npm - cicy-desktop - Versions diffs - 2.1.30 → 2.1.32 - Mend

cicy-desktop 2.1.30 → 2.1.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/bin/cicy-desktop +84 -6
package/package.json +1 -1
package/src/backends/homepage-preload.js +2 -10
package/src/backends/homepage-react/assets/index-CzuQdFw8.js +49 -0
package/src/backends/homepage-react/index.html +1 -1
package/src/backends/ipc.js +2 -3
package/src/backends/sidecar-ipc.js +18 -158
package/src/backends/webview-preload.js +2 -9
package/src/server/tool-registry.js +12 -1
package/src/sidecar/cicy-code.js +44 -68
package/src/sidecar/docker.js +113 -0
package/workers/render/src/App.jsx +2 -8
package/src/backends/homepage-react/assets/index-B8FrtpTX.js +0 -49
package/src/sidecar/installer.js +0 -672
package/src/sidecar/wsl.js +0 -585

package/src/backends/homepage-react/index.html CHANGED Viewed

@@ -4,7 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>CiCy Desktop</title>
-  <script type="module" crossorigin src="./assets/index-B8FrtpTX.js"></script>
+  <script type="module" crossorigin src="./assets/index-CzuQdFw8.js"></script>
   <link rel="stylesheet" crossorigin href="./assets/index-CNVsvsZX.css">
 </head>
 <body>

package/src/backends/ipc.js CHANGED Viewed

@@ -129,9 +129,8 @@ function register(opts = {}) {
         });
       });
-      if (process.platform === "win32") {
-        try { await require("../sidecar/wsl").stop(); } catch {}
-      }
+      // Windows: the daemon runs in Docker; sidecar.stop() removes the
+      // container. (Was wsl.stop() — WSL path retired.)
       await killByPort();
       try { await sidecar.stop({ timeoutMs: 500 }); } catch {}

