cicy-desktop 2.1.238 → 2.1.239

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.238",
+  "version": "2.1.239",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -139,11 +139,11 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.192",
-    "cicy-code-darwin-arm64": "2.3.192",
-    "cicy-code-linux-x64": "2.3.192",
-    "cicy-code-linux-arm64": "2.3.192",
-    "cicy-code-windows-x64": "2.3.192",
+    "cicy-code-darwin-x64": "2.3.194",
+    "cicy-code-darwin-arm64": "2.3.194",
+    "cicy-code-linux-x64": "2.3.194",
+    "cicy-code-linux-arm64": "2.3.194",
+    "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",
     "cicy-mihomo-linux-x64": "1.10.4",

package/src/sidecar/cicy-code.js

@@ -28,11 +28,13 @@ const { t } = require("../i18n"); // 安装/升级日志走 i18n(main 进程按
 // ── Node runtime bootstrap ───────────────────────────────────────────────────
 // (2026-06): native cicy-code 走 `npx cicy-code`,需要一个**可用**的 Node。但用户
 // 机器可能没 node,或 node 太老(实测 josephs 是 node v13/npx6,老 npx 跑不动)。所以:
-// 系统有 node≥20 就用;没有/太老 → 下载 Node 24 到 ~/cicy-ai/runtime/node(免 sudo,
-// 用户自己拥有);下载也失败 → 提示用户去 nodejs.org 自己装。
+// 系统有 node≥20 就用;没有/太老 → 下载 Node 24 到 ~/.local/node(免 sudo,用户自己
+// 拥有);下载也失败 → 提示用户去 nodejs.org 自己装。老装在 ~/cicy-ai/runtime/node 的
+// 树:ensureNode 首次同盘 rename 迁进 ~/.local/node,迁不动也能被 legacy 搜索路径命中。
 const NODE_VER = process.env.CICY_NODE_VERSION || "v24.18.0";
-const NODE_HOME = path.join(os.homedir(), "cicy-ai", "runtime", "node");
-const NODE_SEARCH = ["/usr/local/bin", "/opt/homebrew/bin", path.join(os.homedir(), ".local", "bin"), path.join(NODE_HOME, "bin")];
+const NODE_HOME = path.join(os.homedir(), ".local", "node");
+const LEGACY_NODE_HOME = path.join(os.homedir(), "cicy-ai", "runtime", "node"); // read-only compat
+const NODE_SEARCH = ["/usr/local/bin", "/opt/homebrew/bin", path.join(os.homedir(), ".local", "bin"), path.join(NODE_HOME, "bin"), path.join(LEGACY_NODE_HOME, "bin")];
 function nodeMajor(bin) {
   try { const m = String(execFileSync(bin, ["-v"], { encoding: "utf8", timeout: 5000 })).match(/v(\d+)\./); return m ? Number(m[1]) : 0; } catch { return 0; }
 }
@@ -60,6 +62,15 @@ async function ensureNode({ emit } = {}) {
     }
     return dir;
   };
+  // Migrate a legacy ~/cicy-ai/runtime/node tree into ~/.local/node — same-fs
+  // rename is instant. Cross-fs (EXDEV) → leave it; the legacy NODE_SEARCH dir
+  // still finds it. New downloads (below) land in ~/.local/node directly.
+  try {
+    if (!fs.existsSync(path.join(NODE_HOME, "bin", "node")) && fs.existsSync(path.join(LEGACY_NODE_HOME, "bin", "node"))) {
+      fs.mkdirSync(path.dirname(NODE_HOME), { recursive: true });
+      fs.renameSync(LEGACY_NODE_HOME, NODE_HOME);
+    }
+  } catch {}
   let dir = findUsableNode();
   if (dir) return adopt(dir);
   const arch = process.arch === "arm64" ? "arm64" : "x64";
@@ -188,7 +199,10 @@ async function ensureEnv({ emit } = {}) {
   let mihomoBin = null;
   try {
     const runtime = require("./runtime");
-    mihomoBin = runtime.binPath("mihomo");
+    // ensureFromBundle migrates a legacy ~/cicy-ai/runtime mihomo into ~/.local/bin
+    // (no network) and fixes the symlink; falls through to the npm-pack path below
+    // when nothing is bundled/installed yet.
+    mihomoBin = runtime.ensureFromBundle("mihomo") || runtime.binPath("mihomo");
     if (!mihomoBin) {
       const prevPath = process.env.PATH;
       process.env.PATH = `${nodeBinDir}:${BREW_DIRS.join(":")}:${process.env.PATH || ""}`; // 让 runtime 的 execFile("npm") 命中 node24
@@ -203,7 +217,9 @@ async function ensureEnv({ emit } = {}) {
       } finally { process.env.PATH = prevPath; }
     }
     if (mihomoBin) {
-      linkBinsToDefaultPath(path.dirname(mihomoBin), ["mihomo"], e); // ~/.local/bin/mihomo → runtime
+      // runtime.js already owns ~/.local/bin/mihomo (symlink → mihomo-<ver>); no
+      // extra linking here (mihomoBin is itself under ~/.local/bin now, so the old
+      // linkBinsToDefaultPath call would have symlinked it to itself).
       e({ phase: "deps", status: "done", message: t("sidecar.mihomoReady", { bin: mihomoBin }) });
     }
   } catch (err) {
@@ -235,10 +251,17 @@ function probeExisting(port = DEFAULT_PORT, timeoutMs = 500) {
 
