npm - cicy-desktop - Versions diffs - 2.1.239 → 2.1.241 - Mend

cicy-desktop 2.1.239 → 2.1.241

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/package.json +5 -5
package/src/backends/homepage-preload.js +2 -0
package/src/backends/homepage-react/assets/index-CCx0HFAk.js +377 -0
package/src/backends/homepage-react/index.html +1 -1
package/src/backends/local-teams.js +27 -3
package/src/backends/sidecar-ipc.js +24 -1
package/src/i18n/locales/en.json +12 -0
package/src/i18n/locales/fr.json +12 -0
package/src/i18n/locales/ja.json +12 -0
package/src/i18n/locales/zh-CN.json +12 -0
package/src/main.js +13 -0
package/src/sidecar/cicy-code.js +11 -1
package/src/sidecar/native.js +9 -1
package/src/sidecar/wsl-docker.js +38 -7
package/workers/render/src/App.jsx +71 -0
package/src/backends/homepage-react/assets/index-DEVBS0FI.js +0 -377

package/src/backends/homepage-react/index.html CHANGED Viewed

@@ -6,7 +6,7 @@
   <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
   <link rel="icon" type="image/png" sizes="256x256" href="./favicon-256.png" />
   <title>CiCy Desktop</title>
-  <script type="module" crossorigin src="./assets/index-DEVBS0FI.js"></script>
+  <script type="module" crossorigin src="./assets/index-CCx0HFAk.js"></script>
   <link rel="stylesheet" crossorigin href="./assets/index-C6Zrdgc0.css">
 </head>
 <body>

package/src/backends/local-teams.js CHANGED Viewed

@@ -572,8 +572,10 @@ async function pullCustomTeams() {
     for (const [k, v] of Object.entries(nodes)) { if (v?.cloud_team_id != null) byCloudId[String(v.cloud_team_id)] = k; }
     let added = 0, updated = 0;
     for (const t of list.teams) {
-      if (t.kind !== "custom") continue;
-      const host = String(t.host_url || t.hostUrl || "").trim();
+      // custom teams (remote URL) OR any team with a zero-trust gateway address:
+      // gateway teams are reached at <slug>.gw.cicy-ai.com (preferred over host_url).
+      if (t.kind !== "custom" && !t.gateway_url) continue;
+      const host = String(t.gateway_url || t.host_url || t.hostUrl || "").trim();
       if (!host) continue;
       const tid = t.teamId || t.id || null;
       const localId = tid != null ? byCloudId[String(tid)] : null;
@@ -1099,4 +1101,26 @@ function avatarForUrl(url) {
   return "";
 }
-module.exports = { list, openTeam, reloadTeam, closeLocalWindows, addTeam, removeTeam, updateTeam, upgradeTeam, syncAllLocalTeams, setAvatar, getAvatars, avatarForUrl };
+// Remove teams tied to a cloud ACCOUNT (remote base_url — pulled from the cloud
+// via pullCustomTeams, or user-added remote nodes) so switching/leaving an account
+// doesn't leak them onto the next user. LOCAL machine teams on THIS device
+// (localhost base_url) are kept — they belong to the box, not the account. The
+// next login re-pulls the new account's own teams fresh.
+async function purgeAccountTeams() {
+  let removed = 0;
+  try {
+    await writeNodes((nodes) => {
+      for (const id of Object.keys(nodes)) {
+        let host = "";
+        try { host = new URL(String(nodes[id]?.base_url || "")).hostname.toLowerCase(); } catch {}
+        const isLocal = host === "" || host === "127.0.0.1" || host === "localhost" || host === "::1";
+        if (!isLocal) { delete nodes[id]; removed++; }
+      }
+      return nodes;
+    });
+  } catch (e) { log.warn(`[local-teams] purgeAccountTeams failed: ${e.message}`); }
+  if (removed) { _cache = null; _cacheUntil = 0; log.info(`[local-teams] purged ${removed} account team(s) (login/logout)`); }
+  return removed;
+}
+module.exports = { list, openTeam, reloadTeam, closeLocalWindows, addTeam, removeTeam, updateTeam, upgradeTeam, syncAllLocalTeams, purgeAccountTeams, setAvatar, getAvatars, avatarForUrl };

