fix(system-prompt): render template variables at spawn; L1c/L1d test-isolation barriers (data loss)

Three fixes from investigating "model-specific prompt: no matching entry
found" breaking third-party model launches:

1. Test-isolation L1c/L1d (data loss, root cause): in NODE_TEST_CONTEXT an
   explicit CCV_LOG_DIR / CLAUDE_CONFIG_DIR is now only honored when it
   points inside the OS temp root; anything else forces the private guard
   dir with a loud warning. A ccv-hosted shell exports CCV_LOG_DIR=<real
   ~/.claude/cc-viewer> to every child, so a direct `node --test <file>`
   run there (the everyday loop when developing cc-viewer inside ccv)
   inherited the real user data dir through the explicit-value fast path
   the existing guards did not cover, and pty-manager.test.js's IM-worker
   fixture cleanup rmSync'd the user's real global system_prompt/ --
   confirmed live; this is what silently deleted the saved deepseek-v4-pro
   entry and produced the misleading spawn warning. npm run test was never
   affected (script pins CCV_LOG_DIR=tmp). The wiped entry was restored
   from the current preset.

2. ${...} template variables are now actually rendered at spawn (new
   server/lib/system-prompt-render.js wired into spawnClaude). The editor
   stores placeholders literal by design, but the variable renderer had
   zero callers on the live path, so injected prompts reached the model
   with literal ${model.name}/${os.platform}/... -- the whole "Dynamic
   Parameter Documentation" feature was inert and the third-party-model
   presets shipped broken text. Files without placeholders pass through
   untouched (variable collection is lazy, once per spawn); unknown
   placeholders stay literal so shell syntax like ${HOME} survives;
   ${model.name} strips the [1m] suffix; cwd-dependent variables resolve
   against the launched workspace via createSystemPromptVariables(
   overrides, { cwd }); render failure falls back to the raw file.

3. The "no matching entry found" spawn warning no longer fires on
   intentional skips: buildSystemPromptFileArgs tags suppressed:'env'
   (CCV_DISABLE_AUTO_SYSTEM_PROMPT=1) and suppressed:'manual-flag' (a
   matched entry suppressed by a user-passed --system-prompt[-file]).

Tests: new system-prompt-render suite; L1c/L1d accept/reject cases in
logdir-test-guard; suppressed-marker cases in system-prompt-files; three
existing cases that asserted the old explicit-env semantics updated to
simulate production (read-only echo paths).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