 let child = null;
 
-// 「局域网访问」开关持久化: 存 ~/cicy-ai/runtime/desktop-flags.json 的 public 字段。
+// 「局域网访问」开关持久化: 存 ~/cicy-ai/db/desktop-flags.json 的 public 字段。
 // start() 读它决定 npx cicy-code 加不加 --public。renderer 通过 sidecar:getPublic/setPublic 读写。
-const FLAGS_FILE = path.join(os.homedir(), "cicy-ai", "runtime", "desktop-flags.json");
-function readFlags() { try { return JSON.parse(fs.readFileSync(FLAGS_FILE, "utf8")) || {}; } catch { return {}; } }
+// 不再放 ~/cicy-ai/runtime;老位置只读兜底,首次写入即迁移(public/cft token 不丢)。
+const FLAGS_FILE = path.join(os.homedir(), "cicy-ai", "db", "desktop-flags.json");
+const LEGACY_FLAGS_FILE = path.join(os.homedir(), "cicy-ai", "runtime", "desktop-flags.json");
+function readFlags() {
+  for (const p of [FLAGS_FILE, LEGACY_FLAGS_FILE]) {
+    try { const v = JSON.parse(fs.readFileSync(p, "utf8")); if (v && typeof v === "object") return v; } catch {}
+  }
+  return {};
+}
 function isPublic() { return !!readFlags().public; }
 function setPublicFlag(on) {
   const f = readFlags(); f.public = !!on;

package/src/sidecar/container-scripts/cicy-code-update.sh

@@ -30,7 +30,12 @@ pick_registry() {
   fi
 }
 REG="$(pick_registry)"
-RT="$HOME_DIR/cicy-ai/runtime/cicy-code"
+# cicy-code's binary tree now lives under ~/.local/cicy-code/<ver>/, matching
+# cicy-code v2.3.193+ (api/cicy-code-update.sh). CICY_CODE_STORE overrides it.
+# versions.json deliberately STAYS under ~/cicy-ai/runtime — it's the SHARED
+# pointer the container's mihomo store & the Go server also read; only the
+# cicy-code binary tree moved off runtime.
+RT="${CICY_CODE_STORE:-$HOME_DIR/.local/cicy-code}"
 LINK="$HOME_DIR/.local/bin/cicy-code"
 VERSIONS="$HOME_DIR/cicy-ai/runtime/versions.json"
 SVCTL="supervisorctl -c /etc/supervisor/supervisord.conf"

package/src/sidecar/host-mihomo.js

@@ -37,8 +37,27 @@ function archStr() { return process.arch === "arm64" ? "arm64" : "amd64"; }
 // OSS mirror of cicy-ai/cicy-mihomo releases (see mihomo/<ver>/mihomo-<os>-<arch>).
 function assetUrl() { return process.env.CICY_MIHOMO_RELEASE_URL || `${OSS_BASE}/mihomo/${VER}/mihomo-${osStr()}-${archStr()}${EXT}`; }
 