package/src/backends/sidecar-ipc.js CHANGED Viewed

@@ -1,71 +1,39 @@
-// IPC handlers for the cicy-code sidecar installer.
-// Decoupled from backends/ipc.js so the install flow has its own clear surface.
+// IPC handlers for the cicy-code sidecar.
 //
-// Channels:
-//   sidecar:status         → { userInstalled, userVersion, binaryPath, installing, lastProgress }
-//   sidecar:check-latest   → { ok, latest, installedVersion, network, sizeBytes, releaseUrl, error? }
-//   sidecar:install        → final progress event { phase, version?, ... }; emits sidecar:progress along the way
-//   sidecar:cancel         → boolean
+// cicy-code is no longer downloaded by an in-app installer — the sidecar runs
+// it via `npx cicy-code` (mac/linux) or Docker (Windows); see
+// src/sidecar/cicy-code.js. So this surface is just lifecycle + status:
+//   sidecar:status → { running }   — is something answering on :8008?
+//   sidecar:start  → { ok, ... }   — start (or reuse) the daemon
 //
-// All renderers receive the same `sidecar:progress` broadcast so the UI can
-// rejoin an in-flight install after a refresh.
+// (Removed: sidecar:check-latest / install / cancel / wsl-status / wsl-install,
+// along with src/sidecar/installer.js and src/sidecar/wsl.js.)
-const { ipcMain, BrowserWindow } = require("electron");
-const log = require("electron-log");
-const installer = require("../sidecar/installer");
+const { ipcMain } = require("electron");
 const sidecar = require("../sidecar/cicy-code");
+const PORT = Number(process.env.CICY_CODE_PORT || 8008);
 let registered = false;
-let lastProgress = null;
-function broadcast(event) {
-  lastProgress = event;
-  for (const win of BrowserWindow.getAllWindows()) {
-    try { win.webContents.send("sidecar:progress", event); } catch {}
-  }
-}
 function register({ sidecarLogPath } = {}) {
   if (registered) return;
   registered = true;
   ipcMain.handle("sidecar:status", async () => {
-    const s = installer.getStatus();
-    const running = await installer.isRunning();
-    // On Windows the version cache might be stale; probe WSL for truth.
-    if (process.platform === "win32") {
-      try {
-        const wsl = require("../sidecar/wsl");
-        const [wslStatus, wslInstalled, wslVer] = await Promise.all([
-          wsl.checkStatus(),
-          wsl.userInstalled(),
-          wsl.userVersion(),
-        ]);
-        return {
-          ...s,
-          userInstalled: wslInstalled,
-          userVersion: wslVer || s.userVersion,
-          wsl: wslStatus,
-          running,
-          lastProgress,
-        };
-      } catch {}
-    }
-    return { ...s, running, lastProgress };
+    const running = await sidecar.probeExisting(PORT);
+    return { running };
   });
-  // Start the bundled cicy-code daemon without re-installing anything.
-  // Used when the binary exists locally but the process isn't running yet
-  // (e.g. user closed cicy-desktop, came back, daemon never auto-restarted).
+  // Start (or reuse) the cicy-code daemon. probeExisting inside start() reuses
+  // a healthy :8008; otherwise it spawns `npx cicy-code` / the Docker container.
   ipcMain.handle("sidecar:start", async () => {
     try {
-      // Already up? Skip the spawn.
-      if (await installer.isRunning()) return { ok: true, alreadyRunning: true };
+      if (await sidecar.probeExisting(PORT)) return { ok: true, alreadyRunning: true };
       const child = await sidecar.start({ logPath: sidecarLogPath, force: false });
-      // Wait briefly for the daemon to bind :8008 so the homepage's poll
-      // sees the "running" flip on the very next tick.
+      // Wait briefly for it to bind :8008 so the homepage's poll flips to
+      // "running" on the next tick.
       for (let i = 0; i < 20; i++) {
-        if (await installer.isRunning()) return { ok: true, pid: child?.pid || null };
+        if (await sidecar.probeExisting(PORT)) return { ok: true, pid: child?.pid || null };
         await new Promise((r) => setTimeout(r, 250));
       }
       return { ok: true, pid: child?.pid || null, warning: "spawned but did not bind :8008 within 5s" };
@@ -73,114 +41,6 @@ function register({ sidecarLogPath } = {}) {
       return { ok: false, error: e.message };
     }
   });
-  // Windows-only: expose WSL detection so the homepage can surface the right
-  // setup card (install WSL → install distro → install cicy-code). On other
-  // platforms the call is a no-op returning { supported: false }.
