claude-opencode-viewer 2.6.51 → 2.6.53

package/bin/cov.js

@@ -88,6 +88,7 @@ const serverArgs = [SERVER_PATH, String(port)];
 if (args.includes('--pc')) serverArgs.push('--pc');
 if (args.includes('--https')) serverArgs.push('--https');
 if (args.includes('--json')) serverArgs.push('--json');
+if (args.includes('--shell')) serverArgs.push('--shell');
 const server = spawn(process.execPath, serverArgs, {
   stdio: 'inherit',
   cwd: process.cwd(),

package/index-pc.html

@@ -956,8 +956,10 @@
       <div id="mode-switcher">
         <span id="mode-label"></span>
         <select id="mode-select">
+          <option value="" disabled selected hidden>--</option>
           <option value="opencode">OpenCode</option>
           <option value="claude">Claude</option>
+          <option value="shell">Shell</option>
         </select>
       </div>
     </div>
@@ -1131,6 +1133,8 @@
         cursorBlink: !isMobile,
         fontSize: fontSize,
         fontFamily: 'Menlo, Monaco, "Courier New", monospace',
+        lineHeight: 1.15,
+        letterSpacing: 0,
         theme: {
           background: '#0a0a0a',
           foreground: '#d4d4d4',
@@ -1675,7 +1679,7 @@
         currentMode = mode;
         modeSelect.value = mode;
         document.getElementById('mode-label').textContent = '';
-        var label = mode === 'claude' ? 'Claude' : 'OpenCode';
+        var label = mode === 'claude' ? 'Claude' : mode === 'shell' ? 'Shell' : 'OpenCode';
         var initOv = document.getElementById('init-overlay');
         initOv.textContent = '正在启动 ' + label + (sessionId ? '（恢复会话）' : '');
         initOv.classList.add('visible');
@@ -1745,7 +1749,11 @@
             else if (msg.type === 'exit') {
               if (!isCreatingNewSession && !isTransitioning) {
                 throttledWrite('\r\n[进程已退出: ' + msg.exitCode + ']\r\n');
-                throttledWrite('按 Enter 键重新启动 ' + currentMode + '...\r\n');
+                if (currentMode === 'shell') {
+                  throttledWrite('shell 已结束，切换上方下拉框可启动 Claude / OpenCode / Shell\r\n');
+                } else {
+                  throttledWrite('按 Enter 键重新启动 ' + currentMode + '...\r\n');
+                }
               }
             }
             else if (msg.type === 'mode') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-opencode-viewer",
-  "version": "2.6.51",
+  "version": "2.6.53",
   "description": "A unified terminal viewer for Claude Code and OpenCode with seamless switching",
   "type": "module",
   "main": "server.js",
@@ -8,6 +8,14 @@
     "cov": "bin/cov.js",
     "claude-opencode-viewer": "bin/cov.js"
   },
+  "files": [
+    "bin/",
+    "server.js",
+    "index.html",
+    "index-pc.html",
+    "install.sh",
+    "README.md"
+  ],
   "scripts": {
     "start": "node server.js",
     "postinstall": "node -e \"console.log('\\n✅ claude-opencode-viewer 安装成功！\\n\\n使用方法:\\n  - 全局启动：cov\\n  - 或通过 npm 启动：npx cov\\n')\""

package/server.js

@@ -19,6 +19,7 @@ const IS_PC = process.argv.includes('--pc');
 const PORT = parseInt(process.argv[2]) || 7008;
 const USE_HTTPS = process.argv.includes('--https');
 const JSON_OUTPUT = process.argv.includes('--json');
+const INIT_SHELL = process.argv.includes('--shell');
 const LOG = JSON_OUTPUT ? console.log.bind(console) : () => {};
 