findcc.js

@@ -1,4 +1,4 @@
-import { resolve, join } from 'node:path';
+import { resolve, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, realpathSync, readFileSync } from 'node:fs';
 import { homedir, tmpdir, arch } from 'node:os';
@@ -22,11 +22,42 @@ const NODE_MODULES = resolve(__dirname, '..');
  * Claude Code's config from ~/.claude/ to a custom location.
  * @returns {string} absolute path to the Claude config directory
  */
+// ████████ Test isolation barrier L1c helper — DO NOT REMOVE (2026-07-12 data loss) ████████
+// A ccv-hosted shell exports CCV_LOG_DIR=<real user data dir> (and possibly CLAUDE_CONFIG_DIR)
+// into every child process — the claude pty, its Bash tool, any nested shell. A direct
+// `node --test <file>` run there inherits those vars and sails through the explicit-value fast
+// paths below, handing the test process the REAL user directories; test fixtures/cleanup then
+// delete real user data (confirmed 2026-07-12: a pty-manager fixture's finally-rmSync wiped the
+// user's global system_prompt/ model prompts). Policy: a test process may only ever target
+// disposable temp directories. This helper decides whether an explicit dir qualifies.
+function isDisposableTmpPath(p) {
+  const roots = new Set();
+  const t = resolve(tmpdir());
+  roots.add(t);
+  try { roots.add(realpathSync(t)); } catch { /* keep the unresolved form */ }
+  if (process.platform !== 'win32') { roots.add('/tmp'); roots.add('/private/tmp'); }
+  const forms = new Set([resolve(p)]);
+  try { forms.add(realpathSync(resolve(p))); } catch { /* path may not exist yet */ }
+  for (const f of forms) {
+    for (const r of roots) {
+      if (f === r || f.startsWith(r + sep)) return true;
+    }
+  }
+  return false;
+}
+
 export function getClaudeConfigDir() {
   const envDir = process.env.CLAUDE_CONFIG_DIR;
   if (envDir && typeof envDir === 'string' && envDir.trim()) {
     const raw = envDir.trim();
-    return raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : resolve(raw);
+    const resolved = raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : resolve(raw);
+    // ████ L1d: in test context an explicit CLAUDE_CONFIG_DIR must still be a throwaway dir —
+    // an inherited real config dir would re-open the 2026-06-06 updater CACHE_DIR hole. ████
+    if (process.env.NODE_TEST_CONTEXT && !isDisposableTmpPath(resolved)) {
+      console.warn(`[findcc] L1d test-isolation barrier: CLAUDE_CONFIG_DIR="${raw}" is not under the OS temp dir — forcing a private guard config dir (tests may only target disposable temp dirs)`);
+      return join(tmpdir(), 'cc-viewer-test', `guard-cfg-${process.pid}-${threadId}`);
+    }
+    return resolved;
   }
   // ████████ Test isolation barrier L1b — DO NOT REMOVE (prevents data-loss regressions, 2026-06-06) ████████
   // CCV_LOG_DIR=tmp only redirects LOG_DIR; it does not cover this function: updater.js's
@@ -69,7 +100,21 @@ function resolveLogDir() {
       return join(tmpdir(), 'cc-viewer-test', `${process.pid}-${threadId}`);
     }
     const expanded = raw.startsWith('~/') ? join(homedir(), raw.slice(2)) : raw;
-    return resolve(expanded);
+    const resolved = resolve(expanded);
+    // ████████ Test isolation barrier L1c — DO NOT REMOVE (2026-07-12 data loss) ████████
+    // The NODE_TEST_CONTEXT guard below only covers the no-CCV_LOG_DIR case; this explicit-value
+    // fast path used to accept ANY inherited dir. Inside a ccv-hosted shell CCV_LOG_DIR points at
+    // the real ~/.claude/cc-viewer, so a direct `node --test <file>` there resolved LOG_DIR to
+    // real user data — test cleanup then deleted it (2026-07-12: the user's global system_prompt/
+    // entries were wiped this way, twice). Tests may only target disposable temp dirs: anything
+    // outside the OS temp root is forced to the private guard dir. Use CCV_LOG_DIR=tmp or a
+    // mkdtemp path in tests. Unit test: test/logdir-test-guard.test.js.
+    if (process.env.NODE_TEST_CONTEXT && !isDisposableTmpPath(resolved)) {
+      console.warn(`[findcc] L1c test-isolation barrier: CCV_LOG_DIR="${raw}" is not under the OS temp dir — forcing a private guard LOG_DIR (tests may only target disposable temp dirs; use CCV_LOG_DIR=tmp or a mkdtemp path)`);
+      return join(tmpdir(), 'cc-viewer-test', `guard-${process.pid}-${threadId}`);
+    }
+    // ████████████████████████████████████████████████████████████████████████████
+    return resolved;
   }
   // Test isolation barrier: in node:test environment (NODE_TEST_CONTEXT is auto-injected by the
   // test runner and inherited by spawned child processes via spread env), if CCV_LOG_DIR is not

