cc-viewer 1.9.7 → 1.9.9

package/server/lib/ask/perm-bridge.js

@@ -14,6 +14,7 @@
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
+import { resolve, sep } from 'node:path';
 import { evaluateImDeny } from '../im-deny.js';
 import { APPROVAL_TOOLS, isPublishCommand } from '../approval-policy.js';
 
@@ -94,9 +95,65 @@ if (toolName === 'AskUserQuestion') {
   process.exit(0);
 }
 
-// These tools need explicit user approval via Web UI (mutating or external access).
-// The six-tool set is shared with the SDK canUseTool path via approval-policy.js.
-if (!APPROVAL_TOOLS.has(toolName)) {
+// ExitPlanMode is intentionally left as an explicit allow in PTY mode. Routing it to
+// the generic permission panel would conflict with the existing inline plan-approval
+// card (which uses PTY arrow-key detection) and would let the generic auto-approve
+// countdown/instant bypass the independent planAutoApproveSeconds setting. SDK mode
+// handles ExitPlanMode through its own dedicated branch in sdk-manager.js.
+if (toolName === 'ExitPlanMode') {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if (toolName === 'Read' && typeof toolInput?.file_path === 'string') {
+  // Read inside the session cwd is safe to auto-allow; outside the session cwd
+  // Claude Code's own ask rules would override a PreToolUse allow and still prompt.
+  // Let those fall through to the PermissionRequest hook (perm-request-bridge.js)
+  // which can approve them silently with an updatedDirectories session grant.
+  // Use the hook payload's cwd (the actual session cwd) rather than the server env
+  // so multi-workspace sessions classify inside/outside correctly.
+  const sessionCwd = payload?.cwd || process.env.CCV_PROJECT_DIR;
+  if (sessionCwd) {
+    const filePath = resolve(toolInput.file_path);
+    const root = resolve(sessionCwd);
+    if (filePath === root || filePath.startsWith(root + sep)) {
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+      }) + '\n');
+      process.exit(0);
+    }
+    // Outside session cwd → fall through to PermissionRequest hook
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+    process.exit(0);
+  }
+  // No session cwd → fall back to default behavior (explicit allow)
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if ((toolName === 'Glob' || toolName === 'Grep') && typeof toolInput?.pattern === 'string') {
+  // Glob/Grep carry { pattern, path? }; the path field (not file_path) determines the
+  // base directory. When omitted, Claude Code resolves against the session cwd.
+  const sessionCwd = payload?.cwd || process.env.CCV_PROJECT_DIR;
+  if (sessionCwd) {
+    const baseDir = toolInput.path ? resolve(toolInput.path) : resolve(sessionCwd);
+    const root = resolve(sessionCwd);
+    if (baseDir === root || baseDir.startsWith(root + sep)) {
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+      }) + '\n');
+      process.exit(0);
+    }
+    // Outside session cwd → fall through to PermissionRequest hook
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+    process.exit(0);
+  }
+  // No session cwd → fall back to default behavior (explicit allow)
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
+  }) + '\n');
+  process.exit(0);
+} else if (!APPROVAL_TOOLS.has(toolName)) {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' },
   }) + '\n');