 // 自签名证书生成（使用 selfsigned 库，不依赖 openssl）
@@ -89,6 +90,7 @@ const execFileAsync = promisify(execFile);
 let ptyModule = null;
 let claudeProcess = null;
 let opencodeProcess = null;
+let shellProcess = null;
 let currentProcess = null;
 let outputBuffer = '';
 const dataListeners = [];
@@ -241,6 +243,11 @@ async function spawnProcess(mode, sessionId = null) {
       args.push('--resume', sessionId);
       LOG(`[claude] 恢复会话: ${sessionId}`);
     }
+  } else if (mode === 'shell') {
+    // 普通 shell 终端: 优先使用 $SHELL，回退到 zsh/bash
+    command = process.env.SHELL || (existsSync('/bin/zsh') ? '/bin/zsh' : '/bin/bash');
+    args = ['-l']; // 登录 shell，加载 PATH/alias
+    LOG(`[shell] 启动 shell: ${command} ${args.join(' ')}`);
   } else {
     const t2 = Date.now();
     command = findCommand('opencode');
@@ -335,6 +342,9 @@ async function spawnProcess(mode, sessionId = null) {
     if (opencodeProcess === proc) {
       opencodeProcess = null;
     }
+    if (shellProcess === proc) {
+      shellProcess = null;
+    }
     // 已被替换的旧进程或切换中的进程，不通知前端
     if (isSwitching || currentProcess !== null) return;
     exitListeners.forEach(cb => cb(exitCode || 0));
@@ -349,6 +359,14 @@ async function spawnProcess(mode, sessionId = null) {
       } catch {}
     }
     claudeProcess = proc;
+  } else if (mode === 'shell') {
+    if (shellProcess && shellProcess !== proc && shellProcess.pid) {
+      try {
+        LOG(`[spawnProcess] 清理旧 shell 进程 PID: ${shellProcess.pid}`);
+        killProcessTree(shellProcess);
+      } catch {}
+    }
+    shellProcess = proc;
   } else {
     if (opencodeProcess && opencodeProcess !== proc && opencodeProcess.pid) {
       try {
@@ -369,7 +387,8 @@ async function spawnProcess(mode, sessionId = null) {
   }
 
   currentProcess = proc;
-  LOG(`[claude-opencode-viewer] ${mode === 'claude' ? 'Claude Code' : 'OpenCode'} 已启动 (PID: ${proc.pid})`);
+  const modeLabel = mode === 'claude' ? 'Claude Code' : mode === 'shell' ? 'Shell' : 'OpenCode';
+  LOG(`[claude-opencode-viewer] ${modeLabel} 已启动 (PID: ${proc.pid})`);
   return proc;
 }
 
@@ -400,6 +419,14 @@ async function switchMode(newMode) {
       LOG('[switchMode] 杀死 opencode 进程失败:', e.message);
     }
     opencodeProcess = null;
+  } else if (currentMode === 'shell' && shellProcess) {
+    try {
+      LOG(`[switchMode] 杀死 shell 进程 PID: ${shellProcess.pid}`);
+      killProcessTree(shellProcess);
+    } catch (e) {
+      LOG('[switchMode] 杀死 shell 进程失败:', e.message);
+    }
+    shellProcess = null;
   }
   currentProcess = null;
 
@@ -1232,7 +1259,8 @@ wssInst.on('connection', (ws, req) => {
       if (msg.type === 'input') {
         // 进程已退出时，自动重新启动（参考 cc-viewer 逻辑）
         // 模式切换/新建会话期间不触发 respawn
-        if (!currentProcess && !isSwitching) {
+        // shell 模式不自动 respawn，避免用户输入 exit 后又被重新拉起
+        if (!currentProcess && !isSwitching && currentMode !== 'shell') {
           try {
             LOG(`[respawn] 进程已退出，自动重新启动 ${currentMode}`);
             outputBuffer = '';
@@ -1494,10 +1522,19 @@ function startServer() {
     // 清理上次 cov 崩溃残留的孤儿进程
     cleanupOrphanProcesses();
 
-
-    // 延迟启动：等待 PC 客户端发送 init 消息后再 spawn 进程
-    // 移动端客户端连接时自动启动 claude（见 WS 连接处理）
-    LOG('[startup] 等待客户端连接并选择会话...');
+    if (INIT_SHELL) {
+      // --shell 模式：启动时直接进入 shell，跳过启动对话框
+      currentMode = 'shell';
+      try {
+        await spawnProcess('shell');
+        LOG('[startup] Shell 已启动');
+      } catch (e) {
+        LOG('[startup] Shell 启动失败:', e.message);
+      }
+    } else {
+      // 延迟启动：等待 PC 客户端发送 init 消息后再 spawn 进程
+      LOG('[startup] 等待客户端连接并选择会话...');
+    }
 
