cc-viewer 1.9.9 → 1.9.10

package/server/lib/v2/jsonl-read.js

@@ -14,7 +14,7 @@
 // mirroring readJsonlTolerant's torn-tail tolerance (spec §14).
 
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 
 const DEFAULT_CHUNK_BYTES = 8 * 1024 * 1024;
 // Node's max string length is 0x1fffffe8 (~512MiB) — a line this long can

package/server/lib/v2/live-feed.js

@@ -24,7 +24,7 @@
 
 import { watch, existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 import { createIncrementalReconstructor } from '@ccv/core/delta-reconstructor';
 import { processWatchedEntry, sendEventToClients, sendEventRawToClients } from '../log-watcher.js';
 import { filterClientsByInstance } from './view-router.js';

package/server/lib/v2/meta-rows.js

@@ -21,7 +21,7 @@ import { readJsonlTolerant } from './replay.js';
 import { iterateJsonlLines } from './jsonl-read.js';
 import { iterateV2Items, findTeammateSessionDirs } from './adapter.js';
 import { SingleFlight } from './singleflight.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 import { classifyRequest, withAgentNameSubType } from '@ccv/core/requestType';
 
 // KEEP IN SYNC: server/lib/v2/adapter.js itemKey — (sessionId, seq) identity.

package/server/lib/v2/resume-list.js

@@ -25,7 +25,7 @@ import { summarizeSessionPage } from './session-list.js';
 import { sessionHasMainOrTeammateReq } from './session-select.js';
 import { readPin } from '../session-pin-store.js';
 import { LIVE_SESSION_MTIME_MS } from '../log-file-utils.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 
 /**
  * Liveness heuristic for the "running" placeholder column. A session is

package/server/lib/v2/session-list.js

@@ -26,7 +26,7 @@ import { listSessionIds, readJsonlTolerant } from './replay.js';
 import { readPromptsHead, collectPromptsFromEvents } from '../user-prompt-extract.js';
 import { isDiscardableSession } from './session-select.js';
 import { isSupportedWireFormat, dirSizeSync } from './layout.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 
 const MAX_PROJECTS = 32;
 

package/server/lib/v2/session-owner.js

@@ -26,7 +26,7 @@
 import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { isPidAlive } from '../pid-alive.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 
 export const OWNER_LOCK_NAME = 'owner.lock';
 

package/server/lib/v2/v2-writer.js

@@ -19,7 +19,7 @@
 import { statfsSync, existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join, basename, sep } from 'node:path';
 import { AsyncWriteQueue } from '../async-write-queue.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../../lib/error-report.js';
 import { ensureSessionDirSync, compactLocalTs14, sanitizePathComponent, normalizeSessionCwd } from './layout.js';
 import { resolveSessionDirName, latestMainSession } from './session-select.js';
 import { acquireSessionClaim, releaseSessionClaim, isForeignLiveOwned } from './session-owner.js';

package/server/lib/wire-compress.js

@@ -19,7 +19,7 @@
  * knee on large sessions; q5 collapses to ~2.5x there).
  */
 import zlib from 'node:zlib';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { awaitDrainOrClose } from './sse-backpressure.js';
 
 const C = zlib.constants;

package/server/lib/ws-mux.js

@@ -42,7 +42,7 @@
  */
 import { randomBytes } from 'node:crypto';
 import { EventEmitter } from 'node:events';
-import { reportSwallowed as defaultReport } from '@ccv/core/error-report';
+import { reportSwallowed as defaultReport } from '../lib/error-report.js';
 import { createBackpressureGate } from './ws-backpressure.js';
 
 const STREAM_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;

package/server/proxy.js

@@ -13,7 +13,7 @@ import { parseAgentId, findHeader } from './lib/v2/agent-id.js';
 import { liveSystemPromptEnabled } from './lib/system-prompt-live.js';
 import { executeRequest, extractModel } from './lib/proxy/proxy-retry.js';
 import { buildRecord, appendRecord, dailyFilePath, todayStr, emitProxyStatsUpdate } from './lib/proxy/proxy-stats.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from './lib/error-report.js';
 import { LOG_DIR } from '../findcc.js';
 
