cicy-desktop 2.1.235 → 2.1.236

package/src/master/worker-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const STALE_AFTER_MS = 15000;
 const OFFLINE_AFTER_MS = 30000;
 

package/src/preload-rpc.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { contextBridge, ipcRenderer } = require("electron");
 contextBridge.exposeInMainWorld("electronRPC", {
   invoke: (toolName, args) => ipcRenderer.invoke("rpc:guarded", toolName, args),

package/src/profiles/profile-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // profile-store.js — the shared "browser profile" standard across both backends.
 //
 // One profile = one backend (Chrome OR Electron); the two keep their own store

package/src/profiles/trusted-origins-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Trusted-origins allowlist — the EXACT-hostname set of sites permitted to
 // receive the electronRPC bridge in profile 0 (i.e. allowed to run exec_shell &
 // friends on THIS machine). Persisted at ~/cicy-ai/db/trusted-origins.json as

package/src/server/args-parser.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function parseArgs() {
   const args = process.argv.slice(2);
 

package/src/server/chrome-management-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 function parseToolText(result) {

package/src/server/chrome-proxy-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 const { getVersion, getTargets, activateTarget, callCdp } = require("../chrome/chrome-cdp-client");

package/src/server/electron-setup.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { app: electronApp } = require("electron");
 const log = require("electron-log");
 

package/src/server/express-app.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const cors = require("cors");
 const fs = require("fs");

package/src/server/logging.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const log = require("electron-log");
 const path = require("path");
 const fs = require("fs");

package/src/server/mcp-server.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { McpServer } = require("@modelcontextprotocol/sdk/server/mcp.js");
 const { SSEServerTransport } = require("@modelcontextprotocol/sdk/server/sse.js");
 const log = require("electron-log");

package/src/server/tool-catalog.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function buildToolCatalog(toolModules) {
   const toolsByName = new Map();
   const toolsByTag = {};

package/src/server/tool-executor.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { loadToolCatalog } = require("./tool-catalog");
 
 function getToolRecord(name) {

package/src/server/tool-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 
 function zodToJsonSchema(zodSchema) {

package/src/server/ui-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const { BrowserWindow } = require("electron");
 const router = express.Router();

package/src/server/worker-observability-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 function toPublicSnapshot(snapshot) {

package/src/sidecar/cicy-code.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Discover / probe / spawn the cicy-code daemon for the Electron app.
 //
 // Principle (2026-06): the daemon is run via `npx cicy-code` — a single

package/src/sidecar/colima-docker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Docker-版 cicy-code on macOS via Colima (Lima 轻量 VM + Docker 引擎).
 //
 // macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

package/src/sidecar/docker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Windows sidecar backend: run cicy-code inside a Docker container.
 //
 // Platform split (2026-06): mac/linux start cicy-code locally via `npx

package/src/sidecar/host-mihomo.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Host-side mihomo for the Chrome per-profile proxy.
 //
 // docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

package/src/sidecar/localbin.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // ~/.local/bin install model for the binaries cicy-desktop OWNS.
 //
 // (2026-06): cicy-desktop OWNS its runtime binaries and distributes

package/src/sidecar/mirrors.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Shared GitHub mirror registry for CN-network downloads.
 //
 // Mirror strategies:

package/src/sidecar/native.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Windows NATIVE sidecar backend: run cicy-code.exe directly — no Docker, no
 // WSL. (2026-06 方向变更: the Docker route in docker.js is transitional and
 // being retired; this module replaces it once stable.)

package/src/sidecar/net-detect.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Detect whether the host is on the China mainland network.
 // Strategy:
 //   - Probe both google.com (typically blocked in CN) and baidu.com (typically reachable in CN).

