cicy-desktop 2.1.164 → 2.1.166

package/src/main.js

@@ -817,9 +817,6 @@ X-GNOME-Autostart-enabled=true
 let _sidecarWatchdogTimer = null;
 function startSidecarWatchdog({ intervalMs = 30_000 } = {}) {
   if (_sidecarWatchdogTimer) return;
-  // 主人: native 退役,全平台只有 docker。:8008 由 docker daemon(sidecar-ipc reconcile)
-  // + 容器 --restart 保活,没有 native 要 watchdog 去检查/重启。直接不跑。
-  return;
   let consecutiveFailures = 0;
   let restartInFlight = false;
 
@@ -880,36 +877,9 @@ electronApp.whenReady().then(async () => {
   setupAppIcons();
   ensureDesktopLauncher();
   ensureAutoLaunch();
-  // Start bundled cicy-code daemon as a sidecar. Reuses an existing
-  // instance on :8008 if one is already running; no-op on Windows.
-  cicyCodeSidecar
-    .start({ logPath: path.join(os.homedir(), "logs", "cicy-code-sidecar.log") })
-    .then((c) => { if (c) log.info(`[Sidecar] cicy-code spawned pid=${c.pid}`); })
-    .catch((e) => log.warn(`[Sidecar] cicy-code start failed: ${e.message}`));
-  startSidecarWatchdog();
-
-  // Auto-register the local sidecar as 本地团队 once :8008 answers (主人:
-  // "本地团队没有占位" — a fresh install must show its local team without any
-  // manual step). addTeam upserts by host:port + auto-fills api_token from
-  // global.json, so re-runs are no-ops; addTeam itself then triggers the
-  // cloud team register + gateway-key injection when logged in. A fresh boot
-  // may npm-seed the runtime first, so probe for up to ~90s before giving up.
-  (async () => {
-    const sidecarPort = Number(process.env.CICY_CODE_PORT || 8008);
-    const lt = require("./backends/local-teams");
-    for (let i = 0; i < 30; i++) {
-      try {
-        if (await cicyCodeSidecar.probeExisting(sidecarPort)) {
-          const r = await lt.addTeam({ base_url: `http://127.0.0.1:${sidecarPort}`, name: "本地团队" });
-          if (r && r.ok) log.info(`[Sidecar] local team ${r.upserted ? "refreshed" : "registered"} (${r.id})`);
-          else log.warn(`[Sidecar] local team auto-register failed: ${r && r.error}`);
-          return;
-        }
-      } catch (e) { log.warn(`[Sidecar] local team auto-register error: ${e.message}`); }
-      await new Promise((res) => setTimeout(res, 3000));
-    }
-    log.warn(`[Sidecar] local team auto-register gave up — :${sidecarPort} never came up`);
-  })();
+  // 主人: native :8008 退役 —— 不再起本机 cicy-code、不再 watchdog 保活、不再把它
+  // 自动注册成「本地团队」。cicy-code 只在 docker 容器里跑(Docker 卡,:8009 那套不变,
+  // 由 sidecar-ipc 自己管理)。cicyCodeSidecar 仍保留供 :8008 探活/版本查询用。
 
   // Backend launcher: app menu + IPC handlers. Menu adds a Backends top-level
   // entry; IPC powers the launcher window (src/backends/launcher.html).

package/src/sidecar/cicy-code.js

@@ -100,8 +100,8 @@ async function startFromRuntime({ logPath, port }) {
 async function start({ logPath, port = DEFAULT_PORT, force = false, version = null } = {}) {
   if (child && !force) return child;
 
-  // 主人: native 退役,全平台 docker-only。cicy-code 只在 docker 容器里跑(:8008,命名卷
-  // 隔离,sidecar-ipc 的 docker daemon 负责拉起 + 保活)。这里不再起任何 native。
+  // 主人: native :8008 退役 —— 不再在本机起 cicy-code。docker team(:8009 容器)不变,
+  // 用户用那张 Docker 卡。这里直接返回,native 一律不起。
   return null;
 