 // Setup interceptor to patch fetch

package/server/pty-manager.js

@@ -17,7 +17,7 @@ import { randomBytes } from 'node:crypto';
 // (shared with the SDK link). Re-exported here for existing consumers/tests.
 import { withDefaultThinkingDisplay, resolveLaunchSystemPrompt, insertBeforeDashDash } from './lib/launch-config.js';
 export { withDefaultThinkingDisplay } from './lib/launch-config.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from './lib/error-report.js';
 import { t, tFor } from './i18n.js';
 
 const __filename = fileURLToPath(import.meta.url);

package/server/routes/ask-perm.js

@@ -6,7 +6,7 @@ import { filterClientsByScope } from '../lib/v2/view-router.js';
 import { _projectName } from '../interceptor.js';
 import { readPrefsRaw } from '../lib/prefs-store.js';
 import { getCurrentProjectKey, hasFork, resolveScoped } from '../lib/project-prefs.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 
 function pendingAsks(req, res, parsedUrl, isLocal, deps) {
   try {

package/server/routes/events.js

@@ -5,7 +5,7 @@ import { _projectName, getLiveLogSource, isContinuedLaunch } from '../intercepto
 import { LOG_DIR } from '../../findcc.js';
 import { streamRawEntriesAsync } from '../lib/log-stream.js';
 import { migrationStatus } from '../lib/v2/migrate-prompt.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { sseHead, sseWrite, needsDrain, wireEnd, awaitWireDrain, isWireV3Enabled } from '../lib/wire-compress.js';
 import { scopeKeyForProducer } from '../lib/scope-router.js';
 import { readV2ColdBundle } from '../lib/v2/meta-rows.js';

package/server/routes/expert.js

@@ -19,7 +19,7 @@ import {
   matchBuiltinModelPrompt, isBuiltinDisabled,
   readBuiltinDisabled, setBuiltinDisabled, listBuiltinModelPrompts,
 } from '../lib/builtin-model-prompts.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { resolveSpawnModel } from '../lib/spawn-model-resolver.js';
 import { listSystemPromptPresets, groupPresetsByCategory, getSystemPromptVariablesDoc } from '../lib/system-prompt-presets.js';
 import { LOG_DIR } from '../../findcc.js';

package/server/routes/files-content.js

@@ -6,7 +6,7 @@ import { ERROR_STATUS_MAP } from '../lib/file-api.js';
 import { viewRootOrReply } from '../lib/view-root.js';
 import { loadWorkspaces } from '../workspace-registry.js';
 import { listLivePtys } from '../pty-manager.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { discoverClaudeMdCandidates, readCandidateById } from '../lib/claude-md-discovery.js';
 import { getClaudeConfigDir } from '../../findcc.js';
 import { _projectName } from '../interceptor.js';

package/server/routes/files-fs.js

@@ -125,8 +125,10 @@ function importFile(req, res, parsedUrl, isLocal, deps) {
     res.end(JSON.stringify({ error: 'Missing boundary' }));
     return;
   }
-  const importUrl = new URL(req.url, `${deps.protocol}://${req.headers.host}`);
-  const dir = importUrl.searchParams.get('dir') || '';
+  // Reuse the parsedUrl that handleRequest already validated: req.headers.host may be a
+  // malformed value llhttp accepts but URL parsing rejects, and a fresh new URL() here
+  // would throw synchronously inside dispatch → unhandled rejection.
+  const dir = parsedUrl.searchParams.get('dir') || '';
   // 在 mkdirSync 之前纯字符串校验，防 symlink 副作用目录被创建在项目外
   const dirCheck = validateImportDir(dir);
   if (!dirCheck.ok) {

package/server/routes/misc.js

@@ -2,6 +2,8 @@
 import { getUserProfile } from '../lib/user-profile.js';
 import { runWaterfallHook } from '../lib/plugin-loader.js';
 import { normalizeBasePath } from '../lib/base-path.js';
+import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
 
