cicy-desktop 2.1.247 → 2.1.249

package/.github/workflows/linux-app-release.yml

@@ -64,6 +64,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           set -euo pipefail
           npm run build:linux -- --publish always
@@ -76,3 +77,31 @@ jobs:
             dist/*.deb
             dist/*.AppImage
             dist/latest-linux.yml
+
+      # AppImage + 版本指针传到 OSS —— app-updater 现已全走 OSS(不碰 GitHub),linux 也要在
+      # OSS 上有 versioned AppImage(CiCy-Desktop-<ver>.AppImage)和自己的指针 linux-latest-version.txt。
+      # 和 mac/win 同一 bucket/凭证。electron-builder 默认产物名含空格,重命名成代码约定的连字符名。
+      - name: Upload AppImage to OSS (versioned + latest pointer)
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        env:
+          OSS_AK: ${{ secrets.OSS_ACCESS_KEY_ID }}
+          OSS_SK: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+        run: |
+          set -e
+          if [ -z "${OSS_AK:-}" ] || [ -z "${OSS_SK:-}" ]; then echo "::warning::OSS creds missing — skip"; exit 0; fi
+          VER="${GITHUB_REF_NAME#v}"
+          curl -sL https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil64 -o ossutil && chmod +x ossutil
+          test -s ossutil && head -c4 ossutil | grep -q ELF || { echo "ossutil download bad"; exit 1; }
+          ./ossutil config -e oss-cn-shanghai.aliyuncs.com -i "$OSS_AK" -k "$OSS_SK"
+          BASE="oss://cicy-1372193042-cn/releases"
+          HOST="https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases"
+          APP=$(ls dist/*.AppImage 2>/dev/null | head -1)
+          [ -n "$APP" ] && [ -f "$APP" ] || { echo "::error::no AppImage built"; exit 1; }
+          DEST="CiCy-Desktop-$VER.AppImage"
+          ./ossutil cp "$APP" "$BASE/$DEST" -f --acl public-read
+          ./ossutil cp "$APP" "$BASE/CiCy-Desktop-latest.AppImage" -f --acl public-read || true
+          # 版本指针最后写(包传完再更新),避免版本号涨了但包还没就位。
+          printf '%s' "$VER" > linux-latest-version.txt
+          ./ossutil cp linux-latest-version.txt "$BASE/linux-latest-version.txt" -f --acl public-read
+          echo "OSS linux: $HOST/$DEST"

package/.github/workflows/mac-app-release.yml

@@ -107,6 +107,7 @@ jobs:
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           set -euo pipefail
           rm -rf dist

package/.github/workflows/windows-exe-release.yml

@@ -83,6 +83,7 @@ jobs:
         shell: powershell
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           if (Test-Path dist) { Remove-Item -Recurse -Force dist }
           if (Test-Path "build\logo.ico") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.247",
+  "version": "2.1.249",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -13,9 +13,9 @@
     "format:check": "prettier --check \"src/**/*.js\"",
     "build": "electron-builder --publish never",
     "build:homepage": "node scripts/build-homepage.cjs",
-    "prebuild:win": "node scripts/build-homepage.cjs",
-    "prebuild:mac": "node scripts/build-homepage.cjs",
-    "prebuild:linux": "node scripts/build-homepage.cjs",
+    "prebuild:win": "node scripts/build-homepage.cjs && node scripts/obfuscate.cjs",
+    "prebuild:mac": "node scripts/build-homepage.cjs && node scripts/obfuscate.cjs",
+    "prebuild:linux": "node scripts/build-homepage.cjs && node scripts/obfuscate.cjs",
     "prepublishOnly": "node scripts/build-homepage.cjs",
     "build:win": "electron-builder --win",
     "build:mac": "electron-builder --mac",
@@ -154,6 +154,7 @@
   "devDependencies": {
     "electron": "41.0.3",
     "electron-builder": "^26.7.0",
+    "javascript-obfuscator": "^5.4.7",
     "prettier": "^3.8.1"
   }
 }