-  ipcMain.handle("sidecar:wsl-status", async () => {
-    if (process.platform !== "win32") return { supported: false };
-    try {
-      const wsl = require("../sidecar/wsl");
-      const status = await wsl.checkStatus();
-      return { supported: true, ...status };
-    } catch (e) {
-      return { supported: true, installed: false, error: e.message };
-    }
-  });
-  // Windows-only: trigger `wsl --install`. CN-aware: when network is CN
-  // we prefer --web-download (skips Microsoft Store, GitHub-mirror friendly).
-  // Requires Administrator — UAC may pop. Streams progress via sidecar:progress.
-  ipcMain.handle("sidecar:wsl-install", async () => {
-    if (process.platform !== "win32") return { ok: false, error: "not windows" };
-    try {
-      const wsl = require("../sidecar/wsl");
-      const network = await require("../sidecar/net-detect").detect();
-      const r = await wsl.installWsl({ network, onProgress: broadcast });
-      return r;
-    } catch (e) {
-      return { ok: false, error: e.message };
-    }
-  });
-  ipcMain.handle("sidecar:check-latest", async () => installer.checkLatest());
-  ipcMain.handle("sidecar:install", async () => {
-    try {
-      const { execFile } = require("child_process");
-      const port = 8008;
-      // ── Download and replace binary ───────────────────────────────────────
-      // Do NOT unconditionally stop the daemon before downloading.
-      // If it's owned by another OS user we can't kill it, and the binary
-      // replacement still works on Unix (unlink old inode, rename new file).
-      const final = await installer.install({ onProgress: broadcast });
-      // ── Restart the daemon so the new binary takes effect ────────────────
-      // Platform-specific because the kill primitive differs:
-      //   Windows: cicy-code lives inside WSL → wsl.stop() does pkill in distro
-      //   macOS/Linux: lsof + SIGKILL on the listening process (skip if EPERM)
-      let restartedPid = null;
-      if (process.platform === "win32") {
-        try {
-          const wsl = require("../sidecar/wsl");
-          await wsl.stop();
-          await new Promise(r => setTimeout(r, 500));
-          const ch = await sidecar.start({ logPath: sidecarLogPath, force: true });
-          if (ch?.pid) restartedPid = ch.pid;
-        } catch (e) { log.warn(`[sidecar-ipc] win32 restart failed: ${e.message}`); }
-        const reply = { ok: true, ...final, restartedPid };
-        broadcast({ ...final, restartedPid });
-        return reply;
-      }
-      // Find the PID *listening* on :8008 (not clients connecting to it).
-      // Without -sTCP:LISTEN, lsof also returns processes that have open
-      // connections TO port 8008 — including cicy-desktop's own health
-      // probe connections — which would cause us to kill ourselves.
-      const portPid = await new Promise(resolve => {
-        execFile("lsof", ["-ti", `tcp:${port}`, "-sTCP:LISTEN"], (_, out) => {
-          const pid = parseInt((out || "").trim().split("\n")[0], 10);
-          resolve(isNaN(pid) ? null : pid);
-        });
-      });
-      if (portPid) {
-        const canKill = await new Promise(resolve => {
-          try { process.kill(portPid, 9); resolve(true); }
-          catch { resolve(false); } // EPERM: externally managed
-        });
-        if (canKill) {
-          await new Promise(r => setTimeout(r, 800));
-          try {
-            const ch = await sidecar.start({ logPath: sidecarLogPath, force: true });
-            if (ch?.pid) restartedPid = ch.pid;
-          } catch (e) { log.warn(`[sidecar-ipc] restart failed: ${e.message}`); }
-        } else {
-          log.info(`[sidecar-ipc] :${port} is externally managed (pid ${portPid}) — binary updated, restart externally to activate`);
-        }
-      } else {
-        // Nothing on :8008 — just start fresh
-        try {
-          const ch = await sidecar.start({ logPath: sidecarLogPath, force: true });
-          if (ch?.pid) restartedPid = ch.pid;
-        } catch (e) { log.warn(`[sidecar-ipc] start failed: ${e.message}`); }
-      }
-      const reply = { ok: true, ...final, restartedPid };
-      broadcast({ ...final, restartedPid });
-      return reply;
-    } catch (e) {
-      return { ok: false, error: e.message };
-    }
-  });
-  ipcMain.handle("sidecar:cancel", () => {
-    installer.cancel();
-    return true;
-  });
 }
 module.exports = { register };

