cicy-desktop 2.1.205 → 2.1.207

package/src/sidecar/wsl-docker.js

@@ -131,6 +131,72 @@ async function distroInstalled(distro = DISTRO) {
   });
 }
 
+// ── WSL 卡死(wedged)自愈 ────────────────────────────────────────────────────
+// 偶发深度死锁:所有 `wsl` 命令(连 `wsl --shutdown`)都 hang,且重启电脑也复发——
+// 成因 = 某 distro 的 vhdx 损坏 + LxssManager 卡在 STOP_PENDING。普通用户无从下手。
+// 关键:`sc query LxssManager` / 注册表 / 文件操作都不走 wsl、不会 hang,所以 app 能
+// 绕开卡死的 wsl 自检 + 自愈:检测到卡死 → 标记 → (重启后)bootstrap 启动时自动把坏
+// distro 从注册表移除 + 文件夹改名备份(不删,留 vhdx 可 `wsl --mount` 抢救)→ 重新导入。
+const WSL_RESET_FLAG = path.join(os.homedir(), "cicy-ai", "db", "wsl-reset-needed.flag");
+function markWslReset() { try { fs.mkdirSync(path.dirname(WSL_RESET_FLAG), { recursive: true }); fs.writeFileSync(WSL_RESET_FLAG, String(Date.now())); } catch {} }
+function wslResetPending() { try { return fs.existsSync(WSL_RESET_FLAG); } catch { return false; } }
+function clearWslReset() { try { fs.unlinkSync(WSL_RESET_FLAG); } catch {} }
+
+// LxssManager 卡在 STOP_PENDING/START_PENDING = WSL wedged(此刻所有 wsl 命令都 hang)。
+// 用 `sc query`(不经 wsl,秒回)判定,绝不 hang。
+function lxssWedged() {
+  if (process.platform !== "win32") return Promise.resolve(false);
+  return new Promise((resolve) => {
+    execFile("sc", ["query", "LxssManager"], { timeout: 8000, windowsHide: true }, (err, stdout) => {
+      if (err) return resolve(false);
+      resolve(/STOP_PENDING|START_PENDING/i.test(String(stdout || "")));
+    });
+  });
+}
+
+// 不经 wsl 移除坏 distro:删注册表 Lxss 项 + BasePath 文件夹改名备份(.bak-<ts>,不删)。
+// 仅当 distro 未挂载(vhdx 未锁)时成功——即重启后、任何 wsl 调用之前。返回 powershell 输出。
+function resetDistroFiles(distro = DISTRO) {
+  const ps = `$ErrorActionPreference='SilentlyContinue'
+$b='HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss'
+Get-ChildItem $b | ForEach-Object {
+  $p = Get-ItemProperty $_.PSPath
+  if ($p.DistributionName -eq '${distro}') {
+    $bp = $p.BasePath
+    if ($bp -and $bp.StartsWith('\\\\?\\')) { $bp = $bp.Substring(4) }
+    Remove-Item $_.PSPath -Recurse -Force
+    if ($bp -and (Test-Path $bp)) { Move-Item $bp ($bp + '.bak-' + (Get-Date -Format yyyyMMddHHmmss)) -Force }
+    Write-Output 'reset-done'
+  }
+}`;
+  const file = path.join(os.tmpdir(), `cicy-wsl-reset-${Date.now()}.ps1`);
+  return new Promise((resolve) => {
+    try { fs.writeFileSync(file, ps); } catch {}
+    execFile("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", file], { timeout: 30000, windowsHide: true }, (err, so) => {
+      try { fs.unlinkSync(file); } catch {}
+      resolve(String(so || "").trim());
+    });
+  });
+}
+
+// 一键修复(app 调):先试重启 LxssManager;还卡死(深度死锁,杀不动)→ 标记待重置 +
+// 告诉调用方需重启电脑(重启后 bootstrap 自动重置坏 distro)。
+async function repairWsl({ emit } = {}) {
+  if (process.platform !== "win32") return { ok: false, error: "win-only" };
+  const say = (m) => { try { emit && emit({ phase: "install-docker", status: "running", message: m }); } catch {} };
+  say("尝试重启 WSL 服务(LxssManager)…");
+  await new Promise((r) => execFile("powershell", ["-NoProfile", "-Command", "Restart-Service LxssManager -Force -ErrorAction SilentlyContinue"], { timeout: 30000, windowsHide: true }, () => r()));
+  await new Promise((r) => setTimeout(r, 2500));
+  if (await lxssWedged()) {
+    markWslReset();
+    say("WSL 服务仍卡死,需要重启电脑;重启后会自动修复。");
+    return { ok: false, needsReboot: true };
+  }
+  say("WSL 服务已恢复,正在重置环境…");
+  markWslReset(); // 坏 distro 仍可能在,交给(可能需重启后的)bootstrap 自动重置
+  return { ok: true };
+}
+
 // Install the Ubuntu distro WITHOUT launching its interactive first-run setup
 // (--no-launch). We always run commands as root afterwards, so no user account
 // is needed. Elevated via the scheduled-task path (reliable on these machines).
@@ -331,7 +397,7 @@ async function launchDockerd() {
     { timeout: 20000 });
 }
 