   });
 

package/.agents/skills/code-review-expert/README.md

@@ -1,74 +0,0 @@
-# Code Review Expert
-
-A comprehensive code review skill for AI agents. Performs structured reviews with a senior engineer lens, covering architecture, security, performance, and code quality.
-
-## Installation
-
-```bash
-npx skills add sanyuan0704/sanyuan-skills --path skills/code-review-expert
-```
-
-## Features
-
-- **SOLID Principles** - Detect SRP, OCP, LSP, ISP, DIP violations
-- **Security Scan** - XSS, injection, SSRF, race conditions, auth gaps, secrets leakage
-- **Performance** - N+1 queries, CPU hotspots, missing cache, memory issues
-- **Error Handling** - Swallowed exceptions, async errors, missing boundaries
-- **Boundary Conditions** - Null handling, empty collections, off-by-one, numeric limits
-- **Removal Planning** - Identify dead code with safe deletion plans
-
-## Usage
-
-After installation, simply run:
-
-```
-/code-review-expert
-```
-
-The skill will automatically review your current git changes.
-
-## Workflow
-
-1. **Preflight** - Scope changes via `git diff`
-2. **SOLID + Architecture** - Check design principles
-3. **Removal Candidates** - Find dead/unused code
-4. **Security Scan** - Vulnerability detection
-5. **Code Quality** - Error handling, performance, boundaries
-6. **Output** - Findings by severity (P0-P3)
-7. **Confirmation** - Ask user before implementing fixes
-
-## Severity Levels
-
-| Level | Name | Action |
-|-------|------|--------|
-| P0 | Critical | Must block merge |
-| P1 | High | Should fix before merge |
-| P2 | Medium | Fix or create follow-up |
-| P3 | Low | Optional improvement |
-
-## Structure
-
-```
-code-review-expert/
-├── SKILL.md                 # Main skill definition
-├── agents/
-│   └── agent.yaml           # Agent interface config
-└── references/
-    ├── solid-checklist.md   # SOLID smell prompts
-    ├── security-checklist.md    # Security & reliability
-    ├── code-quality-checklist.md # Error, perf, boundaries
-    └── removal-plan.md      # Deletion planning template
-```
-
-## References
-
-Each checklist provides detailed prompts and anti-patterns:
-
-- **solid-checklist.md** - SOLID violations + common code smells
-- **security-checklist.md** - OWASP risks, race conditions, crypto, supply chain
-- **code-quality-checklist.md** - Error handling, caching, N+1, null safety
-- **removal-plan.md** - Safe vs deferred deletion with rollback plans
-
-## License
-
-MIT