package/src/backends/sidecar-ipc.js CHANGED Viewed

@@ -293,7 +293,7 @@ function register({ sidecarLogPath } = {}) {
     await ensureDockerTeam().catch(() => {});
     const env = { CICY_AI_GATEWAY_LLM_ENDPOINT: GATEWAY_ENDPOINT };
     if (dockerTeamReg && dockerTeamReg.apiKey) env.CICY_AI_GATEWAY_LLM_API_KEY = dockerTeamReg.apiKey;
-    return { port: APP_PORT, container: APP_CONTAINER, volume: APP_VOLUME, env, extraPorts: readExtraPorts() };
+    return { port: APP_PORT, container: APP_CONTAINER, volume: APP_VOLUME, env, extraPorts: readExtraPorts(), dockerSock: sidecar.isDood() };
   };
   // Register the running :8008 instance as a (custom) team so the card's "打开"
   // reuses the token-injected open/reload flow. addTeam dedups by host:port.
@@ -675,6 +675,29 @@ function register({ sidecarLogPath } = {}) {
     }
   });
+  // 「容器内使用 Docker」(Docker-outside-of-Docker)开关: 读/写 dood flag。set 后重建容器
+  // 让 docker.sock + WSL 的 docker 客户端挂载生效(runContainer 内部读 dood flag)。不再下载
+  // docker CLI(改为直接挂 WSL 现成的二进制,秒生效,避免卡在"保存中")。进度推抽屉(op:restart)。
+  ipcMain.handle("sidecar:get-dood", () => {
+    try { return { ok: true, dood: sidecar.isDood() }; } catch (e) { return { ok: false, dood: false, error: e.message }; }
+  });
+  ipcMain.handle("sidecar:set-dood", async (e, on) => {
+    const emit = (ev) => { try { e.sender.send("sidecar:op-progress", { op: "restart", ...ev }); } catch {} };
+    try {
+      sidecar.setDood(!!on);
+      emit({ phase: "swap", status: "running", message: `容器 Docker 访问已${on ? "开启" : "关闭"},正在重建容器…` });
+      try { await appDocker.recreate({ ...(await appOpts()), onProgress: emit }); }
+      catch (err) { try { await appDocker.dockerRestart?.({ onProgress: emit }); } catch {} }
+      let up = false;
+      for (let i = 0; i < 240; i++) { if ((await appDocker.probeHealth?.(PORT)) || (await sidecar.probeExisting(PORT))) { up = true; break; } await new Promise((r) => setTimeout(r, 500)); }
+      emit({ phase: "done", status: up ? "done" : "error", message: up ? `容器 Docker 访问已${on ? "开启" : "关闭"}` : "重建后 :8008 未就绪——稍等或重试" });
+      return { ok: up, dood: !!on };
+    } catch (err) {
+      emit({ phase: "done", status: "error", message: `设置失败:${err.message}` });
+      return { ok: false, error: err.message };
+    }
+  });
   // Update: stop + spawn cicy-code@latest (or reload the Docker image on
   // win32). The npx re-resolve / image pull can take a while on a cold cache,
   // so allow a longer window for :8008 to come back.

package/src/i18n/locales/en.json CHANGED Viewed

@@ -570,5 +570,17 @@
   "tabShell": {
     "myTeam": "My Team",
     "newTabBtn": "New tab"
+  },
+  "dood": {
+    "menu": "Use Docker in container",
+    "hint": "Mount the host Docker + docker client into the container so its agent can run docker (toggling rebuilds the container; takes effect instantly, no download)",
+    "title": "Use Docker in container",
+    "subtitle": "Mount the host Docker + docker client into the container so its agent can run docker (instant, no download)",
+    "enable": "Allow Docker inside the container",
+    "applying": "Enabling container Docker access, rebuilding…",
+    "disabling": "Disabling…",
+    "onDone": "Container Docker access enabled",
+    "offDone": "Container Docker access disabled",
+    "failed": "Failed to apply"
   }
 }