-async function startEngine({ emit } = {}) {
+async function startEngine({ emit, noShutdown = false } = {}) {
   const e = (ev) => { try { emit && emit(ev); } catch {} };
   // Up to 3 attempts. Each: launch dockerd (detached, returns instantly) then POLL
   // the socket in SHORT, SEPARATE wsl calls — never hold the distro in one 120s call
@@ -358,7 +424,10 @@ async function startEngine({ emit } = {}) {
     // Recover. A stuck launch = WSL wedged → `wsl --shutdown` (full VM reset — the
     // ONLY thing that clears a real wedge; --terminate isn't enough). Otherwise
     // dockerd just died/is slow → clear stale runtime files for a clean relaunch.
-    if (stuck) { log.info(`[startEngine] WSL stuck → wsl --shutdown`); try { await wslShutdown(); } catch {} }
+    if (stuck && noShutdown) {
+      // 更新路径:绝不 wsl --shutdown(会把正在跑的容器 + 整个 VM 干掉)。只记录,交给上层处理。
+      log.warn(`[startEngine] WSL stuck but noShutdown=true → 跳过 wsl --shutdown(更新路径不重置 VM)`);
+    } else if (stuck) { log.info(`[startEngine] WSL stuck → wsl --shutdown`); try { await wslShutdown(); } catch {} }
     else { try { await wslRun("if ! pgrep dockerd >/dev/null 2>&1; then rm -f /var/run/docker.pid /run/docker.pid /var/run/docker.sock /run/docker.sock; fi", { timeout: 15000 }); } catch {} }
   }
   log.error("[startEngine] ✗ dockerd NOT up after 3 attempts");
@@ -474,7 +543,22 @@ function projectsMountArg() {
   } catch (e) { log.warn(`[wsl-docker] projects mount setup failed: ${e.message}`); return ""; }
 }
 
-async function runContainer({ port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008", env = {}, emit } = {}) {
+// extraPorts → additional `-p 127.0.0.1:<p>:<p>` mappings (host=container, loopback
+// only). For container-internal agent services the user wants reachable from
+// Windows. Each adds one docker-proxy, so keep the list small. 8008/主端口自动排除。
+function publishArgs(port, extraPorts = []) {
+  const seen = new Set([Number(port), 8008]);
+  let args = `-p 127.0.0.1:${port}:8008`;
+  for (const raw of Array.isArray(extraPorts) ? extraPorts : []) {
+    const p = Number(raw);
+    if (!Number.isInteger(p) || p < 1 || p > 65535 || seen.has(p)) continue;
+    seen.add(p);
+    args += ` -p 127.0.0.1:${p}:${p}`;
+  }
+  return args;
+}
+
+async function runContainer({ port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008", env = {}, extraPorts = [], emit } = {}) {
   // 每次容器"启动"(含已在跑被 adopt)都确保桌面快捷方式存在 —— 不存在就建,坏了就修。
   if (await probeHealth(port)) { ensureDesktopShortcut(volume, port).catch(() => {}); return { adopted: true }; }
   // Replace any stale same-named container.
@@ -493,7 +577,7 @@ async function runContainer({ port = 8008, container = "cicy-code-docker", volum
   // 只发布 :8008(单端口,1 个 docker-proxy)。EXTRA_PORTS 那段 18000-19999(2000 个端口)
   // 已删——docker 默认每端口起一个 userland-proxy 进程 → 2000 进程,docker run 卡死/吃内存/
   // 偶发失败(实测)。容器内 agent 服务需要从 Windows 直达时再按需单独暴露。
-  const cmd = `docker run -d --name ${container} --restart unless-stopped --dns 223.5.5.5 --dns 8.8.8.8 -p 127.0.0.1:${port}:8008 -e CICY_PUBLIC=1 -v ${volume}:/home/cicy ${projectsMountArg()} ${envArgs} ${IMAGE}`;
+  const cmd = `docker run -d --name ${container} --restart unless-stopped --dns 223.5.5.5 --dns 8.8.8.8 ${publishArgs(port, extraPorts)} -e CICY_PUBLIC=1 -v ${volume}:/home/cicy ${projectsMountArg()} ${envArgs} ${IMAGE}`;
   emit && emit({ phase: "container", status: "running", message: `$ ${cmd.length > 220 ? cmd.slice(0, 220) + " …" : cmd}` });
   await wslRun(cmd, { timeout: 60000 }); // 失败时 err.stderr 带 docker 真错误 → _bootstrap 的 errTail 显示
   ensureDesktopShortcut(volume, port).catch(() => {});
@@ -615,7 +699,13 @@ async function status(port = 8008) {
   const running = healthy || !!(engineUp && (await probeHealth(port)));
   // 服务在跑(:8008 健康)但 wsl 查不到发行版/引擎 → WSL 被孤儿化,管理(更新/重启)会失败。
   const wslUnmanaged = healthy && !engineUp;
-  return { wsl, distro, engineUp, running, unknown: unknown && !healthy, healthy, wslUnmanaged };
+  // WSL 卡死(wedged):wsl 探测超时(unknown)且 :8008 也不健康,再确认 LxssManager 卡在
+  // STOP_PENDING(sc query 不 hang)→ 这是死锁,不是「没装」。标记待重置,卡片给「修复」。
+  let wslWedged = false;
+  if (unknown && !healthy) {
+    if (await lxssWedged()) { wslWedged = true; markWslReset(); }
+  }
+  return { wsl, distro, engineUp, running, unknown: unknown && !healthy, healthy, wslUnmanaged, wslWedged };
 }
 