package/.agents/skills/code-review-expert/SKILL.md

@@ -1,156 +0,0 @@
----
-name: code-review-expert
-description: "Expert code review of current git changes with a senior engineer lens. Detects SOLID violations, security risks, and proposes actionable improvements."
----
-
-# Code Review Expert
-
-## Overview
-
-Perform a structured review of the current git changes with focus on SOLID, architecture, removal candidates, and security risks. Default to review-only output unless the user asks to implement changes.
-
-## Severity Levels
-
-| Level | Name | Description | Action |
-|-------|------|-------------|--------|
-| **P0** | Critical | Security vulnerability, data loss risk, correctness bug | Must block merge |
-| **P1** | High | Logic error, significant SOLID violation, performance regression | Should fix before merge |
-| **P2** | Medium | Code smell, maintainability concern, minor SOLID violation | Fix in this PR or create follow-up |
-| **P3** | Low | Style, naming, minor suggestion | Optional improvement |
-
-## Workflow
-
-### 1) Preflight context
-
-- Use `git status -sb`, `git diff --stat`, and `git diff` to scope changes.
-- If needed, use `rg` or `grep` to find related modules, usages, and contracts.
-- Identify entry points, ownership boundaries, and critical paths (auth, payments, data writes, network).
-
-**Edge cases:**
-- **No changes**: If `git diff` is empty, inform user and ask if they want to review staged changes or a specific commit range.
-- **Large diff (>500 lines)**: Summarize by file first, then review in batches by module/feature area.
-- **Mixed concerns**: Group findings by logical feature, not just file order.
-
-### 2) SOLID + architecture smells
-
-- Load `references/solid-checklist.md` for specific prompts.
-- Look for:
-  - **SRP**: Overloaded modules with unrelated responsibilities.
-  - **OCP**: Frequent edits to add behavior instead of extension points.
-  - **LSP**: Subclasses that break expectations or require type checks.
-  - **ISP**: Wide interfaces with unused methods.
-  - **DIP**: High-level logic tied to low-level implementations.
-- When you propose a refactor, explain *why* it improves cohesion/coupling and outline a minimal, safe split.
-- If refactor is non-trivial, propose an incremental plan instead of a large rewrite.
-
-### 3) Removal candidates + iteration plan
-
-- Load `references/removal-plan.md` for template.
-- Identify code that is unused, redundant, or feature-flagged off.
-- Distinguish **safe delete now** vs **defer with plan**.
-- Provide a follow-up plan with concrete steps and checkpoints (tests/metrics).
-
-### 4) Security and reliability scan
-
-- Load `references/security-checklist.md` for coverage.
-- Check for:
-  - XSS, injection (SQL/NoSQL/command), SSRF, path traversal
-  - AuthZ/AuthN gaps, missing tenancy checks
-  - Secret leakage or API keys in logs/env/files
-  - Rate limits, unbounded loops, CPU/memory hotspots
-  - Unsafe deserialization, weak crypto, insecure defaults
-  - **Race conditions**: concurrent access, check-then-act, TOCTOU, missing locks
-- Call out both **exploitability** and **impact**.
-
-### 5) Code quality scan
-
-- Load `references/code-quality-checklist.md` for coverage.
-- Check for:
-  - **Error handling**: swallowed exceptions, overly broad catch, missing error handling, async errors
-  - **Performance**: N+1 queries, CPU-intensive ops in hot paths, missing cache, unbounded memory
-  - **Boundary conditions**: null/undefined handling, empty collections, numeric boundaries, off-by-one
-- Flag issues that may cause silent failures or production incidents.
-
-### 6) Output format
-
-Structure your review as follows:
-
-```markdown
-## Code Review Summary
-
-**Files reviewed**: X files, Y lines changed
-**Overall assessment**: [APPROVE / REQUEST_CHANGES / COMMENT]
-
----
-
-## Findings
-
-### P0 - Critical
-(none or list)
-
-### P1 - High
-1. **[file:line]** Brief title
-  - Description of issue
-  - Suggested fix
-
-### P2 - Medium
-2. (continue numbering across sections)
-  - ...
-
-### P3 - Low
-...
-
----
-
-## Removal/Iteration Plan
-(if applicable)
-
-## Additional Suggestions
-(optional improvements, not blocking)
-```
-
-**Inline comments**: Use this format for file-specific findings:
-```
-::code-comment{file="path/to/file.ts" line="42" severity="P1"}
-Description of the issue and suggested fix.
-::
-```
-
-**Clean review**: If no issues found, explicitly state:
-- What was checked
-- Any areas not covered (e.g., "Did not verify database migrations")
-- Residual risks or recommended follow-up tests
-
-### 7) Next steps confirmation
-
-After presenting findings, ask user how to proceed:
-
-```markdown
----
-
-## Next Steps
-
-I found X issues (P0: _, P1: _, P2: _, P3: _).
-
-**How would you like to proceed?**
-
-1. **Fix all** - I'll implement all suggested fixes
-2. **Fix P0/P1 only** - Address critical and high priority issues
-3. **Fix specific items** - Tell me which issues to fix
-4. **No changes** - Review complete, no implementation needed
-
-Please choose an option or provide specific instructions.
-```
-
-**Important**: Do NOT implement any changes until user explicitly confirms. This is a review-first workflow.
-
-## Resources
-
-### references/
-
-| File | Purpose |
-|------|---------|
-| `solid-checklist.md` | SOLID smell prompts and refactor heuristics |
-| `security-checklist.md` | Web/app security and runtime risk checklist |
-| `code-quality-checklist.md` | Error handling, performance, boundary conditions |
-| `removal-plan.md` | Template for deletion candidates and follow-up plan |

package/.agents/skills/code-review-expert/agents/agent.yaml

@@ -1,7 +0,0 @@
-interface:
-  display_name: "Code Review Expert"
-  short_description: "Senior engineer code review: SOLID, security, performance, error handling"
-  default_prompt: "Review current git changes for SOLID violations, security risks, race conditions, error handling issues, performance problems, and boundary condition bugs."
-
-# Agent-agnostic skill - works with any LLM provider.
-# No provider-specific configuration required.