-const RT_DIR = path.join(os.homedir(), "cicy-ai", "runtime", "mihomo", VER.replace(/^v/, ""));
-function binPath() { return path.join(RT_DIR, "mihomo" + EXT); }
+// Store under ~/.local/bin like cicy-code / cicy-mihomo — never ~/cicy-ai/runtime
+// anymore. Old runtime-store copies still RESOLVE (read-only compat) so an
+// existing install isn't re-downloaded; ensureBinary migrates them in.
+const VERD = VER.replace(/^v/, "");
+const LOCAL_BIN = path.join(os.homedir(), ".local", "bin");
+const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);
+const LINK = path.join(LOCAL_BIN, `mihomo${EXT}`);
+const LEGACY_BIN = path.join(os.homedir(), "cicy-ai", "runtime", "mihomo", VERD, "mihomo" + EXT);
+function valid(p) { try { return fs.statSync(p).size > 1_000_000; } catch { return false; } }
+// resolve: ~/.local/bin versioned file first, legacy runtime store as fallback.
+function binPath() { return valid(NEW_BIN) ? NEW_BIN : valid(LEGACY_BIN) ? LEGACY_BIN : NEW_BIN; }
+// ~/.local/bin/mihomo → versioned file. We exec via the absolute versioned path,
+// so this symlink is only a PATH convenience — create it only when absent, never
+// clobber one that runtime.js / cicy-mihomo already points at their version.
+function ensureLink() {
+  try {
+    if (!valid(NEW_BIN) || fs.existsSync(LINK)) return;
+    if (IS_WIN) { fs.copyFileSync(NEW_BIN, LINK); return; }
+    fs.symlinkSync(NEW_BIN, LINK);
+  } catch {}
+}
 const HOST_CONFIG = path.join(os.homedir(), "cicy-ai", "db", "mihomo-host.yaml");
 // Log lives under ~/logs, NOT db/ — db/ holds data + config only (config below
 // stays in db/ as mihomo-host.yaml; this is just the runtime log).
@@ -50,7 +69,7 @@ const PID_FILE = path.join(os.homedir(), "cicy-ai", "db", "mihomo-host.pid");
 const HOST_MIXED = Number(process.env.CICY_HOST_MIHOMO_MIXED || 9011);
 const HOST_CTRL = Number(process.env.CICY_HOST_MIHOMO_CTRL || 19011);
 
-function binPresent() { try { return fs.statSync(binPath()).size > 1_000_000; } catch { return false; } }
+function binPresent() { return valid(NEW_BIN) || valid(LEGACY_BIN); }
 
 function download(url, dest, redirects = 0) {
   return new Promise((resolve, reject) => {
@@ -70,15 +89,26 @@ function download(url, dest, redirects = 0) {
   });
 }
 
-// Pull the mihomo binary from OSS into the runtime store (idempotent).
+// Ensure the mihomo binary is in ~/.local/bin/mihomo-<ver> (idempotent).
+// Already there → done. Only a legacy runtime copy → migrate it (no network).
+// Nothing → pull from OSS.
 async function ensureBinary({ emit } = {}) {
-  if (binPresent()) return binPath();
-  fs.mkdirSync(RT_DIR, { recursive: true });
+  if (valid(NEW_BIN)) { ensureLink(); return NEW_BIN; }
+  fs.mkdirSync(LOCAL_BIN, { recursive: true });
+  if (valid(LEGACY_BIN)) {
+    // atomic: stage then rename, so an interrupted copy never leaves a partial
+    // NEW_BIN that valid() would later mistake for a good binary.
+    const stg = NEW_BIN + ".mig";
+    try { fs.copyFileSync(LEGACY_BIN, stg); if (!IS_WIN) fs.chmodSync(stg, 0o755); fs.renameSync(stg, NEW_BIN); }
+    catch { try { fs.rmSync(stg, { force: true }); } catch {} }
+    if (valid(NEW_BIN)) { ensureLink(); return NEW_BIN; }
+  }
   emit && emit({ phase: "chrome-proxy", status: "running", message: tt("downloading") });
-  await download(assetUrl(), binPath());
-  if (!IS_WIN) { try { fs.chmodSync(binPath(), 0o755); } catch {} }
-  if (!binPresent()) throw new Error(tt("verifyFailed"));
-  return binPath();
+  await download(assetUrl(), NEW_BIN);
+  if (!IS_WIN) { try { fs.chmodSync(NEW_BIN, 0o755); } catch {} }
+  if (!valid(NEW_BIN)) throw new Error(tt("verifyFailed"));
+  ensureLink();
+  return NEW_BIN;
 }
 