 // Guard against overlapping bootstrap runs (double-click 重试 / re-entrancy):
@@ -652,7 +742,7 @@ async function bootstrap(opts = {}) {
 // 注意: 默认容器/卷名保持 cicy-team / cicy-code-docker(回退实测"现在不行了"的改动)。
 // live 路径(docker:app-bootstrap)始终传显式 APP_*(cicy-team-8008)名,不靠这里的默认;
 // 改默认会让既有 cicy-team 卷的装机对不上 → 退回原值。
-async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {} } = {}) {
+async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {}, extraPorts = [] } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
 
   // Structured, PERSISTED trace of the whole run (electron-log → main.log) so a
@@ -673,6 +763,17 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
   };
   log.info(`[bootstrap] START port=${port} container=${container} volume=${volume}`);
 
+  // 自愈:上次检测到 WSL 卡死(或修复流程标记了待重置)→ 此刻(重启后、未碰 wsl 前)把坏
+  // distro 从注册表移除 + 文件夹改名备份(不删数据),让下面走全新导入,而不是又去碰坏 distro
+  // 再次卡死。纯注册表/文件操作,不经 wsl。
+  if (process.platform === "win32" && wslResetPending()) {
+    begin("reset-broken-distro");
+    emit({ phase: "install-docker", status: "running", message: "检测到上次 WSL 卡死,正在重置环境(旧数据已改名备份,不删)…" });
+    try { const r = await resetDistroFiles(); log.info(`[bootstrap] reset-broken-distro out=${r || "(none)"}`); } catch (e) { log.warn(`[bootstrap] reset failed: ${e.message}`); }
+    clearWslReset();
+    done();
+  }
+
   // 0) Fast path: healthy AND the distro is TRULY wsl-managed → instant no-op.
   //    BUT a ZOMBIE :8008 (distro unregistered from WSL, yet a leftover wslhost.exe
   //    still holds the port-forward → health 200 even after `wsl --shutdown`) is NOT
@@ -752,7 +853,7 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
   begin("run-container");
   if (!(await probeHealth(port))) {
     emit({ phase: "container", status: "running", message: "启动 cicy-code 服务…" });
-    try { await runContainer({ port, container, volume, env, emit }); }
+    try { await runContainer({ port, container, volume, env, extraPorts, emit }); }
     catch (e) { fail("container_start_failed", e.message); emit({ phase: "container", status: "error", message: `服务启动失败：${e.message}（点重试）${errTail(e)}` }); finish(false, "container_start_failed"); return { ok: false, reason: "container_start_failed" }; }
     done();
   } else done(true);
@@ -773,7 +874,9 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
 // running (that's the whole point of the supervisor layout). Falls back to a
 // full container restart on the pre-supervisor image.
 async function restart({ container = "cicy-code-docker", port = 8008, volume = "cicy-team-8008" } = {}) {
-  await startEngine();
+  // 重启 cicy-code 只需 docker exec——引擎必然在跑。同 update:绝不无条件 startEngine()
+  // (它误判卡住会 wsl --shutdown 把容器+WSL 干掉)。引擎确实没起才轻量拉,且 noShutdown。
+  if (!(await dockerEngineUp())) { await startEngine({ noShutdown: true }); }
   try {
     await wslRun(`docker exec ${container} supervisorctl -c /etc/supervisor/supervisord.conf restart cicy-code`, { timeout: 30000 });
   } catch {
@@ -784,24 +887,109 @@ async function restart({ container = "cicy-code-docker", port = 8008, volume = "
   return ok;
 }
 