package/.agents/skills/code-review-expert/references/code-quality-checklist.md

@@ -1,130 +0,0 @@
-# Code Quality Checklist
-
-## Error Handling
-
-### Anti-patterns to Flag
-
-- **Swallowed exceptions**: Empty catch blocks or catch with only logging
-  ```javascript
-  try { ... } catch (e) { }  // Silent failure
-  try { ... } catch (e) { console.log(e) }  // Log and forget
-  ```
-- **Overly broad catch**: Catching `Exception`/`Error` base class instead of specific types
-- **Error information leakage**: Stack traces or internal details exposed to users
-- **Missing error handling**: No try-catch around fallible operations (I/O, network, parsing)
-- **Async error handling**: Unhandled promise rejections, missing `.catch()`, no error boundary
-
-### Best Practices to Check
-
-- [ ] Errors are caught at appropriate boundaries
-- [ ] Error messages are user-friendly (no internal details exposed)
-- [ ] Errors are logged with sufficient context for debugging
-- [ ] Async errors are properly propagated or handled
-- [ ] Fallback behavior is defined for recoverable errors
-- [ ] Critical errors trigger alerts/monitoring
-
-### Questions to Ask
-- "What happens when this operation fails?"
-- "Will the caller know something went wrong?"
-- "Is there enough context to debug this error?"
-
----
-
-## Performance & Caching
-
-### CPU-Intensive Operations
-
-- **Expensive operations in hot paths**: Regex compilation, JSON parsing, crypto in loops
-- **Blocking main thread**: Sync I/O, heavy computation without worker/async
-- **Unnecessary recomputation**: Same calculation done multiple times
-- **Missing memoization**: Pure functions called repeatedly with same inputs
-
-### Database & I/O
-
-- **N+1 queries**: Loop that makes a query per item instead of batch
-  ```javascript
-  // Bad: N+1
-  for (const id of ids) {
-    const user = await db.query(`SELECT * FROM users WHERE id = ?`, id)
-  }
-  // Good: Batch
-  const users = await db.query(`SELECT * FROM users WHERE id IN (?)`, ids)
-  ```
-- **Missing indexes**: Queries on unindexed columns
-- **Over-fetching**: SELECT * when only few columns needed
-- **No pagination**: Loading entire dataset into memory
-
-### Caching Issues
-
-- **Missing cache for expensive operations**: Repeated API calls, DB queries, computations
-- **Cache without TTL**: Stale data served indefinitely
-- **Cache without invalidation strategy**: Data updated but cache not cleared
-- **Cache key collisions**: Insufficient key uniqueness
-- **Caching user-specific data globally**: Security/privacy issue
-
-### Memory
-
-- **Unbounded collections**: Arrays/maps that grow without limit
-- **Large object retention**: Holding references preventing GC
-- **String concatenation in loops**: Use StringBuilder/join instead
-- **Loading large files entirely**: Use streaming instead
-
-### Questions to Ask
-- "What's the time complexity of this operation?"
-- "How does this behave with 10x/100x data?"
-- "Is this result cacheable? Should it be?"
-- "Can this be batched instead of one-by-one?"
-
----
-
-## Boundary Conditions
-
-### Null/Undefined Handling
-
-- **Missing null checks**: Accessing properties on potentially null objects
-- **Truthy/falsy confusion**: `if (value)` when `0` or `""` are valid
-- **Optional chaining overuse**: `a?.b?.c?.d` hiding structural issues
-- **Null vs undefined inconsistency**: Mixed usage without clear convention
-
-### Empty Collections
-
-- **Empty array not handled**: Code assumes array has items
-- **Empty object edge case**: `for...in` or `Object.keys` on empty object
-- **First/last element access**: `arr[0]` or `arr[arr.length-1]` without length check
-
-### Numeric Boundaries
-
-- **Division by zero**: Missing check before division
-- **Integer overflow**: Large numbers exceeding safe integer range
-- **Floating point comparison**: Using `===` instead of epsilon comparison
-- **Negative values**: Index or count that shouldn't be negative
-- **Off-by-one errors**: Loop bounds, array slicing, pagination
-
-### String Boundaries
-
-- **Empty string**: Not handled as edge case
-- **Whitespace-only string**: Passes truthy check but is effectively empty
-- **Very long strings**: No length limits causing memory/display issues
-- **Unicode edge cases**: Emoji, RTL text, combining characters
-
-### Common Patterns to Flag
-
-```javascript
-// Dangerous: no null check
-const name = user.profile.name
-
-// Dangerous: array access without check
-const first = items[0]
-
-// Dangerous: division without check
-const avg = total / count
-
-// Dangerous: truthy check excludes valid values
-if (value) { ... }  // fails for 0, "", false
-```
-
-### Questions to Ask
-- "What if this is null/undefined?"
-- "What if this collection is empty?"
-- "What's the valid range for this number?"
-- "What happens at the boundaries (0, -1, MAX_INT)?"