 // Build the HOST config from the container's mihomo.yaml: keep only what Chrome

package/src/sidecar/runtime.js

@@ -1,36 +1,45 @@
 // Copyright 2026 CiCy AI
 // SPDX-License-Identifier: Apache-2.0
 
-// Runtime Bundle v1 — versioned component store for everything cicy-desktop
-// runs locally (cicy-code, mihomo).
+// Runtime Bundle v2 — versioned component store for everything cicy-desktop
+// runs locally (cicy-code, mihomo). Everything installs under ~/.local/bin,
+// matching cicy-code / cicy-mihomo: the store is on PATH, never in a private
+// ~/cicy-ai/runtime tree anymore.
 //
-// Layout:
-//   ~/cicy-ai/runtime/
-//     versions.json                  { "<comp>": { "current": "<ver>" }, ... }
-//     cicy-code/<ver>/cicy-code(.exe)
-//     mihomo/<ver>/mihomo(.exe)
+// Layout (writes ONLY here):
+//   ~/.local/bin/<comp>-<ver>          versioned binary (e.g. mihomo-1.10.4)
+//   ~/.local/bin/<comp>  ->  <comp>-<ver>   symlink we swap on switch (atomic
+//                                            relink; win32 copies instead —
+//                                            symlink needs admin there)
+//   ~/cicy-ai/db/local-bin-versions.json    { "<comp>": { "current", "previous" } }
 //
-// Sourcing order:
+// Resolution order (READS, with backward compat):
+//   ~/.local/bin/<comp>-<current>  →  ~/.local/bin/<comp> symlink  →
+//   legacy ~/cicy-ai/runtime/<comp>/<ver>/<bin>  (old installs still resolve
+//   until their next upgrade migrates them into ~/.local/bin).
+//
+// Sourcing order for the binary itself:
 //   1. first run: copy out of cicy-desktop's own node_modules — the platform
 //      subpackages are optionalDependencies, so `npm i -g cicy-desktop`
-//      already delivered the right binaries. First start = ZERO network,
-// ZERO npx.
-//   2. upgrades: `npm pack <pkg>@<ver>` (npmmirror default) → extract into
-//      runtime/<comp>/<ver>/ → caller verifies health → switchCurrent().
-//      The previous version stays on disk for instant rollback.
-//
-// The `current` pointer lives in versions.json (NOT a symlink — Windows
-// junction/symlink permissions are a minefield; a JSON pointer is identical
-// on every platform).
+//      already delivered the right binaries. First start = ZERO network.
+//   2. migrate: if only a legacy ~/cicy-ai/runtime binary exists, copy it into
+//      ~/.local/bin (no network) so the new layout takes over.
+//   3. upgrades: `npm pack <pkg>@<ver>` (npmmirror default) → extract → install
+//      into ~/.local/bin → caller verifies health → switchCurrent(). The
+//      previous versioned file stays on disk for instant rollback.
 const { execFile } = require("child_process");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
-const RUNTIME_DIR = path.join(os.homedir(), "cicy-ai", "runtime");
-const VERSIONS_JSON = path.join(RUNTIME_DIR, "versions.json");
+const LOCAL_BIN = path.join(os.homedir(), ".local", "bin");
+const VERSIONS_JSON = path.join(os.homedir(), "cicy-ai", "db", "local-bin-versions.json");
+// read-only backward-compat fallbacks (never written anymore)
+const LEGACY_DIR = path.join(os.homedir(), "cicy-ai", "runtime");
+const LEGACY_VERSIONS = path.join(LEGACY_DIR, "versions.json");
 const REGISTRY = process.env.CICY_NPM_REGISTRY || "https://registry.npmmirror.com";
 const IS_WIN = process.platform === "win32";
+const EXT = IS_WIN ? ".exe" : "";
 
