cicy-desktop 2.1.216 → 2.1.218

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.216",
+  "version": "2.1.218",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -140,11 +140,11 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.98",
-    "cicy-code-darwin-arm64": "2.3.98",
-    "cicy-code-linux-x64": "2.3.98",
-    "cicy-code-linux-arm64": "2.3.98",
-    "cicy-code-windows-x64": "2.3.98",
+    "cicy-code-darwin-x64": "2.3.135",
+    "cicy-code-darwin-arm64": "2.3.135",
+    "cicy-code-linux-x64": "2.3.135",
+    "cicy-code-linux-arm64": "2.3.135",
+    "cicy-code-windows-x64": "2.3.135",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",
     "cicy-mihomo-linux-x64": "1.10.4",

package/src/backends/sidecar-ipc.js

@@ -177,7 +177,14 @@ function register({ sidecarLogPath } = {}) {
     return _dockerStatusCache;
   }
   function startDockerStatusDaemon() {
-    if (!APP_DOCKER_SUPPORTED) return; // mac/linux: native cicy-code,不跑 docker reconcile(否则 colima 反复重试)
+    if (!APP_DOCKER_SUPPORTED) {
+      // mac/linux: native cicy-code, no docker reconcile. But macOS builds
+      // upgraded from the old Colima era still carry a login LaunchAgent that
+      // boots an unused `cicy-code` VM every login → tear that leftover down
+      // once (no-op when the plist doesn't exist, i.e. fresh/native installs).
+      if (process.platform === "darwin") colimaDocker.removeAutostart().catch(() => {});
+      return;
+    }
     setTimeout(() => { reconcileDocker().catch(() => {}); }, 2000);     // shortly after startup
     setInterval(() => { reconcileDocker().catch(() => {}); }, 60000);   // keep fresh + self-heal
   }

package/src/main.js

@@ -22,6 +22,18 @@ const appUpdater = require("./app-updater");
 const { attachContextMenu } = require("./utils/context-menu-options");
 electronApp.on("web-contents-created", (_e, wc) => {
   attachContextMenu(wc);
+  // Security backstop for window.open. createWindow (setupWindowHandlers) and the
+  // tab-browser install their OWN windowOpenHandler LATER, which replaces this one
+  // for those windows. This default therefore only stays in force for webContents
+  // nobody else configured (e.g. a raw agent-electron open). It guarantees
+  // window.open can never drop an external site into the opener's session — profile
+  // 0 / the default session shares cookies and may carry the electronRPC bridge, so
+  // an external popup there is an RCE/creds-leak surface. External links go to the
+  // system browser instead; trusted/local/about:blank popups are still allowed.
+  try {
+    const { windowOpenDecision } = require("./utils/window-utils");
+    wc.setWindowOpenHandler(({ url }) => windowOpenDecision(url, { wc }));
+  } catch (_) {}
   // Ctrl/Cmd+C inside a <webview> guest: on Windows the application menu's
   // role:"copy" accelerator doesn't reach the focused guest, so a selection
   // couldn't be copied with the keyboard (right-click 复制 is fixed separately via
@@ -65,7 +77,7 @@ if (process.platform === "linux") {
 const http = require("http");
 const log = require("electron-log");
 const { config } = require("./config");
-const { createWindow } = require("./utils/window-utils");
+const { createWindow, accountIdxOfWebContents } = require("./utils/window-utils");
 const { AuthManager } = require("./utils/auth");
 const { setupElectronFlags, setupErrorHandlers } = require("./server/electron-setup");
 const { parseArgs } = require("./server/args-parser");
@@ -1329,10 +1341,7 @@ electronApp.whenReady().then(async () => {
         BrowserWindow.getAllWindows()
           .map((w) => {
             try {
-              const part = w.webContents.session.partition || "";
-              const acc = part.startsWith("persist:sandbox-")
-                ? parseInt(part.replace("persist:sandbox-", ""), 10)
-                : 0;
+              const acc = accountIdxOfWebContents(w.webContents);
               return `${acc}::${registry.normalizeUrl(w.webContents.getURL())}`;
             } catch {
               return null;

