
+        candidates.push({ path: cwd, via: 'live' });
+      }
+    }
+  } catch { /* SDK registry unavailable → PTY/registry-only */ }
 
   // Dedupe by path string (a project live AND registered under the SAME path
   // is one candidate). Keys are the raw candidate paths — not realpathSync —
@@ -132,7 +151,7 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
         if (!existsSync(root) || !statSync(root).isDirectory()) {
           return { ok: false, status: 404, error: 'project dir missing' };
         }
-        return { ok: true, root: realpathSync(root), via: 'live' };
+        return { ok: true, root: realpathSync(root), projectName: projectKeyForCwd(root), via: 'live' };
       } catch {
         return { ok: false, status: 404, error: 'project dir unreadable' };
       }
@@ -156,7 +175,7 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
     }
     const root = alive[0].path;
     try {
-      return { ok: true, root: realpathSync(root), via: alive[0].via };
+      return { ok: true, root: realpathSync(root), projectName: projectKeyForCwd(root), via: alive[0].via };
     } catch {
       return { ok: false, status: 404, error: 'project dir unreadable' };
     }
@@ -166,7 +185,7 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
     if (!existsSync(root) || !statSync(root).isDirectory()) {
       return { ok: false, status: 404, error: 'project dir missing' };
     }
-    return { ok: true, root: realpathSync(root), via: uniq[0].via };
+    return { ok: true, root: realpathSync(root), projectName: projectKeyForCwd(root), via: uniq[0].via };
   } catch {
     return { ok: false, status: 404, error: 'project dir unreadable' };
   }
@@ -192,13 +211,14 @@ export function resolveViewRoot({ projectParam, instanceParam, boundCwd, loadWor
  * @param {string} [opts.bodyInstance] - POST-body instance override (wins over query).
  * @returns {string|null} the resolved absolute root, or null (already replied).
  */
-export function viewRootOrReply(req, res, parsedUrl, { boundCwd, loadWorkspaces, listLivePtys, bodyProject, bodyInstance } = {}) {
+export function viewRootOrReply(req, res, parsedUrl, { boundCwd, loadWorkspaces, listLivePtys, listSdkSessions, bodyProject, bodyInstance } = {}) {
   const r = resolveViewRoot({
     projectParam: (typeof bodyProject === 'string' && bodyProject) || parsedUrl?.searchParams?.get('project'),
     instanceParam: (typeof bodyInstance === 'string' && bodyInstance) || parsedUrl?.searchParams?.get('instance'),
     boundCwd,
     loadWorkspaces,
     listLivePtys,
+    listSdkSessions,
   });
   if (!r.ok) {
     res.writeHead(r.status, { 'Content-Type': 'application/json' });

package/server/lib/ws-mux.js

@@ -50,9 +50,14 @@ const HEARTBEAT_SEND_MS = 25_000;   // app-level ping cadence (chisel: proxies k
 const HEARTBEAT_REAP_MS = 60_000;   // no inbound frame for this long → terminate the socket
 const MAX_STREAMS_PER_SOCKET = 8;
 // Per-socket queue is a pure MEMORY SAFETY NET (the primary slow-consumer eviction is the
-// per-stream 30s backpressure rule inherited from _safeSseWrite). Sized well above any
-// legitimate burst so it only trips on a wedged socket, never on a fast-producer burst.
-const QUEUE_MAX_BYTES = 8 * 1024 * 1024;
+// per-stream 30s backpressure rule inherited from _safeSseWrite). Sized above any legitimate
+// cold-load burst so it only trips on a genuinely wedged socket, never on a fast-producer
+// burst. Postmortem (2026-10-15): cc-viewer's own ~11MB v3 cold load exceeded the old 8MB
+// cap — the CAP RAISE is the load-bearing fix; the perMessageDeflate disable below is
+// prophylactic (it removes bufferedAmount inflation so the gate stops false-tripping, but
+// even with deflate on the 32MB cap absorbs the burst: measured peak 10.6MB).
+// 32MB covers ~40k-row sessions while still bounding a truly dead client's damage.
+export const QUEUE_MAX_BYTES = 32 * 1024 * 1024;
 const HIGH_WATER = 1024 * 1024;     // mirrors terminal's hysteresis band
 const LOW_WATER = 256 * 1024;
 