 // npm subpackage platform suffix. NOTE: Windows is "windows" not "win32" —
 // npm's spam filter 403s NEW package names containing 'win32', so EVERY cicy
@@ -48,21 +57,41 @@ const COMPONENTS = {
   "cicy-code": {
     kind: "bin",
     pkg: () => `cicy-code-${plat()}`,
-    bin: () => (IS_WIN ? "cicy-code.exe" : "cicy-code"),
+    bin: () => `cicy-code${EXT}`,
   },
   "mihomo": {
     kind: "bin",
     pkg: () => `cicy-mihomo-${plat()}`,
-    bin: () => (IS_WIN ? "mihomo.exe" : "mihomo"),
+    bin: () => `mihomo${EXT}`,
   },
 };
 
+// ~/.local/bin/<comp>-<ver>[.exe] — the versioned binary we own.
+function binFile(comp, ver) {
+  return path.join(LOCAL_BIN, `${comp}-${ver}${EXT}`);
+}
+// ~/.local/bin/<comp>[.exe] — the PATH entry (symlink, or copy on win32).
+function linkPath(comp) {
+  return path.join(LOCAL_BIN, `${comp}${EXT}`);
+}
+// legacy ~/cicy-ai/runtime/<comp>/<ver>/<bin> — read-only compat.
+function legacyBinPath(comp, ver) {
+  const c = COMPONENTS[comp];
+  return c ? path.join(LEGACY_DIR, comp, ver, c.bin()) : null;
+}
+
 function readVersions() {
-  try { return JSON.parse(fs.readFileSync(VERSIONS_JSON, "utf8")); } catch { return {}; }
+  for (const p of [VERSIONS_JSON, LEGACY_VERSIONS]) {
+    try {
+      const v = JSON.parse(fs.readFileSync(p, "utf8"));
+      if (v && Object.keys(v).length) return v;
+    } catch {}
+  }
+  return {};
 }
 
 function writeVersions(updater) {
-  fs.mkdirSync(RUNTIME_DIR, { recursive: true });
+  fs.mkdirSync(path.dirname(VERSIONS_JSON), { recursive: true });
   const next = updater(readVersions()) || {};
   const tmp = VERSIONS_JSON + ".tmp";
   fs.writeFileSync(tmp, JSON.stringify(next, null, 2));
@@ -74,51 +103,87 @@ function currentVersion(comp) {
   return readVersions()[comp]?.current || null;
 }
 
-function versionDir(comp, ver) {
-  return path.join(RUNTIME_DIR, comp, ver);
-}
-
 // Absolute path of the component's current executable. null when not installed.
+// ~/.local/bin versioned file → symlink → legacy runtime store (compat).
 function binPath(comp) {
   const c = COMPONENTS[comp];
+  if (!c) return null;
   const ver = currentVersion(comp);
-  if (!c || !ver) return null;
-  const p = path.join(versionDir(comp, ver), c.bin());
-  return fs.existsSync(p) ? p : null;
+  if (ver) {
+    const vf = binFile(comp, ver);
+    if (fs.existsSync(vf)) return vf;
+  }
+  const lp = linkPath(comp);
+  if (fs.existsSync(lp)) return lp;
+  if (ver) {
+    const legacy = legacyBinPath(comp, ver);
+    if (legacy && fs.existsSync(legacy)) return legacy; // old install, pre-migration
+  }
+  return null;
 }
 