   if (!force && await probeExisting(port)) {

package/src/sidecar/colima-docker.js

@@ -4,7 +4,7 @@
 // Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、
 // 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会
 // 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在
-// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。
+// :8009 的容器,Mac 上 127.0.0.1:8009 直接可达——和 WSL2 的 localhost 转发等价。
 //
 // 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/
 // recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js
@@ -220,7 +220,7 @@ const probeHealth = docker.probeHealth;
 //   • Apple Silicon 加 --platform linux/amd64(rosetta 跑 x86 容器);
 //   • /home/cicy 必须用 docker **named volume**,不能用 host bind-mount!真机实测:
 //     bind-mount 会用空的宿主目录**遮住镜像里预装的 /home/cicy**(cicy-code 装在那),
-//     entrypoint 找不到就试图全局 npm 重装 → EACCES 崩溃,:8008 起不来。named volume
+//     entrypoint 找不到就试图全局 npm 重装 → EACCES 崩溃,:8009 起不来。named volume
 //     首次挂载会**从镜像内容预填充**,容器才看得到预装的 cicy-code(和 WSL 一致)。
 // Shared folder bind: the CURRENT macOS user's ~/Desktop/Share ↔
 // /home/cicy/cicy-ai/Share in the container. Auto-created (with a readme) on every
@@ -255,7 +255,7 @@ function shareMountArg() {
   } catch { return ""; }
 }
 
-async function runContainer({ port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function runContainer({ port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009", env = {} } = {}) {
   if (await probeHealth(port)) return { adopted: true };
   try { await dk(`rm -f ${container}`, { timeout: 20000 }); } catch {} // 替换同名残留容器
   const envArgs = Object.entries(env || {})
@@ -273,7 +273,7 @@ async function runContainer({ port = 8008, container = "cicy-code-docker-8008",
 // 该卷的 _data/cicy-ai/global.json(最稳,避开 busy 容器的慢 exec);② 退回 docker
 // exec。重试到 entrypoint 把 global.json 写出来为止;真读不到返回 ""(调用方不得拿
 // 错/宿主 token 去开,会卡登录)。
-async function readContainerToken(port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008") {
+async function readContainerToken(port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009") {
   for (let attempt = 1; attempt <= 5; attempt++) {
     try { const { stdout } = await sh(`colima ssh -p ${PROFILE} -- sudo cat /var/lib/docker/volumes/${volume}/_data/cicy-ai/global.json 2>/dev/null`, { timeout: 10000 });
       const m = String(stdout).match(/"api_token"\s*:\s*"(cicy_[A-Za-z0-9]+)"/);
@@ -324,7 +324,7 @@ async function ensureDesktopShortcut(_volume, _port) { /* no-op on darwin: named
 // 与 wsl status 同形 { wsl, distro, engineUp, running },供 sidecar-ipc 复用:
 //   wsl    → 平台/依赖就绪(brew+colima+docker CLI 都在)
 //   distro → VM(profile)已创建
-async function status(port = 8008) {
+async function status(port = 8009) {
   const deps   = (await colimaInstalled()) && (await dockerCliInstalled());
   const vm     = deps && (await vmExists());
   const up     = vm && (await engineUp());
@@ -344,7 +344,7 @@ async function bootstrap(opts = {}) {
   return _bootstrapInFlight;
 }
 
-async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function _bootstrap({ onProgress, port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009", env = {} } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
 
   // 0) 快路径:已健康 → 秒返回(幂等)。
@@ -396,7 +396,7 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
 // ---- 生命周期(卡片 ⋯ 菜单)--------------------------------------------
 
 // 仅重启容器内的 cicy-code 进程(supervisor),cron/sshd 等不动;退回整容器重启。
-async function restart({ container = "cicy-code-docker-8008", port = 8008, volume = "cicy-team-8008" } = {}) {
+async function restart({ container = "cicy-code-docker-8009", port = 8009, volume = "cicy-team-8009" } = {}) {
   await startVM({});
   try { await dk(`exec ${container} supervisorctl -c /etc/supervisor/supervisord.conf restart cicy-code`, { timeout: 30000 }); }
   catch { try { await dk(`restart ${container}`, { timeout: 60000 }); } catch {} }
@@ -406,7 +406,7 @@ async function restart({ container = "cicy-code-docker-8008", port = 8008, volum
 }
 
 // 原地更新 cicy-code(镜像内的 cicy-code-update.sh,不重建容器)。
-async function update({ onProgress, container = "cicy-code-docker-8008", port = 8008 } = {}) {
+async function update({ onProgress, container = "cicy-code-docker-8009", port = 8009 } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   await startVM({});
   emit({ phase: "image", status: "running", message: "更新 cicy-code(拉取最新版)…" });
@@ -415,23 +415,23 @@ async function update({ onProgress, container = "cicy-code-docker-8008", port =
       { emit, phase: "image", timeout: 300000 });
   } catch (e) { emit({ phase: "done", status: "error", message: `更新失败:${e.message}(试试「升级」重装)` }); return { ok: false, reason: "update_failed" }; }
   const healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 });
-  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? "cicy-code 已更新到最新 🎉" : "更新了但 :8008 还没响应——稍等或点重试" });
+  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? "cicy-code 已更新到最新 🎉" : "更新了但 :8009 还没响应——稍等或点重试" });
   return { ok: healthy };
 }
 