package/.agents/skills/code-review-expert/references/removal-plan.md

@@ -1,52 +0,0 @@
-# Removal and Iteration Plan Template
-
-## Priority Levels
-
-- [ ] **P0**: Immediate removal needed (security risk, significant cost, blocking other work)
-- [ ] **P1**: Remove in current sprint
-- [ ] **P2**: Backlog / next iteration
-
----
-
-## Safe to Remove Now
-
-### Item: [Name/Description]
-
-| Field | Details |
-|-------|---------|
-| **Location** | `path/to/file.ts:line` |
-| **Rationale** | Why this should be removed |
-| **Evidence** | Unused (no references), dead feature flag, deprecated API |
-| **Impact** | None / Low - no active consumers |
-| **Deletion steps** | 1. Remove code 2. Remove tests 3. Remove config |
-| **Verification** | Run tests, check no runtime errors, monitor logs |
-
----
-
-## Defer Removal (Plan Required)
-
-### Item: [Name/Description]
-
-| Field | Details |
-|-------|---------|
-| **Location** | `path/to/file.ts:line` |
-| **Why defer** | Active consumers, needs migration, stakeholder sign-off |
-| **Preconditions** | Feature flag off for 2 weeks, telemetry shows 0 usage |
-| **Breaking changes** | List any API/contract changes |
-| **Migration plan** | Steps for consumers to migrate |
-| **Timeline** | Target date or sprint |
-| **Owner** | Person/team responsible |
-| **Validation** | Metrics to confirm safe removal (error rates, usage counts) |
-| **Rollback plan** | How to restore if issues found |
-
----
-
-## Checklist Before Removal
-
-- [ ] Searched codebase for all references (`rg`, `grep`)
-- [ ] Checked for dynamic/reflection-based usage
-- [ ] Verified no external consumers (APIs, SDKs, docs)
-- [ ] Feature flag telemetry reviewed (if applicable)
-- [ ] Tests updated/removed
-- [ ] Documentation updated
-- [ ] Team notified (if shared code)

package/.agents/skills/code-review-expert/references/security-checklist.md

@@ -1,118 +0,0 @@
-# Security and Reliability Checklist
-
-## Input/Output Safety
-
-- **XSS**: Unsafe HTML injection, `dangerouslySetInnerHTML`, unescaped templates, innerHTML assignments
-- **Injection**: SQL/NoSQL/command/GraphQL injection via string concatenation or template literals
-- **SSRF**: User-controlled URLs reaching internal services without allowlist validation
-- **Path traversal**: User input in file paths without sanitization (`../` attacks)
-- **Prototype pollution**: Unsafe object merging in JavaScript (`Object.assign`, spread with user input)
-
-## AuthN/AuthZ
-
-- Missing tenant or ownership checks for read/write operations
-- New endpoints without auth guards or RBAC enforcement
-- Trusting client-provided roles/flags/IDs
-- Broken access control (IDOR - Insecure Direct Object Reference)
-- Session fixation or weak session management
-
-## JWT & Token Security
-
-- Algorithm confusion attacks (accepting `none` or `HS256` when expecting `RS256`)
-- Weak or hardcoded secrets
-- Missing expiration (`exp`) or not validating it
-- Sensitive data in JWT payload (tokens are base64, not encrypted)
-- Not validating `iss` (issuer) or `aud` (audience)
-
-## Secrets and PII
-
-- API keys, tokens, or credentials in code/config/logs
-- Secrets in git history or environment variables exposed to client
-- Excessive logging of PII or sensitive payloads
-- Missing data masking in error messages
-
-## Supply Chain & Dependencies
-
-- Unpinned dependencies allowing malicious updates
-- Dependency confusion (private package name collision)
-- Importing from untrusted sources or CDNs without integrity checks
-- Outdated dependencies with known CVEs
-
-## CORS & Headers
-
-- Overly permissive CORS (`Access-Control-Allow-Origin: *` with credentials)
-- Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options)
-- Exposed internal headers or stack traces
-
-## Runtime Risks
-
-- Unbounded loops, recursive calls, or large in-memory buffers
-- Missing timeouts, retries, or rate limiting on external calls
-- Blocking operations on request path (sync I/O in async context)
-- Resource exhaustion (file handles, connections, memory)
-- ReDoS (Regular Expression Denial of Service)
-
-## Cryptography
-
-- Weak algorithms (MD5, SHA1 for security purposes)
-- Hardcoded IVs or salts
-- Using encryption without authentication (ECB mode, no HMAC)
-- Insufficient key length
-
-## Race Conditions
-
-Race conditions are subtle bugs that cause intermittent failures and security vulnerabilities. Pay special attention to:
-
-### Shared State Access
-- Multiple threads/goroutines/async tasks accessing shared variables without synchronization
-- Global state or singletons modified concurrently
-- Lazy initialization without proper locking (double-checked locking issues)
-- Non-thread-safe collections used in concurrent context
-
-### Check-Then-Act (TOCTOU)
-- `if (exists) then use` patterns without atomic operations
-- `if (authorized) then perform` where authorization can change
-- File existence check followed by file operation
-- Balance check followed by deduction (financial operations)
-- Inventory check followed by order placement
-
-### Database Concurrency
-- Missing optimistic locking (`version` column, `updated_at` checks)
-- Missing pessimistic locking (`SELECT FOR UPDATE`)
-- Read-modify-write without transaction isolation
-- Counter increments without atomic operations (`UPDATE SET count = count + 1`)
-- Unique constraint violations in concurrent inserts
-
-### Distributed Systems
-- Missing distributed locks for shared resources
-- Leader election race conditions
-- Cache invalidation races (stale reads after writes)
-- Event ordering dependencies without proper sequencing
-- Split-brain scenarios in cluster operations
-
-### Common Patterns to Flag
-```
-# Dangerous patterns:
-if not exists(key):       # TOCTOU
-    create(key)
-
-value = get(key)          # Read-modify-write
-value += 1
-set(key, value)
-
-if user.balance >= amount:  # Check-then-act
-    user.balance -= amount
-```
-
-### Questions to Ask
-- "What happens if two requests hit this code simultaneously?"
-- "Is this operation atomic or can it be interrupted?"
-- "What shared state does this code access?"
-- "How does this behave under high concurrency?"
-
-## Data Integrity
-
-- Missing transactions, partial writes, or inconsistent state updates
-- Weak validation before persistence (type coercion issues)
-- Missing idempotency for retryable operations
-- Lost updates due to concurrent modifications