-// Update cicy-code IN PLACE: the supervisor image ships cicy-code-update.sh,
-// which installs the latest version side-by-side, repoints the symlink, and
-// `supervisorctl restart cicy-code` — no container recreate, daemons untouched.
-// Streamed to the drawer so the user sees the npm pull + restart.
+// Minimal JSON GET (host network, fail-fast). Used to resolve the latest
+// cicy-code version on the HOST instead of inside the slow container registry.
+function getJson(url, timeout = 12000) {
+  const https = require("https");
+  return new Promise((resolve, reject) => {
+    // Accept-Encoding: identity — Node http(s) does NOT auto-gunzip; force plain
+    // so JSON.parse never chokes on a compressed body. rejectUnauthorized:false —
+    // this only reads a version *string*, so survive TLS-intercepting proxies.
+    const req = https.get(url, { headers: { "User-Agent": "cicy-desktop", Accept: "application/json", "Accept-Encoding": "identity" }, timeout, rejectUnauthorized: false }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { res.resume(); return getJson(res.headers.location, timeout).then(resolve, reject); }
+      if (res.statusCode !== 200) { res.resume(); return reject(new Error(`HTTP ${res.statusCode}`)); }
+      let s = ""; res.setEncoding("utf8"); res.on("data", (d) => (s += d));
+      res.on("end", () => { try { resolve(JSON.parse(s)); } catch (e) { reject(e); } });
+    });
+    req.on("error", reject);
+    req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
+  });
+}
+
+// Resolve cicy-code's latest published version from the HOST (fast/reliable
+// network), trying the network-appropriate registry first then falling back.
+// 2 passes (transient failures are common), both registries each pass. Returns
+// null if all fail (caller then lets the in-container script try).
+async function resolveLatestCicy(net) {
+  const CN = "https://registry.npmmirror.com", OFFICIAL = "https://registry.npmjs.org";
+  const order = net === "global" ? [OFFICIAL, CN] : [CN, OFFICIAL];
+  for (let pass = 0; pass < 2; pass++) {
+    for (const reg of order) {
+      try {
+        const j = await getJson(`${reg}/cicy-code/latest`, 12000);
+        if (j && j.version) return String(j.version);
+      } catch (e) { log.warn(`[wsl-docker] resolveLatestCicy via ${reg} (pass ${pass}) failed:`, e.message); }
+    }
+  }
+  return null;
+}
+
+// Current installed cicy-code version, read from the container's versions.json.
+async function installedCicyVersion(container) {
+  try {
+    const { stdout } = await wslRun(`docker exec ${container} bash -lc "cat ~/cicy-ai/runtime/versions.json 2>/dev/null"`, { timeout: 15000 });
+    const j = JSON.parse(stdout);
+    return j && j["cicy-code"] && j["cicy-code"].current ? String(j["cicy-code"].current) : null;
+  } catch { return null; }
+}
+
+// Update cicy-code IN PLACE. SMART path (避免容器内 npm view 卡 ~2min):
+//  1. 在宿主机解析最新版本号(host 网络,不过容器代理/DNS)
+//  2. 和容器里已装版本比对——一样就直接「已是最新」,根本不 docker exec
+//  3. 真有新版才 cp 脚本进容器,并把**已解析的具体版本**传给它(脚本跳过自己的 npm view)
+// 容器里只剩真正的 `npm install -g cicy-code@<ver>`(+ fail-fast/换源),不再有版本查询的卡顿。
 async function update({ onProgress, container = "cicy-code-docker", port = 8008 } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
-  await startEngine();
-  emit({ phase: "image", status: "running", message: "更新 cicy-code（拉取最新版）…" });
+  // 更新一个 running 容器只需 docker exec——引擎必然在跑。绝不无条件 startEngine():它的
+  // 「WSL 卡住→wsl --shutdown」恢复路径会把正在跑的容器 + 整个 WSL VM 一起干掉(这正是
+  // 「点更新 → docker 挂 + WSL 卡死」的根因:一次瞬时 wsl 慢响应被误判成 wedged → shutdown)。
+  // 只有引擎确实没起才轻量拉一下,且**禁用 wsl --shutdown**(noShutdown)。
+  if (!(await dockerEngineUp())) {
+    emit({ phase: "container", status: "running", message: t("dockerOpen.engineStartingNoReset") });
+    await startEngine({ emit, noShutdown: true });
+  }
+  // 1) 宿主机解析最新版 + 读容器已装版本(都很快;net-detect 决定源顺序 + 注入)。
+  emit({ phase: "image", status: "running", message: t("docker.updating.checking") });
+  let net = "unknown";
+  try { net = await require("./net-detect").detect(); } catch {}
+  const [latest, current] = await Promise.all([resolveLatestCicy(net), installedCicyVersion(container)]);
+  log.info(`[wsl-docker] update: net=${net} latest=${latest} current=${current}`);
+  // 2) 已是最新 → 秒回,根本不进容器装(你点更新等 2 分钟的就是这种「其实已最新」的空跑)。
+  if (latest && current && latest === current) {
+    emit({ phase: "done", status: "done", message: t("docker.updating.alreadyLatest", { v: current }) });
+    return { ok: true, alreadyLatest: true, version: current };
+  }
+  // 宿主机没解析出版本 → 给个可见提示(诊断:让用户/我们知道是 host 网络问题,而非容器)。
+  if (!latest) emit({ phase: "image", status: "running", message: t("docker.updating.hostResolveFail") });
+  // 3) 真要装:cp desktop 自带的脚本进容器(随 desktop 发版下发,不依赖镜像),把**已解析