package/src/i18n/locales/fr.json CHANGED Viewed

@@ -570,5 +570,17 @@
   "tabShell": {
     "myTeam": "Mon équipe",
     "newTabBtn": "Nouvel onglet"
+  },
+  "dood": {
+    "menu": "Utiliser Docker dans le conteneur",
+    "hint": "Monte le Docker et le client docker de l'hôte dans le conteneur pour que son agent puisse exécuter docker (le basculement recrée le conteneur ; effet immédiat, sans téléchargement)",
+    "title": "Utiliser Docker dans le conteneur",
+    "subtitle": "Monte le Docker et le client docker de l'hôte dans le conteneur pour que son agent puisse exécuter docker (immédiat, sans téléchargement)",
+    "enable": "Autoriser Docker dans le conteneur",
+    "applying": "Activation de l'accès Docker du conteneur, reconstruction…",
+    "disabling": "Désactivation…",
+    "onDone": "Accès Docker du conteneur activé",
+    "offDone": "Accès Docker du conteneur désactivé",
+    "failed": "Échec de l'application"
   }
 }

package/src/i18n/locales/ja.json CHANGED Viewed

@@ -570,5 +570,17 @@
   "tabShell": {
     "myTeam": "マイチーム",
     "newTabBtn": "新しいタブ"
+  },
+  "dood": {
+    "menu": "コンテナ内で Docker を使う",
+    "hint": "ホストの Docker と docker クライアントをコンテナにマウントし、agent が docker を実行できるようにします(切り替えでコンテナを再作成、即時反映・ダウンロード不要)",
+    "title": "コンテナ内で Docker を使う",
+    "subtitle": "ホストの Docker と docker クライアントをコンテナにマウントして、agent が docker を直接実行できます(即時反映、ダウンロード不要)",
+    "enable": "コンテナ内での Docker を許可",
+    "applying": "コンテナ Docker アクセスを有効化、再作成中…",
+    "disabling": "無効化中…",
+    "onDone": "コンテナ Docker アクセスを有効化しました",
+    "offDone": "コンテナ Docker アクセスを無効化しました",
+    "failed": "設定に失敗しました"
   }
 }

package/src/i18n/locales/zh-CN.json CHANGED Viewed

@@ -570,5 +570,17 @@
   "tabShell": {
     "myTeam": "我的团队",
     "newTabBtn": "新建标签"
+  },
+  "dood": {
+    "menu": "容器内使用 Docker",
+    "hint": "把宿主 Docker + docker 客户端挂进容器,容器内 agent 能直接跑 docker(切换会重建容器,秒生效、无需下载)",
+    "title": "容器内使用 Docker",
+    "subtitle": "把宿主 Docker + docker 客户端挂进容器,容器内 agent 就能直接跑 docker(秒生效,无需下载)",
+    "enable": "允许容器内使用 Docker",
+    "applying": "开启容器 Docker 访问,重建容器中…",
+    "disabling": "关闭中…",
+    "onDone": "容器 Docker 访问已开启",
+    "offDone": "容器 Docker 访问已关闭",
+    "failed": "设置失败"
   }
 }

package/src/main.js CHANGED Viewed

@@ -998,6 +998,17 @@ electronApp.whenReady().then(async () => {
     // renderer. A completed email login is thus indistinguishable downstream.
     const onAuthResult = (payload) => {
       if (payload && payload.token) {
+        // Account isolation: if a DIFFERENT user is signing in, drop the previous
+        // account's cloud/remote teams so they don't leak onto this account. The
+        // login below re-pulls this account's own teams fresh. Local machine
+        // teams (localhost) are kept — they belong to the device.
+        try {
+          const prevUid = String((readGlobalConfig(GLOBAL_JSON)?.desktopAuth?.userId) || "");
+          const nextUid = payload.userId != null ? String(payload.userId) : "";
+          if (prevUid && nextUid && prevUid !== nextUid) {
+            require("./backends/local-teams").purgeAccountTeams().catch(() => {});
+          }
+        } catch {}
         saveDesktopAuth(payload);
         // Now that we have a real owner-bound login token, report this
         // machine to the cloud (best-effort; safe to call repeatedly —
@@ -1067,6 +1078,8 @@ electronApp.whenReady().then(async () => {
     __ipcMainAuth.handle("auth:logout", () => {
       try {
         updateGlobalConfig(GLOBAL_JSON, (c) => { delete c.desktopAuth; return c; });
+        // Drop this account's cloud/remote teams on logout (local machines stay).
+        require("./backends/local-teams").purgeAccountTeams().catch(() => {});
         log.info("[auth] desktop login cleared (explicit logout)");
       } catch (e) { log.warn(`[auth] logout clear failed: ${e.message}`); }
       return { ok: true };