package/src/sidecar/colima-docker.js

@@ -415,6 +415,25 @@ async function ensureAutostart() {
   } catch {}
 }
 
+// Undo ensureAutostart. macOS moved from Colima to native cicy-code (colima
+// crushed memory on 16G Macs), but builds upgraded from the old Colima era still
+// carry the login LaunchAgent, which starts an unused `cicy-code` VM every boot.
+// Called once on darwin startup to tear that leftover down. Gated on the plist
+// actually existing so fresh/native-only installs never invoke colima at all.
+async function removeAutostart() {
+  if (process.platform !== "darwin") return;
+  try {
+    const label = `com.cicy.colima.${PROFILE}`;
+    const plist = path.join(os.homedir(), "Library", "LaunchAgents", `${label}.plist`);
+    if (!fs.existsSync(plist)) return; // no leftover → don't touch colima
+    try { await sh(`launchctl unload ${JSON.stringify(plist)} 2>/dev/null; true`, { timeout: 15000 }); } catch {}
+    try { fs.rmSync(plist, { force: true }); } catch {}
+    // Stop ONLY our profile's VM (never the user's default colima). Keep the VM
+    // image (no delete) so a rollback to a Colima build can restart it.
+    try { await sh(`export PATH=${BREW_PATHS}:$PATH; colima stop -p ${PROFILE} 2>/dev/null; true`, { timeout: 60000 }); } catch {}
+  } catch {}
+}
+
 // 桌面文件入口:Mac 上 /home/cicy 是 docker named volume(数据在 Colima VM 内,
 // 不在 Mac 文件系统上),Finder 没法像 WSL 的 \\wsl$ 那样直接浏览。所以 Mac 端
 // 暂不放桌面快捷方式(放了也是死链)。要看文件用 `colima ssh -p cicy-code` 进 VM,
@@ -601,5 +620,5 @@ async function readMihomoConfig(container = "cicy-code-docker-8008") {
 module.exports = {
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
   vmExists, colimaInstalled, dockerCliInstalled, engineUp, imagePresent, probeHealth, hasGatewayKey, authorizeHostSsh,
-  readMihomoConfig,
+  readMihomoConfig, removeAutostart,
 };

package/src/tools/tab-browser-tools.js

@@ -214,6 +214,12 @@ class TabManager {
     const view = new BrowserView({ webPreferences: wp });
     const wc = view.webContents;
     const id = wc.id;
+    // Tag the tab's webContents with its profile so anything holding just the wc
+    // (context menu, window helpers) can resolve the REAL profile deterministically.
+    // BrowserView guests don't expose a readable partition (session.partition and
+    // getWebPreferences().partition both come back empty), so this tag — set from
+    // the owning TabManager's accountIdx — is the only reliable source.
+    try { wc.cicyAccountIdx = this.accountIdx; } catch (e) {}
     // BrowserView tabs aren't auto-covered by the global contextMenu() (it only
     // attaches to BrowserWindows + webviews), so give each tab exactly one
     // right-click menu (copy/paste/inspect) — without this, right-click did nothing.

package/src/utils/context-menu-options.js

@@ -59,8 +59,20 @@ const OPTIONS = {
     const url = (() => { try { return wc && wc.getURL ? wc.getURL() : ""; } catch (e) { return ""; } })();
     const title = (() => { try { return wc && wc.getTitle ? wc.getTitle() : ""; } catch (e) { return ""; } })();
     // profile id = 它所在 session 的 accountIdx:partition `persist:sandbox-<N>` → N,否则 0(系统槽)。
-    const part = (() => { try { return wc && wc.session ? (wc.session.partition || "") : ""; } catch (e) { return ""; } })();
-    const profile = part.startsWith("persist:sandbox-") ? (parseInt(part.replace("persist:sandbox-", ""), 10) || 0) : 0;
+    // profile id = the webContents' account. Tab-browser BrowserView guests do NOT
+    // expose a readable partition (session.partition AND getWebPreferences().partition
+    // both come back empty → everything mis-reported as profile 0), so read the
+    // `cicyAccountIdx` tag stamped on the wc at tab creation. Fall back to partition
+    // parsing only for non-tab surfaces (BrowserWindow / <webview>) without the tag.
+    const profile = (() => {
+      try {
+        if (wc && typeof wc.cicyAccountIdx === "number") return wc.cicyAccountIdx;
+        const wp = wc && wc.getWebPreferences ? wc.getWebPreferences() : null;
+        const part = (wp && wp.partition) || (wc && wc.session && wc.session.partition) || "";
+        const m = /^persist:sandbox-(\d+)$/.exec(part);
+        return m ? parseInt(m[1], 10) : 0;
+      } catch (e) { return 0; }
+    })();
     // 给 agent 用的一句话指令:带 webContents id + profile id + url + title,让它用 agent-electron 操作。
     const skillPrompt = t("ctxMenu.skillPrompt", { id: wcId, profile, url, title });
     // 导航:优先用 Electron 新 navigationHistory API,旧版兜底 wc.canGoBack/goBack。

