cicy-desktop 2.1.273 → 2.1.275

package/.github/workflows/linux-app-release.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Build Linux AppImage
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           set -euo pipefail

package/.github/workflows/mac-app-release.yml

@@ -110,7 +110,7 @@ jobs:
         shell: bash
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           set -euo pipefail
@@ -136,7 +136,7 @@ jobs:
       - name: Ensure draft GitHub release exists
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "${{ steps.meta.outputs.tag }}" \
             --repo "cicy-ai/cicy-desktop" \
@@ -148,7 +148,7 @@ jobs:
       - name: Build and publish PKG installers
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           VER="${{ steps.meta.outputs.version }}"

package/.github/workflows/windows-exe-release.yml

@@ -72,7 +72,7 @@ jobs:
         # uploaded. Promoted to non-draft + latest in the final step.
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "${{ steps.meta.outputs.tag }}" \
             --repo "cicy-ai/cicy-desktop" \
@@ -85,7 +85,7 @@ jobs:
         # --publish always uploads .exe + latest.yml to the release created above.
         shell: powershell
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           CICY_OBFUSCATE: "1"   # 发版混淆 JS(prebuild 主进程 + Vite 渲染层),仅 release CI
         run: |
           if (Test-Path dist) { Remove-Item -Recurse -Force dist }
@@ -176,7 +176,7 @@ jobs:
         # existing clients will pick up the new version on its next poll.
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.CICY_RELEASE_GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh release edit "${{ steps.meta.outputs.tag }}" \
             --repo "cicy-ai/cicy-desktop" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.273",
+  "version": "2.1.275",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/tools/desktop-snapshot-tools.js

@@ -52,11 +52,13 @@ module.exports = (registerTool) => {
           return { content: [{ type: "text", text: fresh.b64 }] };
         }
 
-        // Stale/missing. A desktop_snapshot RPC is an explicit one-shot request,
-        // so mac/linux capture immediately even when the periodic daemon is off.
-        // CICY_DESKTOP_SNAPSHOT only controls the background capture loop in
-        // main.js; it must not make the user's “立即截图” button unusable.
-        if (process.platform !== "win32") {
+        // Stale/missing. mac/linux can capture live in-process; win32 cannot (needs
+        // the --disable-gpu daemon), so there we fall back to whatever file exists.
+        // BUT honor snapshotEnabled(): on macOS capture is off by default, and a live
+        // `screencapture` here is exactly what pops the Screen-Recording prompt (just
+        // less often than the daemon did) — so when disabled we must NOT live-capture.
+        // mac/linux:进程内即时抓屏(honor snapshotEnabled — mac 默认关避免授权弹窗)。
+        if (process.platform !== "win32" && snap.snapshotEnabled()) {
           try {
             const r = await snap.captureB64(maxWidth);
             return { content: [{ type: "text", text: r.b64 }] };
@@ -79,6 +81,10 @@ module.exports = (registerTool) => {
         }
 
         if (fresh) return { content: [{ type: "text", text: fresh.b64 }] }; // stale is better than nothing
+        // macOS 默认关(避免反复弹屏幕录制授权)。
+        if (process.platform === "darwin" && !snap.snapshotEnabled()) {
+          throw new Error("桌面截图在 macOS 默认关闭(避免反复弹屏幕录制授权)。需要 agent 看屏幕时,启动 app 前设环境变量 CICY_DESKTOP_SNAPSHOT=1。");
+        }
         throw new Error("no desktop snapshot yet");
       } catch (error) {
         return { content: [{ type: "text", text: `Error: ${error.message}` }], isError: true };

package/src/utils/desktop-snapshot.js

@@ -37,15 +37,14 @@ function snapDir() {
 }
 
 // Is desktop screen capture allowed here? Single source of truth shared by the
-// periodic daemon (main.js). One-shot `desktop_snapshot` RPC requests bypass this
-// switch: clicking “立即截图” must work without enabling background capture.
+// periodic daemon (main.js) AND the on-demand `desktop_snapshot` tool's live fallback.
 // OFF by default on macOS AND Windows (opt in with CICY_DESKTOP_SNAPSHOT=1):
 //  - macOS: any capture trips the Screen-Recording prompt that won't persist for a
 //    non-Apple-Team-ID signature (re-prompts forever).
 //  - Windows: the periodic whole-desktop capture spawns an always-on --disable-gpu
 //    child + writes every 30s — pure overhead for users who only manage docker/teams
 //    and aren't being driven by a screen-watching cloud agent (资源占用). The on-demand
-//    `desktop_snapshot` still captures once when explicitly requested.
+//    `desktop_snapshot` tool still has its own live fallback when actually requested.
 // linux stays ON by default (no prompt, cheap scrot); opt out with =0.
 function snapshotEnabled() {
   return (process.platform === "darwin" || process.platform === "win32")

package/test/desktop-snapshot-tools.test.js

@@ -0,0 +1,58 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+test("desktop_snapshot does not capture live when desktop snapshots are disabled", async (t) => {
+  if (process.platform === "win32") {
+    t.skip("the Windows one-shot capture path is intentionally separate");
+    return;
+  }
+
+  const emptySnapshotDir = fs.mkdtempSync(path.join(os.tmpdir(), "cicy-snapshot-test-"));
+  t.after(() => fs.rmSync(emptySnapshotDir, { recursive: true, force: true }));
+
+  const snapshotPath = require.resolve("../src/utils/desktop-snapshot");
+  const toolsPath = require.resolve("../src/tools/desktop-snapshot-tools");
+  const originalSnapshotModule = require.cache[snapshotPath];
+  const originalToolsModule = require.cache[toolsPath];
+  let captureCalls = 0;
+
+  require.cache[snapshotPath] = {
+    id: snapshotPath,
+    filename: snapshotPath,
+    loaded: true,
+    exports: {
+      snapDir: () => emptySnapshotDir,
+      snapshotEnabled: () => false,
+      captureB64: async () => {
+        captureCalls += 1;
+        return { b64: "captured" };
+      },
+    },
+  };
+  delete require.cache[toolsPath];
+
+  t.after(() => {
+    if (originalSnapshotModule) require.cache[snapshotPath] = originalSnapshotModule;
+    else delete require.cache[snapshotPath];
+    if (originalToolsModule) require.cache[toolsPath] = originalToolsModule;
+    else delete require.cache[toolsPath];
+  });
+
+  let handler;
+  require(toolsPath)((name, _description, _schema, registeredHandler) => {
+    if (name === "desktop_snapshot") handler = registeredHandler;
+  });
+
+  assert.equal(typeof handler, "function");
+  const result = await handler({ maxWidth: 600 });
+
+  assert.equal(captureCalls, 0);
+  assert.equal(result.isError, true);
+  assert.match(result.content[0].text, /^Error:/);
+});