cicy-desktop 2.1.235 → 2.1.237

package/jest.config.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 module.exports = {
   testEnvironment: "node",
   testMatch: ["<rootDir>/tests/**/*.test.js"],

package/jest.setup.global.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { startTestServer } = require('./tests/mcp/setup-test-server');
 
 module.exports = async () => {

package/jest.teardown.global.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { stopTestServer } = require('./tests/mcp/setup-test-server');
 
 module.exports = async () => {

package/package.json

@@ -1,12 +1,10 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.235",
+  "version": "2.1.237",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
-    "cicy-desktop": "./bin/cicy-desktop",
-    "cicy": "./bin/cicy-desktop",
-    "cicy-rpc": "./bin/cicy-rpc"
+    "cicy-desktop": "./bin/cicy-desktop"
   },
   "scripts": {
     "start": "node ./bin/cicy-desktop",
@@ -16,7 +14,6 @@
     "test": "jest",
     "test:ls": "node tests/test-ls.js",
     "build": "electron-builder --publish never",
-    "build:ui": "cd packages/ui-react && npm install && npm run build",
     "build:homepage": "node scripts/build-homepage.cjs",
     "prebuild:win": "node scripts/build-homepage.cjs",
     "prebuild:mac": "node scripts/build-homepage.cjs",
@@ -124,13 +121,14 @@
     "name": "cicybot",
     "email": "support@cicy-ai.com"
   },
-  "license": "MIT",
+  "license": "Apache-2.0",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.3",
     "chrome-remote-interface": "^0.33.0",
     "cors": "^2.8.5",
     "electron-context-menu": "^4.0.4",
     "electron-log": "^5.2.4",
+    "electron-updater": "6.6.2",
     "express": "^4.18.2",
     "i18next": "^26.2.0",
     "js-beautify": "^1.15.4",
@@ -138,17 +136,16 @@
     "serve-index": "^1.9.2",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",
-    "zod": "3.25",
-    "electron-updater": "6.6.2"
+    "zod": "3.25"
   },
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.190",
-    "cicy-code-darwin-arm64": "2.3.190",
-    "cicy-code-linux-x64": "2.3.190",
-    "cicy-code-linux-arm64": "2.3.190",
-    "cicy-code-windows-x64": "2.3.190",
+    "cicy-code-darwin-x64": "2.3.192",
+    "cicy-code-darwin-arm64": "2.3.192",
+    "cicy-code-linux-x64": "2.3.192",
+    "cicy-code-linux-arm64": "2.3.192",
+    "cicy-code-windows-x64": "2.3.192",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",
     "cicy-mihomo-linux-x64": "1.10.4",

package/scripts/build-homepage.cjs

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Single source of truth for producing the SHIPPED homepage.
 //
 // The app loads src/backends/homepage-react/ (a prebuilt SPA snapshot). The

package/scripts/sync-runtime-deps.cjs

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Sync optionalDependencies to the LATEST published per-platform cicy-code and
 // cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the
 // newest binaries. Run in CI before install/build (and before `npm publish`).

package/src/app-updater.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // CiCy Desktop 自定义自更新(替掉 electron-updater 的全自动 quitAndInstall —— 它对
 // 未签名 mac / loose 源码版 / 多窗口 tab-shell 都不适配)。
 //

package/src/backends/auth-email.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Email magic-link DEVICE-POLL login — cross-device safe.
 //
 // The 127.0.0.1 loopback in auth-loopback.js only works when the magic link is

package/src/backends/auth-loopback.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Loopback browser-login listener.
 //
 // Flow (B-variant of OAuth-style desktop login — same pattern as `gcloud

package/src/backends/homepage-preload.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Homepage preload — last sweep. After this we should not need another
 // .app rebuild for routine UI work; everything new lands in the Vite
 // project at cicy-desktop/workers/render/src/ and HMRs in.

package/src/backends/homepage-window.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Homepage window — primary CiCy Desktop window. Singleton; closing it
 // does NOT quit the app.
 //

package/src/backends/ipc.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Main-side IPC for the homepage. Same backends:* / windows:* / updates:*
 // contract as before plus the "one rebuild for the year" additions below
 // (app, shell, tos, logs). Anything more specific should go through the

package/src/backends/local-teams.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Local-teams discovery — reads ~/cicy-ai/global.json and pings each
 // configured node's /api/health. Local-only by design: this module never
 // talks to the cloud, never runs `docker ps`, and never invents nodes

package/src/backends/open-external.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Robust "open this URL in the system browser".
 //
 // electron's shell.openExternal silently fails on some Windows setups — a fresh

package/src/backends/poller.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Probes each backend's /api/health and returns the JSON payload. Used by
 // the homepage to populate per-backend status (uptime, mem, agents count).
 // Stateless — homepage caches results in renderer-side state.