+  //    的具体版本**作参数传进去 → 脚本跳过自己的 npm view,容器里不再有版本查询的卡顿。
+  emit({ phase: "image", status: "running", message: latest ? t("docker.updating.toVersion", { v: latest }) : t("docker.updating.pulling") });
+  // cp 结果出到 drawer(诊断:之前静默失败 → 回落镜像内旧脚本 → 又卡 2 分钟,看不出来)。
   try {
-    await wslRunStream(`docker exec ${container} bash -lc "command -v cicy-code-update.sh >/dev/null && cicy-code-update.sh || /usr/local/bin/cicy-code-update.sh"`,
+    const b64 = fs.readFileSync(path.join(__dirname, "container-scripts", "cicy-code-update.sh")).toString("base64");
+    await wslRun(`echo ${b64} | base64 -d | docker exec -i ${container} bash -c 'cat > /usr/local/bin/cicy-code-update.sh && chmod 0755 /usr/local/bin/cicy-code-update.sh'`, { timeout: 30000 });
+    emit({ phase: "image", status: "running", message: t("docker.updating.scriptReady") });
+  } catch (e) {
+    log.warn("[wsl-docker] push cicy-code-update.sh failed, fallback to baked:", e.message);
+    emit({ phase: "image", status: "running", message: t("docker.updating.scriptPushFail") });
+  }
+  // 按宿主机网络选 npm 源(脚本里 NPM_REGISTRY override 最高优先)。
+  let regEnv = "";
+  if (net === "global") regEnv = "-e NPM_REGISTRY=https://registry.npmjs.org ";
+  else if (net === "cn") regEnv = "-e NPM_REGISTRY=https://registry.npmmirror.com ";
+  // 解析到了具体版本就传进去(脚本据此跳过 npm view);没解析到则传空 → 脚本走 latest+fail-fast。
+  const verArg = latest ? ` ${latest}` : "";
+  try {
+    await wslRunStream(`docker exec ${regEnv}${container} bash -lc "command -v cicy-code-update.sh >/dev/null && cicy-code-update.sh${verArg} || /usr/local/bin/cicy-code-update.sh${verArg}"`,
       { emit, phase: "image", timeout: 300000 });
   } catch (e) {
-    emit({ phase: "done", status: "error", message: `更新失败：${e.message}（此镜像可能不支持，试试「升级」重装）` });
+    emit({ phase: "done", status: "error", message: t("docker.updating.failed", { msg: e.message }) });
     return { ok: false, reason: "update_failed" };
   }
   const healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 });
-  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? "cicy-code 已更新到最新 🎉" : "更新了但 :8008 还没响应——稍等或点重试" });
-  return { ok: healthy };
+  const doneMsg = healthy ? (latest ? t("docker.updating.doneVersion", { v: latest }) : t("docker.updating.doneLatest")) : t("docker.updating.notReady");
+  emit({ phase: "done", status: healthy ? "done" : "error", message: doneMsg });
+  return { ok: healthy, version: latest || null };
 }
 async function stop({ container = "cicy-code-docker" } = {}) {
   try { await wslRun(`docker stop ${container}`, { timeout: 30000 }); } catch {}
@@ -818,16 +1006,21 @@ async function dockerRestart({ container = "cicy-code-docker-8008" } = {}) {
 // 重建容器:docker rm -f 旧容器 + docker run 新容器(用新 env,如新的 docker team 网关
 // key)。**保留 volume**(数据/api_token/deviceId 不丢),只是换掉容器本身 + env。
 // 破坏性(短暂中断 + 换 key)→ 调用方要 confirm。
-async function recreate({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {} } = {}) {
+async function recreate({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {}, extraPorts = [] } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   // 重建 = 用最新镜像重建。OSS 有更新版先刷新(非破坏性,不删发行版/volume),再 rm + run。
   try { await ensureFreshImage({ emit }); } catch (e) { emit({ phase: "image", status: "running", message: `镜像刷新跳过(${e.message}),用现有镜像重建` }); }
   // 强删占用该端口的**任何**容器(含老名字 cicy-code-docker)+ 目标容器 —— 否则
   // runContainer 开头的 probeHealth 看到旧容器还健康会 adopt 它、不重建,key 就换不了。
   try { await wslRun(`docker ps -aq --filter publish=${port} | xargs -r docker rm -f 2>/dev/null; docker rm -f ${container} 2>/dev/null; true`, { timeout: 30000 }); } catch {}
-  const r = await runContainer({ port, container, volume, env, emit });
+  const r = await runContainer({ port, container, volume, env, extraPorts, emit });
   try { await ensureDesktopShortcut(volume, port); } catch {}
-  return r;
+  // 等 :8008 真正起来再返回——否则 docker run 一返回卡片就探测「没运行」,显示「启动」让
+  // 用户再点一下(实测:端口保存后重建,drawer 关了还要手动点启动)。
+  emit({ phase: "container", status: "running", message: t("docker.updating.starting") });
+  const healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 });
+  emit({ phase: "done", status: healthy ? "done" : "error", message: healthy ? t("docker.ready") : t("docker.updating.notReady") });
+  return { ...r, ok: healthy };
 }
 // Unregister the dedicated distro (idempotent; no-op if absent). Used by upgrade
 // to wipe a stale install before re-importing the latest pre-baked package.
@@ -867,5 +1060,5 @@ async function readMihomoConfig(container = "cicy-code-docker-8008") {
 module.exports = {
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
   distroInstalled, dockerInstalled, dockerEngineUp, imagePresent, probeHealth, wslRun, hasGatewayKey,
-  readMihomoConfig,
+  readMihomoConfig, repairWsl, lxssWedged,
 };