package/server/lib/ask/perm-request-bridge.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * perm-request-bridge.js — PermissionRequest hook bridge for permission prompts.
+ *
+ * Registered with matcher: 'Read|Glob|Grep' in ~/.claude/settings.json.
+ * Called by Claude Code when a permission prompt is about to be shown, after
+ * PreToolUse hooks have not resolved the decision. This catches cases where
+ * PreToolUse allow is overridden by built-in ask rules / safety checks — most
+ * notably Read/Glob/Grep outside the launch directory.
+ *
+ * Behavior:
+ *   - If cc-viewer is not running (CCVIEWER_PORT unset): exit 0 with { continue: true }.
+ *   - Query the cc-viewer server for the current project's autoApproveSeconds.
+ *   - Only Read/Glob/Grep are eligible for silent allow; all other tools return
+ *     { continue: true } so the normal prompt appears.
+ *   - If auto-approve is enabled (instant -1 or countdown >0), return an allow
+ *     decision plus updatedPermissions.addDirectories for the target directory.
+ *   - Otherwise return { continue: true } so the normal terminal prompt appears.
+ *
+ * Exit 0 = success (stdout contains hookSpecificOutput or continue fallback)
+ * Exit 1 = error (malformed/missing stdin or invalid env)
+ */
+
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import { dirname, resolve } from 'node:path';
+import { isOverTrustDir } from '../approval-policy.js';
+
+const port = process.env.CCVIEWER_PORT;
+const rawProtocol = process.env.CCVIEWER_PROTOCOL;
+if (rawProtocol && rawProtocol !== 'http' && rawProtocol !== 'https') {
+  process.stderr.write(`perm-request-bridge: invalid CCVIEWER_PROTOCOL "${rawProtocol}" (expected "http" or "https")\n`);
+  process.exit(1);
+}
+const isHttps = rawProtocol === 'https';
+const httpClient = isHttps ? https : http;
+if (!port) {
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}
+
+let stdinData;
+try {
+  stdinData = readFileSync(0, 'utf-8');
+} catch {
+  process.exit(1);
+}
+
+if (!stdinData || !stdinData.trim()) {
+  process.exit(1);
+}
+
+let payload;
+try {
+  payload = JSON.parse(stdinData);
+} catch {
+  process.exit(1);
+}
+
+const toolName = payload?.tool_name;
+const toolInput = payload?.tool_input;
+const cwd = payload?.cwd;
+
+if (!toolName) {
+  process.exit(1);
+}
+
+// Only Read/Glob/Grep are eligible for silent allow via PermissionRequest. All other
+// tools fall through to the normal prompt so user-configured ask rules and
+// sensitive operations are never silently approved.
+if (toolName !== 'Read' && toolName !== 'Glob' && toolName !== 'Grep') {
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}
+
+const TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+
+function postToViewer() {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ toolName, input: toolInput, cwd });
+    const req = httpClient.request({
+      hostname: '127.0.0.1',
+      port: Number(port),
+      path: '/api/perm-request-hook',
+      method: 'POST',
+      rejectUnauthorized: false, // allow self-signed certs
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => {
+        if (res.statusCode === 200) {
+          try {
+            resolve(JSON.parse(data));
+          } catch {
+            reject(new Error('Invalid response JSON'));
+          }
+        } else {
+          reject(new Error(`HTTP ${res.statusCode}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.setTimeout(TIMEOUT_MS, () => {
+      req.destroy();
+      reject(new Error('Timeout'));
+    });
+    req.write(body);
+    req.end();
+  });
+}
+
+function buildAllowOutput() {
+  const decision = { behavior: 'allow' };
+  // For path-based tools, add the target directory to session-level trusted
+  // directories so subsequent accesses to the same directory do not prompt again.
+  // Guard against over-trust: skip when the resolved parent is '/', the user's
+  // home directory, or a top-level/dot directory (e.g. /etc, /Users, ~/.ssh).
+  if (toolName === 'Read' && typeof toolInput?.file_path === 'string') {
+    const dir = dirname(resolve(toolInput.file_path));
+    if (!isOverTrustDir(dir)) {
+      decision.updatedPermissions = [
+        { type: 'addDirectories', directories: [dir], destination: 'session' },
+      ];
+    }
+  } else if ((toolName === 'Glob' || toolName === 'Grep') && typeof toolInput?.pattern === 'string') {
+    const base = toolInput.path ? resolve(toolInput.path) : (cwd ? resolve(cwd) : null);
+    if (base && !isOverTrustDir(base)) {
+      decision.updatedPermissions = [
+        { type: 'addDirectories', directories: [base], destination: 'session' },
+      ];
+    }
+  }
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PermissionRequest',
+      decision,
+    },
+  };
+}
+
+try {
+  const data = await postToViewer();
+  if (data.decision === 'allow') {
+    process.stdout.write(JSON.stringify(buildAllowOutput()) + '\n');
+  } else if (data.decision === 'deny') {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PermissionRequest',
+        decision: { behavior: 'deny', message: 'Denied by cc-viewer plugin' },
+      },
+    }) + '\n');
+  } else {
+    // 'ask' or anything else → let Claude Code show the normal prompt
+    process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  }
+  process.exit(0);
+} catch (err) {
+  // Server unreachable / timeout → fall back to normal prompt
+  process.stderr.write(`perm-request-bridge: ${err.message} (falling back to terminal UI)\n`);
+  process.stdout.write(JSON.stringify({ continue: true, suppressOutput: true }) + '\n');
+  process.exit(0);
+}