history.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- fix(test-isolation, **data loss**): new **L1c/L1d barriers** in `findcc.js` — in a test context (`NODE_TEST_CONTEXT`), an **explicit** `CCV_LOG_DIR` / `CLAUDE_CONFIG_DIR` is now only honored when it points inside the OS temp root; anything else is forced to the private guard dir with a loud warning. Root cause of a real data-loss class the existing L1/L1b guards missed: a ccv-hosted shell exports `CCV_LOG_DIR=<real ~/.claude/cc-viewer>` into every child (the claude pty, its Bash tool, nested shells), so a direct `node --test test/<file>.js` run there — the everyday dev loop when developing cc-viewer inside ccv — inherited the real user data dir straight through the explicit-value fast path (the NODE_TEST_CONTEXT guard only covered the *unset* case), and `test/pty-manager.test.js`'s IM-worker fixture cleanup (`finally { rmSync(join(LOG_DIR,'system_prompt'), {recursive}) }`) then **deleted the user's real global model-prompt directory** (confirmed live: this is what silently ate the saved deepseek-v4-pro entry and produced the misleading "model-specific prompt … no matching entry found" spawn warning; `npm run test` was never affected because the script pins `CCV_LOG_DIR=tmp`). All repo tests already use tmp-based dirs, so nothing legitimate changes; production semantics (no `NODE_TEST_CONTEXT`) are untouched. New L1c/L1d accept/reject cases in `logdir-test-guard`.
+
+- feat(expert/system-prompt): **`${...}` template variables are now actually rendered at spawn** — new `server/lib/system-prompt-render.js`, wired into `pty-manager.spawnClaude`. The Edit System Prompt editor stores presets/entries with placeholders literal (by design), but nothing in the live pipeline ever substituted them: the variable renderer (`renderPreset`/`createSystemPrompt`/`createSystemPromptVariables`) had zero callers on the spawn path, so every model entry and sentinel injected via `--system-prompt-file`/`--append-system-prompt-file` reached the model with literal `${model.name}`, `${os.platform}`, `${memory.index}` … — the entire "Dynamic Parameter Documentation" feature was inert, and the third-party-model presets (deepseek/GLM/Qwen/kimi, whose whole point is replacing the Anthropic-specific system prompt) shipped broken text. Rendering rules: files without placeholders pass through untouched (zero cost — variable collection shells out to git and is now lazy + once per spawn); unknown placeholders stay literal (`missingVariableMode: 'keep'`, so prompt text quoting shell syntax like `${HOME}` survives); `${model.name}` resolves from the spawn's resolved model id with the `[1m]` context-window suffix stripped; cwd-dependent variables (git/cwd/memory) resolve against the launched workspace via a new `createSystemPromptVariables(overrides, { cwd })` param; rendered copies live under `<tmpdir>/cc-viewer-rendered-prompts/<pid>/`; any render failure falls back to injecting the raw file (never breaks the spawn). Tests: new `system-prompt-render` suite (substitution, laziness, unknown-var preservation, fallback, `[1m]` strip, opts.cwd).
+
+- fix(expert/system-prompt): the spawn diagnostic **"modelId resolved but no matching entry found"** no longer fires when injection was *intentionally skipped* — `buildSystemPromptFileArgs` now tags `suppressed: 'env'` (kill-switch `CCV_DISABLE_AUTO_SYSTEM_PROMPT=1`) and `suppressed: 'manual-flag'` (a matched model entry suppressed by a user-passed `--system-prompt[-file]`/`--append-system-prompt[-file]`), and `pty-manager` keeps quiet on both; only a genuine no-entry miss warns. Suppressed-marker cases added to `system-prompt-files`.
+
 - fix(im, review round): hardening from a six-role review of the drawer Start button. **P1**: the `starting` boolean + platform-guarded `finally` reset leaked permanently when the user switched platforms mid-poll — a loading Start button then appeared on every platform and never stopped spinning until a page reload; `starting` is now a platform-scoped `startingPlatform` (button shows/loads only for the platform being started, functional-update reset clears only its own round). **P2 server**: `'start'` now rejects with 400 `missing <fields>` when required cred/secret fields are unset (new shared `missingCreds`, same gate the `/test` route uses — previously it would persist `enabled:true` for a credential-less platform whose worker no-ops forever, and reconcile would respawn that zombie on every server restart), and flipping `enabled` via `/process` now hits the same empty-allowlist server-side audit warning as the config route (extracted shared `warnIfEmptyAllowlist` — the headless bind-first-conversation warning could previously be bypassed). **P2 client**: the start-success criterion is tightened from `process.state==='ready'` to ready **and** bridge connected (`connection.connected`/`connectionState==='connected'`) in both the drawer and `ImPlatformSettings.start` — `ready` only means the worker's HTTP identity service is up, so stale creds produced a green "Connected" toast contradicting the "Running, connecting…" badge; the drawer's failure toast now appends the server `detail`; the outer POST catch reports via `reportSwallowed` instead of discarding the error; and the drawer mirrors the settings panel's `busyRef` (start-poll pauses the 5s background poll whose failure branch could flash the badge back to "Disconnected" mid-boot) + `mountedRef` (no setState after a real unmount) guards. Tests: idempotent start (already-enabled → prefs file not rewritten, mtime-pinned), creds gate (400, nothing persisted or spawned), and audit-warning cases added to `im-routes-gap`.
 