package/src/sidecar/cicy-code.js CHANGED Viewed

@@ -269,6 +269,16 @@ function setPublicFlag(on) {
   return f.public;
 }
+// 「容器内使用 Docker」开关(desktop-flags.json 的 dood 字段 = Docker-outside-of-Docker)。
+// 开启后 runContainer 把宿主 dockerd 的 /var/run/docker.sock 挂进容器,并把 docker CLI 装进
+// 容器持久卷,容器内 agent 就能跑 docker。只影响 Windows/WSL(+mac colima)容器路径。
+function isDood() { return !!readFlags().dood; }
+function setDood(on) {
+  const f = readFlags(); f.dood = !!on;
+  try { fs.mkdirSync(path.dirname(FLAGS_FILE), { recursive: true }); fs.writeFileSync(FLAGS_FILE, JSON.stringify(f, null, 2)); } catch (e) { console.warn(`[cicy-code-sidecar] setDood write failed: ${e.message}`); }
+  return f.dood;
+}
 // 「Cloudflare Tunnel」配置持久化(同 desktop-flags.json 的 cft 字段):
 // { enabled, token, host }。enabled 且 token 非空时,start() 注入 CICY_CFT_TOKEN/
 // CICY_CFT_HOST 环境变量 —— cicy-code 据此跑一条命名隧道(固定域名)。host 是对外
@@ -565,4 +575,4 @@ async function update({ logPath, port = DEFAULT_PORT, emit } = {}) {
   }
 }
-module.exports = { start, stop, restart, update, probeExisting, clearNpxCache, isUpdating, isBusy, ensureEnv, ensureNode, isPublic, setPublicFlag, getCft, setCft, cftEnv };
+module.exports = { start, stop, restart, update, probeExisting, clearNpxCache, isUpdating, isBusy, ensureEnv, ensureNode, isPublic, setPublicFlag, isDood, setDood, getCft, setCft, cftEnv };

package/src/sidecar/native.js CHANGED Viewed

@@ -143,7 +143,15 @@ async function start({ port = 8008, logPath = null, emit, version = null } = {})
   };
   // --helper removed : boot cicy-code in normal mode (full tmux-based
   // multi-agent), not the single headless 团队助手.
-  const child = spawn(exe, ["--desktop"], { stdio, detached: true, windowsHide: true, env });
+  const args = ["--desktop"];
+  // Host role: if a zero-trust gateway is provisioned (~/cicy-ai/db/gateway.json
+  // with url+token), boot with --gateway so this machine dials OUT and becomes
+  // reachable through the gateway (no inbound port). Absent → plain local boot.
+  try {
+    const gwPath = require("path").join(require("os").homedir(), "cicy-ai", "db", "gateway.json");
+    if (require("fs").existsSync(gwPath)) args.push("--gateway");
+  } catch { /* best-effort */ }
+  const child = spawn(exe, args, { stdio, detached: true, windowsHide: true, env });
   child.unref();
   try { fs.writeFileSync(PID_FILE, String(child.pid)); } catch {}
   console.log(`[native-sidecar] spawned ${exe} --desktop pid=${child.pid} port=${port} log=${logPath || "(none)"}`);