package/server/lib/ensure-hooks.js

@@ -82,7 +82,7 @@ function _looksStaleManagedCommand(cmd) {
 // All hook sections cc-viewer manages. _purgeStaleManagedHooks and
 // removeAllManagedHooks must iterate this exact set or uninstall/cleanup
 // leaves zombie entries behind (cli.js cleanup-hooks path).
-const MANAGED_SECTIONS = ['PreToolUse', 'Stop', 'SessionStart', 'TaskCreated', 'TaskCompleted', 'UserPromptSubmit', 'PostToolUse'];
+const MANAGED_SECTIONS = ['PreToolUse', 'PermissionRequest', 'Stop', 'SessionStart', 'TaskCreated', 'TaskCompleted', 'UserPromptSubmit', 'PostToolUse'];
 
 function _purgeStaleManagedHooks(settings) {
   let removed = 0;
@@ -200,6 +200,38 @@ export function ensureHooks() {
       changed = true;
     }
 
+    // PermissionRequest hook → perm-request-bridge.js (matcher: 'Read|Glob|Grep')
+    // Catches permission prompts that PreToolUse could not resolve (e.g. Read/Glob/Grep
+    // outside the launch directory where Claude Code ask rules override a hook allow).
+    // Find-by-command (NOT find-by-matcher): a user may legitimately have their own
+    // PermissionRequest entry, and in-place overwriting would clobber it — multiple
+    // entries per matcher are valid config, so we always append our own.
+    // Matcher is scoped to Read|Glob|Grep because the bridge only silently allows those
+    // tools; other tools still get a prompt and do not need the bridge process.
+    const permRequestBridgePath = resolve(SERVER_LIB, 'ask', 'perm-request-bridge.js');
+    const permRequestCmd = `[ -n "$CCVIEWER_PORT" ] && node "${permRequestBridgePath}" || true ${CCV_HOOK_MARKER}`;
+    const permRequestDesired = _buildHookObj(permRequestCmd);
+    const permRequestExisting = settings.hooks.PermissionRequest.find(h => {
+      const cmd = h.hooks?.[0]?.command || '';
+      return cmd.includes('perm-request-bridge.js');
+    });
+    if (permRequestExisting) {
+      if (permRequestExisting.matcher !== 'Read|Glob|Grep') {
+        permRequestExisting.matcher = 'Read|Glob|Grep';
+        changed = true;
+      }
+      if (!_hookObjEqual(permRequestExisting.hooks?.[0], permRequestDesired)) {
+        permRequestExisting.hooks = [_mergeHookObj(permRequestExisting.hooks?.[0], permRequestDesired)];
+        changed = true;
+      }
+    } else {
+      settings.hooks.PermissionRequest.push({
+        matcher: 'Read|Glob|Grep',
+        hooks: [permRequestDesired]
+      });
+      changed = true;
+    }
+
     // Stop hook → turn-end-bridge.js. Fires when Claude finishes responding (real
     // end of a user-prompt turn), so the voice-pack `turnEnd` event can play at the
     // right moment — not after every individual API call like the SSE streaming

package/server/lib/sdk-manager.js

@@ -29,11 +29,12 @@
 import { ASK_TIMEOUT_MS } from './ask/ask-constants.js';
 import { withDefaultThinkingDisplay, resolveLaunchSystemPrompt, launchArgsToExtraArgs } from './launch-config.js';
 import { evaluateImDeny } from './im-deny.js';
-import { APPROVAL_TOOLS, isPublishCommand } from './approval-policy.js';
+import { APPROVAL_TOOLS, isOverTrustDir, isPublishCommand } from './approval-policy.js';
 import { reportSwallowed } from '@ccv/core/error-report';
-import { resolve as _pathResolve } from 'node:path';
+import { resolve as _pathResolve, dirname as _pathDirname, sep as _pathSep } from 'node:path';
 import { createHash } from 'node:crypto';
 import { registerSdkSessionLister } from './sdk-session-index.js';
+import { readPrefsRaw } from './prefs-store.js';
 