package/scripts/obfuscate.cjs

@@ -0,0 +1,81 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// Release-time obfuscation of the MAIN-PROCESS source (src/**/*.js), run as part
+// of the prebuild hooks. Electron ships JS as plaintext inside app.asar (anyone can
+// `asar extract` and read it), so on release we obfuscate our authored source.
+//
+// Gated by CICY_OBFUSCATE=1 — set ONLY in the release workflows. Local/dev builds
+// (Loop B on Mac, plain `npm run build:*`) leave the working tree untouched, so this
+// never dirties source you're editing. CI runs on a disposable checkout.
+//
+// The renderer (src/backends/homepage-react) is EXCLUDED here: it's already
+// Vite-minified (identifiers mangled, comments stripped) and additionally obfuscated
+// by vite-plugin-javascript-obfuscator during its own build. Re-obfuscating the
+// bundled React output post-hoc is high-risk / low-reward, so we don't.
+
+const fs = require("fs");
+const path = require("path");
+
+if (process.env.CICY_OBFUSCATE !== "1") {
+  console.log("[obfuscate] CICY_OBFUSCATE != 1 — skipping (dev build, source untouched).");
+  process.exit(0);
+}
+
+const JavaScriptObfuscator = require("javascript-obfuscator");
+const ROOT = path.join(__dirname, "..");
+const SRC = path.join(ROOT, "src");
+const EXCLUDE_DIRS = [
+  path.join(SRC, "backends", "homepage-react"), // Vite-built SPA snapshot (obfuscated by the Vite plugin)
+];
+
+// 保守配置:重命名标识符 + 字符串数组(base64)+ compact。**故意关掉** controlFlowFlattening /
+// deadCodeInjection / selfDefending / debugProtection —— 这几项最容易把代码搞坏、且严重拖慢启动。
+// 目标是"读不懂",不是"跑不动"。renameGlobals=false:绝不动 require/module/exports/process 等全局名。
+const OPTIONS = {
+  compact: true,
+  simplify: true,
+  target: "node",
+  identifierNamesGenerator: "hexadecimal",
+  renameGlobals: false,
+  stringArray: true,
+  stringArrayThreshold: 0.75,
+  stringArrayEncoding: ["base64"],
+  splitStrings: false,
+  numbersToExpressions: false,
+  controlFlowFlattening: false,
+  deadCodeInjection: false,
+  selfDefending: false,
+  debugProtection: false,
+  disableConsoleOutput: false,
+  unicodeEscapeSequence: false,
+};
+
+function isExcluded(p) {
+  return EXCLUDE_DIRS.some((d) => p === d || p.startsWith(d + path.sep));
+}
+function* walkJs(dir) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, e.name);
+    if (isExcluded(full)) continue;
+    if (e.isDirectory()) yield* walkJs(full);
+    else if (e.isFile() && full.endsWith(".js")) yield full;
+  }
+}
+
+let count = 0;
+let outBytes = 0;
+for (const file of walkJs(SRC)) {
+  const code = fs.readFileSync(file, "utf8");
+  try {
+    const out = JavaScriptObfuscator.obfuscate(code, OPTIONS).getObfuscatedCode();
+    fs.writeFileSync(file, out);
+    count++;
+    outBytes += out.length;
+  } catch (e) {
+    // Fail the build rather than ship a half-obfuscated app.
+    console.error(`[obfuscate] FAILED ${path.relative(ROOT, file)}: ${e.message}`);
+    process.exit(1);
+  }
+}
+console.log(`[obfuscate] obfuscated ${count} main-process file(s), ${Math.round(outBytes / 1024)}KB total (renderer handled by the Vite plugin).`);

package/src/app-updater.js

@@ -19,18 +19,7 @@ const path = require("path");
 const fs = require("fs");
 const https = require("https");
 const log = require("electron-log");
-const { OSS_RELEASES_BASE, MIRRORS, mirrorUrl } = require("./sidecar/mirrors");
-
-const REPO = "cicy-ai/cicy-desktop";
-const GH_DL = (ver) => `https://github.com/${REPO}/releases/download/v${ver}`;
-
-// ── 网络判定(缓存)──────────────────────────────────────────────────────────
-let _network = null;
-async function detectNetwork() {
-  if (_network) return _network;
-  try { _network = await require("./sidecar/net-detect")(); } catch { _network = "unknown"; }
-  return _network;
-}
+const { OSS_RELEASES_BASE } = require("./sidecar/mirrors");
 
 // ── 版本比较:>0 a 新于 b ─────────────────────────────────────────────────────
 function cmpVer(a, b) {
@@ -61,12 +50,6 @@ function getText(url, redirects = 0) {
   });
 }
 
-// CN 走 ghproxy 兜底(OSS 没有 mac/linux 包)。
-function mirrored(githubUrl) {
-  const m = MIRRORS[0];
-  return m ? mirrorUrl(githubUrl, m) : githubUrl;
-}
-
 // HEAD 探测 URL 是否可下(200/206 = ok)。跟随重定向(GitHub release 会 302 到 CDN)。
 // 用于「先出包再更新版本」的客户端保险:版本号涨了但包还没传 → HEAD 404 → 先不报更新。
 function headOk(url, redirects = 0) {
@@ -89,40 +72,25 @@ function headOk(url, redirects = 0) {
 }
 