package/src/sidecar/wsl-docker.js CHANGED Viewed

@@ -560,6 +560,32 @@ async function allDrivesMountArg() {
   } catch (e) { log.warn(`[wsl-docker] enumerate drives failed: ${e.message}`); return ""; }
 }
+// Docker-outside-of-Docker: 把 WSL 里 dockerd 的 socket 挂进容器,容器内 agent 就能直接跑
+// docker —— 复用 WSL 那个 dockerd,起的是**兄弟容器**(非嵌套),所以兄弟容器里 `-v` 的路径
+// 是 WSL 宿主视角、不是 cicy-code 容器内路径。socket 通常 root:docker(或 root:root)660,
+// 给容器进程 `--group-add <socket 的 gid>` 让非 root 的 cicy 用户也能访问。
+// 同时把 WSL 自带的 docker 客户端(静态 Go 二进制,/usr/bin/docker)只读挂进容器 PATH —— 这样
+// 容器里立刻有 `docker` 命令可用,**不用下载**(之前下 70MB static tarball 会让 UI 卡在"保存中")。
+// socket 不在(dockerd 没起)→ 返回 ""(best-effort,不挡容器启动)。挂载在 `docker run` 时定死,
+// 已在跑的容器要 recreate 才带上。
+async function dockerSockMountArg() {
+  const SOCK = "/var/run/docker.sock";
+  try { await wslRun(`test -S ${SOCK}`, { timeout: 8000 }); } catch { return ""; } // socket 不存在
+  let groupAdd = "";
+  try {
+    const { stdout } = await wslRun(`stat -c '%g' ${SOCK} 2>/dev/null`, { timeout: 8000 });
+    const gid = String(stdout || "").trim();
+    if (/^\d+$/.test(gid)) groupAdd = ` --group-add ${gid}`;
+  } catch {}
+  let cliMount = "";
+  try {
+    const { stdout } = await wslRun(`command -v docker 2>/dev/null`, { timeout: 8000 });
+    const p = String(stdout || "").trim();
+    if (p) cliMount = ` -v ${p}:/usr/local/bin/docker:ro`;
+  } catch {}
+  return `-v ${SOCK}:${SOCK}${cliMount}${groupAdd}`;
+}
 // extraPorts → additional `-p 127.0.0.1:<p>:<p>` mappings (host=container, loopback
 // only). For container-internal agent services the user wants reachable from
 // Windows. Each adds one docker-proxy, so keep the list small. 8008/主端口自动排除。
@@ -575,7 +601,7 @@ function publishArgs(port, extraPorts = []) {
   return args;
 }
-async function runContainer({ port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008", env = {}, extraPorts = [], emit } = {}) {
+async function runContainer({ port = 8008, container = "cicy-code-docker", volume = "cicy-team-8008", env = {}, extraPorts = [], dockerSock = false, emit } = {}) {
   // 每次容器"启动"(含已在跑被 adopt)都确保桌面快捷方式存在 —— 不存在就建,坏了就修。
   if (await probeHealth(port)) { ensureDesktopShortcut(volume, port).catch(() => {}); return { adopted: true }; }
   // Replace any stale same-named container.
@@ -599,7 +625,12 @@ async function runContainer({ port = 8008, container = "cicy-code-docker", volum
   // 已删——docker 默认每端口起一个 userland-proxy 进程 → 2000 进程,docker run 卡死/吃内存/
   // 偶发失败(实测)。容器内 agent 服务需要从 Windows 直达时再按需单独暴露。
   const drivesArg = await allDrivesMountArg(); // 动态:有几个盘挂几个
-  const cmd = `docker run -d --name ${container} --restart unless-stopped --dns 223.5.5.5 --dns 8.8.8.8 ${publishArgs(port, extraPorts)} -e CICY_PUBLIC=1 -v ${volume}:/home/cicy ${projectsMountArg()} ${drivesArg} ${envArgs} ${IMAGE}`;
+  // DooD:开关开时挂 WSL docker.sock。跟 cftEnv 一样内部读 flag(与显式 opt 取或),
+  // 这样任何 recreate 调用方式(带不带 appOpts)都能生效。
+  let doodOn = dockerSock;
+  if (!doodOn) { try { doodOn = require("./cicy-code").isDood(); } catch {} }
+  const sockArg = doodOn ? await dockerSockMountArg() : "";
+  const cmd = `docker run -d --name ${container} --restart unless-stopped --dns 223.5.5.5 --dns 8.8.8.8 ${publishArgs(port, extraPorts)} -e CICY_PUBLIC=1 -v ${volume}:/home/cicy ${projectsMountArg()} ${drivesArg} ${sockArg} ${envArgs} ${IMAGE}`;
   emit && emit({ phase: "container", status: "running", message: `$ ${cmd.length > 220 ? cmd.slice(0, 220) + " …" : cmd}` });