-async function stop({ container = "cicy-code-docker-8008" } = {}) {
+async function stop({ container = "cicy-code-docker-8009" } = {}) {
   try { await dk(`stop ${container}`, { timeout: 30000 }); } catch {}
 }
 
 // docker restart 整个容器(entrypoint 重跑、重读 volume global.json)。
-async function dockerRestart({ container = "cicy-code-docker-8008" } = {}) {
+async function dockerRestart({ container = "cicy-code-docker-8009" } = {}) {
   await dk(`restart ${container}`, { timeout: 45000 });
   return true;
 }
 
 // 重建:强删占该端口的任何容器 + 目标容器,再 docker run(用新 env,如新 docker team
 // 网关 key)。保留 bind-mount 宿主目录(数据/api_token 不丢)。破坏性 → 调用方要 confirm。
-async function recreate({ port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function recreate({ port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009", env = {} } = {}) {
   try { await dk(`ps -aq --filter publish=${port} | xargs -r docker --context ${CTX} rm -f 2>/dev/null; docker --context ${CTX} rm -f ${container} 2>/dev/null; true`, { timeout: 30000 }); } catch {}
   const r = await runContainer({ port, container, volume, env });
   try { await ensureDesktopShortcut(volume, port); } catch {}
@@ -439,21 +439,14 @@ async function recreate({ port = 8008, container = "cicy-code-docker-8008", volu
 }
 
 // 升级 = 删 VM 重装(重置;cicy-team 数据随之重置,实例重新 seed 出新 token)。
-async function upgrade({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function upgrade({ onProgress, port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009", env = {} } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   emit({ phase: "install-docker", status: "running", message: "升级 = 重装运行环境(会重置容器数据)…" });
   try { await sh(`colima delete -f -p ${PROFILE} 2>/dev/null; true`, { timeout: 120000 }); } catch {}
   return await _bootstrap({ onProgress, port, container, volume, env });
 }
 
-// 容器 env 里有没有网关 LLM key —— daemon 用它判断运行中的容器是否需要"带 key 重建"
-// (容器可能在登录前就先无 key 起来了)。key 未设时 printenv 非零退出 → catch → false。
-async function hasGatewayKey(container = "cicy-code-docker-8008") {
-  try { const { stdout } = await dk(`exec ${container} printenv CICY_AI_GATEWAY_LLM_API_KEY`, { timeout: 8000 }); return /sk-/.test(String(stdout || "")); }
-  catch { return false; }
-}
-
 module.exports = {
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
-  vmExists, colimaInstalled, dockerCliInstalled, engineUp, imagePresent, probeHealth, hasGatewayKey,
+  vmExists, colimaInstalled, dockerCliInstalled, engineUp, imagePresent, probeHealth,
 };

package/src/sidecar/docker.js

@@ -441,7 +441,7 @@ function desktopDir() {
 // Start the container. Returns a sidecar child token { docker:true, container,
 // id } or null when Docker isn't ready (homepage guides the user to install
 // Docker Desktop). `container`/`volume` are parameterized so a SECOND instance
-// (the Docker-版 cicy-code on :8008) can run alongside the native local one
+// (the Docker-版 cicy-code on :8009) can run alongside the native local one
 // without a name/volume collision.
 async function start({ port = 8008, container = CONTAINER, volume = VOLUME, mountTarget = "/home/cicy/cicy-ai", env = {} } = {}) {
   // Something already serves a healthy cicy-code on :port (a legacy-named

package/src/sidecar/wsl-docker.js

@@ -4,11 +4,11 @@
 // (Apache-2.0, no licensing) INSIDE a WSL2 Ubuntu distro and drive it with
 // deterministic Linux commands — no UAC click-through, no whale-icon wait, no
 // leftover-staging / PATH issues. WSL2 forwards localhost, so a container
-// published on :8008 in Ubuntu is reachable at 127.0.0.1:8008 on Windows.
+// published on :8009 in Ubuntu is reachable at 127.0.0.1:8009 on Windows.
 //
 // Flow: ensure WSL2 → ensure Ubuntu distro → apt install docker.io → start
 // dockerd → docker load (image tarball from ~/Downloads via /mnt/c) → docker run
-// → health-probe :8008 from Windows. Every step checks-then-acts and is
+// → health-probe :8009 from Windows. Every step checks-then-acts and is
 // idempotent, so 重试 resumes.
 
 const { execFile, execFileSync, spawn } = require("child_process");
@@ -411,7 +411,7 @@ function shareMountArg() {
   } catch (e) { log.warn(`[wsl-docker] Share mount setup failed: ${e.message}`); return ""; }
 }
 