package/src/backends/webview-preload.js CHANGED Viewed

@@ -46,15 +46,8 @@ contextBridge.exposeInMainWorld("cicy", {
     update:  (id, patch)    => relay("localTeams:update", { id, patch }),
     upgrade: (id)           => relay("localTeams:upgrade", { id }),
   },
-  // cicy-code daemon ("sidecar") install/update — distinct from
-  // localTeams.upgrade which is per-team. install() downloads the latest
-  // binary to ~/.local/bin/cicy-code-<ver> + atomic-relinks the
-  // ~/.local/bin/cicy-code symlink. checkLatest() reports {ok, latest,
-  // installedVersion, network} without writing anything.
-  sidecar: {
-    install:     ()         => relay("sidecar:install"),
-    checkLatest: ()         => relay("sidecar:checkLatest"),
-  },
+  // (sidecar install/checkLatest removed — cicy-code is installed via
+  // `npx cicy-code` by the sidecar, no in-app downloader.)
 });
 console.log("[webview-preload] electronRPC + cicy.localTeams ready");

package/src/server/tool-registry.js CHANGED Viewed

@@ -62,7 +62,18 @@ function registerTool(mcpServer, tools, title, description, schema, handler, opt
     tag,
   });
-  mcpServer.tool(title, description, inputSchema, async (args) => {
+  // MCP SDK ≥1.29 rejects a plain JSON-Schema object as the params arg
+  // ("expected a Zod schema or ToolAnnotations, but received an unrecognized
+  // object"). It wants the raw Zod shape (an object of Zod types) and does its
+  // own JSON-Schema conversion. The hand-rolled `inputSchema` above is still
+  // used for our own `tools` catalog (express tool listing). Pass the real
+  // Zod shape here; falls back to {} (a valid empty raw shape) when absent.
+  const rawShape =
+    schema && schema._def && typeof schema._def.shape === "function"
+      ? schema._def.shape()
+      : (schema && schema.shape) || {};
+  mcpServer.tool(title, description, rawShape, async (args) => {
     try {
       const { executeTool } = require("./tool-executor");
       return await executeTool(title, args, {