 - feat(im): the IM conversation-record drawer (对话记录) gains an inline **Start** button next to the status badge — when the worker is confirmed dead (`process.state === 'dead'`, badge shows "Disconnected"), the user can relaunch the bridge without detouring through the settings modal. The button POSTs the existing loopback-only `POST /api/im/:platform/process {action:'start'}` and then polls `/status` until the worker is truly ready (`state === 'ready'`, same 15s criterion as `ImPlatformSettings.start`; success/failure surfaced as toasts, badge transitions live through Starting… → Connected, a platform-switch mid-poll is guarded by ref comparison so no cross-platform state bleed). Server-side, the `'start'` action now **persists `enabled: true`** first (read-merge-write via `loadConfig`+`saveConfig`, creds/allowlist untouched): a worker spawned while the stored config says disabled no-ops its bridge in `im-bridge-core` and would not survive a restart reconcile, so "start" must mean "enable + spawn" — `'stop'`/`'restart'` semantics unchanged (disabling stays on the config route). Remote (LAN) clients never see the button (their trimmed `/status` carries no `process` info, and `/process` is loopback-only anyway). Reuses existing i18n keys (`ui.im.start`/`ui.im.startFailed`/`ui.im.statusConnected`), no new entries. Tests: `im-routes-gap` gains persist-on-start (creds preserved) and stop-does-not-touch-enabled cases.

server/lib/create_system_prompt.js

@@ -130,8 +130,11 @@ function resolveMemory(home, cwd) {
   return { dir, index, enabled: enabled ? 'true' : 'false' }
 }
 
-export function createSystemPromptVariables(overrides = {}) {
-  const cwd = stringOrEmpty(() => process.cwd())
+export function createSystemPromptVariables(overrides = {}, opts = {}) {
+  // opts.cwd: resolve cwd-dependent variables (environment.cwd, git.*, memory.dir) against a
+  // caller-supplied directory instead of process.cwd() — the spawn-time renderer passes the
+  // workspace being launched, which is not necessarily where the ccv server itself runs.
+  const cwd = (typeof opts.cwd === 'string' && opts.cwd) ? opts.cwd : stringOrEmpty(() => process.cwd())
   const now = new Date()
   const timeZone = stringOrEmpty(
     () => Intl.DateTimeFormat().resolvedOptions().timeZone,

server/lib/system-prompt-files.js

@@ -53,13 +53,15 @@ function hasArg(args, ...names) {
  * @param {string[]} [existingArgs] 已有的 claude 参数(用于「手动优先」判断)
  * @param {Object} [env] 环境变量(默认 process.env)
  * @param {{ modelId?: string|null, globalModelDir?: string|null }} [opts]
- * @returns {{ args: string[], loaded: string[], model: string|null }}
- *          args: 待追加参数；loaded: 实际加载的文件(终端提示)；model: 命中的条目名(未命中为 null)
+ * @returns {{ args: string[], loaded: string[], model: string|null, suppressed?: 'env'|'manual-flag' }}
+ *          args: 待追加参数；loaded: 实际加载的文件(终端提示)；model: 命中的条目名(未命中为 null)；
+ *          suppressed: 注入被有意跳过的原因(env 开关 / 手动同义 flag 抑制了已命中的模型条目)——
+ *          调用方(pty-manager)据此不再打「no matching entry」误导性告警。
  */
 export function buildSystemPromptFileArgs(projectDir, existingArgs = [], env = process.env, opts = {}) {
   const out = { args: [], loaded: [], model: null };
   if (!projectDir) return out;
-  if (env?.[DISABLE_AUTO_SYSTEM_PROMPT_ENV] === '1') return out;
+  if (env?.[DISABLE_AUTO_SYSTEM_PROMPT_ENV] === '1') return { ...out, suppressed: 'env' };
 
   if (opts?.modelId) {
     const candidates = [{ dir: join(projectDir, MODEL_PROMPT_DIR), scope: 'workspace' }];
@@ -73,6 +75,8 @@ export function buildSystemPromptFileArgs(projectDir, existingArgs = [], env = p
         out.args.push(flagPair[1], match.path);
         out.loaded.push(`${match.scope === 'global' ? 'global ' : ''}${MODEL_PROMPT_DIR}/${match.fileName}`);
         out.model = match.name;
+      } else {
+        out.suppressed = 'manual-flag'; // 条目命中但用户手传了同义 flag：有意跳过，非「无条目」
       }
       return out; // 命中即返回：默认 sentinel 不再参与(含手动 flag 抑制注入的情况)。
     }