package/src/utils/window-thumbnails.js

@@ -31,7 +31,11 @@ function accountIdxOf(win) {
   // session (homepage / system windows) maps to 0.
   if (typeof win.cicyAccountIdx === "number") return win.cicyAccountIdx;
   try {
-    const p = win.webContents.session.partition || "";
+    // Session has no readable `.partition`; read it off WebPreferences (was
+    // session.partition → always undefined → every window mis-tagged profile 0).
+    const wc = win.webContents;
+    const wp = wc && wc.getWebPreferences ? wc.getWebPreferences() : null;
+    const p = (wp && wp.partition) || (wc && wc.session && wc.session.partition) || "";
     const m = /^persist:sandbox-(\d+)$/.exec(p);
     if (m) return parseInt(m[1], 10);
   } catch (_) {}

package/src/utils/window-utils.js

@@ -1,4 +1,4 @@
-const { app, BrowserWindow, Menu, dialog, shell } = require("electron");
+const { app, BrowserWindow, Menu, shell } = require("electron");
 const { default: contextMenu } = require("electron-context-menu");
 const contextMenuOptions = require("./context-menu-options");
 const path = require("path");
@@ -15,39 +15,78 @@ if (app) {
   app.name = "CiCy Desktop";
 }
 
-function setupWindowHandlers(win) {
-  // Hook window.open. App/internal popups (about:blank or trusted/local hosts —
-  // e.g. a popped-out ttyd terminal from CiCy Code) must open as REAL Electron
-  // windows WITH webviewTag, or any <webview> inside them (terminal / artifact
-  // guest) collapses to 0x0. Returning action:"deny" (the old behavior) routed
-  // every popup through a dialog; an *allowed* window.open window inherits
-  // DEFAULT webPreferences (webviewTag=false) unless we override it here.
-  // External links (other websites) keep the open-in-browser/app dialog.
-  win.webContents.setWindowOpenHandler(({ url }) => {
-    log.info(`[WindowOpen] Intercepted: ${url}`);
-    if (!url || url === "about:blank" || isTrustedUrl(url)) {
-      return {
-        action: "allow",
-        overrideBrowserWindowOptions: {
-          autoHideMenuBar: true,
-          icon: require("./app-icon").appIconPath(),
-          webPreferences: {
-            webviewTag: true, // embedded <webview> (ttyd/artifact) must render
-            // hole #4: trusted pages no longer get raw Node. Their electronRPC
-            // bridge comes from webview-preload via contextBridge, so a trusted-origin
-            // XSS can't `require('child_process')` to bypass the rpc:guarded gate.
-            nodeIntegration: false,
-            contextIsolation: true,
-            preload: path.join(__dirname, "../backends/webview-preload.js"),
-            webSecurity: false,
-            enableClipboard: true,
-          },
+// Resolve the profile (accountIdx) a webContents lives in, from its session
+// partition: persist:sandbox-N → N; the default/"" session → 0 (profile 0, the
+// privileged/shared session). Mirrors getWindowInfo's derivation.
+function partitionOfWebContents(wc) {
+  // Electron's Session has NO readable `.partition`; the partition string lives on
+  // the webContents' WebPreferences. Reading session.partition (always undefined)
+  // made every profile resolve to 0. Prefer getWebPreferences(), fall back to
+  // session.partition just in case.
+  try {
+    const wp = wc && wc.getWebPreferences ? wc.getWebPreferences() : null;
+    if (wp && wp.partition) return wp.partition;
+    return (wc && wc.session && wc.session.partition) || "";
+  } catch (_) { return ""; }
+}
+
+function accountIdxOfWebContents(wc) {
+  // Prefer the cicyAccountIdx tag stamped at creation (the only reliable source for
+  // BrowserView tab guests, whose partition is never readable). Fall back to
+  // partition parsing for surfaces that carry a real partition.
+  if (wc && typeof wc.cicyAccountIdx === "number") return wc.cicyAccountIdx;
+  const partition = partitionOfWebContents(wc);
+  if (partition.startsWith("persist:sandbox-")) {
+    const n = parseInt(partition.slice("persist:sandbox-".length), 10);
+    return Number.isFinite(n) ? n : 0;
+  }
+  return 0;
+}
+
+// Single source of truth for the window.open policy. App/internal popups
+// (about:blank or trusted/local hosts — e.g. a popped-out ttyd terminal from CiCy
+// Code) open in-place as REAL Electron windows WITH webviewTag (any <webview>
+// inside them — terminal / artifact guest — otherwise collapses to 0x0).
+//
+// Any OTHER (external) URL is routed DETERMINISTICALLY by the OPENER's profile,
+// and never lands in profile 0: an opener in profile 0 (the privileged/shared
+// session — team cookies + trusted-origin RPC surface) has the link FORCED into
+// sandbox profile 1; an opener already in a sandbox profile N opens the link in
+// its OWN profile N. This mirrors the tab-browser policy (profile 0 link →
+// openTab(1); else same profile) — no dialog, no leak into profile 0.
+function windowOpenDecision(url, { wc } = {}) {
+  log.info(`[WindowOpen] Intercepted: ${url}`);
+  if (!url || url === "about:blank" || isTrustedUrl(url)) {
+    return {
+      action: "allow",
+      overrideBrowserWindowOptions: {
+        autoHideMenuBar: true,
+        icon: require("./app-icon").appIconPath(),
+        webPreferences: {
+          webviewTag: true, // embedded <webview> (ttyd/artifact) must render
+          // hole #4: trusted pages no longer get raw Node. Their electronRPC
+          // bridge comes from webview-preload via contextBridge, so a trusted-origin
+          // XSS can't `require('child_process')` to bypass the rpc:guarded gate.
+          nodeIntegration: false,
+          contextIsolation: true,
+          preload: path.join(__dirname, "../backends/webview-preload.js"),
+          webSecurity: false,
+          enableClipboard: true,
         },
-      };
-    }
-    showOpenLinkDialog(win, url);
-    return { action: "deny" };
-  });
+      },
+    };
+  }
+  // External URL: profile 0 → forced sandbox profile 1; any sandbox profile N →
+  // its own profile N. Never in-session for profile 0.
+  const openerIdx = accountIdxOfWebContents(wc);
+  const target = openerIdx === 0 ? 1 : openerIdx;
+  try { createWindow({ url }, target, true); }
+  catch (e) { log.warn(`[WindowOpen] open external in profile ${target} failed: ${e && e.message}`); }
+  return { action: "deny" };
+}
+
+function setupWindowHandlers(win) {
+  win.webContents.setWindowOpenHandler(({ url }) => windowOpenDecision(url, { wc: win.webContents }));
   if (!win.webContents.debugger.isAttached()) {
     win.webContents.debugger.attach("1.3");
   }
@@ -301,6 +340,12 @@ function createWindow(options = {}, accountIdx = 1, forceNew = false) {
     },
   });
 