package/src/backends/registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // File-backed BackendRegistry. Stores user's known cicy-code backends in
 // <userData>/backends.json. A pinned `local` entry is upserted on every load
 // so it cannot be accidentally deleted from the launcher UI.

package/src/backends/sidecar-ipc.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // IPC handlers for the cicy-code sidecar.
 //
 // cicy-code is no longer downloaded by an in-app installer — the sidecar runs

package/src/backends/updater.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Queries GitHub for the latest cicy-code release and compares against the
 // version currently reported by the bundled sidecar (via /api/health).
 // Phase 1 surface: { hasUpdate, currentVersion, latestVersion, releaseUrl }.

package/src/backends/webview-preload.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Team Helper <webview> preload — runs inside the right-drawer webview that
 // loads the cloud helper SPA. Exposes a deliberately TINY surface compared
 // to homepage-preload.js: the helper agent is a remote third party, so it

package/src/backends/window-manager.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Opens BrowserWindow instances targeting a Backend. The local backend wraps
 // the bundled cicy-code daemon (started + supervised by src/sidecar/cicy-code.js)
 // and resolves its admin URL against ~/cicy-ai/global.json's api_token —

package/src/backends/window-tracker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Tracks BrowserWindows opened via openWindowForBackend, mapping each window
 // back to the backend that spawned it. Used by the homepage's "Recent
 // Windows" section. Cleans up on close.

package/src/chrome/chrome-cdp-client.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const CDP = require("chrome-remote-interface");
 
 async function fetchJson(url) {

package/src/chrome/chrome-launcher.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const os = require("os");
 const path = require("path");

package/src/chrome/debugger-port-resolver.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const os = require("os");
 const path = require("path");

package/src/chrome/runtime-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { getWorkerIdentity } = require("../cluster/worker-identity");
 const { createRuntimeSessionId } = require("../cluster/types");
 

package/src/cloud/cloud-client.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Cloud ⇄ cicy-desktop client (device / team / teams).
 //
 // Implements the contract agreed with the cloud side (w-10032), documented at

package/src/cluster/local-agent-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { BrowserWindow } = require("electron");
 const { getWindowInfo } = require("../utils/window-utils");
 const { getWorkerIdentity } = require("./worker-identity");

package/src/cluster/remote-executor.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 async function forwardJsonRequest(baseUrl, token, requestPath, payload) {
   const response = await fetch(new URL(requestPath, baseUrl), {
     method: "POST",

package/src/cluster/types.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function toIsoString(value) {
   return value ? new Date(value).toISOString() : null;
 }

package/src/cluster/worker-client.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const DEFAULT_INTERVAL_MS = 5000;
 
 class WorkerClient {

package/src/cluster/worker-identity.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const os = require("os");
 const { config } = require("../config");
 

package/src/config.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 module.exports = {
   config: {
     port: null,

package/src/extension/inject.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 console.log("hi cicy v4");
 
 window.__cicyInjected = true;

package/src/i18n/index.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // CiCy Desktop i18n.
 // Single instance shared between main process and preload (loaded via require).
 // - locale comes from app.getLocale() (set in main.js init)

package/src/main-old.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { app: electronApp, BrowserWindow } = require("electron");
 const fs = require("fs");
 const path = require("path");

package/src/main.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { app: electronApp } = require("electron");
 const { default: contextMenu } = require("electron-context-menu");
 const fs = require("fs");

package/src/master/agent-index.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 class AgentIndex {
   constructor() {
     this.agentsByWorker = new Map();

package/src/master/chrome-config.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const os = require("os");
 const path = require("path");

package/src/master/master-admin-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const {
   getClusterSummary,

package/src/master/master-main.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const path = require("path");
 const { WorkerRegistry } = require("./worker-registry");

package/src/master/master-metrics.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function formatMemory(memory = {}) {
   return {
     rss: memory?.rss || 0,

package/src/master/master-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const { randomUUID } = require("crypto");
 const remoteExecutor = require("../cluster/remote-executor");

package/src/master/master-token-manager.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const path = require("path");
 const crypto = require("crypto");

package/src/master/session-affinity-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 class SessionAffinityStore {
   constructor() {
     this.byControlSessionId = new Map();

package/src/master/task-scheduler.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function pickIdleAgent(agents = []) {
   return agents.find((agent) => agent.status === "idle") || agents[0] || null;
 }

package/src/master/task-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 class TaskStore {
   constructor() {
     this.tasks = new Map();