-// Install a payload directory as <comp>@<ver> and return the version dir.
-// Payload = the npm package dir (or node_modules/<pkg>). Atomic-ish: extract
-// to .staging then rename.
-function installPayload(comp, ver, payloadDir) {
-  const c = COMPONENTS[comp];
-  const dst = versionDir(comp, ver);
-  if (fs.existsSync(dst)) return dst; // already installed — idempotent
+// Copy a single executable file into ~/.local/bin/<comp>-<ver>. Atomic-ish
+// (stage under a temp name, then rename). Idempotent.
+function installFromFile(comp, ver, srcFile) {
+  const dst = binFile(comp, ver);
+  if (fs.existsSync(dst)) return dst;
+  if (!fs.existsSync(srcFile)) throw new Error(`${comp}: source binary missing (${srcFile})`);
+  fs.mkdirSync(LOCAL_BIN, { recursive: true });
   const staging = dst + ".staging";
-  fs.rmSync(staging, { recursive: true, force: true });
-  fs.mkdirSync(staging, { recursive: true });
-  const src = path.join(payloadDir, c.bin());
-  if (!fs.existsSync(src)) { fs.rmSync(staging, { recursive: true, force: true }); throw new Error(`${comp}: ${c.bin()} missing in package`); }
-  fs.copyFileSync(src, path.join(staging, c.bin()));
-  if (!IS_WIN) fs.chmodSync(path.join(staging, c.bin()), 0o755);
+  try { fs.rmSync(staging, { force: true }); } catch {}
+  fs.copyFileSync(srcFile, staging);
+  if (!IS_WIN) fs.chmodSync(staging, 0o755);
   fs.renameSync(staging, dst);
   return dst;
 }
 
+// Install a payload directory (the npm package dir) as <comp>@<ver>.
+function installPayload(comp, ver, payloadDir) {
+  const c = COMPONENTS[comp];
+  return installFromFile(comp, ver, path.join(payloadDir, c.bin()));
+}
+
+// Point ~/.local/bin/<comp> at <comp>-<ver>. Symlink on posix (atomic
+// tmp+rename), copy on win32 (symlink there needs admin — same call the
+// cicy-mihomo/cicy-code installers make).
+function relink(comp, ver) {
+  const target = binFile(comp, ver);
+  if (!fs.existsSync(target)) return;
+  const link = linkPath(comp);
+  fs.mkdirSync(LOCAL_BIN, { recursive: true });
+  if (IS_WIN) {
+    try { fs.rmSync(link, { force: true }); } catch {}
+    try { fs.copyFileSync(target, link); } catch {}
+    return;
+  }
+  const tmp = `${link}.tmp-${process.pid}`;
+  try {
+    try { fs.rmSync(tmp, { force: true }); } catch {}
+    fs.symlinkSync(target, tmp);
+    fs.renameSync(tmp, link); // atomically replaces the old symlink
+  } catch {
+    try { fs.rmSync(tmp, { force: true }); } catch {}
+  }
+}
+
 function switchCurrent(comp, ver) {
   writeVersions((v) => { v[comp] = { ...(v[comp] || {}), current: ver, switched_at: new Date().toISOString() }; return v; });
+  relink(comp, ver);
 }
 
-// Keep current + previous; GC everything older.
+// Keep current + previous versioned files; GC everything older in ~/.local/bin.
 function gc(comp) {
   const cur = currentVersion(comp);
-  const dir = path.join(RUNTIME_DIR, comp);
-  let entries = [];
-  try { entries = fs.readdirSync(dir).filter((d) => !d.endsWith(".staging")); } catch { return; }
   const prev = readVersions()[comp]?.previous;
+  const prefix = `${comp}-`;
+  let entries = [];
+  try { entries = fs.readdirSync(LOCAL_BIN); } catch { return; }
   for (const e of entries) {
-    if (e !== cur && e !== prev) {
-      try { fs.rmSync(path.join(dir, e), { recursive: true, force: true }); } catch {}
+    if (!e.startsWith(prefix)) continue; // skips the bare "<comp>" symlink too
+    if (e.endsWith(".staging") || e.includes(".tmp-")) { try { fs.rmSync(path.join(LOCAL_BIN, e), { force: true }); } catch {} continue; }
+    const ver = e.slice(prefix.length).replace(/\.exe$/, "");
+    if (ver !== cur && ver !== prev) {
+      try { fs.rmSync(path.join(LOCAL_BIN, e), { force: true }); } catch {}
     }
   }
 }
@@ -139,18 +204,33 @@ function bundledPkgDir(comp) {
   return null;
 }
 