server/lib/system-prompt-render.js

@@ -0,0 +1,76 @@
+// Spawn-time `${...}` template-variable rendering for injected system-prompt files.
+//
+// The Edit System Prompt editor stores entries (model entries under system_prompt/ and the
+// CC_SYSTEM.md / CC_APPEND_SYSTEM.md sentinels) with `${...}` placeholders LITERAL — that is the
+// editing surface documented by the "Dynamic Parameter Documentation" popup. The substitution has
+// to happen when claude is launched: this module takes the args produced by
+// buildSystemPromptFileArgs, and for every injected file whose content contains template
+// variables, renders it via create_system_prompt.js and swaps in a rendered temp copy.
+//
+// Design constraints:
+// - Files without `${...}` pass through untouched (zero cost — no variable collection, which
+//   shells out to git several times, and no temp file).
+// - missingVariableMode is 'keep': unknown placeholders stay literal, so user-authored prompt
+//   text quoting shell syntax like `${HOME}` or `${1:-default}` is never eaten.
+// - Any failure (unreadable file, variable collection throwing, temp write failing) falls back
+//   to the raw path — rendering must never break the claude spawn.
+// - Temp copies live under <tmpdir>/cc-viewer-rendered-prompts/<pid>/: per-process so two ccv
+//   instances never clobber each other; sequential spawns of one instance overwrite the same
+//   basename, which is safe because claude reads the file once at startup.
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, basename } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createSystemPrompt, createSystemPromptVariables } from './create_system_prompt.js';
+
+// Detection only (no capture): does the text contain at least one `${...}` placeholder?
+const TEMPLATE_VARIABLE_RE = /\$\{[^}]+\}/;
+
+/** Per-process directory holding the rendered temp copies. */
+export function renderedPromptDir(pid = process.pid) {
+  return join(tmpdir(), 'cc-viewer-rendered-prompts', String(pid));
+}
+
+/**
+ * Render template variables in the file args produced by buildSystemPromptFileArgs.
+ *
+ * @param {{ args: string[], loaded: string[], model: string|null }} sysPrompt
+ * @param {{ cwd?: string, modelId?: string|null, variablesFactory?: Function }} [opts]
+ *        cwd: workspace being launched (git/cwd/memory variables resolve against it);
+ *        modelId: resolved model id from the last launch — becomes ${model.name} (the [1m]
+ *        context-window suffix is stripped: it is a claude-code UI notation, not a model name);
+ *        variablesFactory: test seam replacing createSystemPromptVariables.
+ * @returns {{ args: string[], loaded: string[], model: string|null }} same shape; file paths
+ *          whose content was rendered point at the temp copy instead.
+ */
+export function renderSystemPromptFileArgs(sysPrompt, opts = {}) {
+  const args = Array.isArray(sysPrompt?.args) ? sysPrompt.args : [];
+  if (args.length === 0) return sysPrompt;
+
+  let variables = null; // lazy: collected once, and only if some file actually has placeholders
+  const out = [...args];
+  for (let i = 0; i + 1 < out.length; i += 2) {
+    const flag = out[i];
+    if (flag !== '--system-prompt-file' && flag !== '--append-system-prompt-file') continue;
+    const path = out[i + 1];
+    try {
+      const text = readFileSync(path, 'utf-8');
+      if (!TEMPLATE_VARIABLE_RE.test(text)) continue;
+      if (!variables) {
+        const factory = opts.variablesFactory || createSystemPromptVariables;
+        const overrides = {};
+        if (opts.modelId) overrides.model = { name: String(opts.modelId).replace(/\[1m\]$/, '') };
+        variables = factory(overrides, { cwd: opts.cwd });
+      }
+      const rendered = createSystemPrompt(text, { variables, missingVariableMode: 'keep' });
+      if (rendered === text) continue; // every placeholder unknown → nothing changed, keep raw path
+      const dir = renderedPromptDir();
+      mkdirSync(dir, { recursive: true });
+      const target = join(dir, basename(path));
+      writeFileSync(target, rendered, 'utf-8');
+      out[i + 1] = target;
+    } catch (e) {
+      console.warn(`[CC Viewer] system-prompt template render failed for ${path} (injecting the raw file):`, e?.message || e);
+    }
+  }
+  return { ...sysPrompt, args: out };
+}