-async function runContainer({ port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008", env = {} } = {}) {
+async function runContainer({ port = 8009, container = "cicy-code-docker", volume = "cicy-team-8009", env = {} } = {}) {
   // 每次容器"启动"(含已在跑被 adopt)都确保桌面快捷方式存在 —— 不存在就建,坏了就修。
   if (await probeHealth(port)) { ensureDesktopShortcut(volume, port).catch(() => {}); return { adopted: true }; }
   // Replace any stale same-named container.
@@ -423,7 +423,7 @@ async function runContainer({ port = 8008, container = "cicy-code-docker", volum
   // --dns: WSL2's auto resolv.conf points the distro at the host NAT gateway
   // (172.x.x.1), which docker's default DNS forwarding does NOT reach from inside a
   // bridge container → every lookup is EAI_AGAIN and cicy-code's startup `npm i`
-  // crash-loops the container (:8008 never comes up). Pin public resolvers: Aliyun
+  // crash-loops the container (:8009 never comes up). Pin public resolvers: Aliyun
   // 223.5.5.5 (CN-fast) first, Google 8.8.8.8 as the overseas fallback.
   const cmd = `docker run -d --name ${container} --restart unless-stopped --dns 223.5.5.5 --dns 8.8.8.8 -p 127.0.0.1:${port}:8008 -e CICY_PUBLIC=1 -v ${volume}:/home/cicy ${shareMountArg()} ${envArgs} ${IMAGE}`;
   await wslRun(cmd, { timeout: 60000 });
@@ -432,11 +432,11 @@ async function runContainer({ port = 8008, container = "cicy-code-docker", volum
 }
 
 // Read the container's OWN api_token (its volume-persisted global.json). This is
-// the ONLY correct credential for :8008 — the host's 8008 token is different and
-// 8008 rejects it. Retries because right after start the entrypoint may not have
+// the ONLY correct credential for :8009 — the host's 8008 token is different and
+// 8009 rejects it. Retries because right after start the entrypoint may not have
 // written global.json yet; returns "" only if it truly can't be read (callers
 // must then NOT open with a wrong/host token — that strands the user at login).
-async function readContainerToken(port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008") {
+async function readContainerToken(port = 8009, container = "cicy-code-docker", volume = "cicy-team-8009") {
   for (let attempt = 1; attempt <= 5; attempt++) {
     // 1) Fast + reliable: read the volume-backed global.json straight from the
     //    distro fs. `docker exec` into a just-loaded/busy container is slow and
@@ -459,7 +459,7 @@ async function readContainerToken(port = 8008, container = "cicy-code-docker", v
 }
 
 // Register a Windows logon task that starts dockerd in our distro on every
-// logon — old inbox WSL ignores wsl.conf [boot], so without this :8008 is dead
+// logon — old inbox WSL ignores wsl.conf [boot], so without this :8009 is dead
 // after a Windows reboot until the user clicks 启动. The container's
 // --restart unless-stopped then brings cicy-code back automatically. Idempotent
 // (start-dockerd.sh is `pgrep dockerd || dockerd`); /f overwrites a stale task.
@@ -477,7 +477,7 @@ function ensureAutostart() {
 }
 
 // Drop a desktop shortcut (folder icon) to the container's /home/cicy — i.e. the
-// cicy-team volume on the distro — so the user can browse :8008's files from
+// cicy-team volume on the distro — so the user can browse :8009's files from
 // Windows Explorer. \\wsl$\<distro>\… is the UNC view of the WSL filesystem.
 // Idempotent: CreateShortcut overwrites. Best-effort (errors swallowed).
 // PowerShell single-quoted literal. PowerShell does NOT treat backslash as an
@@ -487,7 +487,7 @@ function ensureAutostart() {
 // backslashes) which Explorer can't open. That was the broken "WSL 快捷方式".
 function psSingle(s) { return "'" + String(s).replace(/'/g, "''") + "'"; }
 
-function ensureDesktopShortcut(volume = "cicy-team-8008", port = 8008) {
+function ensureDesktopShortcut(volume = "cicy-team-8009", port = 8009) {
   if (process.platform !== "win32") return Promise.resolve();
   return new Promise((res) => {
     // 快捷方式名带 port —— 多个 docker(不同端口)各自一个桌面文件夹快捷方式。
@@ -511,7 +511,7 @@ function ensureDesktopShortcut(volume = "cicy-team-8008", port = 8008) {
 }
 