+  // Stamp the profile on the window + its webContents so any holder of just the wc
+  // (context menu, accountIdxOfWebContents, thumbnails) resolves the REAL profile
+  // deterministically — session.partition/getWebPreferences().partition are not
+  // reliably readable back.
+  try { win.cicyAccountIdx = accountIdx; win.webContents.cicyAccountIdx = accountIdx; } catch (e) {}
+
   // 监听窗口状态变化并自动保存（基于URL）
   watchWindowState(win, accountIdx);
 
@@ -427,7 +472,7 @@ function getWindowInfo(win) {
   try {
     const wc = win.webContents;
     if (!wc || !wc.session) return null;
-    const partition = wc.session.partition || "";
+    const partition = partitionOfWebContents(wc);
     // persist:sandbox-N → account N (N>=1 are user profiles). Anything on the
     // default session (homepage / platform system windows, partition "") maps
     // to account 0 — the reserved system slot.
@@ -517,34 +562,13 @@ if (app) {
   });
 }
 
-function showOpenLinkDialog(parentWin, url) {
-  const i18n = require("../i18n");
-  dialog
-    .showMessageBox(parentWin, {
-      type: "question",
-      buttons: [
-        i18n.t("dialog.openLink.openInBrowser"),
-        i18n.t("dialog.openLink.openInApp"),
-        i18n.t("dialog.openLink.cancel"),
-      ],
-      defaultId: 0,
-      title: i18n.t("dialog.openLink.title"),
-      message: i18n.t("dialog.openLink.message"),
-      detail: url,
-    })
-    .then(({ response }) => {
-      if (response === 0) {
-        shell.openExternal(url);
-      } else if (response === 1) {
-        createWindow({ url }, 0, true);
-      }
-    });
-}
-
 module.exports = {
   createWindow,
   setupWindowHandlers,
+  windowOpenDecision,
   getWindowInfo,
+  partitionOfWebContents,
+  accountIdxOfWebContents,
   refreshTrustedOrigins,
   isTrustedUrl,
 };