cicy-desktop 2.1.261 → 2.1.263

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.261",
+  "version": "2.1.263",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -139,10 +139,10 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.331",
-    "cicy-code-darwin-arm64": "2.3.331",
-    "cicy-code-linux-x64": "2.3.331",
-    "cicy-code-linux-arm64": "2.3.331",
+    "cicy-code-darwin-x64": "2.3.342",
+    "cicy-code-darwin-arm64": "2.3.342",
+    "cicy-code-linux-x64": "2.3.342",
+    "cicy-code-linux-arm64": "2.3.342",
     "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",

package/src/sidecar/docker.js

@@ -35,7 +35,7 @@ const DOCKER_DESKTOP_MIRROR = process.env.CICY_DOCKER_DESKTOP_MIRROR
 const PASS_ENV = [
   "CICY_TEAM_TOKEN", "CICY_CODE_VERSION", "NPM_REGISTRY", "CICY_NPM_REGISTRY",
   "CICY_AGENTS", "ENABLE_CDN", "CICY_CLOUDFLARED_TOKEN",
-  "CICY_CLOUD_EMAIL", "CICY_CLOUD_TEAM_ID",
+  "CICY_CLOUD_EMAIL", "CICY_CLOUD_TEAM_ID", "CICY_CFT",
 ];
 
 // Resolve the docker CLI. CRITICAL on Windows: right after Docker Desktop

package/src/sidecar/wsl-docker.js

@@ -675,7 +675,7 @@ async function runContainer({ port = 8008, container = "cicy-code-docker", volum
   // Without this, Desktop starts a healthy cicy-code that never registers the
   // requested Cloud account/team even though the variables exist on Windows.
   const inheritedCloudEnv = {};
-  for (const key of ["CICY_CLOUD_EMAIL", "CICY_CLOUD_TEAM_ID"]) {
+  for (const key of ["CICY_CLOUD_EMAIL", "CICY_CLOUD_TEAM_ID", "CICY_CFT"]) {
     if (process.env[key]) inheritedCloudEnv[key] = process.env[key];
   }
   const envArgs = Object.entries({ ...inheritedCloudEnv, ...(env || {}) })

package/src/tools/tab-browser-tools.js

@@ -36,6 +36,33 @@ const managerByHost = new Map(); // shell webContents.id -> TabManager
 
 function stripVol(u) { try { const x = new URL(u); return x.origin + x.pathname; } catch (e) { return u || ""; } }
 
+const INSTANCE_HOST_RE = /^(team-[a-z0-9][a-z0-9-]{0,30}-[0-9]+-[0-9a-f]{8})\.cicy-ai\.com$/;
+
+// Keep the fixed Instance authentication shuttle in the current team tab.
+// This is deliberately narrower than trusting *.cicy-ai.com: only the exact
+// Instance → Cloud connect route and Cloud → same Instance one-time grant route
+// are allowed to cross origins. Every other profile-0 cross-origin navigation
+// still gets moved to the hard-sandboxed browser profile below.
+function isInstanceAuthNavigation(currentUrl, targetUrl) {
+  let current; let target;
+  try { current = new URL(currentUrl); target = new URL(targetUrl); } catch (e) { return false; }
+  if (current.protocol !== "https:" || target.protocol !== "https:") return false;
+
+  const currentInstance = current.hostname.match(INSTANCE_HOST_RE);
+  if (currentInstance && target.hostname === "cicy-ai.com") {
+    return target.pathname === "/instance-connect"
+      && target.searchParams.get("slug") === currentInstance[1];
+  }
+
+  const targetInstance = target.hostname.match(INSTANCE_HOST_RE);
+  if (current.hostname === "cicy-ai.com" && targetInstance) {
+    const grant = target.searchParams.get("grant") || "";
+    return target.pathname === "/_proxy/login"
+      && /^[A-Za-z0-9_-]{40,64}$/.test(grant);
+  }
+  return false;
+}
+
 // 团队 tab 的 webContentsId 状态表:openTab 时记入、对应 webContents destroy 时删除
 // (打开/关闭都更新)。刷新窗口据此按 wcId 强制 reload(reloadIgnoringCache),避开
 // "tab 打开后 URL 漂移(登录跳转 / token / 重定向)→ 按 URL 匹配失败"的 bug。
@@ -383,7 +410,10 @@ class TabManager {
           let tgt; try { tgt = new URL(u); } catch { return; }
           if (tgt.protocol === "about:") return;
           let curOrigin = ""; try { curOrigin = new URL(wc.getURL()).origin; } catch {}
-          if (tgt.origin !== curOrigin) { e.preventDefault(); openTab(1, u); }
+          if (tgt.origin !== curOrigin && !(tab.team && isInstanceAuthNavigation(wc.getURL(), u))) {
+            e.preventDefault();
+            openTab(1, u);
+          }
         } catch (err) {}
       });
     }