 let _query;
 try {
@@ -326,6 +327,13 @@ function _createSession(key, cwd) {
   let _sessionId = null;
   let _initAnnouncedSid = ''; // sessionId whose slash-command surface was already announced (reset on full reset)
   let _lastInitSnapshot = null; // last sdk-init payload for WS reconnect replay
+  // Last sdk-skills frame (supportedCommands() result) for WS reconnect replay, and the
+  // resident query it was loaded from (dedupes the once-per-query-generation fetch).
+  let _lastSkillsSnapshot = null;
+  let _skillsLoadedQuery = null;
+  // init 帧的 skills 白名单（name / plugin:skill / :suffix 形式），用于把 supportedCommands()
+  // 的全量命令面收敛为纯 skill 面；null = 该 init 帧未提供（不做过滤，保守放行）。
+  let _initSkills = null;
   // Last announced session state ('idle' | 'running' | 'requires_action' | null) — the
   // turn-level busy truth for the conversation spinner. Sources, most authoritative
   // first: CLI-emitted session_state_changed (gated behind CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS,
@@ -689,6 +697,8 @@ function _createSession(key, cwd) {
     const inputQueue = _inputQueue;
     _activeQuery = null;
     _inputQueue = null;
+    _skillsLoadedQuery = null; // next resident query re-pulls supportedCommands() on init
+    _initSkills = null;        // re-captured from the next init frame
     _clearGraceTimer();
     _clearTurnWatchdog();
     _lateResultTombstones = 0;
@@ -747,20 +757,33 @@ function _createSession(key, cwd) {
         // push/result fallbacks keep the spinner correct at result granularity.
         if (msg.subtype === 'session_state_changed') {
           _announceSessionState(msg.state);
-        } else if (msg.subtype === 'init' && _broadcastWs
-          && Array.isArray(msg.slash_commands) && msg.slash_commands.length > 0
-          && msg.session_id !== _initAnnouncedSid) {
-          _initAnnouncedSid = msg.session_id;
-          _lastInitSnapshot = {
-            type: 'sdk-init',
-            sessionId: msg.session_id,
-            model: msg.model,
-            slashCommands: msg.slash_commands,
-            tools: msg.tools,
-            cwd: _cwd,
-            instanceKey,
-          };
-          _broadcastWs(_lastInitSnapshot);
+        } else if (msg.subtype === 'init') {
+          if (_broadcastWs && Array.isArray(msg.slash_commands) && msg.slash_commands.length > 0
+            && msg.session_id !== _initAnnouncedSid) {
+            _initAnnouncedSid = msg.session_id;
+            _lastInitSnapshot = {
+              type: 'sdk-init',
+              sessionId: msg.session_id,
+              model: msg.model,
+              slashCommands: msg.slash_commands,
+              tools: msg.tools,
+              cwd: _cwd,
+              instanceKey,
+            };
+            _broadcastWs(_lastInitSnapshot);
+          }
+          // Skill menu surface: pull the full supportedCommands() (name + description +
+          // argumentHint) once per resident-query generation. Done even when slash_commands
+          // is empty/absent — a session with no TUI commands can still expose skills.
+          // supportedCommands() returns the whole command surface (incl. /clear, /compact,
+          // /model, /usage), so keep ONLY real skills: intersect with the init frame's
+          // `skills` allowlist (name / plugin:skill / :suffix forms) to honour the
+          // "slash menu indexes skills only" decision.
+          if (_broadcastWs && _activeQuery && _skillsLoadedQuery !== _activeQuery) {
+            _skillsLoadedQuery = _activeQuery;
+            _initSkills = Array.isArray(msg.skills) ? msg.skills : null;
+            _loadSupportedCommands();
+          }
         } else if (msg.subtype === 'compact_boundary' && _broadcastWs) {
           const meta = msg.compact_metadata;
           _broadcastWs({
@@ -952,6 +975,58 @@ function _createSession(key, cwd) {
     }
   }
 