 // Composite status for the card.
-async function status(port = 8008) {
+async function status(port = 8009) {
   // `unknown` = WSL didn't answer a probe (stuck/booting). The homepage uses it
   // to show 「检测中/WSL 无响应·重试」instead of falsely showing 「下载安装」.
   const miss = await docker.wslMissing();           // true | false | null(unknown)
@@ -542,7 +542,7 @@ async function bootstrap(opts = {}) {
   return _bootstrapInFlight;
 }
 
-async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {} } = {}) {
+async function _bootstrap({ onProgress, port = 8009, container = "cicy-code-docker", volume = "cicy-team", env = {} } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
 
   // Structured, PERSISTED trace of the whole run (electron-log → main.log) so a
@@ -650,7 +650,7 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
 // Restart ONLY cicy-code via supervisor — cron / sshd / user daemons keep
 // running (that's the whole point of the supervisor layout). Falls back to a
 // full container restart on the pre-supervisor image.
-async function restart({ container = "cicy-code-docker", port = 8008, volume = "cicy-team-8008" } = {}) {
+async function restart({ container = "cicy-code-docker", port = 8009, volume = "cicy-team-8009" } = {}) {
   await startEngine();
   try {
     await wslRun(`docker exec ${container} supervisorctl -c /etc/supervisor/supervisord.conf restart cicy-code`, { timeout: 30000 });
@@ -666,7 +666,7 @@ async function restart({ container = "cicy-code-docker", port = 8008, volume = "
 // which installs the latest version side-by-side, repoints the symlink, and
 // `supervisorctl restart cicy-code` — no container recreate, daemons untouched.
 // Streamed to the drawer so the user sees the npm pull + restart.
-async function update({ onProgress, container = "cicy-code-docker", port = 8008 } = {}) {
+async function update({ onProgress, container = "cicy-code-docker", port = 8009 } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   await startEngine();
   emit({ phase: "image", status: "running", message: "更新 cicy-code（拉取最新版）…" });
@@ -678,7 +678,7 @@ async function update({ onProgress, container = "cicy-code-docker", port = 8008
     return { ok: false, reason: "update_failed" };
   }
   const healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 });
-  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? "cicy-code 已更新到最新 🎉" : "更新了但 :8008 还没响应——稍等或点重试" });
+  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? "cicy-code 已更新到最新 🎉" : "更新了但 :8009 还没响应——稍等或点重试" });
   return { ok: healthy };
 }
 async function stop({ container = "cicy-code-docker" } = {}) {
@@ -688,7 +688,7 @@ async function stop({ container = "cicy-code-docker" } = {}) {
 // docker restart 整个容器(stop+start 同一个容器)—— 区别于 restart()(supervisorctl
 // 重启容器内的 cicy-code 进程)和重建(rm+run)。容器重启后 entrypoint 重跑,会重读
 // volume global.json,所以若先把新 key 写进 volume,这个就能让 cicy-code 用上新 key。
-async function dockerRestart({ container = "cicy-code-docker-8008" } = {}) {
+async function dockerRestart({ container = "cicy-code-docker-8009" } = {}) {
   await wslRun(`docker restart ${container}`, { timeout: 45000 });
   return true;
 }
@@ -696,7 +696,7 @@ async function dockerRestart({ container = "cicy-code-docker-8008" } = {}) {
 // 重建容器:docker rm -f 旧容器 + docker run 新容器(用新 env,如新的 docker team 网关
 // key)。**保留 volume**(数据/api_token/deviceId 不丢),只是换掉容器本身 + env。
 // 破坏性(短暂中断 + 换 key)→ 调用方要 confirm。
-async function recreate({ port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function recreate({ port = 8009, container = "cicy-code-docker-8009", volume = "cicy-team-8009", env = {} } = {}) {
   // 强删占用该端口的**任何**容器(含老名字 cicy-code-docker)+ 目标容器 —— 否则
   // runContainer 开头的 probeHealth 看到旧容器还健康会 adopt 它、不重建,key 就换不了。
   try { await wslRun(`docker ps -aq --filter publish=${port} | xargs -r docker rm -f 2>/dev/null; docker rm -f ${container} 2>/dev/null; true`, { timeout: 30000 }); } catch {}
@@ -718,7 +718,7 @@ function unregisterDistro() {
 // downloader, which copes with the flaky CN DNS that bare curl can't) is the
 // only reliable CN update path. This RESETS the distro: the cicy-team volume is
 // re-created and the instance re-seeds (new token) on next boot.
-async function upgrade({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {} } = {}) {
+async function upgrade({ onProgress, port = 8009, container = "cicy-code-docker", volume = "cicy-team", env = {} } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   emit({ phase: "install-docker", status: "running", message: "升级 = 拉取最新运行环境并重装（会重置容器数据）…" });
   try { await stop({ container }); } catch {}
@@ -727,16 +727,7 @@ async function upgrade({ onProgress, port = 8008, container = "cicy-code-docker"
   return await _bootstrap({ onProgress, port, container, volume, env });
 }
 