package/.agents/skills/code-review-expert/references/solid-checklist.md

@@ -1,65 +0,0 @@
-# SOLID Smell Prompts
-
-## SRP (Single Responsibility)
-
-- File owns unrelated concerns (e.g., HTTP + DB + domain rules in one file)
-- Large class/module with low cohesion or multiple reasons to change
-- Functions that orchestrate many unrelated steps
-- God objects that know too much about the system
-- **Ask**: "What is the single reason this module would change?"
-
-## OCP (Open/Closed)
-
-- Adding a new behavior requires editing many switch/if blocks
-- Feature growth requires modifying core logic rather than extending
-- No plugin/strategy/hook points for variation
-- **Ask**: "Can I add a new variant without touching existing code?"
-
-## LSP (Liskov Substitution)
-
-- Subclass checks for concrete type or throws for base method
-- Overridden methods weaken preconditions or strengthen postconditions
-- Subclass ignores or no-ops parent behavior
-- **Ask**: "Can I substitute any subclass without the caller knowing?"
-
-## ISP (Interface Segregation)
-
-- Interfaces with many methods, most unused by implementers
-- Callers depend on broad interfaces for narrow needs
-- Empty/stub implementations of interface methods
-- **Ask**: "Do all implementers use all methods?"
-
-## DIP (Dependency Inversion)
-
-- High-level logic depends on concrete IO, storage, or network types
-- Hard-coded implementations instead of abstractions or injection
-- Import chains that couple business logic to infrastructure
-- **Ask**: "Can I swap the implementation without changing business logic?"
-
----
-
-## Common Code Smells (Beyond SOLID)
-
-| Smell | Signs |
-|-------|-------|
-| **Long method** | Function > 30 lines, multiple levels of nesting |
-| **Feature envy** | Method uses more data from another class than its own |
-| **Data clumps** | Same group of parameters passed together repeatedly |
-| **Primitive obsession** | Using strings/numbers instead of domain types |
-| **Shotgun surgery** | One change requires edits across many files |
-| **Divergent change** | One file changes for many unrelated reasons |
-| **Dead code** | Unreachable or never-called code |
-| **Speculative generality** | Abstractions for hypothetical future needs |
-| **Magic numbers/strings** | Hardcoded values without named constants |
-
----
-
-## Refactor Heuristics
-
-1. **Split by responsibility, not by size** - A small file can still violate SRP
-2. **Introduce abstraction only when needed** - Wait for the second use case
-3. **Keep refactors incremental** - Isolate behavior before moving
-4. **Preserve behavior first** - Add tests before restructuring
-5. **Name things by intent** - If naming is hard, the abstraction might be wrong
-6. **Prefer composition over inheritance** - Inheritance creates tight coupling
-7. **Make illegal states unrepresentable** - Use types to enforce invariants

package/.claude/settings.local.json

@@ -1,18 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npm start:*)",
-      "Bash(kill:*)",
-      "Bash(pkill:*)",
-      "Bash(node:*)",
-      "Bash(lsof -ti:7008)",
-      "Bash(sqlite3:*)",
-      "Bash(ps:*)",
-      "Bash(git add:*)",
-      "Bash(git commit -m ':*)",
-      "Bash(git push:*)",
-      "Bash(npm publish:*)",
-      "Bash(git commit:*)"
-    ]
-  }
-}