package/src/sidecar/cicy-code.js CHANGED Viewed

@@ -1,17 +1,17 @@
 // Discover / probe / spawn the cicy-code daemon for the Electron app.
 //
-// Principle (2026-05-29): cicy-desktop does NOT bundle cicy-code. The
-// daemon is acquired three ways, in priority order:
-//   1. An already-running instance on :8008 (helper-installed, user-run,
-//      or surviving from a previous launch). probeExisting wins → reuse.
-//   2. <userData>/cicy-code/<platform>-<arch>/cicy-code — written by
-//      src/sidecar/installer.js when the user clicks the in-app installer
-//      OR by the cloud Team Helper agent when it finishes onboarding.
-//   3. (no-op) if neither, return null — the homepage's Team Helper card
-//      will guide the user through install. No "bundled" fallback exists.
+// Principle (2026-06): the daemon is run via `npx cicy-code` — a single
+// source of truth. cicy-desktop neither bundles nor downloads a binary; the
+// per-version binary is fetched from npm by the launcher (CN: npmmirror).
+//   1. An already-running instance on :8008 (user-run, npx, surviving from a
+//      previous launch). probeExisting wins → reuse, never double-spawn.
+//   2. Otherwise spawn `npx cicy-code` on mac/linux.
 //
-// Windows is not bundled either — the daemon is WSL2-hosted via
-// src/sidecar/wsl.js. start() delegates there on win32.
+// This replaced the old in-app installer (downloaded binary at
+// ~/.local/bin/cicy-code), which raced the npx-launched daemon for :8008.
+//
+// Windows runs cicy-code in Docker (src/sidecar/docker.js); start() delegates
+// there on win32. (The old WSL path was retired.)
 const fs = require("fs");
 const http = require("http");
@@ -20,32 +20,6 @@ const { spawn } = require("child_process");
 const DEFAULT_PORT = Number(process.env.CICY_CODE_PORT || 8008);
-function platformDir() {
-  if (process.platform === "darwin") return "darwin";
-  if (process.platform === "linux") return "linux";
-  return null;
-}
-function archDir() {
-  if (process.arch === "arm64") return "arm64";
-  if (process.arch === "x64") return "x64";
-  return null;
-}
-function bundledBinaryPath() {
-  const plat = platformDir();
-  const arch = archDir();
-  if (!plat || !arch) return null;
-  // Only the user-installed copy is considered. There is intentionally
-  // no <App>/Contents/Resources/cicy-code fallback — cicy-desktop no
-  // longer bundles the daemon (2026-05-29 principle).
-  try {
-    const installer = require("./installer");
-    const userBin = installer.userBinary();
-    if (userBin && fs.existsSync(userBin)) return userBin;
-  } catch {}
-  return null;
-}
 function probeExisting(port = DEFAULT_PORT, timeoutMs = 500) {
   return new Promise(resolve => {
     const req = http.get(
@@ -71,36 +45,25 @@ async function start({ logPath, port = DEFAULT_PORT, force = false } = {}) {
   }
   if (process.platform === "win32") {
-    // Windows uses WSL2 to host the linux-amd64 binary. The wsl module owns
-    // every wsl-touching command; here we just delegate.
+    // Windows runs cicy-code in Docker Desktop (the container's entrypoint
+    // npx-installs cicy-code). The docker module owns image-load-from-R2 +
+    // container run; here we just delegate. (Replaced the old WSL path.)
     try {
-      const wsl = require("./wsl");
-      const status = await wsl.checkStatus();
-      if (!status.installed || !status.hasDistro) {
-        console.warn(`[cicy-code-sidecar] WSL not ready (${JSON.stringify(status)}) — homepage will guide install`);
+      const docker = require("./docker");
+      const r = await docker.start({ port });
+      if (!r) {
+        console.warn("[cicy-code-sidecar] Docker not ready — homepage will guide install");
         return null;
       }
-      if (!(await wsl.userInstalled())) {
-        console.warn("[cicy-code-sidecar] cicy-code not installed in WSL yet — homepage will trigger install");
-        return null;
-      }
-      const r = await wsl.start({ port, force });
-      // Treat WSL-internal pid as the child token so the outer code knows we're up.
-      child = { wsl: true, pid: r.pid };
-      console.log(`[cicy-code-sidecar] started inside WSL pid=${r.pid}`);
+      child = r; // { docker:true, container, id }
+      console.log(`[cicy-code-sidecar] started in Docker container ${r.container} (${r.id})`);
       return child;
     } catch (e) {
-      console.warn(`[cicy-code-sidecar] WSL start failed: ${e.message}`);
+      console.warn(`[cicy-code-sidecar] Docker start failed: ${e.message}`);
       return null;
     }
   }
-  const bin = bundledBinaryPath();
-  if (!bin || !fs.existsSync(bin)) {
-    console.warn(`[cicy-code-sidecar] no daemon binary found (user has not run the in-app installer or the cloud Team Helper); homepage's Team Helper card will guide install`);
-    return null;
-  }
   let stdio = ["ignore", "ignore", "ignore"];
   if (logPath) {
     fs.mkdirSync(path.dirname(logPath), { recursive: true });
@@ -108,12 +71,25 @@ async function start({ logPath, port = DEFAULT_PORT, force = false } = {}) {
     stdio = ["ignore", fd, fd];
   }
-  // cicy-code reads `PORT` env var. Strip the parent's PORT (set by the
-  // worker process to its own listen port, e.g. 8101) so it doesn't leak
-  // into the sidecar and clash with the worker's HTTP server.
-  const env = { ...process.env, CICY_CODE_PORT: String(port), PORT: String(port) };
-  child = spawn(bin, [], { stdio, detached: false, env });
-  console.log(`[cicy-code-sidecar] spawned ${bin} pid=${child.pid} port=${port} log=${logPath || "(none)"}`);
+  // Run the daemon via `npx cicy-code` — no bundled/downloaded binary. The
+  // launcher fetches the per-version binary from npm (default npmmirror for
+  // CN; override with CICY_NPM_REGISTRY) and does its own :8008 port hygiene.
+  // cicy-code reads PORT; we also set CICY_CODE_PORT and override the parent's
+  // PORT (the worker sets it to its own listen port, e.g. 8101) so it doesn't
+  // leak in and clash with the worker's HTTP server.
+  const registry = process.env.CICY_NPM_REGISTRY || "https://registry.npmmirror.com";
+  const env = {
+    ...process.env,
+    CICY_CODE_PORT: String(port),
+    PORT: String(port),
+    npm_config_registry: registry,
+  };
+  const npxBin = process.platform === "win32" ? "npx.cmd" : "npx";
+  const spec = process.env.CICY_CODE_VERSION
+    ? `cicy-code@${process.env.CICY_CODE_VERSION}`
+    : "cicy-code";
+  child = spawn(npxBin, ["-y", spec], { stdio, detached: false, env });
+  console.log(`[cicy-code-sidecar] spawned npx ${spec} pid=${child.pid} port=${port} registry=${registry} log=${logPath || "(none)"}`);
   child.on("exit", (code, signal) => {
     console.log(`[cicy-code-sidecar] exited code=${code} signal=${signal}`);
@@ -126,9 +102,9 @@ async function stop({ timeoutMs = 5000 } = {}) {
   if (!child) return;
   const p = child;
   child = null;
-  // WSL-launched: not a real ChildProcess, kill via wsl pkill instead.
-  if (p && p.wsl) {
-    try { await require("./wsl").stop(); } catch {}
+  // Docker-launched (win32): not a real ChildProcess — remove the container.
+  if (p && p.docker) {
+    try { await require("./docker").stop(); } catch {}
     return;
   }
   try { p.kill("SIGTERM"); } catch {}
@@ -141,4 +117,4 @@ async function stop({ timeoutMs = 5000 } = {}) {
   }
 }
-module.exports = { start, stop, probeExisting, bundledBinaryPath };
+module.exports = { start, stop, probeExisting };

