cc-viewer 1.9.7 → 1.9.8

package/dist/index.html

@@ -21,7 +21,7 @@
     // 整体显示大小已弃用 CSS zoom：Electron 改用 webFrame.setZoomFactor（首屏抢占见
     // electron/tab-content-preload.js），纯浏览器交由用户用浏览器自带快捷键缩放，故此处不再设 zoom。
   </script>
-  <script type="module" crossorigin src="./assets/index-BjL6Cj_m.js"></script>
+  <script type="module" crossorigin src="./assets/index-D2maXxkC.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-antd-CS_S2mBN.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-codemirror-B5l-VbBO.js">
   <link rel="modulepreload" crossorigin href="./assets/vendor-mdxeditor-Cz09a1_I.js">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-viewer",
-  "version": "1.9.7",
+  "version": "1.9.8",
   "description": "Claude Code logging, visualization, and management toolkit — launch a web viewer alongside Claude Code with full request/response tracing, proxy, and mobile support",
   "license": "MIT",
   "main": "server.js",

package/server/lib/approval-policy.js

@@ -12,11 +12,16 @@
  *     approval modal: perm-bridge.js exempts it from the CCV_BYPASS_PERMISSIONS
  *     auto-allow; sdk-manager.js routes it into the perm approval branch even in
  *     bypassPermissions mode.
+ *   - isOverTrustDir: shared guard against over-broad session directory grants
+ *     (used by both the PTY PermissionRequest bridge and the SDK canUseTool path).
  *
  * Pure leaf module (L1-lib): no imports, no I/O — importable from both L1-lib
  * (sdk-manager.js) and L1-sub (ask/perm-bridge.js) without boundary-gate edges.
  */
 
+import { sep } from 'node:path';
+import { homedir } from 'node:os';
+
 export const APPROVAL_TOOLS = new Set(['Bash', 'Edit', 'Write', 'NotebookEdit', 'WebFetch', 'WebSearch']);
 
 /**
@@ -27,3 +32,27 @@ export const APPROVAL_TOOLS = new Set(['Bash', 'Edit', 'Write', 'NotebookEdit',
 export function isPublishCommand(toolName, input) {
   return toolName === 'Bash' && typeof input?.command === 'string' && /npm\s+publish/i.test(input.command);
 }
+
+/**
+ * Whether granting session-level trust to `dir` would be over-broad.
+ * Skips: filesystem root, the user's home directory, top-level directories
+ * (e.g. /etc, /Users, C:\), and any path containing a dot-directory segment
+ * (e.g. ~/.ssh, ~/Library/Keychains).
+ *
+ * @param {string} dir — absolute directory path
+ * @returns {boolean} true when the directory should NOT be granted session trust
+ */
+export function isOverTrustDir(dir) {
+  if (!dir || typeof dir !== 'string') return true;
+  const parts = dir.split(sep).filter(Boolean);
+  // Filesystem root or Windows drive root (e.g. 'C:\')
+  if (parts.length === 0) return true;
+  if (parts.length === 1 && /^[A-Za-z]$/.test(parts[0])) return true;
+  // Top-level system directories (e.g. /etc, /Users, /tmp, C:\Windows)
+  if (parts.length <= 1) return true;
+  // Any dot-directory segment (e.g. ~/.ssh, ~/.aws, ~/Library/Keychains)
+  if (parts.some(p => p.startsWith('.'))) return true;
+  // User home directory
+  if (dir === homedir()) return true;
+  return false;
+}

package/server/lib/ask/perm-bridge.js

@@ -14,6 +14,7 @@
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
+import { resolve, sep } from 'node:path';
 import { evaluateImDeny } from '../im-deny.js';
 import { APPROVAL_TOOLS, isPublishCommand } from '../approval-policy.js';
 