package/src/sidecar/runtime.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Runtime Bundle v1 — versioned component store for everything cicy-desktop
 // runs locally (cicy-code, mihomo).
 //

package/src/sidecar/version.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // cicy-code 版本的唯一读法。三个概念一个模块,别处不准再自己解析 /api/health、
 // 也不准再直连 npm 拿版本("拿版本就一个方法")。
 //   running(port) → 活着的 daemon 在 /api/health 报的版本(“正在跑什么”的唯一真相)

package/src/sidecar/wsl-docker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Docker-版 cicy-code via WSL2 + Ubuntu + Docker Engine (选定方案 A).
 //
 // Instead of the heavy/fragile Docker Desktop GUI install, we run Docker Engine

package/src/tabbrowser/newtab-protocol.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // cicyui://newtab — the tab browser's start page, served via a custom scheme so a
 // new tab's URL is a clean "cicyui://newtab" instead of a giant inline data: URL
 // (url 不要那串 data: 天书). Chrome's chrome://newtab analog.

package/src/tabbrowser/tab-shell-preload.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Preload for the BrowserView tab-browser shell (tab strip + toolbar).
 // Exposes window.tabAPI so the chrome UI drives the main-process TabManager,
 // and receives tab state pushes. Tabs themselves are BrowserViews (managed in

package/src/tools/account-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 const os = require("os");

package/src/tools/automation-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const { z } = require("zod");
 

package/src/tools/cdp-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow, clipboard } = require("electron");
 const { z } = require("zod");
 const { sendCDP } = require("../utils/cdp-utils");

package/src/tools/chrome-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const fs = require("fs");
 const os = require("os");

package/src/tools/clipboard-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { clipboard, BrowserWindow } = require("electron");
 const { z } = require("zod");
 const { sendCDP } = require("../utils/cdp-utils");

package/src/tools/desktop-snapshot-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const fs = require("fs");
 const path = require("path");

package/src/tools/device-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 
 // get_device_info — return this machine's identity + detected network/locale

package/src/tools/download-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const downloadManager = require("../utils/download-manager");
 

package/src/tools/exec-js.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const { z } = require("zod");
 

package/src/tools/exec-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const { exec } = require("child_process");
 const util = require("util");

package/src/tools/file-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const fs = require("fs");
 const path = require("path");

package/src/tools/hook-chatgpt.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const { z } = require("zod");
 const { sendCDP } = require("../utils/cdp-utils");

package/src/tools/hook-gemini.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow, clipboard, nativeImage } = require("electron");
 const { z } = require("zod");
 const { sendCDP } = require("../utils/cdp-utils");

package/src/tools/index.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // 统一导出所有工具模块，支持热重载
 
 module.exports = [

package/src/tools/ipc-bridge.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { ipcMain, BrowserWindow } = require("electron");
 const { createWindow } = require("../utils/window-utils");
 const log = require("electron-log");

package/src/tools/list-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const { loadToolCatalog } = require("../server/tool-catalog");
 const { zodToJsonSchema } = require("../server/tool-registry");

package/src/tools/ping.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const { updateGlobalConfig } = require("../utils/global-json");
 

package/src/tools/r-reset.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 
 module.exports = (registerTool) => {

package/src/tools/screenshot-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const { z } = require("zod");
 const { captureSnapshot } = require("../snapshot-utils");

package/src/tools/system-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 const { execSync } = require("child_process");
 

package/src/tools/tab-browser-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // tab-browser-tools.js — Chrome-like tabbed browser, one window per profile,
 // built on BrowserView tabs (NOT <webview>), so each tab is a full webContents
 // that can itself host <webview> (the cicy-code team app's artifact frame, the

package/src/tools/window-tools.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const log = require("electron-log");
 const { z } = require("zod");

package/src/tray.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Tray icon (macOS menu bar / Windows + Linux system tray) and macOS dock icon.
 // Loaded once after app.whenReady(). Resources live in build/ alongside the
 // platform installer icons; we ship them via electron-builder's `extraResources`

package/src/utils/app-icon.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Resolve the bundled app icon for BrowserWindow({ icon }).
 //
 // When cicy-desktop runs UNPACKAGED (npx / npm i -g — the mac/win/linux default,

package/src/utils/auth.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 const crypto = require("crypto");

package/src/utils/brand-host-electron.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Rebrand the HOST (unpackaged) Electron bundle so cicy-desktop presents as
 // "CiCy Desktop" at the OS level — menu-bar app name, Cmd-Tab app switcher,
 // Finder, and dock — instead of the stock "Electron".