package/src/sidecar/docker.js ADDED Viewed

@@ -0,0 +1,113 @@
+// Windows sidecar backend: run cicy-code inside a Docker container.
+//
+// Platform split (2026-06): mac/linux start cicy-code locally via `npx
+// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.
+// The base-env image's entrypoint installs cicy-code from npm at container
+// startup, so the image is version-independent. If the image isn't present
+// locally it's loaded from R2 (CN-friendly, no Docker Hub pull):
+//   https://r2.deepfetch.de5.net/docker/cicy-code-latest.tar.gz
+//
+// The container maps :8008 and persists ~/cicy-ai in a named volume.
+const { execFile } = require("child_process");
+const https = require("https");
+const http = require("http");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const IMAGE     = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest";
+const R2_TARBALL = process.env.CICY_DOCKER_URL  || "https://r2.deepfetch.de5.net/docker/cicy-code-latest.tar.gz";
+const CONTAINER = process.env.CICY_DOCKER_CONTAINER || "cicy-code";
+const VOLUME    = process.env.CICY_DOCKER_VOLUME || "cicy-ai-data";
+// CICY_* env vars forwarded into the container (team onboarding, version pin…).
+const PASS_ENV = ["CICY_TEAM_TOKEN", "CICY_CODE_VERSION", "NPM_REGISTRY", "CICY_NPM_REGISTRY", "CICY_AGENTS", "ENABLE_CDN", "CICY_CLOUDFLARED_TOKEN"];
+function run(args, { timeout = 30000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile("docker", args, { timeout, windowsHide: true }, (err, stdout, stderr) => {
+      if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }
+      resolve({ stdout: String(stdout), stderr: String(stderr) });
+    });
+  });
+}
+async function dockerOk() {
+  try { await run(["version", "--format", "{{.Server.Version}}"], { timeout: 8000 }); return true; }
+  catch { return false; }
+}
+async function imagePresent() {
+  try { await run(["image", "inspect", IMAGE], { timeout: 8000 }); return true; }
+  catch { return false; }
+}
+function download(url, dest, hops = 5) {
+  return new Promise((resolve, reject) => {
+    if (hops <= 0) return reject(new Error("too many redirects"));
+    const lib = url.startsWith("https:") ? https : http;
+    const req = lib.get(url, { timeout: 60000 }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return download(res.headers.location, dest, hops - 1).then(resolve, reject);
+      }
+      if (res.statusCode !== 200) { res.resume(); return reject(new Error(`HTTP ${res.statusCode}`)); }
+      const out = fs.createWriteStream(dest);
+      res.pipe(out);
+      out.on("finish", () => out.close(() => resolve(dest)));
+      out.on("error", reject);
+    });
+    req.on("error", reject);
+    req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
+  });
+}
+async function loadImage() {
+  const tmp = path.join(os.tmpdir(), `cicy-code-image-${process.pid}.tar.gz`);
+  console.log(`[docker-sidecar] downloading image from ${R2_TARBALL}`);
+  await download(R2_TARBALL, tmp);
+  console.log(`[docker-sidecar] docker load…`);
+  await run(["load", "-i", tmp], { timeout: 300000 });
+  try { fs.unlinkSync(tmp); } catch {}
+}
+async function checkStatus() {
+  const installed = await dockerOk();
+  return { installed, imagePresent: installed ? await imagePresent() : false };
+}
+// Start the container. Returns a sidecar child token { docker:true, container,
+// id } or null when Docker isn't ready (homepage guides the user to install
+// Docker Desktop).
+async function start({ port = 8008 } = {}) {
+  if (!(await dockerOk())) {
+    console.warn("[docker-sidecar] Docker not available — homepage will guide install");
+    return null;
+  }
+  if (!(await imagePresent())) {
+    try { await loadImage(); }
+    catch (e) { console.warn(`[docker-sidecar] image load failed: ${e.message}`); return null; }
+  }
+  // Replace any stale container of the same name.
+  try { await run(["rm", "-f", CONTAINER]); } catch {}
+  const args = [
+    "run", "-d", "--name", CONTAINER, "--restart", "unless-stopped",
+    "-p", `${port}:8008`,
+    "-v", `${VOLUME}:/home/cicy/cicy-ai`,
+  ];
+  for (const k of PASS_ENV) {
+    if (process.env[k]) args.push("-e", `${k}=${process.env[k]}`);
+  }
+  args.push(IMAGE);
+  const { stdout } = await run(args, { timeout: 60000 });
+  const id = stdout.trim().slice(0, 12);
+  console.log(`[docker-sidecar] started container ${CONTAINER} (${id}) on :${port}`);
+  return { docker: true, container: CONTAINER, id };
+}
+async function stop() {
+  try { await run(["rm", "-f", CONTAINER]); } catch {}
+}
+module.exports = { start, stop, checkStatus, loadImage, imagePresent, dockerOk };

package/workers/render/src/App.jsx CHANGED Viewed

@@ -264,15 +264,9 @@ export default function App() {
           result = await window.cicy.localTeams.upgrade(msg.id);
         } else if (msg?.type === "localTeams:list") {
           result = { ok: true, teams: await window.cicy.localTeams.list({ refresh: true }) };
-        } else if (msg?.type === "sidecar:install") {
-          // Triggers the in-app installer: download latest cicy-code →
-          // ~/.local/bin/cicy-code-<ver> + atomic-relink symlink. Note: does
-          // NOT restart the running daemon. Pair with localTeams.upgrade for
-          // a full restart cycle.
-          result = await window.cicy.sidecar.install();
-        } else if (msg?.type === "sidecar:checkLatest") {
-          result = await window.cicy.sidecar.checkLatest();
         }
+        // (sidecar:install / sidecar:checkLatest removed — cicy-code is now
+        // installed via `npx cicy-code` by the sidecar, no in-app downloader.)
         // Force-refresh the team list so the new/removed/upgraded card
         // shows up before the next 30 s poll.
         fetchLocalTeams();