package/workers/render/src/App.jsx

@@ -1155,7 +1155,7 @@ function TrustedSitesModal({ onClose }) {
   };
 
   return createPortal(
-    <div style={S.overlay} onClick={onClose} data-id="TrustedSitesModal">
+    <div style={S.overlay} onMouseDown={(e) => { if (e.target === e.currentTarget) onClose(); }} data-id="TrustedSitesModal">
       <div style={S.card} onClick={(e) => e.stopPropagation()}>
         <div style={S.head}>
           <h2 style={S.title}>{tr("trustedSites.title", "受信任站点")}</h2>
@@ -1285,7 +1285,7 @@ function AuditLogModal({ onClose }) {
   const Th = (t) => <div>{t}</div>;
 
   return createPortal(
-    <div style={S.overlay} onClick={onClose} data-id="AuditLogModal">
+    <div style={S.overlay} onMouseDown={(e) => { if (e.target === e.currentTarget) onClose(); }} data-id="AuditLogModal">
       <div style={S.card} onClick={(e) => e.stopPropagation()}>
         <div style={S.head}>
           <div style={S.titleWrap}>
@@ -1822,8 +1822,15 @@ const dockerDrawer = {
     // Log only milestone events — never the per-% running download ticks.
     const isRunningTick = ev.status === "running" && hasPct && isDl;
     if (!isRunningTick) {
-      const line = { id: ++dockerDrawerLogSeq, t: clockHHMMSS(), phase, status: ev.status || "running", message: ev.message || "" };
-      next.logs = [...dockerDrawerState.logs, line];
+      // 去重:两条订阅(全局兜底 + 某 run*() 自己的)偶发对同一事件各 push 一次 → 日志重复。
+      // 末行 phase/status/message 完全相同则跳过(兜底,不影响正常重复行很少的场景)。
+      const last = dockerDrawerState.logs[dockerDrawerState.logs.length - 1];
+      const st = ev.status || "running";
+      const msg = ev.message || "";
+      if (!(last && last.phase === phase && last.status === st && last.message === msg)) {
+        const line = { id: ++dockerDrawerLogSeq, t: clockHHMMSS(), phase, status: st, message: msg };
+        next.logs = [...dockerDrawerState.logs, line];
+      }
     }
     dockerDrawerState = next;
     emitDockerDrawer();
@@ -1993,6 +2000,10 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   const [busy, setBusy] = useState("");   // "" | bootstrap | restart | stop | upgrade | probe
   const [menuOpen, setMenuOpen] = useState(false);
   const [confirmRecreate, setConfirmRecreate] = useState(false); // 重建容器 in-app 确认弹窗(不用 native confirm)
+  const [portsOpen, setPortsOpen] = useState(false);   // 端口设置 modal
+  const [portList, setPortList] = useState([]);         // 编辑中的额外端口(字符串数组,便于输入)
+  const [portsBusy, setPortsBusy] = useState(false);
+  const [portsErr, setPortsErr] = useState("");
   // Inline rename (mirrors LocalTeamCard): double-click the title to edit.
   const [editing, setEditing] = useState(false);
   const [draft, setDraft] = useState("");
@@ -2021,7 +2032,12 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
       // 不到 docker:app-progress 完成事件,抽屉就一直转(用户看到的「正在跟随同一进度」假死)。
       // 这里检测到容器起来了就直接把抽屉收成「完成」,不再死等 promise。
       // kind!=="open":只自愈安装抽屉;「打开」抽屉(失败报告)绝不被「已就绪」劫持。
-      if (s?.running && dockerDrawerState && dockerDrawerState.status === "running" && dockerDrawerState.kind !== "open") {
+      // **只自愈真正卡住的抽屉**(>10s 没收到任何进度事件):否则会误杀正在进行的「更新/
+      // 重启 cicy-code」——它们是 in-place 操作,容器全程 healthy,点更新瞬间 busy 变化触发
+      // 一次 checkStatus 就会把还在跑的抽屉提前收成「完成」,用户点完成关掉、命令却还在跑、
+      // 卡片卡在「处理中」(实测 bug)。活跃流式的抽屉 lastAt 是新的,不动它。
+      const stale = Date.now() - (dockerDrawerState?.lastAt || 0) > 30000;
+      if (s?.running && dockerDrawerState && dockerDrawerState.status === "running" && dockerDrawerState.kind !== "open" && stale) {
         dockerDrawer.finish({ ok: true, message: "Docker cicy-code 已就绪" });
       }
     } catch (e) { console.warn("[DockerCard]", e); }
@@ -2036,6 +2052,38 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
     return () => clearInterval(id);
   }, [checkStatus, busy]);
 
+  // 端口设置(定义在 checkStatus 之后:savePorts 依赖它,放前面会 TDZ 崩首页)。
+  const openPorts = useCallback(async () => {
+    setMenuOpen(false); setPortsErr("");
+    try { const r = await window.cicy?.docker?.getPorts?.(); setPortList((r?.ports || []).map(String)); }
+    catch { setPortList([]); }
+    setPortsOpen(true);
+  }, []);
+  const savePorts = useCallback(async () => {
+    // 校验:1-65535、≠8008、去重、忽略空行。
+    const seen = new Set(); const out = [];
+    for (const raw of portList) {
+      const s = String(raw).trim(); if (!s) continue;
+      const p = Number(s);
+      if (!Number.isInteger(p) || p < 1 || p > 65535 || p === 8008 || seen.has(p)) { setPortsErr(tr("docker.ports.invalid", "有端口无效(1-65535,不能是 8008,不能重复)")); return; }
+      seen.add(p); out.push(p);
+    }
+    setPortsErr(""); setPortsBusy(true); setPortsOpen(false);
+    setBusy("recreate");
+    dockerDrawer.open({ onRetry: savePorts });
+    const unsub = window.cicy?.docker?.onAppProgress?.((ev) => dockerDrawer.push(ev));
+    try {
+      const r = await window.cicy?.docker?.setPorts?.(out);
+      dockerDrawer.finish({ ok: !!r?.ok, message: r?.ok ? tr("docker.ports.save", "保存并重建") + " ✅" : (r?.error || tr("docker.opFailed", "操作失败")) });
+      if (r?.ok) { try { const s = await window.cicy?.docker?.appRedetect?.(); if (s) setStatus(s); } catch {} }
+    } catch (e) {
+      dockerDrawer.finish({ ok: false, message: e.message });
+    } finally {
+      try { unsub && unsub(); } catch {}
+      setPortsBusy(false); setBusy(""); checkStatus();
+    }
+  }, [portList, checkStatus]);
+
   // Close the ⋯ menu on outside-click / Esc (mirrors LocalTeamCard).
   useEffect(() => {
     if (!menuOpen) return;
@@ -2081,6 +2129,30 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
     }
   }, [checkStatus, onRefresh]);
 