package/.idea/claude_opencode_viewer.iml

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="JAVA_MODULE" version="4">
-  <component name="NewModuleRootManager" inherit-compiler-output="true">
-    <exclude-output />
-    <content url="file://$MODULE_DIR$" />
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>

package/.idea/inspectionProfiles/Project_Default.xml

@@ -1,5 +0,0 @@
-<component name="InspectionProjectProfileManager">
-  <profile version="1.0">
-    <option name="myName" value="Project Default" />
-  </profile>
-</component>

package/.idea/modules.xml

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/claude_opencode_viewer.iml" filepath="$PROJECT_DIR$/.idea/claude_opencode_viewer.iml" />
-    </modules>
-  </component>
-</project>

package/.idea/smartfox/common_info.xml

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="SmartFoxWorkToolsProjectState">
-    <option name="branch" value="fix/v2.1.0-keyboard" />
-    <option name="gitUrl" value="https://github.com/ChrisJason121238/claude-opencode-viewer.git" />
-    <option name="localBranch" value="fix/v2.1.0-keyboard" />
-    <option name="revision" value="e81a3afd4423f60c1d4f185dd4b16cf7ad1848cc" />
-  </component>
-</project>

package/.idea/tdkConfig.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="tdkConfig">
-    <option name="projectKey" value="0c137ba0-d5df-44aa-97f8-3eee32813208" />
-  </component>
-</project>

package/.idea/vcs.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="" vcs="Git" />
-  </component>
-</project>

package/skills-lock.json

@@ -1,10 +0,0 @@
-{
-  "version": 1,
-  "skills": {
-    "code-review-expert": {
-      "source": "sanyuan0704/sanyuan-skills",
-      "sourceType": "github",
-      "computedHash": "6c2fe31851a34e63e033257527eab04eea835ca1cf4c4276d1392a323e36e377"
-    }
-  }
-}

package/test-doc.md

@@ -1,86 +0,0 @@
-# Claude OpenCode Viewer 使用指南
-
-## 简介
-
-Claude OpenCode Viewer（COV）是一个统一的终端查看器，支持在浏览器中远程查看和操作 Claude Code 与 OpenCode 的终端会话。适用于需要在手机或其他设备上查看 AI 编程助手工作进度的场景。
-
-## 安装
-
-```bash
-npm install -g claude-opencode-viewer
-```
-
-安装完成后，可以通过以下命令启动：
-
-```bash
-cov
-```
-
-默认监听端口 7008，PC 模式使用 `--pc` 参数启动。
-
-## 功能特性
-
-### 终端查看
-
-支持实时查看终端输出，基于 xterm.js 实现完整的终端模拟，包括：
-
-- 颜色渲染
-- Unicode 字符支持
-- WebGL 加速渲染
-- 移动端触摸滚动
-
-### 会话管理
-
-可以管理多个会话，支持以下操作：
-
-1. 查看历史会话列表
-2. 恢复已有会话
-3. 创建新会话
-4. 在 Claude 和 OpenCode 之间切换
-
-### Git 变更查看
-
-集成了 Git 状态查看功能，可以直接在页面上查看：
-
-| 状态 | 含义 | 颜色 |
-|------|------|------|
-| M | 已修改 | 橙色 |
-| A | 新增 | 绿色 |
-| D | 已删除 | 红色 |
-| ?? | 未跟踪 | 灰色 |
-
-### 文档浏览
-
-支持浏览项目中的 Markdown 文档，自动扫描项目目录下的 `.md` 文件并以富文本格式展示。
-
-## 配置说明
-
-> 注意：以下配置需要在项目根目录下操作，确保 `PROJECT_DIR` 环境变量指向正确的项目路径。
-
-常用环境变量：
-
-- `PROJECT_DIR` — 指定项目工作目录
-- `PORT` — 自定义端口号
-- `COV_MODE` — 默认启动模式（claude / opencode）
-
-## 常见问题
-
-### 连接断开怎么办？
-
-页面会自动显示重连提示并尝试重新连接。如果持续无法连接，请检查：
-
-1. 服务进程是否仍在运行
-2. 网络是否可达
-3. 端口是否被占用
-
-### 移动端键盘遮挡问题
-
-在 iOS 设备上，系统会自动调整终端高度以适应键盘弹出。如果遇到显示异常，可以尝试旋转屏幕后再旋转回来。
-
-## 更新日志
-
-**v2.6.48** — 修复重连内容重复、模式切换黑屏问题
-
-**v2.6.47** — 添加 PC 端重连覆盖层
-
-**v2.6.46** — 移动端键盘交互优化