@@ -94,9 +95,65 @@ if (toolName === 'AskUserQuestion') {
   process.exit(0);
 }
 
-// These tools need explicit user approval via Web UI (mutating or external access).
-// The six-tool set is shared with the SDK canUseTool path via approval-policy.js.
-if (!APPROVAL_TOOLS.has(toolName)) {
+// ExitPlanMode is intentionally left as an explicit allow in PTY mode. Routing it to
+// the generic permission panel would conflict with the existing inline plan-approval
+// card (which uses PTY arrow-key detection) and would let the generic auto-approve
+// countdown/instant bypass the independent planAutoApproveSeconds setting. SDK mode
+// handles ExitPlanMode through its own dedicated branch in sdk-manager.js.
+if (toolName === 'ExitPlanMode') {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if (toolName === 'Read' && typeof toolInput?.file_path === 'string') {
+  // Read inside the session cwd is safe to auto-allow; outside the session cwd
+  // Claude Code's own ask rules would override a PreToolUse allow and still prompt.
+  // Let those fall through to the PermissionRequest hook (perm-request-bridge.js)
+  // which can approve them silently with an updatedDirectories session grant.
+  // Use the hook payload's cwd (the actual session cwd) rather than the server env
+  // so multi-workspace sessions classify inside/outside correctly.
+  const sessionCwd = payload?.cwd || process.env.CCV_PROJECT_DIR;
+  if (sessionCwd) {
+    const filePath = resolve(toolInput.file_path);
+    const root = resolve(sessionCwd);
+    if (filePath === root || filePath.startsWith(root + sep)) {
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+      }) + '\n');
+      process.exit(0);
+    }
+    // Outside session cwd → fall through to PermissionRequest hook
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+    process.exit(0);
+  }
+  // No session cwd → fall back to default behavior (explicit allow)
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if ((toolName === 'Glob' || toolName === 'Grep') && typeof toolInput?.pattern === 'string') {
+  // Glob/Grep carry { pattern, path? }; the path field (not file_path) determines the
+  // base directory. When omitted, Claude Code resolves against the session cwd.
+  const sessionCwd = payload?.cwd || process.env.CCV_PROJECT_DIR;
+  if (sessionCwd) {
+    const baseDir = toolInput.path ? resolve(toolInput.path) : resolve(sessionCwd);
+    const root = resolve(sessionCwd);
+    if (baseDir === root || baseDir.startsWith(root + sep)) {
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+      }) + '\n');
+      process.exit(0);
+    }
+    // Outside session cwd → fall through to PermissionRequest hook
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+    process.exit(0);
+  }
+  // No session cwd → fall back to default behavior (explicit allow)
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if (!APPROVAL_TOOLS.has(toolName)) {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
   }) + '\n');