 // ── 最新版本号 ────────────────────────────────────────────────────────────────
-async function fetchLatestVersion(network) {
-  // **Windows 包只在 OSS(GitHub 不发 win),版本清单也一律读 OSS —— 与网络判定无关。**
-  // 否则 net=unknown(启动探测超时会被缓存成 unknown 整个会话)或 global 时去读 GitHub,CN
-  // 用户读不到 → 更新提示整段会话都不出现(用户报的「更新 banner 没出现」)。win→win-latest。
-  if (process.platform === "win32") {
-    return (await getText(`${OSS_RELEASES_BASE}/win-latest-version.txt`)).trim().replace(/^v/, "");
-  }
-  // mac/linux:net-detect 契约是「cn 和 unknown 都优先镜像」—— 只有确认可达 GitHub(global)
-  // 才走 GitHub;cn/unknown 一律读 OSS。按平台读各自指针(win/mac 两条独立 CI、版本可能不
-  // 同步,读错平台会 404);linux 无独立 OSS 指针、沿用裸名(与 win 同 tag、走 GitHub 下载)。
-  if (network !== "global") {
-    const file = process.platform === "darwin" ? "mac-latest-version.txt" : "latest-version.txt";
-    return (await getText(`${OSS_RELEASES_BASE}/${file}`)).trim().replace(/^v/, "");
-  }
-  // 确认可达 GitHub:releases/latest 的 tag_name。
-  const j = JSON.parse(await getText(`https://api.github.com/repos/${REPO}/releases/latest`));
-  return String(j.tag_name || "").trim().replace(/^v/, "");
+async function fetchLatestVersion() {
+  // 版本清单**一律读 OSS**(win/mac/linux 各自指针),与网络判定无关 —— 彻底不碰 GitHub,
+  // 这样 cicy-desktop 仓库私有也不影响更新检查。win/mac 是两条独立 CI、版本可能不同步,读错
+  // 平台会 404,所以各读各的指针文件。
+  const file = process.platform === "win32" ? "win-latest-version.txt"
+    : process.platform === "darwin" ? "mac-latest-version.txt"
+    : "linux-latest-version.txt";
+  return (await getText(`${OSS_RELEASES_BASE}/${file}`)).trim().replace(/^v/, "");
 }
 
 // ── 安装包 URL(分平台 + 分网络)+ 本地文件名 ────────────────────────────────
-function assetFor(version, network) {
+function assetFor(version) {
   const plat = process.platform;
   const arch = process.arch === "arm64" ? "arm64" : "x64";
-  if (plat === "win32") {
-    // win 包只在 OSS(GitHub 不发);CN/非 CN 都用 OSS。
-    return { url: `${OSS_RELEASES_BASE}/cicy-desktop-${version}.exe`, file: `cicy-desktop-${version}.exe` };
-  }
-  if (plat === "darwin") {
-    const gh = `${GH_DL(version)}/cicy-desktop-${version}-${arch}.pkg`;
-    return { url: network === "global" ? gh : mirrored(gh), file: `cicy-desktop-${version}-${arch}.pkg` };
-  }
-  // linux
-  const gh = `${GH_DL(version)}/CiCy-Desktop-${version}.AppImage`;
-  return { url: network === "global" ? gh : mirrored(gh), file: `CiCy-Desktop-${version}.AppImage` };
+  // 三端安装包**全部从 OSS 拉**,与网络无关 —— 不再拼 GitHub 下载 URL,仓库私有也能更新。
+  const file = plat === "win32" ? `cicy-desktop-${version}.exe`
+    : plat === "darwin" ? `cicy-desktop-${version}-${arch}.pkg`
+    : `CiCy-Desktop-${version}.AppImage`;
+  return { url: `${OSS_RELEASES_BASE}/${file}`, file };
 }
 
 // ── 下载(带进度,跟随重定向)──────────────────────────────────────────────────
@@ -187,13 +155,12 @@ function init(mainWin) {
 async function check() {
   try {
     broadcast({ status: "checking", error: null });
-    const net = await detectNetwork();
-    const latest = await fetchLatestVersion(net);
+    const latest = await fetchLatestVersion();
     const current = app.getVersion();
     if (latest && cmpVer(latest, current) > 0) {
       // 「先出包再更新版本」客户端保险:版本号涨了不代表包传完了。先 HEAD 确认本平台安装包
       // 真能下(200),否则当成「还没就绪」继续显已是最新,避免用户点下载 404。
-      const { url } = assetFor(latest, net);
+      const { url } = assetFor(latest);
       const ready = await headOk(url);
       if (ready) broadcast({ status: "available", version: latest, current, progress: null, filePath: null });
       else { log.info(`[app-updater] ${latest} 版本号已更新但安装包未就位(HEAD 非 200):${url} — 暂不提示更新`); broadcast({ status: "up-to-date", version: current, current }); }
@@ -215,8 +182,7 @@ async function downloadUpdate() {
   if (!version) { broadcast({ status: "error", error: "no version" }); return _state; }
   _downloading = true;
   try {
-    const net = await detectNetwork();
-    const { url, file } = assetFor(version, net);
+    const { url, file } = assetFor(version);
     // 下到 ~/Downloads(用户能直接找到安装包);目录不存在则建。
     const dir = app.getPath("downloads");
     try { fs.mkdirSync(dir, { recursive: true }); } catch {}