   await wslRun(cmd, { timeout: 60000 }); // 失败时 err.stderr 带 docker 真错误 → _bootstrap 的 errTail 显示
   ensureDesktopShortcut(volume, port).catch(() => {});
@@ -764,7 +795,7 @@ async function bootstrap(opts = {}) {
 // 注意: 默认容器/卷名保持 cicy-team / cicy-code-docker(回退实测"现在不行了"的改动)。
 // live 路径(docker:app-bootstrap)始终传显式 APP_*(cicy-team-8008)名,不靠这里的默认;
 // 改默认会让既有 cicy-team 卷的装机对不上 → 退回原值。
-async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {}, extraPorts = [] } = {}) {
+async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-docker", volume = "cicy-team", env = {}, extraPorts = [], dockerSock = false } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   // Structured, PERSISTED trace of the whole run (electron-log → main.log) so a
@@ -875,7 +906,7 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
   begin("run-container");
   if (!(await probeHealth(port))) {
     emit({ phase: "container", status: "running", message: "启动 cicy-code 服务…" });
-    try { await runContainer({ port, container, volume, env, extraPorts, emit }); }
+    try { await runContainer({ port, container, volume, env, extraPorts, dockerSock, emit }); }
     catch (e) { fail("container_start_failed", e.message); emit({ phase: "container", status: "error", message: `服务启动失败：${e.message}（点重试）${errTail(e)}` }); finish(false, "container_start_failed"); return { ok: false, reason: "container_start_failed" }; }
     done();
   } else done(true);
@@ -1028,14 +1059,14 @@ async function dockerRestart({ container = "cicy-code-docker-8008" } = {}) {
 // 重建容器:docker rm -f 旧容器 + docker run 新容器(用新 env,如新的 docker team 网关
 // key)。**保留 volume**(数据/api_token/deviceId 不丢),只是换掉容器本身 + env。
 // 破坏性(短暂中断 + 换 key)→ 调用方要 confirm。
-async function recreate({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {}, extraPorts = [] } = {}) {
+async function recreate({ onProgress, port = 8008, container = "cicy-code-docker-8008", volume = "cicy-team-8008", env = {}, extraPorts = [], dockerSock = false } = {}) {
   const emit = (ev) => { try { onProgress && onProgress(ev); } catch {} };
   // 重建 = 用最新镜像重建。OSS 有更新版先刷新(非破坏性,不删发行版/volume),再 rm + run。
   try { await ensureFreshImage({ emit }); } catch (e) { emit({ phase: "image", status: "running", message: `镜像刷新跳过(${e.message}),用现有镜像重建` }); }
   // 强删占用该端口的**任何**容器(含老名字 cicy-code-docker)+ 目标容器 —— 否则
   // runContainer 开头的 probeHealth 看到旧容器还健康会 adopt 它、不重建,key 就换不了。
   try { await wslRun(`docker ps -aq --filter publish=${port} | xargs -r docker rm -f 2>/dev/null; docker rm -f ${container} 2>/dev/null; true`, { timeout: 30000 }); } catch {}
-  const r = await runContainer({ port, container, volume, env, extraPorts, emit });
+  const r = await runContainer({ port, container, volume, env, extraPorts, dockerSock, emit });
   try { await ensureDesktopShortcut(volume, port); } catch {}
   // 等 :8008 真正起来再返回——否则 docker run 一返回卡片就探测「没运行」,显示「启动」让
   // 用户再点一下(实测:端口保存后重建,drawer 关了还要手动点启动)。
@@ -1064,7 +1095,7 @@ async function upgrade({ onProgress, port = 8008, container = "cicy-code-docker"
   try { await stop({ container }); } catch {}
   try { await unregisterDistro(); } catch {}
   // Reuse the robust one-shot install flow (download → import → dockerd → run).
-  return await _bootstrap({ onProgress, port, container, volume, env });
+  return await _bootstrap({ onProgress, port, container, volume, env, dockerSock });
 }
 // 容器里有没有注入网关 key(reconcile 自愈用):printenv 看 CICY_AI_GATEWAY_LLM_API_KEY。