-// 容器 env 里有没有网关 LLM key —— daemon 判断是否需要带 key 重建(同 colima-docker)。
-async function hasGatewayKey(container = "cicy-code-docker") {
-  try {
-    const r = await wslRun(`docker exec ${container} printenv CICY_AI_GATEWAY_LLM_API_KEY`, { timeout: 8000 });
-    const s = (r && r.stdout != null) ? r.stdout : (r || "");
-    return /sk-/.test(String(s));
-  } catch { return false; }
-}
-
 module.exports = {
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
-  distroInstalled, dockerInstalled, dockerEngineUp, imagePresent, probeHealth, wslRun, hasGatewayKey,
+  distroInstalled, dockerInstalled, dockerEngineUp, imagePresent, probeHealth, wslRun,
 };

package/workers/render/src/App.css

@@ -839,14 +839,8 @@ body {
 .bcard__menu-item.is-accent:hover { background: var(--accent-soft); color: #c7dbff; }
 .bcard__menu-item.is-danger { color: #f7a3a3; }
 .bcard__menu-item.is-danger:hover { background: rgba(239,68,68,.16); color: #fff; }
-/* Labeled divider grouping the Docker container ops below it (主人: docker 操作放一起 + divider). */
-.bcard__menu-sep {
-  display: flex; align-items: center; gap: 8px;
-  margin: 5px 0 2px; padding: 0 12px;
-  font-size: 10.5px; letter-spacing: .04em; text-transform: uppercase;
-  color: #6b7280; user-select: none;
-}
-.bcard__menu-sep::after { content: ""; flex: 1; height: 1px; background: rgba(255,255,255,.08); }
+/* Plain divider line in the DockerCard ⋯ menu (cicy-code ops 上 / Docker 容器 ops 下). */
+.bcard__menu-sep { height: 1px; margin: 5px 10px; background: rgba(255,255,255,.08); }
 /* Portaled to document.body to escape .bcard's overflow:hidden (which clipped the
    dropdown). Inline top/left position it under the kebab; here just a high
    stacking order (below toast/drawer) + word-wrapping items so nothing overflows. */

package/workers/render/src/App.jsx

@@ -745,7 +745,7 @@ export default function App() {
 
   // Logged in: unified tabs + cards grid on the left, full-height webview
   // drawer on the right.
-  // The Docker-版 cicy-code on :8008 has its own dedicated <DockerCard> (right of
+  // The Docker-版 cicy-code on :8009 has its own dedicated <DockerCard> (right of
   // the local card), so pull it out of the generic node list — else it'd ALSO
   // render as a 自定义 card (the bootstrap registers it as a team for the
   // token-injected 打开/刷新 flow).
@@ -833,37 +833,11 @@ export default function App() {
         )}
 
         <div className="app__grid">
-          {/* The docker team (:8008) is rendered ONCE — as the dedicated <DockerCard>
-              below, NOT also as a LocalTeamCard here. Since :8008 is now BOTH the local
-              sidecar port AND the docker app port, it matched localList + dockerTeam and
-              rendered twice (the duplicate card). Exclude it from this map. */}
-          {showLocal && localList.filter((t) => !isDockerApp(t.base_url)).map((t) => (
+          {showLocal && localList.map((t) => (
             <LocalTeamCard key={"local:" + t.id} team={t} onOpen={() => openLocalTeam(t.id)} onRename={renameLocalTeam} onRefresh={fetchLocalTeams} />
           ))}
-          {/* 占位卡 (主人: "本地团队没有占位"): a fresh install starts the sidecar
-              and main auto-registers 本地团队 once :8008 answers — until that
-              lands, hold its spot so the 本地 tab is never blank. The slow
-              localTeams poll swaps this for the real card automatically. */}
-          {showLocal && localList.length === 0 && (
-            <div data-id="LocalTeamPlaceholder" className="bcard bcard--local">
-              <div className="bcard__accent" />
-              <div className="bcard__top">
-                <div className="bcard__pill">
-                  <span className="bcard__dot" data-tone="warn" />
-                  <LaptopIcon />
-                </div>
-              </div>
-              <div className="bcard__body">
-                <h3 className="bcard__name">本地团队</h3>
-                <div className="bcard__host">http://127.0.0.1:8008</div>
-                <div className="bcard__meta" />
-              </div>
-              <button type="button" className="bcard__cta" disabled>
-                <Spinner />
-                <span>{localTeamsFetched ? "正在启动，就绪后自动加入…" : "检测中…"}</span>
-              </button>
-            </div>
-          )}
+          {/* 主人: native :8008 退役 —— 不再有"本地团队 正在启动"占位卡(native 已删,
+              :8008 永远不会起来,占位会一直转)。cicy-code 用下面的 Docker 卡(:8009)。 */}
           {showLocal && (
             <DockerCard
               dockerTeam={dockerTeam}
@@ -873,7 +847,7 @@ export default function App() {
                 // (主人: 必须拿到 token 才能打开,否则被卡在登录页).
                 try {
                   const r = await window.cicy?.docker?.appOpen?.();
-                  if (!r?.ok) toast.show({ id: "docker-open", status: "error", ttl: 6000, message: tr("docker.openNoToken", "服务还没就绪,稍等几秒再点「打开」(或用卡片菜单「重启」)。") });
+                  if (!r?.ok) window.alert("拿不到容器 token,无法打开 :8009。请确认服务已就绪(或用卡片菜单「重启」)后再试。");
                 } catch (e) { console.warn("[DockerCard] open", e); }
               }}
               cloudTitle={dockerCloudTeam?.title}
@@ -1695,7 +1669,7 @@ function DockerInstallDrawerHost() {
             </span>
             <div>
               <div className="drawer__h">{tr("docker.setupTitle", "安装 Docker cicy-code")}</div>
-              <div className="drawer__sub">127.0.0.1:8008</div>
+              <div className="drawer__sub">127.0.0.1:8009</div>
             </div>
           </div>
           <div className="drawer__headbtns">
@@ -1774,7 +1748,7 @@ function DockerInstallDrawerHost() {
 }
 