package/src/master/worker-inventory.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const fs = require("fs");
 const os = require("os");
 const path = require("path");

package/src/master/worker-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const STALE_AFTER_MS = 15000;
 const OFFLINE_AFTER_MS = 30000;
 

package/src/preload-rpc.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { contextBridge, ipcRenderer } = require("electron");
 contextBridge.exposeInMainWorld("electronRPC", {
   invoke: (toolName, args) => ipcRenderer.invoke("rpc:guarded", toolName, args),

package/src/profiles/profile-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // profile-store.js — the shared "browser profile" standard across both backends.
 //
 // One profile = one backend (Chrome OR Electron); the two keep their own store

package/src/profiles/trusted-origins-store.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Trusted-origins allowlist — the EXACT-hostname set of sites permitted to
 // receive the electronRPC bridge in profile 0 (i.e. allowed to run exec_shell &
 // friends on THIS machine). Persisted at ~/cicy-ai/db/trusted-origins.json as

package/src/server/args-parser.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function parseArgs() {
   const args = process.argv.slice(2);
 

package/src/server/chrome-management-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 function parseToolText(result) {

package/src/server/chrome-proxy-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 const { getVersion, getTargets, activateTarget, callCdp } = require("../chrome/chrome-cdp-client");

package/src/server/electron-setup.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { app: electronApp } = require("electron");
 const log = require("electron-log");
 

package/src/server/express-app.js

@@ -1,6 +1,8 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const cors = require("cors");
-const fs = require("fs");
 const path = require("path");
 const uiRoutes = require("./ui-routes");
 
@@ -153,31 +155,18 @@ function createExpressApp(authMiddleware, tools = {}) {
     }
   });
 
-  const reactUiDir = path.join(__dirname, "../ui-react-dist");
-
-  // Keep legacy UI for fallback/debugging
+  // Legacy debug UI. The React /console (packages/ui-react → ui-react-dist) was
+  // removed — it was served but nothing in the app ever linked to it; the real
+  // desktop UI is the homepage + tab-shell. ui.html stays as a bare debug page.
   app.get("/ui-legacy", (req, res) => {
     res.sendFile(path.join(__dirname, "../ui.html"));
   });
 
-  // UI (React) lives at /console; /ui is reserved for UI APIs (snapshot, windows, etc.)
-  if (fs.existsSync(reactUiDir)) {
-    app.use("/console", express.static(reactUiDir));
-    app.get(["/console", "/console/*"], (req, res) => {
-      res.sendFile(path.join(reactUiDir, "index.html"));
-    });
-  } else {
-    // Fallback: serve legacy UI at /console too
-    app.get(["/console", "/console/*"], (req, res) => {
-      res.sendFile(path.join(__dirname, "../ui.html"));
-    });
-  }
-
   // Mount UI API routes under /ui
   app.use("/ui", uiRoutes);
 
-  // Convenience redirect
-  app.get("/", (req, res) => res.redirect("/console/chrome"));
+  // Root → the remaining legacy debug UI.
+  app.get("/", (req, res) => res.redirect("/ui-legacy"));
 
   return app;
 }

package/src/server/logging.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const log = require("electron-log");
 const path = require("path");
 const fs = require("fs");

package/src/server/mcp-server.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { McpServer } = require("@modelcontextprotocol/sdk/server/mcp.js");
 const { SSEServerTransport } = require("@modelcontextprotocol/sdk/server/sse.js");
 const log = require("electron-log");

package/src/server/tool-catalog.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 function buildToolCatalog(toolModules) {
   const toolsByName = new Map();
   const toolsByTag = {};

package/src/server/tool-executor.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { loadToolCatalog } = require("./tool-catalog");
 
 function getToolRecord(name) {

package/src/server/tool-registry.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const { z } = require("zod");
 
 function zodToJsonSchema(zodSchema) {

package/src/server/ui-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 const { BrowserWindow } = require("electron");
 const router = express.Router();

package/src/server/worker-observability-routes.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 const express = require("express");
 
 function toPublicSnapshot(snapshot) {

package/src/sidecar/cicy-code.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Discover / probe / spawn the cicy-code daemon for the Electron app.
 //
 // Principle (2026-06): the daemon is run via `npx cicy-code` — a single

package/src/sidecar/colima-docker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Docker-版 cicy-code on macOS via Colima (Lima 轻量 VM + Docker 引擎).
 //
 // macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

package/src/sidecar/docker.js

@@ -1,3 +1,6 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
 // Windows sidecar backend: run cicy-code inside a Docker container.
 //
 // Platform split (2026-06): mac/linux start cicy-code locally via `npx