+  /**
+   * Pull the SDK's supportedCommands() (skill surface: name + description + argumentHint)
+   * once per resident-query generation and broadcast it as an `sdk-skills` frame, retained
+   * for WS reconnect replay. Fire-and-forget from the init branch — never awaited. Bounded
+   * by CTX_USAGE_TIMEOUT_MS; on timeout/rejection/stale generation it reports and broadcasts
+   * nothing (clients fall back to /api/skills). Raw commands are passed through; the web
+   * client's normalizeSdkCommands does the safe-name filtering.
+   */
+  function _loadSupportedCommands() {
+    const q = _activeQuery;
+    if (!q || typeof q.supportedCommands !== 'function') return;
+    let timeoutId;
+    const timeout = new Promise((_, reject) => {
+      timeoutId = setTimeout(() => reject(new Error('supportedCommands timeout')), CTX_USAGE_TIMEOUT_MS);
+      if (timeoutId.unref) timeoutId.unref();
+    });
+    Promise.race([Promise.resolve().then(() => q.supportedCommands()), timeout]).then((commands) => {
+      if (_activeQuery !== q) return; // stale generation (session switch/death) — drop
+      // Keep only real skills: supportedCommands() also returns TUI built-ins (/clear,
+      // /compact, /model, /usage). When the init frame supplied a skills allowlist, filter
+      // by it (name, plugin:skill, or :suffix). No allowlist → pass through (conservative).
+      let filtered = Array.isArray(commands) ? commands : [];
+      if (Array.isArray(_initSkills) && _initSkills.length > 0) {
+        const allow = new Set();
+        for (const s of _initSkills) {
+          if (typeof s !== 'string' || !s) continue;
+          allow.add(s);                       // exact (name or plugin:skill)
+          const idx = s.lastIndexOf(':');
+          if (idx >= 0) allow.add(s.slice(idx + 1)); // :suffix form → bare name
+        }
+        filtered = filtered.filter(c => c && (allow.has(c.name)
+          || (typeof c.name === 'string' && allow.has(c.name.replace(/^plugin.*:/, '')))));
+      }
+      _lastSkillsSnapshot = {
+        type: 'sdk-skills',
+        sessionId: _sessionId || null,
+        ts: Date.now(),
+        cwd: _cwd,
+        instanceKey,
+        commands: filtered,
+      };
+      if (_broadcastWs) {
+        try { _broadcastWs(_lastSkillsSnapshot); }
+        catch (err) { reportSwallowed('sdk-manager.skills-broadcast', err); }
+      }
+    }).catch((err) => {
+      reportSwallowed('sdk-manager.supported-commands', err);
+    }).finally(() => {
+      if (timeoutId) clearTimeout(timeoutId);
+    });
+  }
+
   /**
    * Collect an MCP-server-status snapshot via the Query control surface (`mcp_status`).
    * Returns { ok:true, snapshot } | { ok:false, reason:'session-inactive'|'control-failed' }.
@@ -1103,6 +1178,38 @@ function _createSession(key, cwd) {
     // Tools that need explicit user approval via Web UI (mutating or external access).
     // The six-tool set is shared with the PTY perm-bridge via approval-policy.js.
     if (!APPROVAL_TOOLS.has(toolName)) {
+      // Read/Glob/Grep outside the session cwd would still hit Claude Code's own ask
+      // rules even if we allow here. Only add a session-level directory grant when the
+      // user has enabled auto-approval; otherwise the plain allow still stands but the
+      // directory is not trusted for subsequent calls.
+      if (toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep') {
+        const prefs = readPrefsRaw();
+        const autoApproveSeconds = Number(prefs.autoApproveSeconds);
+        const shouldGrantDir = autoApproveSeconds === -1 || autoApproveSeconds > 0;
+        const sessionCwd = _cwd || process.env.CCV_PROJECT_DIR;
+        if (sessionCwd && shouldGrantDir) {
+          let targetDir = null;
+          if (toolName === 'Read' && typeof input?.file_path === 'string') {
+            targetDir = _pathDirname(_pathResolve(input.file_path));
+          } else if ((toolName === 'Glob' || toolName === 'Grep') && typeof input?.pattern === 'string') {
+            targetDir = input.path ? _pathResolve(input.path) : _pathResolve(sessionCwd);
+          }
+          if (targetDir) {
+            const root = _pathResolve(sessionCwd);
+            if (!(targetDir === root || targetDir.startsWith(root + _pathSep))) {
+              if (!isOverTrustDir(targetDir)) {
+                return {
+                  behavior: 'allow',
+                  updatedInput: input,
+                  updatedPermissions: [
+                    { type: 'addDirectories', directories: [targetDir], destination: 'session' },
+                  ],
+                };
+              }
+            }
+          }
+        }
+      }
       return { behavior: 'allow', updatedInput: input };
     }
 