package/workers/render/src/App.jsx CHANGED Viewed

@@ -2016,6 +2016,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
   const [busy, setBusy] = useState("");   // "" | bootstrap | restart | stop | upgrade | probe
   const [menuOpen, setMenuOpen] = useState(false);
   const [cftOpen, setCftOpen] = useState(false); // Cloudflare 隧道 modal(卡片层,菜单外)
+  const [doodOpen, setDoodOpen] = useState(false); // 容器内使用 Docker(DooD)modal(卡片层,菜单外)
   const [confirmRecreate, setConfirmRecreate] = useState(false); // 重建容器 in-app 确认弹窗(不用 native confirm)
   const [portsOpen, setPortsOpen] = useState(false);   // 端口设置 modal
   const [portList, setPortList] = useState([]);         // 编辑中的额外端口(字符串数组,便于输入)
@@ -2411,6 +2412,11 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
                   onClick={(e) => { e.stopPropagation(); setMenuOpen(false); window.cicy?.docker?.openDir?.("projects"); }}>
                   {tr("docker.openProjectsDir", "打开项目目录")}
                 </button>
+                <button type="button" data-id="DockerCard-dood" className="bcard__menu-item"
+                  title={tr("dood.hint", "把宿主 Docker + docker 客户端挂进容器,容器内 agent 能直接跑 docker(切换会重建容器,秒生效、无需下载)")}
+                  onClick={(e) => { e.stopPropagation(); setMenuOpen(false); setDoodOpen(true); }}>
+                  {tr("dood.menu", "容器内使用 Docker")}
+                </button>
                 <button type="button" data-id="DockerCard-billing" className="bcard__menu-item"
                   onClick={() => { setMenuOpen(false); openCloudPage((cloudCode || dockerTeam?.cloud_team_id) ? `?team=${encodeURIComponent(cloudCode || dockerTeam.cloud_team_id)}` : "?view=usage"); }}>
                   {tr("docker.billing", "帐单")}
@@ -2487,6 +2493,7 @@ function DockerCard({ dockerTeam, cloudTitle, cloudCode, onOpen, onRename, onRef
         <span>{ctaLabel}</span>
       </button>
       <CftModal open={cftOpen} onClose={() => setCftOpen(false)} toastId="docker-op" />
+      <DoodModal open={doodOpen} onClose={() => setDoodOpen(false)} toastId="docker-op" />
       {confirmRecreate && createPortal(
         <div data-id="DockerCard-recreate-modal"
           style={{ position: "fixed", inset: 0, zIndex: 9999, background: "rgba(0,0,0,0.55)", display: "flex", alignItems: "center", justifyContent: "center" }}
@@ -3529,6 +3536,70 @@ function CftModal({ open, onClose, toastId = "cft-op" }) {
     </>
   );
 }
+// 容器内使用 Docker(Docker-outside-of-Docker)modal —— 单 checkbox,像 CftModal 一样渲染在
+// 卡片层(菜单外)。开启 → sidecar.setDood → 重建容器挂 docker.sock + 把 docker CLI 装进容器
+// 持久卷,下载进度实时显示在弹窗里。DockerCard(Windows 容器)用。
+function DoodModal({ open, onClose, toastId = "dood-op" }) {
+  const [busy, setBusy] = useState(false);
+  const [err, setErr] = useState("");
+  const [on, setOn] = useState(false);
+  const [line, setLine] = useState("");
+  useEffect(() => {
+    if (!open || !window.cicy?.sidecar?.getDood) return;
+    setErr(""); setLine("");
+    window.cicy.sidecar.getDood().then((r) => setOn(!!r?.dood)).catch(() => {});
+  }, [open]);
+  // 把重建/下载进度实时显示在弹窗(installDockerCli 的每行输出经 op-progress 推来)
+  useEffect(() => {
+    if (!open || !busy || !window.cicy?.sidecar?.onOpProgress) return;
+    return window.cicy.sidecar.onOpProgress((ev) => { if (ev?.message) setLine(String(ev.message)); });
+  }, [open, busy]);