 async function userProfile(req, res) {
   const profile = await getUserProfile();
@@ -10,6 +12,15 @@ async function userProfile(req, res) {
 }
 
 async function localUrl(req, res, parsedUrl, isLocal, deps) {
+  // The response embeds the full ACCESS_TOKEN. Without this gate the permissive global
+  // CORS prelude would let any cross-site page read the token from a loopback server
+  // (loopback skips auth) and then bypass every Origin/admin check end-to-end.
+  // CLI/native clients (no Origin header) and same-origin admin pages stay allowed.
+  if (!isAdminReq(req, isLocal) || !isSameOriginBrowserRequest(req, parsedUrl)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Forbidden: admin and same-origin required' }));
+    return;
+  }
   const localIp = deps.getLocalIp();
   // 反代子路径部署时分享/二维码 URL 也要带前缀，否则扫码绕过代理直连源站端口（与
   // server.startedNetwork 启动打印保持一致）。未设 CCV_BASE_PATH 时为空串，行为不变。

package/server/routes/plugin-services.js

@@ -0,0 +1,104 @@
+// Routes for service-plugin proxies (/plugins/<name>/*) and panel bundles
+// (/plugin-panels/<name>/*). Registered in server.js's _routes after pluginsRoutes.
+// Unknown plugin names return 404 here — requests must NOT fall through to the SPA
+// fallback (it would serve index.html as JS/JSON).
+import { getPluginEntries } from '../lib/plugin-loader.js';
+import { tryProxyHttp } from '../lib/plugin-runtime.js';
+import { servePanelFile } from '../lib/plugin-panels.js';
+import { reportSwallowed } from '../lib/error-report.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+
+function findPanelEntry(name) {
+  for (const entry of getPluginEntries()) {
+    if (entry.shape === 'dir' && entry.enabled && !entry.loadError && entry.panel && entry.name === name) {
+      return entry;
+    }
+  }
+  return null;
+}
+
+function pluginProxyHandler(req, res, parsedUrl) {
+  try {
+    // Plugin services are same-machine capabilities reachable through the main origin.
+    // A cross-site browser page must not drive them just because loopback trusts the
+    // socket peer; CLI/native callers (no Origin) and same-origin pages pass.
+    if (!isSameOriginBrowserRequest(req, parsedUrl)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Forbidden: cross-site plugin proxy request' }));
+      return;
+    }
+    const handled = tryProxyHttp(req, res, parsedUrl);
+    if (!handled) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'unknown plugin service' }));
+    }
+  } catch (err) {
+    reportSwallowed('plugin-services.proxy-route', err);
+    try {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'plugin proxy failure' }));
+      } else {
+        res.destroy();
+      }
+    } catch { /* noop */ }
+  }
+}
+
+function pluginPanelHandler(req, res, parsedUrl) {
+  try {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('method not allowed');
+      return;
+    }
+    // /plugin-panels/<name>/<rel...>
+    const rest = parsedUrl.pathname.slice('/plugin-panels/'.length);
+    const slash = rest.indexOf('/');
+    const name = slash === -1 ? rest : rest.slice(0, slash);
+    const relPath = slash === -1 ? '' : rest.slice(slash + 1);
+    let decodedName;
+    try {
+      decodedName = decodeURIComponent(name);
+    } catch {
+      res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('bad plugin name');
+      return;
+    }
+    const entry = findPanelEntry(decodedName);
+    if (!entry) {
+      res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('unknown plugin panel');
+      return;
+    }
+    if (!relPath) {
+      // Bare directory path -> entry bundle (relative rootDir = drop the first segment of entryRel)
+      const entryRel = entry.panel.entryRel;
+      const rel = entryRel.slice(entryRel.indexOf('/') + 1);
+      servePanelFile(req, res, entry, rel);
+      return;
+    }
+    servePanelFile(req, res, entry, relPath);
+  } catch (err) {
+    reportSwallowed('plugin-services.panel-route', err);
+    try {
+      if (!res.headersSent) {
+        res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end('panel route failure');
+      } else {
+        res.destroy();
+      }
+    } catch { /* noop */ }
+  }
+}
+
+export const pluginServicesRoutes = [
+  {
+    predicate: (url) => url === '/plugins' || url.startsWith('/plugins/'),
+    handler: pluginProxyHandler,
+  },
+  {
+    predicate: (url) => url === '/plugin-panels' || url.startsWith('/plugin-panels/'),
+    handler: pluginPanelHandler,
+  },
+];