@@ -1431,6 +1538,7 @@ function _createSession(key, cwd) {
       _launchResume = null;
       _initAnnouncedSid = '';
       _lastInitSnapshot = null; // don't replay the OLD session's sdk-init to the new one
+      _lastSkillsSnapshot = null; // same for the skill surface
       _lastSessionState = null; // same for the session-state snapshot — new session starts idle
       _clearContextUsage('session-switched');
       _clearMcpStatus('session-switched');
@@ -1452,6 +1560,7 @@ function _createSession(key, cwd) {
     _turnInFlight = false;
     _initAnnouncedSid = '';
     _lastInitSnapshot = null;
+    _lastSkillsSnapshot = null;
     // Tell clients BEFORE nulling the snapshot: a re-init/launch mid-turn would
     // otherwise leave the spinner lit with no frame ever clearing it (the new
     // session starts idle and the state-change guard would swallow the first
@@ -1513,6 +1622,7 @@ function _createSession(key, cwd) {
     },
     getContextUsageSnapshot: () => _lastContextUsage,
     getMcpStatusSnapshot: () => _lastMcpStatus,
+    getSkillsSnapshot: () => _lastSkillsSnapshot,
     fetchContextUsage: async () => {
       // On-demand fetch for the HTTP route: refresh the snapshot, broadcast to all clients,
       // then reply. Unlike _refreshContextUsage this bypasses the in-flight gate (an explicit
@@ -1867,6 +1977,16 @@ export function getSdkInitSnapshot(anchor) {
   return sess ? sess.getSdkInitSnapshot() : null;
 }
 
+/**
+ * Last sdk-skills frame (supportedCommands() result) for WS reconnect replay. Null until
+ * the first init-driven pull resolves; an absent frame leaves the client on its /api/skills
+ * fallback. No anchor → active session.
+ */
+export function getSkillsSnapshot(anchor) {
+  const sess = anchor ? _sessionForAnchor(anchor) : _active();
+  return sess ? sess.getSkillsSnapshot() : null;
+}
+
 /**
  * Last announced session-state frame for WS reconnect replay (sdk-init snapshot
  * parity). Null until the first state transition — a fresh session is idle, and an