package/server/lib/ask/perm-request-bridge.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * perm-request-bridge.js — PermissionRequest hook bridge for permission prompts.
+ *
+ * Registered with matcher: 'Read|Glob|Grep' in ~/.claude/settings.json.
+ * Called by Claude Code when a permission prompt is about to be shown, after
+ * PreToolUse hooks have not resolved the decision. This catches cases where
+ * PreToolUse allow is overridden by built-in ask rules / safety checks — most
+ * notably Read/Glob/Grep outside the launch directory.
+ *
+ * Behavior:
+ *   - If cc-viewer is not running (CCVIEWER_PORT unset): exit 0 with { continue: true }.
+ *   - Query the cc-viewer server for the current project's autoApproveSeconds.
+ *   - Only Read/Glob/Grep are eligible for silent allow; all other tools return
+ *     { continue: true } so the normal prompt appears.
+ *   - If auto-approve is enabled (instant -1 or countdown >0), return an allow
+ *     decision plus updatedPermissions.addDirectories for the target directory.
+ *   - Otherwise return { continue: true } so the normal terminal prompt appears.
+ *
+ * Exit 0 = success (stdout contains hookSpecificOutput or continue fallback)
+ * Exit 1 = error (malformed/missing stdin or invalid env)
+ */
+
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import { dirname, resolve } from 'node:path';
+import { isOverTrustDir } from '../approval-policy.js';
+
+const port = process.env.CCVIEWER_PORT;
+const rawProtocol = process.env.CCVIEWER_PROTOCOL;
+if (rawProtocol && rawProtocol !== 'http' && rawProtocol !== 'https') {
+  process.stderr.write(`perm-request-bridge: invalid CCVIEWER_PROTOCOL "${rawProtocol}" (expected "http" or "https")\n`);
+  process.exit(1);
+}
+const isHttps = rawProtocol === 'https';
+const httpClient = isHttps ? https : http;
+if (!port) {
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}
+
+let stdinData;
+try {
+  stdinData = readFileSync(0, 'utf-8');
+} catch {
+  process.exit(1);
+}
+
+if (!stdinData || !stdinData.trim()) {
+  process.exit(1);
+}
+
+let payload;
+try {
+  payload = JSON.parse(stdinData);
+} catch {
+  process.exit(1);
+}
+
+const toolName = payload?.tool_name;
+const toolInput = payload?.tool_input;
+const cwd = payload?.cwd;
+
+if (!toolName) {
+  process.exit(1);
+}
+
+// Only Read/Glob/Grep are eligible for silent allow via PermissionRequest. All other
+// tools fall through to the normal prompt so user-configured ask rules and
+// sensitive operations are never silently approved.
+if (toolName !== 'Read' && toolName !== 'Glob' && toolName !== 'Grep') {
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}
+
+const TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+
+function postToViewer() {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ toolName, input: toolInput, cwd });
+    const req = httpClient.request({
+      hostname: '127.0.0.1',
+      port: Number(port),
+      path: '/api/perm-request-hook',
+      method: 'POST',
+      rejectUnauthorized: false, // allow self-signed certs
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => {
+        if (res.statusCode === 200) {
+          try {
+            resolve(JSON.parse(data));
+          } catch {
+            reject(new Error('Invalid response JSON'));
+          }
+        } else {
+          reject(new Error(`HTTP ${res.statusCode}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.setTimeout(TIMEOUT_MS, () => {
+      req.destroy();
+      reject(new Error('Timeout'));
+    });
+    req.write(body);
+    req.end();
+  });
+}
+
+function buildAllowOutput() {
+  const decision = { behavior: 'allow' };
+  // For path-based tools, add the target directory to session-level trusted
+  // directories so subsequent accesses to the same directory do not prompt again.
+  // Guard against over-trust: skip when the resolved parent is '/', the user's
+  // home directory, or a top-level/dot directory (e.g. /etc, /Users, ~/.ssh).
+  if (toolName === 'Read' && typeof toolInput?.file_path === 'string') {
+    const dir = dirname(resolve(toolInput.file_path));
+    if (!isOverTrustDir(dir)) {
+      decision.updatedPermissions = [
+        { type: 'addDirectories', directories: [dir], destination: 'session' },
+      ];
+    }
+  } else if ((toolName === 'Glob' || toolName === 'Grep') && typeof toolInput?.pattern === 'string') {
+    const base = toolInput.path ? resolve(toolInput.path) : (cwd ? resolve(cwd) : null);
+    if (base && !isOverTrustDir(base)) {
+      decision.updatedPermissions = [
+        { type: 'addDirectories', directories: [base], destination: 'session' },
+      ];
+    }
+  }
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PermissionRequest',
+      decision,
+    },
+  };
+}
+
+try {
+  const data = await postToViewer();
+  if (data.decision === 'allow') {
+    process.stdout.write(JSON.stringify(buildAllowOutput()) + '\n');
+  } else if (data.decision === 'deny') {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PermissionRequest',
+        decision: { behavior: 'deny', message: 'Denied by cc-viewer plugin' },
+      },
+    }) + '\n');
+  } else {
+    // 'ask' or anything else → let Claude Code show the normal prompt
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  }
+  process.exit(0);
+} catch (err) {
+  // Server unreachable / timeout → fall back to normal prompt
+  process.stderr.write(`perm-request-bridge: ${err.message} (falling back to terminal UI)\n`);
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}