package/server/routes/plugins.js

@@ -1,17 +1,84 @@
 // Plugin management routes (moved verbatim from server.js handleRequest).
+// Write operations go through the plugin runtime's single-flight queue so service
+// plugins are deactivated/stopped/re-spawned — never a bare loadPlugins() that would
+// leave child processes behind.
 import { existsSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
-import { loadPlugins, getPluginsInfo, getPluginsDir } from '../lib/plugin-loader.js';
-import { uploadPlugins, installPluginFromUrl } from '../lib/plugin-manager.js';
+import { getPluginsInfo, getPluginsDir, getPluginEntries } from '../lib/plugin-loader.js';
+import { uploadPlugins, installPluginFromUrl, deletePluginDir } from '../lib/plugin-manager.js';
+import {
+  reloadRuntime,
+  unloadPlugin,
+  restartPlugin,
+  getRuntimePluginStatus,
+  isRuntimeStopping,
+} from '../lib/plugin-runtime.js';
+import { buildPanelDescriptor } from '../lib/plugin-panels.js';
 import { SERVER_LIB } from '../_paths.js';
+import { reportSwallowed } from '../lib/error-report.js';
+import { isAdminReq } from '../lib/is-admin.js';
+import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+
+// Write endpoints execute arbitrary plugin code (reload/restart), install remote files,
+// or delete on-disk plugins. They require an admin AND a same-origin browser context:
+// the global ACAO:* prelude would otherwise let a cross-site page drive a localhost
+// server that trusts its socket peer. CLI/native clients (no Origin) stay allowed.
+function rejectWrite(req, res, isLocal, parsedUrl) {
+  // Refuse during the shutdown teardown window: a reload/restart accepted here could
+  // spawn a child after onServerStopping already swept the runtime, leaking a lock file.
+  if (isRuntimeStopping()) {
+    res.writeHead(503, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'server is stopping' }));
+    return true;
+  }
+  if (isAdminReq(req, isLocal) && isSameOriginBrowserRequest(req, parsedUrl)) return false;
+  res.writeHead(403, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ error: 'Forbidden: admin and same-origin required' }));
+  return true;
+}
+
+function decorateWithRuntime(plugins) {
+  return plugins.map(p => {
+    // Only service plugins have a service status; lifecycle-only dir plugins also get a
+    // runtime entry, but exposing it as serviceStatus would imply a service exists.
+    if (p.type !== 'service') return p;
+    const status = getRuntimePluginStatus(p.name);
+    return status ? { ...p, serviceStatus: status } : p;
+  });
+}
 
 function pluginsList(req, res) {
-  const plugins = getPluginsInfo();
+  const plugins = decorateWithRuntime(getPluginsInfo());
   res.writeHead(200, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify({ plugins, pluginsDir: getPluginsDir() }));
 }
 
-async function pluginsDelete(req, res, parsedUrl) {
+async function pluginsDelete(req, res, parsedUrl, isLocal) {
+  if (rejectWrite(req, res, isLocal, parsedUrl)) return;
+  const dir = parsedUrl.searchParams.get('dir');
+  if (dir) {
+    try {
+      const unloaded = await unloadPlugin(dir, 'delete');
+      if (!unloaded.ok) {
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: unloaded.error || 'plugin runtime is stopping' }));
+        return;
+      }
+      deletePluginDir(getPluginsDir(), dir);
+      const result = await reloadRuntime();
+      if (!result.ok) {
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: result.error || 'plugin runtime is stopping' }));
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, plugins: decorateWithRuntime(getPluginsInfo()), pluginsDir: getPluginsDir(), generation: result.generation }));
+    } catch (err) {
+      res.writeHead(err.statusCode || 500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+    return;
+  }
   const file = parsedUrl.searchParams.get('file');
   if (!file || file.includes('..') || file.includes('/') || file.includes('\\')) {
     res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -26,39 +93,93 @@ async function pluginsDelete(req, res, parsedUrl) {
       return;
     }
     unlinkSync(filePath);
-    await loadPlugins();
-    const plugins = getPluginsInfo();
+    const result = await reloadRuntime();
+    if (!result.ok) {
+      res.writeHead(503, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: result.error || 'plugin runtime is stopping' }));
+      return;
+    }
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+    res.end(JSON.stringify({ ok: true, plugins: decorateWithRuntime(getPluginsInfo()), pluginsDir: getPluginsDir(), generation: result.generation }));
   } catch (err) {
     res.writeHead(500, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: err.message }));
   }
 }
 