+  // 修复 WSL(WSL 死锁时):重启 LxssManager;若深度死锁(杀不动)→ 提示重启电脑(重启后
+  // bootstrap 自动重置坏 distro)。全程走抽屉显示进度。
+  const repairWsl = useCallback(async () => {
+    setBusy("repair");
+    dockerDrawer.open({ onRetry: repairWsl });
+    const unsub = window.cicy?.docker?.onAppProgress?.((ev) => dockerDrawer.push(ev));
+    try {
+      const r = await window.cicy?.docker?.appRepairWsl?.();
+      if (r?.needsReboot) {
+        dockerDrawer.finish({ status: "reboot", message: tr("docker.wslNeedReboot", "WSL 服务卡死,请【重启 Windows】;重启后打开 CiCy 会自动修复(旧数据已改名备份,不删)。") });
+      } else if (r?.ok) {
+        dockerDrawer.finish({ ok: true, message: tr("docker.wslRepaired", "WSL 已修复 ✅") });
+        onRefresh?.();
+      } else {
+        dockerDrawer.finish({ ok: false, message: r?.error || tr("docker.repairFailed", "修复失败") });
+      }
+    } catch (e) {
+      dockerDrawer.finish({ ok: false, message: e.message });
+    } finally {
+      try { unsub && unsub(); } catch {}
+      setBusy(""); checkStatus();
+    }
+  }, [checkStatus, onRefresh]);
+
   // Upgrade: re-pull the R2 image + recreate the container — also through the
   // drawer so the user sees the pull/import/restart log (升级要能看日志).
   const runUpgrade = useCallback(async () => {
@@ -2181,10 +2253,13 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   // 消失 → token 读不到、打不开。所以 wslUnmanaged 不再是「可打开」,而是「需修复」:
   // CTA 走「修复 WSL」自动重装(bootstrap 会杀僵尸端口 + wsl --shutdown + 重新 import)。
   const wslUnmanaged = !!status?.wslUnmanaged;
+  const wslWedged = !!status?.wslWedged; // WSL 死锁(LxssManager StopPending,所有 wsl 命令 hang)
   const realRunning = running && !wslUnmanaged; // 真能打开 = 健康 且 WSL 没孤儿化
-  const tone = realRunning ? "ok" : (wslUnmanaged || dockerRunning || installed || unknown) ? "warn" : "off";
+  const tone = realRunning ? "ok" : (wslWedged || wslUnmanaged || dockerRunning || installed || unknown) ? "warn" : "off";
   const isBusy = !!busy;
-  const stateText = wslUnmanaged
+  const stateText = wslWedged
+    ? tr("docker.wslWedged", "WSL 卡死 · 点「修复 WSL」")
+    : wslUnmanaged
     ? tr("docker.wslBrokenRepair", "WSL 管理异常 · 点「修复 WSL」重装")
     : running
     ? tr("docker.running", "运行中")
@@ -2204,7 +2279,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
     ? tr("docker.working", "处理中…")
     : realRunning
       ? tr("localTeams.open", "打开")
-      : wslUnmanaged
+      : (wslWedged || wslUnmanaged)
         ? tr("docker.repairWsl", "修复 WSL")
       : dockerRunning
         ? tr("docker.start", "启动")
@@ -2216,6 +2291,8 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
 