 // Docker-版 cicy-code card (Windows only): a SECOND cicy-code instance running
-// in Docker on :8008, alongside the native local daemon (:8008). If Docker
+// in Docker on :8009, alongside the native local daemon (:8008). If Docker
 // Desktop is missing, the install flow downloads its installer to the user's
 // Desktop and runs it (主人指令), streaming progress through the drawer above.
 function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
@@ -1786,8 +1760,8 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
   const [editing, setEditing] = useState(false);
   const [draft, setDraft] = useState("");
   // 标题 = 云端 team 的 title(和其它团队同一套;refreshCloudTeams 周期刷新 → 自动跟随
-   // 云端改名)。还没建好云端 team 时回退 "本地团队"(docker-only:这就是本地团队卡)。
-  const displayName = cloudTitle || "本地团队";
+   // 云端改名)。还没建好云端 team 时回退 "Docker 团队"。
+  const displayName = cloudTitle || "Docker 团队";
   const startEdit = (e) => { e?.stopPropagation?.(); setDraft(displayName); setEditing(true); };
   const commitName = async () => {
     setEditing(false);
@@ -1921,7 +1895,7 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
   if (platform !== "win32" && platform !== "darwin") return null;
 
   // Distinct states (主人: 状态分清楚):
-  //   running       — :8008 container healthy → 打开
+  //   running       — :8009 container healthy → 打开
   //   dockerRunning — engine up, no container → 启动 (build/start container)
   //   installed     — Docker on disk but engine down → 启动 Docker
   //   else          — not installed → 下载安装
@@ -1963,10 +1937,10 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
   const onCta = async () => {
     if (isBusy) return;
     if (running) {
-      // 主人令:打开很慢 → 先探这个 :8008 tab 开过没。开过(openedWc 里有它的
+      // 主人令:打开很慢 → 先探这个 :8009 tab 开过没。开过(openedWc 里有它的
       // webContentsId)就**直接 active 秒切**,不再拿 token / 注册 team(那是慢的根)。
       try {
-        const r = await window.cicy?.tabs?.activateIfOpen?.("http://127.0.0.1:8008");
+        const r = await window.cicy?.tabs?.activateIfOpen?.("http://127.0.0.1:8009");
         if (r?.active) return;
       } catch {}
       // 没开过 → 显示 loading(打开中…),走慢路径:拿容器 token 再开 tab。
@@ -2021,32 +1995,29 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
                 ref={menuRef}
                 style={{ position: "fixed", top: menuPos.top, left: menuPos.left, width: MENU_W }}
                 onClick={(e) => e.stopPropagation()}>
-                {/* 常用:更新 / 刷新窗口 / 帐单 / 地址 */}
+                {/* cicy-code 操作(容器内的 cicy-code:更新 / 重启 / 停止)*/}
                 <button type="button" data-id="DockerCard-update" className="bcard__menu-item is-accent" onClick={runUpdate}>
                   {tr("docker.update", "更新 cicy-code")}
                 </button>
+                <button type="button" data-id="DockerCard-restart" className="bcard__menu-item"
+                  onClick={() => runOp("restart", () => window.cicy.docker.appRestart(), tr("docker.restarted", "已重启 cicy-code"))}>
+                  {tr("docker.restart", "重启 cicy-code")}
+                </button>
+                <button type="button" data-id="DockerCard-stop" className="bcard__menu-item is-danger"
+                  onClick={() => runOp("stop", () => window.cicy.docker.appStop(), tr("docker.stopped", "已停止 cicy-code"))}>
+                  {tr("docker.stop", "停止 cicy-code")}
+                </button>
+                {/* 常用 */}
                 <button type="button" data-id="DockerCard-reload" className="bcard__menu-item"
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8008", displayName); }}>
+                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.tabs?.reloadIfOpen?.("http://127.0.0.1:8009", "Docker 团队"); }}>