+  const save = async () => {
+    if (busy) return;
+    setBusy(true); setErr(""); setLine("");
+    toast.show({ id: toastId, message: on ? tr("dood.applying", "开启容器 Docker 访问,重建容器中…") : tr("dood.disabling", "关闭中…"), status: "running", progress: undefined });
+    try {
+      const r = await window.cicy.sidecar.setDood(on);
+      if (r?.ok) {
+        onClose && onClose();
+        toast.show({ id: toastId, message: on ? tr("dood.onDone", "容器 Docker 访问已开启") : tr("dood.offDone", "容器 Docker 访问已关闭"), status: "done", ttl: 4000 });
+      } else {
+        setErr(r?.error || tr("dood.failed", "设置失败"));
+        toast.show({ id: toastId, message: tr("dood.failed", "设置失败") + (r?.error ? `: ${r.error}` : ""), status: "error", ttl: 6000 });
+      }
+    } catch (e) { setErr(e?.message || String(e)); toast.show({ id: toastId, message: tr("dood.failed", "设置失败") + `: ${e?.message || e}`, status: "error", ttl: 6000 }); }
+    finally { setBusy(false); }
+  };
+  const setOpenX = (v) => { if (!v) onClose && onClose(); };
+  if (!open) return null;
+  return (
+    <>
+      {createPortal(
+        <div data-id="dood-modal"
+          style={{ position: "fixed", inset: 0, zIndex: 66, display: "flex", alignItems: "center", justifyContent: "center", background: "rgba(0,0,0,.5)" }}
+          onMouseDown={(e) => { if (!busy && e.target === e.currentTarget) setOpenX(false); }}>
+          <div onClick={(e) => e.stopPropagation()}
+            style={{ width: 440, maxWidth: "92vw", background: "var(--card, #1b1d22)", border: "1px solid var(--border, #2c2f36)", borderRadius: 14, padding: 22, boxShadow: "0 20px 60px rgba(0,0,0,.5)" }}>
+            <div style={{ fontSize: 16, fontWeight: 700, marginBottom: 4 }}>{tr("dood.title", "容器内使用 Docker")}</div>
+            <div style={{ fontSize: 12, opacity: .6, marginBottom: 16 }}>{tr("dood.subtitle", "把宿主 Docker + docker 客户端挂进容器,容器内 agent 就能直接跑 docker(秒生效,无需下载)")}</div>
+            <label data-id="dood-toggle-row" style={{ display: "flex", alignItems: "center", gap: 10, cursor: busy ? "default" : "pointer", marginBottom: 12 }}>
+              <input type="checkbox" data-id="dood-toggle" checked={on} disabled={busy}
+                onChange={(e) => setOn(e.target.checked)} />
+              <span style={{ fontSize: 14, fontWeight: 600 }}>{tr("dood.enable", "允许容器内使用 Docker")}</span>
+            </label>
+            {busy && line && <div data-id="dood-progress" style={{ fontSize: 11, opacity: .7, fontFamily: "var(--mono)", wordBreak: "break-all", margin: "0 0 8px", maxHeight: 60, overflow: "hidden" }}>{line}</div>}
+            {err && <div className="error" style={{ marginTop: 8, fontSize: 12 }}>{err}</div>}
+            <div className="modal-actions">
+              <button type="button" className="btn-ghost" disabled={busy} onClick={() => setOpenX(false)}>{tr("common.cancel", "取消")}</button>
+              <button type="button" className="btn-primary" data-id="dood-save" disabled={busy} onClick={save}>{busy ? tr("common.saving", "保存中…") : tr("common.save", "保存")}</button>
+            </div>
+          </div>
+        </div>,
+        document.body,
+      )}
+    </>
+  );
+}
 function TeamAvatar({ avatar, name, teamId, onChanged, size = 34 }) {
   const fileRef = useRef(null);
   const initial = ((name || "?").trim()[0] || "?").toUpperCase();