-async function pluginsReload(req, res) {
+async function pluginsReload(req, res, parsedUrl, isLocal) {
+  if (rejectWrite(req, res, isLocal, parsedUrl)) return;
   try {
-    await loadPlugins();
-    const plugins = getPluginsInfo();
+    // ?reason=disable: the UI disable toggle goes through preferences + reload, so deactivate must receive 'disable'
+    const reason = parsedUrl && parsedUrl.searchParams.get('reason');
+    const result = await reloadRuntime(reason === 'disable' ? { reason: 'disable' } : {});
+    if (!result.ok) {
+      res.writeHead(503, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: result.error || 'plugin runtime is stopping' }));
+      return;
+    }
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+    res.end(JSON.stringify({ ok: true, plugins: decorateWithRuntime(getPluginsInfo()), pluginsDir: getPluginsDir(), generation: result.generation }));
+  } catch (err) {
+    reportSwallowed('plugins.reload', err);
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function pluginsRestart(req, res, parsedUrl, isLocal) {
+  if (rejectWrite(req, res, isLocal, parsedUrl)) return;
+  const name = parsedUrl.searchParams.get('name');
+  if (!name) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'name is required' }));
+    return;
+  }
+  try {
+    const result = await restartPlugin(name);
+    res.writeHead(result.ok ? 200 : 400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    reportSwallowed('plugins.restart', err);
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+function pluginPanelsList(req, res) {
+  try {
+    const panels = [];
+    for (const entry of getPluginEntries()) {
+      if (entry.shape !== 'dir' || !entry.enabled || entry.loadError || !entry.panel) continue;
+      const status = getRuntimePluginStatus(entry.name);
+      panels.push(buildPanelDescriptor(entry, { serviceStatus: status }));
+    }
+    panels.sort((a, b) => a.name.localeCompare(b.name));
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ ok: true, panels }));
   } catch (err) {
+    reportSwallowed('plugins.panels', err);
     res.writeHead(500, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: err.message }));
   }
 }
 
 function pluginsUpload(req, res, parsedUrl, isLocal, deps) {
+  if (rejectWrite(req, res, isLocal, parsedUrl)) return;
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
   req.on('end', async () => {
     try {
       const { files: fileList } = JSON.parse(body);
       uploadPlugins(getPluginsDir(), fileList);
-      await loadPlugins();
-      const plugins = getPluginsInfo();
+      const result = await reloadRuntime();
+      if (!result.ok) {
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: result.error || 'plugin runtime is stopping' }));
+        return;
+      }
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+      res.end(JSON.stringify({ ok: true, plugins: decorateWithRuntime(getPluginsInfo()), pluginsDir: getPluginsDir(), generation: result.generation }));
     } catch (err) {
       const status = err.statusCode || 500;
       res.writeHead(status, { 'Content-Type': 'application/json' });
@@ -68,6 +189,7 @@ function pluginsUpload(req, res, parsedUrl, isLocal, deps) {
 }
 