                   {tr("docker.reloadWindow", "刷新窗口")}
                 </button>
                 <button type="button" data-id="DockerCard-billing" className="bcard__menu-item"
                   onClick={() => { setMenuOpen(false); openCloudPage(dockerTeam?.cloud_team_id ? `?team=${encodeURIComponent(dockerTeam.cloud_team_id)}` : "?view=usage"); }}>
                   {tr("docker.billing", "帐单")}
                 </button>
-                <button type="button" data-id="DockerCard-addr" className="bcard__menu-item"
-                  title={tr("localTeams.copyAddr", "点击复制地址")}
-                  style={{ whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" }}
-                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); try { navigator.clipboard.writeText("http://127.0.0.1:8008"); } catch {} }}>
-                  http://127.0.0.1:8008
-                </button>
-                {/* ── Docker 容器操作(归到一起,divider 分隔)── */}
-                <div className="bcard__menu-sep" data-id="DockerCard-menu-sep" role="separator">
-                  <span>{tr("docker.opsGroup", "Docker 容器")}</span>
-                </div>
-                <button type="button" data-id="DockerCard-restart" className="bcard__menu-item"
-                  onClick={() => runOp("restart", () => window.cicy.docker.appRestart(), tr("docker.restarted", "已重启 cicy-code"))}>
-                  {tr("docker.restart", "重启 cicy-code")}
-                </button>
+                {/* 分隔线:下面是操作整个 Docker 容器的(重启 Docker / 重建 Docker)*/}
+                <div className="bcard__menu-sep" data-id="DockerCard-menu-sep" role="separator" aria-hidden />
                 <button type="button" data-id="DockerCard-docker-restart" className="bcard__menu-item"
                   onClick={() => runOp("restart", () => window.cicy.docker.appDockerRestart(), tr("docker.dockerRestarted", "已重启 Docker 容器"))}>
                   {tr("docker.dockerRestart", "重启 Docker")}
@@ -2055,10 +2026,6 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
                   onClick={(e) => { e.stopPropagation(); setMenuOpen(false); setConfirmRecreate(true); }}>
                   {tr("docker.recreate", "重建 Docker")}
                 </button>
-                <button type="button" data-id="DockerCard-stop" className="bcard__menu-item is-danger"
-                  onClick={() => runOp("stop", () => window.cicy.docker.appStop(), tr("docker.stop", "停止 cicy-code"))}>
-                  {tr("docker.stop", "停止")}
-                </button>
               </div>,
               document.body
             )}
@@ -2066,7 +2033,7 @@ function DockerCard({ dockerTeam, cloudTitle, onOpen, onRename, onRefresh }) {
         )}
       </div>
       <div className="bcard__body">
-        {/* 8008 现在有独立云端 team(cloud_team_id 是它自己的,不再和 8008 串),所以
+        {/* 8009 现在有独立云端 team(cloud_team_id 是它自己的,不再和 8008 串),所以
             标题可改名:本地节点名 + 云端 PATCH 双写(onRename 在父组件处理)。 */}
         <div style={{ height: 28, display: "flex", alignItems: "center" }}>
           {editing ? (
@@ -2541,13 +2508,13 @@ function isLocalSidecar(baseUrl) {
   } catch { return false; }
 }
 
-// The Docker-版 cicy-code instance — localhost:8008. Owned by <DockerCard>, so
+// The Docker-版 cicy-code instance — localhost:8009. Owned by <DockerCard>, so
 // it's filtered out of the generic node lists.
 function isDockerApp(baseUrl) {
   try {
     const p = new URL(baseUrl);
     const local = p.hostname === "127.0.0.1" || p.hostname === "localhost" || p.hostname === "::1";
-    return local && p.port === "8008";
+    return local && p.port === "8009";
   } catch { return false; }
 }