@@ -241,11 +246,25 @@ export function createStreamMuxServer({
   clearTimeout: clearT = clearTimeout,
   now = Date.now,
 } = {}) {
-  // perMessageDeflate: the dialogue channel carries the app's largest transfers (cold-load
-  // windows); without it the mux would send verbatim JSON where the SSE path gets per-connection
-  // brotli (measured 21-88x on real sessions). ws's built-in permessage-deflate (zlib) recovers
-  // most of that with no new dependency. (SSE keeps its stronger brotli; this closes the gap.)
-  const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: true });
+  // perMessageDeflate DISABLED (2026-10-15, queue-overflow postmortem): with deflate on,
+  // ws.send() enqueues into Node's zlib pending queue and ws.bufferedAmount counts those
+  // bytes BEFORE they reach TCP (sender.js adds the UNCOMPRESSED size to _bufferedBytes
+  // pre-compress, subtracting only in the zlib callback). During a cold-load burst the gate
+  // then sees a phantom backlog, marks the socket behind, and queues frames — pings included —
+  // so the queue grows until the cap kills the connection (1011 queue-overflow) and the
+  // client's channel watchdog fires into a reconnect→overflow loop.
+  //
+  // Measured (real ws, ~11MB burst): peak bufferedAmount ~1.05MB in BOTH modes — deflate's
+  // contribution is queue DWELL TIME, not peak depth. The cap raise above is what actually
+  // prevents the overflow; disabling deflate keeps the gate's behind-detection honest.
+  //
+  // Trade-off (accepted): the mux path is now UNCOMPRESSED — MuxSink._wireEnc stays falsy,
+  // so the SSE brotli encoder never runs here (only the SSE fallback compresses). On
+  // localhost/LAN the wire growth is irrelevant; on a slow remote link a cold load is
+  // slower than it would be compressed, and an SSE-fallback user can cold-load FASTER than
+  // a healthy-mux user. The structural fix (cold-load history over one compressed HTTP
+  // fetch, WS reserved for control + live deltas) is tracked as follow-up work.
+  const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024, perMessageDeflate: false });
   const sockets = new Set();
   wss.on('error', (err) => reportSwallowed('ws.mux.server', err));
   wss.on('connection', (ws) => handleConnection(ws));

package/server/routes/events.js

@@ -13,6 +13,7 @@ import { readV2SingleEntry } from '../lib/v2/adapter.js';
 import { resolveSessionDirName, latestMainSessionDir } from '../lib/v2/session-select.js';
 import { sanitizePathComponent, normalizeSessionCwd } from '../lib/v2/layout.js';
 import { listLivePtys } from '../pty-manager.js';
+import { findSdkSessionByInstance } from '../lib/sdk-session-index.js';
 import { enrichRawIfNeeded } from '../lib/enrich-plan-input.js';
 import { validateLogPath } from '../lib/log-management.js';
 import { isMainAgentEntry, extractCachedContent } from '../lib/kv-cache-analyzer.js';
@@ -351,7 +352,8 @@ export async function serveEventStream(sink, params, deps) {
         let targetCwd = '';
         if (instanceParam) {
           try {
-            const rec = listLivePtys().find((p) => p && p.instanceKey === instanceParam);
+            const rec = listLivePtys().find((p) => p && p.instanceKey === instanceParam)
+              || findSdkSessionByInstance(instanceParam);
             targetCwd = rec && rec.cwd ? normalizeSessionCwd(rec.cwd) : '';
           } catch (err) { targetCwd = ''; reportSwallowed('events.target-cwd', err); }
         }
@@ -391,7 +393,8 @@ export async function serveEventStream(sink, params, deps) {
   let instanceAlive = false;
   if (instanceNoSession) {
     try {
-      instanceAlive = listLivePtys().some((p) => p && p.instanceKey === instanceParam);
+      instanceAlive = listLivePtys().some((p) => p && p.instanceKey === instanceParam)
+        || !!findSdkSessionByInstance(instanceParam);
     } catch (err) {
       // Lookup failure degrades to the explicit dead-instance posture (never
       // silently blank the client on a lookup error).

package/server/routes/project-meta.js

@@ -14,10 +14,11 @@ import { detectHomebrewInstall } from '../lib/updater.js';
 // not become a presence oracle over LOG_DIR — `?project=` is accepted ONLY
 // when it resolves to a registered workspace / live PTY (or the bound
 // project), never an arbitrary sanitized name.
-function _resolveStatsName(projectParam, res) {
-  if (!projectParam) return _projectName || '';
+function _resolveStatsName(projectParam, instanceParam, res) {
+  if (!projectParam && !instanceParam) return _projectName || '';
   const r = resolveViewRoot({
     projectParam,
+    instanceParam,
     boundCwd: process.env.CCV_PROJECT_DIR || process.cwd(),
     loadWorkspaces,
     listLivePtys,
@@ -27,7 +28,12 @@ function _resolveStatsName(projectParam, res) {
     res.end(JSON.stringify({ error: r.error }));
     return null;
   }
-  return sanitizePathComponent(projectParam);
+  // The log-store name derives from the RAW matched path (basename BEFORE the
+  // resolver's realpath), which the wire/store layer keys on — never from the raw
+  // ?project= (forged names + a live instance would otherwise become a LOG_DIR
+  // presence oracle) and never from the realpath'd root (a leaf-symlinked workspace
+  // would then read the target's store name instead of its own).
+  return sanitizePathComponent(r.projectName);
 }
 
 // 判定当前 cc-viewer 的安装渠道，供前端精准匹配升级命令。
@@ -73,7 +79,8 @@ function projectStats(req, res, parsedUrl) {
     // Multi-project (2026-10): project-stats resolves the VIEWED project
     // (?project=, registered/live only — never an arbitrary name).
     const projectParam = parsedUrl && parsedUrl.searchParams ? parsedUrl.searchParams.get('project') : null;
-    const name = _resolveStatsName(projectParam, res);
+    const instanceParam = parsedUrl && parsedUrl.searchParams ? parsedUrl.searchParams.get('instance') : null;
+    const name = _resolveStatsName(projectParam, instanceParam, res);
     if (name === null) return; // error already replied
     if (!name) {
       res.writeHead(404, { 'Content-Type': 'application/json' });