package/server/lib/ensure-hooks.js

@@ -82,7 +82,7 @@ function _looksStaleManagedCommand(cmd) {
 // All hook sections cc-viewer manages. _purgeStaleManagedHooks and
 // removeAllManagedHooks must iterate this exact set or uninstall/cleanup
 // leaves zombie entries behind (cli.js cleanup-hooks path).
-const MANAGED_SECTIONS = ['PreToolUse', 'Stop', 'SessionStart', 'TaskCreated', 'TaskCompleted', 'UserPromptSubmit', 'PostToolUse'];
+const MANAGED_SECTIONS = ['PreToolUse', 'PermissionRequest', 'Stop', 'SessionStart', 'TaskCreated', 'TaskCompleted', 'UserPromptSubmit', 'PostToolUse'];
 
 function _purgeStaleManagedHooks(settings) {
   let removed = 0;
@@ -200,6 +200,38 @@ export function ensureHooks() {
       changed = true;
     }
 
+    // PermissionRequest hook → perm-request-bridge.js (matcher: 'Read|Glob|Grep')
+    // Catches permission prompts that PreToolUse could not resolve (e.g. Read/Glob/Grep
+    // outside the launch directory where Claude Code ask rules override a hook allow).
+    // Find-by-command (NOT find-by-matcher): a user may legitimately have their own
+    // PermissionRequest entry, and in-place overwriting would clobber it — multiple
+    // entries per matcher are valid config, so we always append our own.
+    // Matcher is scoped to Read|Glob|Grep because the bridge only silently allows those
+    // tools; other tools still get a prompt and do not need the bridge process.
+    const permRequestBridgePath = resolve(SERVER_LIB, 'ask', 'perm-request-bridge.js');
+    const permRequestCmd = `[ -n "$CCVIEWER_PORT" ] && node "${permRequestBridgePath}" || true ${CCV_HOOK_MARKER}`;
+    const permRequestDesired = _buildHookObj(permRequestCmd);
+    const permRequestExisting = settings.hooks.PermissionRequest.find(h => {
+      const cmd = h.hooks?.[0]?.command || '';
+      return cmd.includes('perm-request-bridge.js');
+    });
+    if (permRequestExisting) {
+      if (permRequestExisting.matcher !== 'Read|Glob|Grep') {
+        permRequestExisting.matcher = 'Read|Glob|Grep';
+        changed = true;
+      }
+      if (!_hookObjEqual(permRequestExisting.hooks?.[0], permRequestDesired)) {
+        permRequestExisting.hooks = [_mergeHookObj(permRequestExisting.hooks?.[0], permRequestDesired)];
+        changed = true;
+      }
+    } else {
+      settings.hooks.PermissionRequest.push({
+        matcher: 'Read|Glob|Grep',
+        hooks: [permRequestDesired]
+      });
+      changed = true;
+    }
+
     // Stop hook → turn-end-bridge.js. Fires when Claude finishes responding (real
     // end of a user-prompt turn), so the voice-pack `turnEnd` event can play at the
     // right moment — not after every individual API call like the SSE streaming

package/server/lib/sdk-manager.js

@@ -29,11 +29,12 @@
 import { ASK_TIMEOUT_MS } from './ask/ask-constants.js';
 import { withDefaultThinkingDisplay, resolveLaunchSystemPrompt, launchArgsToExtraArgs } from './launch-config.js';
 import { evaluateImDeny } from './im-deny.js';
-import { APPROVAL_TOOLS, isPublishCommand } from './approval-policy.js';
+import { APPROVAL_TOOLS, isOverTrustDir, isPublishCommand } from './approval-policy.js';
 import { reportSwallowed } from '@ccv/core/error-report';
-import { resolve as _pathResolve } from 'node:path';
+import { resolve as _pathResolve, dirname as _pathDirname, sep as _pathSep } from 'node:path';
 import { createHash } from 'node:crypto';
 import { registerSdkSessionLister } from './sdk-session-index.js';
+import { readPrefsRaw } from './prefs-store.js';
 
