cicy-desktop 2.1.262 → 2.1.264

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.262",
+  "version": "2.1.264",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -139,10 +139,10 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.332",
-    "cicy-code-darwin-arm64": "2.3.332",
-    "cicy-code-linux-x64": "2.3.331",
-    "cicy-code-linux-arm64": "2.3.332",
+    "cicy-code-darwin-x64": "2.3.343",
+    "cicy-code-darwin-arm64": "2.3.343",
+    "cicy-code-linux-x64": "2.3.343",
+    "cicy-code-linux-arm64": "2.3.343",
     "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",

package/src/tabbrowser/panel-cells.js

@@ -99,6 +99,20 @@ class PanelCells {
     });
     const wc = view.webContents;
     try { view.setBackgroundColor("#ffffff"); } catch (e) {}
+    // Chromium uses a dark canvas for transparent/un-styled documents when the
+    // app theme is dark (for example a plain `Not Found` response). Keep real
+    // site backgrounds intact, but give transparent pages a white fallback.
+    wc.on("dom-ready", () => {
+      wc.executeJavaScript(`(() => {
+        const transparent = (el) => {
+          const c = getComputedStyle(el).backgroundColor;
+          return c === 'transparent' || /rgba\\([^)]*,\\s*0(?:\\.0+)?\\)$/.test(c);
+        };
+        if (transparent(document.documentElement) && transparent(document.body)) {
+          document.documentElement.style.backgroundColor = '#fff';
+        }
+      })()`).catch(() => {});
+    });
     try { wc.cicyAccountIdx = profileIdx; } catch (e) {}
     scrubUA(wc);
     try { require("../utils/context-menu-options").attachContextMenu(wc); } catch (e) {}

package/src/tabbrowser/split-panel.html

@@ -707,6 +707,19 @@
     // ("this browser may not be secure")。
     wv.setAttribute('useragent', navigator.userAgent.replace(/\s(CiCyDesktop|Electron)\/\S+/g, ''));
     wv.setAttribute('src', url);
+    // file:// dev fallback uses a real <webview> instead of PanelCells. Match
+    // the native BrowserView behavior for transparent/un-styled pages.
+    wv.addEventListener('dom-ready', () => {
+      wv.executeJavaScript(`(() => {
+        const transparent = (el) => {
+          const c = getComputedStyle(el).backgroundColor;
+          return c === 'transparent' || /rgba\\([^)]*,\\s*0(?:\\.0+)?\\)$/.test(c);
+        };
+        if (transparent(document.documentElement) && transparent(document.body)) {
+          document.documentElement.style.backgroundColor = '#fff';
+        }
+      })()`).catch(() => {});
+    });
     wv.addEventListener('did-start-loading', () => c.el.classList.add('loading'));
     wv.addEventListener('did-stop-loading', () => c.el.classList.remove('loading'));
     wv.addEventListener('did-navigate', (e) => syncUrl(leafId, e.url));

package/src/tools/tab-browser-tools.js

@@ -36,6 +36,33 @@ const managerByHost = new Map(); // shell webContents.id -> TabManager
 
 function stripVol(u) { try { const x = new URL(u); return x.origin + x.pathname; } catch (e) { return u || ""; } }
 
+const INSTANCE_HOST_RE = /^(team-[a-z0-9][a-z0-9-]{0,30}-[0-9]+-[0-9a-f]{8})\.cicy-ai\.com$/;
+
+// Keep the fixed Instance authentication shuttle in the current team tab.
+// This is deliberately narrower than trusting *.cicy-ai.com: only the exact
+// Instance → Cloud connect route and Cloud → same Instance one-time grant route
+// are allowed to cross origins. Every other profile-0 cross-origin navigation
+// still gets moved to the hard-sandboxed browser profile below.
+function isInstanceAuthNavigation(currentUrl, targetUrl) {
+  let current; let target;
+  try { current = new URL(currentUrl); target = new URL(targetUrl); } catch (e) { return false; }
+  if (current.protocol !== "https:" || target.protocol !== "https:") return false;
+
+  const currentInstance = current.hostname.match(INSTANCE_HOST_RE);
+  if (currentInstance && target.hostname === "cicy-ai.com") {
+    return target.pathname === "/instance-connect"
+      && target.searchParams.get("slug") === currentInstance[1];
+  }
+
+  const targetInstance = target.hostname.match(INSTANCE_HOST_RE);
+  if (current.hostname === "cicy-ai.com" && targetInstance) {
+    const grant = target.searchParams.get("grant") || "";
+    return target.pathname === "/_proxy/login"
+      && /^[A-Za-z0-9_-]{40,64}$/.test(grant);
+  }
+  return false;
+}
+
 // 团队 tab 的 webContentsId 状态表:openTab 时记入、对应 webContents destroy 时删除
 // (打开/关闭都更新)。刷新窗口据此按 wcId 强制 reload(reloadIgnoringCache),避开
 // "tab 打开后 URL 漂移(登录跳转 / token / 重定向)→ 按 URL 匹配失败"的 bug。
@@ -383,7 +410,10 @@ class TabManager {
           let tgt; try { tgt = new URL(u); } catch { return; }
           if (tgt.protocol === "about:") return;
           let curOrigin = ""; try { curOrigin = new URL(wc.getURL()).origin; } catch {}
-          if (tgt.origin !== curOrigin) { e.preventDefault(); openTab(1, u); }
+          if (tgt.origin !== curOrigin && !(tab.team && isInstanceAuthNavigation(wc.getURL(), u))) {
+            e.preventDefault();
+            openTab(1, u);
+          }
         } catch (err) {}
       });
     }