   const onCta = async () => {
     if (isBusy) return;
+    // WSL 死锁 → 走「修复 WSL」(重启 LxssManager;不行则提示重启电脑 + 重启后自动重置坏 distro)。
+    if (wslWedged) { repairWsl(); return; }
     // WSL 孤儿化 → 走「修复」(bootstrap 杀僵尸端口 + wsl --shutdown + 重新 import),不进打开。
     if (wslUnmanaged) { runBootstrap(); return; }
     if (realRunning) {
@@ -2331,6 +2408,10 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
                   onClick={() => runOp("restart", () => window.cicy.docker.appDockerRestart(), tr("docker.dockerRestarted", "已重启 Docker 容器"))}>
                   {tr("docker.dockerRestart", "重启 Docker")}
                 </button>
+                <button type="button" data-id="DockerCard-ports" className="bcard__menu-item"
+                  onClick={(e) => { e.stopPropagation(); openPorts(); }}>
+                  {tr("docker.ports.menu", "端口设置")}
+                </button>
                 <button type="button" data-id="DockerCard-recreate" className="bcard__menu-item is-danger"
                   onClick={(e) => { e.stopPropagation(); setMenuOpen(false); setConfirmRecreate(true); }}>
                   {tr("docker.recreate", "重建 Docker")}
@@ -2385,7 +2466,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
       {confirmRecreate && createPortal(
         <div data-id="DockerCard-recreate-modal"
           style={{ position: "fixed", inset: 0, zIndex: 9999, background: "rgba(0,0,0,0.55)", display: "flex", alignItems: "center", justifyContent: "center" }}
-          onClick={() => setConfirmRecreate(false)}>
+          onMouseDown={(e) => { if (e.target === e.currentTarget) setConfirmRecreate(false); }}>
           <div onClick={(e) => e.stopPropagation()}
             style={{ width: 360, maxWidth: "90vw", background: "#161b22", border: "1px solid #30363d", borderRadius: 12, padding: "20px 22px", boxShadow: "0 12px 40px rgba(0,0,0,0.5)" }}>
             <h3 style={{ margin: "0 0 8px", fontSize: 16, color: "#e6edf3" }}>{tr("docker.recreate", "重建 Docker")}</h3>
@@ -2408,6 +2489,56 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
         </div>,
         document.body
       )}
+      {portsOpen && createPortal(
+        <div data-id="DockerCard-ports-modal"
+          style={{ position: "fixed", inset: 0, zIndex: 9999, background: "rgba(0,0,0,0.55)", display: "flex", alignItems: "center", justifyContent: "center" }}
+          onMouseDown={(e) => { if (e.target === e.currentTarget) setPortsOpen(false); }}>
+          <div onClick={(e) => e.stopPropagation()}
+            style={{ width: 420, maxWidth: "92vw", background: "#161b22", border: "1px solid #30363d", borderRadius: 12, padding: "20px 22px", boxShadow: "0 12px 40px rgba(0,0,0,0.5)" }}>
+            <h3 style={{ margin: "0 0 6px", fontSize: 16, color: "#e6edf3" }}>{tr("docker.ports.title", "端口设置")}</h3>
+            <p style={{ margin: "0 0 14px", fontSize: 12.5, lineHeight: 1.6, color: "#9aa4b2" }}>{tr("docker.ports.sub", "除 :8008 外,额外发布、可从 Windows 直达容器内服务的端口")}</p>
+            <div style={{ display: "flex", alignItems: "center", gap: 8, padding: "8px 10px", marginBottom: 10, borderRadius: 8, background: "#0d1117", border: "1px solid #21262d", color: "#7d8590", fontSize: 13 }}>
+              🔒 {tr("docker.ports.mainFixed", ":8008 · cicy-code(固定)")}
+            </div>
+            <div style={{ display: "flex", flexDirection: "column", gap: 8, maxHeight: 220, overflowY: "auto" }}>
+              {portList.length === 0 && (
+                <div style={{ fontSize: 12.5, color: "#6e7681", padding: "4px 2px" }}>{tr("docker.ports.none", "暂无额外端口")}</div>
+              )}
+              {portList.map((p, i) => (
+                <div key={i} style={{ display: "flex", alignItems: "center", gap: 8 }}>
+                  <input data-id={`DockerCard-port-input-${i}`} type="text" inputMode="numeric" value={p}
+                    placeholder={tr("docker.ports.ph", "端口号 1-65535")}
+                    onChange={(e) => { const v = e.target.value.replace(/[^0-9]/g, ""); setPortList((list) => list.map((x, j) => j === i ? v : x)); setPortsErr(""); }}
+                    style={{ flex: 1, padding: "7px 10px", borderRadius: 8, border: "1px solid #30363d", background: "#0d1117", color: "#e6edf3", fontSize: 13, fontFamily: "var(--mono)" }} />
+                  <button type="button" data-id={`DockerCard-port-remove-${i}`} title={tr("docker.ports.remove", "移除")}
+                    onClick={() => { setPortList((list) => list.filter((_, j) => j !== i)); setPortsErr(""); }}
+                    style={{ padding: "6px 10px", borderRadius: 8, border: "1px solid #30363d", background: "transparent", color: "#da3633", cursor: "pointer", fontSize: 14 }}>✕</button>
+                </div>
+              ))}
+            </div>
+            <button type="button" data-id="DockerCard-port-add"
+              onClick={() => setPortList((list) => [...list, ""])}
+              style={{ marginTop: 10, padding: "7px 12px", borderRadius: 8, border: "1px dashed #30363d", background: "transparent", color: "#58a6ff", cursor: "pointer", fontSize: 13, width: "100%" }}>
+              {tr("docker.ports.add", "+ 添加端口")}
+            </button>
+            {portsErr && <div style={{ marginTop: 10, fontSize: 12.5, color: "#f85149" }}>{portsErr}</div>}
+            <p style={{ margin: "12px 0 16px", fontSize: 11.5, lineHeight: 1.5, color: "#6e7681" }}>{tr("docker.ports.hint", "保存会重建容器(volume 数据保留),会有短暂中断")}</p>
+            <div style={{ display: "flex", justifyContent: "flex-end", gap: 10 }}>
+              <button type="button" data-id="DockerCard-ports-cancel" disabled={portsBusy}
+                onClick={() => setPortsOpen(false)}
+                style={{ padding: "7px 16px", borderRadius: 8, border: "1px solid #30363d", background: "transparent", color: "#c9d1d9", cursor: "pointer", fontSize: 13 }}>
+                {tr("docker.ports.cancel", "取消")}
+              </button>
+              <button type="button" data-id="DockerCard-ports-save" disabled={portsBusy}
+                onClick={savePorts}
+                style={{ padding: "7px 16px", borderRadius: 8, border: "none", background: "#238636", color: "white", cursor: "pointer", fontSize: 13, fontWeight: 600 }}>
+                {portsBusy ? tr("docker.ports.saving", "保存中…") : tr("docker.ports.save", "保存并重建")}
+              </button>
+            </div>
+          </div>
+        </div>,
+        document.body
+      )}
     </div>
   );
 }