-// First-run seeding: make sure SOME version of `comp` is installed + current,
-// sourcing from the bundled subpackage. Never touches the network.
+// First-run seeding / migration: make sure the current `comp` binary lives in
+// ~/.local/bin and its symlink is current. Never touches the network.
+//   • already in ~/.local/bin → just fix the symlink.
+//   • only a legacy ~/cicy-ai/runtime copy → migrate it into ~/.local/bin.
+//   • nothing → copy from the bundled subpackage.
 function ensureFromBundle(comp) {
   const c = COMPONENTS[comp];
   if (!c) return null;
-  const existing = binPath(comp);
-  if (existing) return existing;
+  const cur = currentVersion(comp);
+
+  if (cur && fs.existsSync(binFile(comp, cur))) { relink(comp, cur); return binFile(comp, cur); }
+
+  // migrate a legacy runtime-store install into ~/.local/bin (no network)
+  if (cur) {
+    const legacy = legacyBinPath(comp, cur);
+    if (legacy && fs.existsSync(legacy)) {
+      try { installFromFile(comp, cur, legacy); switchCurrent(comp, cur); return binPath(comp); } catch {}
+    }
+  }
+
+  // seed from the bundled optionalDependency subpackage
   const pkgDir = bundledPkgDir(comp);
-  if (!pkgDir) return null; // not bundled (e.g. dev tree) — caller may npm-install
+  if (!pkgDir) return binPath(comp); // dev tree / not bundled — may still resolve via legacy or symlink
   const ver = JSON.parse(fs.readFileSync(path.join(pkgDir, "package.json"), "utf8")).version;
   installPayload(comp, ver, pkgDir);
-  if (!currentVersion(comp)) switchCurrent(comp, ver);
+  if (!currentVersion(comp) || !fs.existsSync(binFile(comp, currentVersion(comp)))) switchCurrent(comp, ver);
+  else relink(comp, currentVersion(comp));
   return binPath(comp);
 }
 
@@ -171,14 +251,14 @@ async function checkUpdate(comp) {
 }
 
 // Download <pkg>@<ver> via `npm pack` (pacote verifies sha512 integrity),
-// extract, install as a runtime version. Does NOT switch `current` — the
-// caller health-checks first, then calls switchCurrent()/rollback.
+// extract, install into ~/.local/bin. Does NOT switch `current` — the caller
+// health-checks first, then calls switchCurrent()/rollback.
 async function fetchVersion(comp, ver, { emit } = {}) {
   const c = COMPONENTS[comp];
   const e = emit || (() => {});
-  if (fs.existsSync(versionDir(comp, ver))) {
+  if (fs.existsSync(binFile(comp, ver))) {
     e({ phase: "download", status: "skip", message: `${comp} ${ver} 已在本地，跳过下载` });
-    return versionDir(comp, ver);
+    return binFile(comp, ver);
   }
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `cicy-rt-${comp}-`));
   try {
@@ -189,9 +269,9 @@ async function fetchVersion(comp, ver, { emit } = {}) {
       execFile("tar", ["-xzf", tgz, "-C", tmp], { windowsHide: true, timeout: 120000 },
         (err) => (err ? reject(err) : resolve()));
     });
-    const dir = installPayload(comp, ver, path.join(tmp, "package"));
+    const file = installPayload(comp, ver, path.join(tmp, "package"));
     e({ phase: "download", status: "done", message: `${comp} ${ver} 就绪` });
-    return dir;
+    return file;
   } finally {
     fs.rmSync(tmp, { recursive: true, force: true });
   }
@@ -220,7 +300,7 @@ async function upgrade(comp, { emit, stop, start, verify } = {}) {
   } catch (err) {
     // rollback: pointer back, restart old version
     e({ phase: "swap", status: "error", message: `新版本异常（${err.message}），回滚到 ${from}` });
-    switchCurrent(comp, from);
+    if (from) switchCurrent(comp, from);
     if (start) { try { await start(); } catch {} }
     return { ok: false, from, to: latest, rolledBack: true, error: err.message };
   }
@@ -230,7 +310,7 @@ async function upgrade(comp, { emit, stop, start, verify } = {}) {
 }
 
 module.exports = {
-  RUNTIME_DIR, COMPONENTS,
-  binPath, currentVersion, ensureFromBundle, fetchVersion, switchCurrent,
+  LOCAL_BIN, COMPONENTS,
+  binPath, binFile, linkPath, currentVersion, ensureFromBundle, fetchVersion, switchCurrent,
   checkUpdate, upgrade, gc, readVersions,
 };