 function pluginsInstallFromUrl(req, res, parsedUrl, isLocal, deps) {
+  if (rejectWrite(req, res, isLocal, parsedUrl)) return;
   let body = '';
   req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
   req.on('end', async () => {
@@ -75,10 +197,14 @@ function pluginsInstallFromUrl(req, res, parsedUrl, isLocal, deps) {
       const { url: fileUrl } = JSON.parse(body);
       const extractScript = join(SERVER_LIB, 'extract-plugin-name.mjs');
       await installPluginFromUrl(getPluginsDir(), fileUrl, extractScript);
-      await loadPlugins();
-      const plugins = getPluginsInfo();
+      const result = await reloadRuntime();
+      if (!result.ok) {
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: result.error || 'plugin runtime is stopping' }));
+        return;
+      }
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+      res.end(JSON.stringify({ ok: true, plugins: decorateWithRuntime(getPluginsInfo()), pluginsDir: getPluginsDir(), generation: result.generation }));
     } catch (err) {
       const status = err.statusCode || 500;
       res.writeHead(status, { 'Content-Type': 'application/json' });
@@ -91,6 +217,8 @@ export const pluginsRoutes = [
   { method: 'GET', match: 'exact', path: '/api/plugins', handler: pluginsList },
   { method: 'DELETE', match: 'exact', path: '/api/plugins', handler: pluginsDelete },
   { method: 'POST', match: 'exact', path: '/api/plugins/reload', handler: pluginsReload },
+  { method: 'POST', match: 'exact', path: '/api/plugins/restart', handler: pluginsRestart },
+  { method: 'GET', match: 'exact', path: '/api/plugin-panels', handler: pluginPanelsList },
   { method: 'POST', match: 'exact', path: '/api/plugins/upload', handler: pluginsUpload },
   { method: 'POST', match: 'exact', path: '/api/plugins/install-from-url', handler: pluginsInstallFromUrl },
 ];

package/server/routes/preferences.js

@@ -7,7 +7,7 @@ import { PROFILE_PATH, _defaultConfig, getActiveProfileId, getStoredRoles, isOff
 import { migrateProxyProfileList, isValidRoleValue, PROXY_ROLE_KEYS } from '../lib/interceptor-core.js';
 import { DEFAULT_RETRY_CONFIG, validateRetryConfig, resolveRetryConfig } from '../lib/proxy/proxy-retry.js';
 import { discoverCcSwitchProviders, mergeImportedProfiles } from '../lib/ccswitch-import.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { setLang } from '../i18n.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';

package/server/routes/resume.js

@@ -53,7 +53,7 @@ import { bumpWorkspacesVersion } from '../lib/file-access-policy.js';
 import { isAdminReq } from '../lib/is-admin.js';
 import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
 import { sseWrite } from '../lib/wire-compress.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 import { findSdkSessionByInstance, listSdkSessionInstances } from '../lib/sdk-session-index.js';
 
 function sendJson(res, code, obj) {

package/server/routes/sdk-context.js

@@ -2,7 +2,7 @@
 // the automatic turn-end/compact refreshes flow over the WS broadcast instead. A
 // `session-inactive` outcome is a NORMAL state (no turn run yet / query dead), so it
 // returns 200 with { ok:false, reason } rather than an HTTP error.
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 
 async function sdkContextUsage(req, res) {
   try {

package/server/routes/sdk-mcp-status.js

@@ -2,7 +2,7 @@
 // pull; there is no turn-driven refresh (MCP status is not turn-correlated). A
 // `session-inactive` outcome is a NORMAL state (no turn run yet / query dead), so it
 // returns 200 with { ok:false, reason } rather than an HTTP error.
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 
 async function sdkMcpStatus(req, res) {
   try {

package/server/routes/workspaces.js

@@ -4,7 +4,7 @@ import { basename } from 'node:path';
 import { initForWorkspace, resetWorkspace, getLiveLogSource, markContinuedLaunch, markForkSession, markResumeSession, isContinuedLaunch, clearScopeState } from '../interceptor.js';
 import { LOG_DIR } from '../../findcc.js';
 import { migrationStatus } from '../lib/v2/migrate-prompt.js';
-import { reportSwallowed } from '@ccv/core/error-report';
+import { reportSwallowed } from '../lib/error-report.js';
 
 // P2: claude continuation flags — the workspace launcher injects `-c` itself
 // (WorkspaceList's logCount heuristic), so argv scanning in cli.js never sees