 let _query;
 try {
@@ -1103,6 +1104,38 @@ function _createSession(key, cwd) {
     // Tools that need explicit user approval via Web UI (mutating or external access).
     // The six-tool set is shared with the PTY perm-bridge via approval-policy.js.
     if (!APPROVAL_TOOLS.has(toolName)) {
+      // Read/Glob/Grep outside the session cwd would still hit Claude Code's own ask
+      // rules even if we allow here. Only add a session-level directory grant when the
+      // user has enabled auto-approval; otherwise the plain allow still stands but the
+      // directory is not trusted for subsequent calls.
+      if (toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep') {
+        const prefs = readPrefsRaw();
+        const autoApproveSeconds = Number(prefs.autoApproveSeconds);
+        const shouldGrantDir = autoApproveSeconds === -1 || autoApproveSeconds > 0;
+        const sessionCwd = _cwd || process.env.CCV_PROJECT_DIR;
+        if (sessionCwd && shouldGrantDir) {
+          let targetDir = null;
+          if (toolName === 'Read' && typeof input?.file_path === 'string') {
+            targetDir = _pathDirname(_pathResolve(input.file_path));
+          } else if ((toolName === 'Glob' || toolName === 'Grep') && typeof input?.pattern === 'string') {
+            targetDir = input.path ? _pathResolve(input.path) : _pathResolve(sessionCwd);
+          }
+          if (targetDir) {
+            const root = _pathResolve(sessionCwd);
+            if (!(targetDir === root || targetDir.startsWith(root + _pathSep))) {
+              if (!isOverTrustDir(targetDir)) {
+                return {
+                  behavior: 'allow',
+                  updatedInput: input,
+                  updatedPermissions: [
+                    { type: 'addDirectories', directories: [targetDir], destination: 'session' },
+                  ],
+                };
+              }
+            }
+          }
+        }
+      }
       return { behavior: 'allow', updatedInput: input };
     }
 

