cicy-desktop 2.1.153 → 2.1.155

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.153",
+  "version": "2.1.155",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/scripts/mac-allinone/postinstall

@@ -7,47 +7,10 @@ APP="/Applications/CiCy Desktop.app"
 [ -d "$APP" ] || exit 0
 /usr/bin/xattr -dr com.apple.quarantine "$APP" 2>/dev/null || true
 /usr/bin/xattr -cr "$APP" 2>/dev/null || true
-
-# ── Stable LOCAL code-signing identity (主人令: 用自签证书) ────────────────────
-# ad-hoc has no stable identity, so macOS never persists the Screen-Recording TCC
-# grant → it re-prompts forever. A self-signed cert gives the app a STABLE designated
-# requirement, so the grant sticks after the user allows it once. We run as root here,
-# so we can write the System keychain + trust the cert with NO password prompt.
-SIGN_CN="CiCy Desktop Local Signing"
-SYS_KC="/Library/Keychains/System.keychain"
-if ! /usr/bin/security find-identity -p codesigning "$SYS_KC" 2>/dev/null | grep -qF "$SIGN_CN"; then
-  TMPD="$(/usr/bin/mktemp -d)"
-  # Config file (portable across the LibreSSL that ships in /usr/bin/openssl, which
-  # lacks `-addext`). codeSigning EKU is what makes it a valid signing identity.
-  cat > "$TMPD/c.cnf" <<CNF
-[req]
-distinguished_name = dn
-x509_extensions = v3
-prompt = no
-[dn]
-CN = $SIGN_CN
-[v3]
-basicConstraints = critical,CA:false
-keyUsage = critical,digitalSignature
-extendedKeyUsage = critical,codeSigning
-CNF
-  /usr/bin/openssl req -x509 -newkey rsa:2048 -keyout "$TMPD/k.pem" -out "$TMPD/c.pem" \
-    -days 3650 -nodes -config "$TMPD/c.cnf" >/dev/null 2>&1
-  /usr/bin/openssl pkcs12 -export -inkey "$TMPD/k.pem" -in "$TMPD/c.pem" \
-    -out "$TMPD/id.p12" -passout pass:cicy -name "$SIGN_CN" >/dev/null 2>&1
-  # -A = no ACL on the key → codesign can use it without a partition-list/password dance.
-  /usr/bin/security import "$TMPD/id.p12" -k "$SYS_KC" -P cicy -A >/dev/null 2>&1 || true
-  /usr/bin/security add-trusted-cert -d -r trustRoot -p codeSign -k "$SYS_KC" "$TMPD/c.pem" >/dev/null 2>&1 || true
-  /bin/rm -rf "$TMPD"
-fi
-if /usr/bin/security find-identity -p codesigning "$SYS_KC" 2>/dev/null | grep -qF "$SIGN_CN"; then
-  /usr/bin/codesign --force --deep --sign "$SIGN_CN" --keychain "$SYS_KC" "$APP" 2>/dev/null \
-    && echo "signed with local identity: $SIGN_CN" \
-    || /usr/bin/codesign --force --deep --sign - "$APP" 2>/dev/null || true
-else
-  echo "local identity unavailable — falling back to ad-hoc"
-  /usr/bin/codesign --force --deep --sign - "$APP" 2>/dev/null || true
-fi
+# Re-ad-hoc-sign so the app opens with no Apple cert. (A self-signed cert was tried to
+# make the Screen-Recording grant persist — it did sign, but macOS 15 still re-prompts
+# without an Apple Team ID, so it was dropped; desktop capture is OFF by default on mac.)
+/usr/bin/codesign --force --deep --sign - "$APP" 2>/dev/null || true
 
 # Desktop shortcut for the logged-in user (postinstall runs as root, so resolve the
 # console user + their home and chown the symlink to them). Launchpad/Spotlight pick