package/server/routes/ask-perm.js

@@ -4,6 +4,9 @@ import { runWaterfallHook, runParallelHook } from '../lib/plugin-loader.js';
 import { sendEventToClients } from '../lib/log-watcher.js';
 import { filterClientsByScope } from '../lib/v2/view-router.js';
 import { _projectName } from '../interceptor.js';
+import { readPrefsRaw } from '../lib/prefs-store.js';
+import { getCurrentProjectKey, hasFork, resolveScoped } from '../lib/project-prefs.js';
+import { reportSwallowed } from '@ccv/core/error-report';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {
@@ -376,15 +379,20 @@ function askHookCancel(req, res, parsedUrl, isLocal, deps) {
 // Permission hook bridge: receive tool permission request from perm-bridge.js, long-poll for user decision
 function permHook(req, res, parsedUrl, isLocal, deps) {
   let body = '';
+  let bodyTooLarge = false;
   req.on('data', (chunk) => {
+    if (bodyTooLarge) return;
     body += chunk;
     if (body.length > 1000000) {
-      res.writeHead(413, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Request body too large' }));
-      return;
+      bodyTooLarge = true;
+      req.destroy();
     }
   });
   req.on('end', async () => {
+    if (bodyTooLarge) {
+      try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+      return;
+    }
     try {
       const { toolName, input } = JSON.parse(body);
       if (!toolName) {
@@ -472,6 +480,88 @@ function permHook(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// PermissionRequest hook bridge: receive permission-prompt notification from
+// perm-request-bridge.js and decide whether to auto-approve based on the current
+// project's autoApproveSeconds preference. This runs when a permission prompt is
+// about to be shown (e.g. Read/Glob outside the launch directory) and lets us
+// suppress it silently when the user has enabled auto-approval.
+//
+// Security model: this endpoint is a machine bridge (called by the loopback
+// perm-request-bridge.js hook), not a user prefs read. It must therefore resolve
+// the project fork from the payload cwd regardless of isLocal, and restrict the
+// silent allow to Read/Glob only — all other tools return 'ask' so user ask-rules
+// and sensitive operations still prompt.
+function permRequestHook(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  let bodyTooLarge = false;
+  req.on('data', (chunk) => {
+    if (bodyTooLarge) return;
+    body += chunk;
+    if (body.length > 1000000) {
+      bodyTooLarge = true;
+      req.destroy();
+    }
+  });
+  req.on('end', async () => {
+    if (bodyTooLarge) {
+      try { if (!res.headersSent) { res.writeHead(413, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Request body too large' })); } } catch {}
+      return;
+    }
+    try {
+      const { toolName, input, cwd } = JSON.parse(body);
+      if (!toolName) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Missing toolName' }));
+        return;
+      }
+
+      // Only Read/Glob/Grep may be silently allowed; everything else falls through to
+      // the normal prompt so user-configured ask rules are never bypassed.
+      if (toolName !== 'Read' && toolName !== 'Glob' && toolName !== 'Grep') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ decision: 'ask' }));
+        return;
+      }
+
+      // Plugin hook: let plugins handle permission requests directly.
+      try {
+        const hookResult = await runWaterfallHook('onPermRequest', { toolName, input, mode: 'permission-request' });
+        if (hookResult.decision === 'allow' || hookResult.decision === 'deny') {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ decision: hookResult.decision }));
+          return;
+        }
+      } catch (err) { reportSwallowed('ask-perm.permRequestHook.waterfall', err); }
+
+      const prefs = readPrefsRaw(deps.getPrefsFile?.() || undefined);
+      // Resolve the project fork from the payload cwd (the actual session cwd),
+      // not the server's current CCV_PROJECT_DIR, so multi-workspace setups read
+      // the correct project's autoApproveSeconds.
+      const projectKey = typeof cwd === 'string' && cwd ? cwd : getCurrentProjectKey();
+      const scoped = hasFork(prefs, projectKey);
+      const effective = scoped ? resolveScoped(prefs, prefs.prefsByProject[projectKey]) : prefs;
+      const autoApproveSeconds = Number(effective.autoApproveSeconds);
+
+      // autoApproveSeconds: 0 = off/manual, >0 = countdown, -1 = instant.
+      // For PermissionRequest the prompt is already imminent; we only suppress it
+      // when the user has explicitly enabled auto-approval. Both instant (-1) and
+      // countdown (>0) are treated as allow here because the user has already
+      // opted into automatic approval; the countdown variant simply adds a visible
+      // delay in the UI, which is irrelevant for a headless hook.
+      const shouldAutoAllow = autoApproveSeconds === -1 || autoApproveSeconds > 0;
+
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ decision: shouldAutoAllow ? 'allow' : 'ask' }));
+    } catch (err) {
+      reportSwallowed('ask-perm.permRequestHook.parse', err);
+      if (!res.headersSent) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid request body' }));
+      }
+    }
+  });
+}
+
 // 流式 chunk 接收端点：interceptor 在 SSE 流过程中推送的 partial entry
 // 仅广播，不落盘。前端按 timestamp|url 自动与最终 entry 去重覆盖。
 // 鉴权：server 绑 0.0.0.0 允许同机任意进程访问，必须校验 remote 必须是 loopback
@@ -556,5 +646,6 @@ export const askPermRoutes = [
   { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/result') && method === 'GET', handler: askHookResult },
   { predicate: (url, method) => url.startsWith('/api/ask-hook/') && url.includes('/cancel') && method === 'POST', handler: askHookCancel },
   { method: 'POST', match: 'exact', path: '/api/perm-hook', handler: permHook },
+  { method: 'POST', match: 'exact', path: '/api/perm-request-hook', handler: permRequestHook },
   { method: 'POST', match: 'exact', path: '/api/stream-chunk', handler: streamChunk },
 ];