package/server/routes/ask-perm.js

@@ -4,6 +4,9 @@ import { runWaterfallHook, runParallelHook } from '../lib/plugin-loader.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { filterClientsByScope } from '../lib/v2/view-router.js';
 import { _projectName } from '../interceptor.js';
+import { readPrefsRaw } from '../lib/prefs-store.js';
+import { getCurrentProjectKey, hasFork, resolveScoped } from '../lib/project-prefs.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {
@@ -376,15 +379,20 @@ function askHookCancel(req, res, parsedUrl, isLocal, deps) {
 // Permission hook bridge: receive tool permission request from perm-bridge.js, long-poll for user decision
 function permHook(req, res, parsedUrl, isLocal, deps) {
   let body = '';
+  let bodyTooLarge = false;
   req.on('data', (chunk) => {
+    if (bodyTooLarge) return;
     body += chunk;
     if (body.length > 1000000) {
-      res.writeHead(413, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Request body too large' }));
-      return;
+      bodyTooLarge = true;
+      req.destroy();
     }
   });
   req.on('end', async () => {
+    if (bodyTooLarge) {
+      try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+      return;
+    }
     try {
       const { toolName, input } = JSON.parse(body);
       if (!toolName) {
@@ -472,6 +480,88 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// PermissionRequest hook bridge: receive permission-prompt notification from
+// perm-request-bridge.js and decide whether to auto-approve based on the current
+// project's autoApproveSeconds preference. This runs when a permission prompt is
+// about to be shown (e.g. Read/Glob outside the launch directory) and lets us
+// suppress it silently when the user has enabled auto-approval.
+//
+// Security model: this endpoint is a machine bridge (called by the loopback
+// perm-request-bridge.js hook), not a user prefs read. It must therefore resolve
+// the project fork from the payload cwd regardless of isLocal, and restrict the
+// silent allow to Read/Glob only — all other tools return 'ask' so user ask-rules
+// and sensitive operations still prompt.
+function permRequestHook(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  let bodyTooLarge = false;
+  req.on('data', (chunk) => {
+    if (bodyTooLarge) return;
+    body += chunk;
+    if (body.length > 1000000) {
+      bodyTooLarge = true;
+      req.destroy();
+    }
+  });
+  req.on('end', async () => {
+    if (bodyTooLarge) {
+      try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+      return;
+    }
+    try {
+      const { toolName, input, cwd } = JSON.parse(body);
+      if (!toolName) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Missing toolName' }));
+        return;
+      }
+
+      // Only Read/Glob/Grep may be silently allowed; everything else falls through to
+      // the normal prompt so user-configured ask rules are never bypassed.
+      if (toolName !== 'Read' && toolName !== 'Glob' && toolName !== 'Grep') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ decision: 'ask' }));
+        return;
+      }
+
+      // Plugin hook: let plugins handle permission requests directly.
+      try {
+        const hookResult = await runWaterfallHook('onPermRequest', { toolName, input, mode: 'permission-request' });
+        if (hookResult.decision === 'allow' || hookResult.decision === 'deny') {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ decision: hookResult.decision }));
+          return;
+        }
+      } catch (err) { reportSwallowed('ask-perm.permRequestHook.waterfall', err); }
+
+      const prefs = readPrefsRaw(deps.getPrefsFile?.() || undefined);
+      // Resolve the project fork from the payload cwd (the actual session cwd),
+      // not the server's current CCV_PROJECT_DIR, so multi-workspace setups read
+      // the correct project's autoApproveSeconds.
+      const projectKey = typeof cwd === 'string' && cwd ? cwd : getCurrentProjectKey();
+      const scoped = hasFork(prefs, projectKey);
+      const effective = scoped ? resolveScoped(prefs, prefs.prefsByProject[projectKey]) : prefs;
+      const autoApproveSeconds = Number(effective.autoApproveSeconds);
+
+      // autoApproveSeconds: 0 = off/manual, >0 = countdown, -1 = instant.
+      // For PermissionRequest the prompt is already imminent; we only suppress it
+      // when the user has explicitly enabled auto-approval. Both instant (-1) and
+      // countdown (>0) are treated as allow here because the user has already
+      // opted into automatic approval; the countdown variant simply adds a visible
+      // delay in the UI, which is irrelevant for a headless hook.
+      const shouldAutoAllow = autoApproveSeconds === -1 || autoApproveSeconds > 0;
+
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ decision: shouldAutoAllow ? 'allow' : 'ask' }));
+    } catch (err) {
+      reportSwallowed('ask-perm.permRequestHook.parse', err);
+      if (!res.headersSent) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid request body' }));
+      }
+    }
+  });
+}
+
 // 流式 chunk 接收端点：interceptor 在 SSE 流过程中推送的 partial entry
 // 仅广播，不落盘。前端按 timestamp|url 自动与最终 entry 去重覆盖。
 // 鉴权：server 绑 0.0.0.0 允许同机任意进程访问，必须校验 remote 必须是 loopback
@@ -556,5 +646,6 @@ export const askPermRoutes = [
   { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/result') && method === 'GET', handler: askHookResult },
   { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/cancel') && method === 'POST', handler: askHookCancel },
   { method: 'POST', match: 'exact', path: '/api/perm-hook', handler: permHook },
+  { method: 'POST', match: 'exact', path: '/api/perm-request-hook', handler: permRequestHook },
   { method: 'POST', match: 'exact', path: '/api/stream-chunk', handler: streamChunk },
 ];