package/src/backends/auth-email.js

@@ -0,0 +1,109 @@
+// Email magic-link DEVICE-POLL login — cross-device safe.
+//
+// The 127.0.0.1 loopback in auth-loopback.js only works when the magic link is
+// clicked on the SAME machine: a phone can't reach the desktop's localhost, so a
+// link opened on mobile leaves the desktop hanging until timeout (todo#196).
+//
+// This flow (cloud contract by w-10122) decouples the click from the device:
+//   1. desktop generates a high-entropy `state` (it IS the retrieval credential).
+//   2. POST /api/auth/email/request {email, state, flow:'desktop_poll'} → cloud
+//      registers state=pending and sends the magic-link email.
+//   3. user clicks the link on ANY device → cloud mints the session, stores it
+//      under `state`, and shows a "回到桌面端" page (no loopback redirect).
+//   4. desktop polls GET /api/auth/desktop/poll?state=<state> until it flips to
+//      `ready` (one-time consumed), then fires onResult with the SAME payload
+//      shape as the loopback flow so main's auth hook is unchanged.
+//
+// state TTL is 10 min cloud-side; the token is sk-sess- (the SOLE Bearer for all
+// /api/* — no exchange, no New-Api-User header needed).
+
+const crypto = require("crypto");
+const log = require("electron-log");
+
+const CLOUD_BASE = "https://cicy-ai.com";
+const REQUEST_URL = `${CLOUD_BASE}/api/auth/email/request`;
+const POLL_URL = `${CLOUD_BASE}/api/auth/desktop/poll`;
+const POLL_EVERY_MS = 2500;
+const TIMEOUT_MS = 600_000; // 10 min — matches the cloud state TTL.
+
+let _state = null;
+let _timer = null;
+let _onResult = null;
+let _resultFired = false;
+
+function shutdown(reason) {
+  if (_timer) { clearTimeout(_timer); _timer = null; }
+  _state = null;
+  if (reason) log.info(`[auth-email] shutdown: ${reason}`);
+}
+
+// Deliver the result exactly once — the poll loop, the timeout, and cancel() all
+// race to be first (same guard pattern as auth-loopback).
+function fire(payload) {
+  if (_resultFired) return;
+  _resultFired = true;
+  try { _onResult && _onResult(payload); } catch {}
+}
+
+// Begin the device-poll flow. Resolves once the email has been requested (so the
+// renderer can show "邮件已发送"); the actual login lands later via onResult.
+async function startEmailLogin({ email, onResult } = {}) {
+  shutdown("new email login");
+  const addr = String(email || "").trim();
+  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(addr)) throw new Error("invalid email");
+
+  _state = crypto.randomBytes(24).toString("hex");
+  _resultFired = false;
+  _onResult = onResult;
+  const state = _state;
+
+  const res = await fetch(REQUEST_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ email: addr, state, flow: "desktop_poll" }),
+  });
+  if (!res.ok) {
+    shutdown(`request HTTP ${res.status}`);
+    throw new Error(`发送登录邮件失败 (HTTP ${res.status})`);
+  }
+  log.info(`[auth-email] request sent for ${addr}, polling state ${state.slice(0, 8)}…`);
+
+  const startedAt = Date.now();
+  const tick = async () => {
+    if (state !== _state) return; // superseded / cancelled
+    if (Date.now() - startedAt > TIMEOUT_MS) { fire({ error: "timeout" }); shutdown("timeout"); return; }
+    try {
+      const r = await fetch(`${POLL_URL}?state=${encodeURIComponent(state)}`);
+      if (r.status === 404) { fire({ error: "expired" }); shutdown("poll 404"); return; }
+      const j = await r.json().catch(() => ({}));
+      if (j.status === "ready" && j.token) {
+        // Map cloud fields → the loopback payload shape main already persists.
+        // token = access_token = sk-sess- (SOLE Bearer); user_id for any local
+        // New-Api-User header (cloud itself doesn't require it).
+        fire({
+          token: j.token,
+          accessToken: j.access_token || j.token,
+          userId: j.user_id != null ? String(j.user_id) : "",
+          reused: !!j.reused,
+          email: j.email || addr,
+        });
+        shutdown("ready");
+        return;
+      }
+      if (j.status === "expired") { fire({ error: "expired" }); shutdown("expired"); return; }
+      // pending → keep polling.
+    } catch (e) {
+      // Transient network blip — keep polling until the overall timeout.
+      log.warn(`[auth-email] poll error (retrying): ${e.message}`);
+    }
+    if (state === _state) _timer = setTimeout(tick, POLL_EVERY_MS);
+  };
+  _timer = setTimeout(tick, POLL_EVERY_MS);
+  return { state, email: addr };
+}
+
+function cancel() {
+  if (_state) { fire({ error: "cancelled" }); shutdown("cancelled by user"); }
+}
+
+module.exports = { startEmailLogin, cancel };

package/src/backends/homepage-preload.js

@@ -241,6 +241,12 @@ contextBridge.exposeInMainWorld("cicy", {
   auth: {
     loginStart:  ()  => logInvoke("auth:login-start"),
     loginCancel: ()  => logInvoke("auth:login-cancel"),
+    // Email magic-link device-poll login (cross-device: the link works when
+    // clicked on a phone). emailLoginStart resolves once the email is sent
+    // ({ ok, email } | { ok:false, error }); the actual login lands later on the
+    // same auth:complete event (onComplete below) as the loopback flow.
+    emailLoginStart:  (email) => logInvoke("auth:email-start", email),
+    emailLoginCancel: ()      => logInvoke("auth:email-cancel"),
     // Durable, origin-independent login persisted in main (global.json).
     // getSaved() restores it when this origin's localStorage is empty;
     // logout() clears it (the only thing that should).