package/src/utils/cdp-utils.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 async function sendCDP(webContents, method, params = {}) {
   if (!webContents.debugger.isAttached()) {
     webContents.debugger.attach("1.3");

package/src/utils/context-menu-options.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Shared electron-context-menu (ecm) config + a universal attach helper so the
 // SAME i18n'd right-click menu — 重新加载 / 复制 / 粘贴 / 检查元素(DevTools)— applies to
 // EVERY surface: the tab-browser SHELL window (host/"BaseWindow"), BrowserView

package/src/utils/cookie-logins.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Shared "which sites is this session logged into?" summarizer for BOTH backends.
 //
 // Input: an array of cookies, each with at least { name, domain }. Both

package/src/utils/desktop-snapshot.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // desktop-snapshot.js
 // Periodically captures the WHOLE desktop (not a window) to disk so the cloud
 // (cicy-code) can fetch a recent screen preview by just reading a file — no live

package/src/utils/download-manager.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // 全局下载管理器
 const downloads = new Map();
 let downloadIdCounter = 0;

package/src/utils/global-json.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 

package/src/utils/ip-probe.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Per-profile egress IP + geo probe. Fetches an IP-info API THROUGH a given
 // Electron session (so the result reflects that profile's proxy egress), in the
 // main process via net.request (no browser launch needed). Returns

package/src/utils/process-utils.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { exec } = require("child_process");
 const net = require("net");
 const { promisify } = require("util");

package/src/utils/rpc-audit.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // RPC audit log — an append-only record of (a) every electronRPC tool call and
 // (b) every authorization decision (including the TEMPORARY ones — "本次允许" /
 // "允许一次" / "本页面内允许" — which otherwise live only in memory and leave no

package/src/utils/rpc-guard.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // RPC capability gate (security hole #3 — "trusted source XSS ≠ RCE").
 //
 // The renderer electronRPC bridge can invoke ANY registered tool, including host

package/src/utils/snapshot-utils.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // snapshot-utils.js
 // Snapshot utilities for CiCy Desktop server
 // Provides page snapshot capture with screenshots and element references

package/src/utils/window-monitor.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 const os = require("os");

package/src/utils/window-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Persistent window registry.
 //
 // Background: every window list in the app (get_windows tool, /ui/windows,

package/src/utils/window-state.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 const os = require("os");

package/src/utils/window-thumbnails.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // window-thumbnails.js
 // Periodically writes a small JPEG thumbnail of every open BrowserWindow to a
 // folder — like Chrome's tab thumbnails. On-disk so the homepage / agents can

package/src/utils/window-utils.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { app, BrowserWindow, Menu, shell } = require("electron");
 const { default: contextMenu } = require("electron-context-menu");
 const contextMenuOptions = require("./context-menu-options");

package/workers/render/package-lock.json

@@ -7,6 +7,7 @@
     "": {
       "name": "cicy-desktop-render",
       "version": "0.0.1",
+      "license": "Apache-2.0",
       "dependencies": {
         "react": "^19.0.0",
         "react-dom": "^19.0.0"

package/workers/render/package.json

@@ -16,5 +16,6 @@
     "@vitejs/plugin-react": "^4.3.4",
     "vite": "^6.0.0",
     "wrangler": "^3.99.0"
-  }
+  },
+  "license": "Apache-2.0"
 }

package/workers/render/src/App.jsx

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 import { useEffect, useState, useCallback, useMemo, useRef } from "react";
 import { createPortal } from "react-dom";
 import "./App.css";

package/workers/render/src/main.jsx

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 import { createRoot } from "react-dom/client";
 import App from "./App.jsx";
 

package/workers/render/src/mdLite.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Tiny, dependency-free Markdown → HTML renderer for static, TRUSTED content
 // (the terms-of-use string only). Not a general-purpose/safe renderer — do not
 // feed user input. Supports: # / ## / ### headings, --- rules, > blockquotes,

package/workers/render/src/termsText.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // AUTO-GENERATED from w-10065 terms docs (草案 v0.2). Full terms body for the
 // first-run gate's '查看完整条款' / 'View full terms'. Both locales now have
 // the complete counsel-reviewed text.