cicy-desktop 2.1.314 → 2.1.316

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.314",
+  "version": "2.1.316",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/sidecar-ipc.js

@@ -277,6 +277,14 @@ function register({ sidecarLogPath } = {}) {
             return;
           }
           if (_relayMisses < 2) { log.warn(`[docker-daemon] :${APP_PORT} unreachable from Windows but healthy inside (${_relayMisses}/2)`); return; }
+          // 已重置过一次仍不通:bootstrap 对此无能为力(而且以前它会跑「修复=更新」把 cicy-code
+          // 重启掉)。只把原因和修复提示写进卡片,每 10 分钟记一次日志,不再反复 bootstrap。
+          if (_relayResetDone) {
+            const hint = (appDocker.RELAY_UNREACHABLE_HINT && appDocker.RELAY_UNREACHABLE_HINT(APP_PORT)) || `container healthy inside but 127.0.0.1:${APP_PORT} unreachable from Windows`;
+            if (!_lastBootstrapError || _lastBootstrapError.reason !== "relay_unreachable") { _lastBootstrapError = { reason: "relay_unreachable", message: hint, ts: Date.now() }; log.warn(`[docker-daemon] ${hint}`); }
+            await refreshDockerStatus();
+            return;
+          }
         } else { _relayMisses = 0; }
       } else if (s.running) { _relayMisses = 0; }
       if (!s.running && !s.unknown && _autoBootstrapPaused && Date.now() < _autoBootstrapRetryAt) {

package/src/sidecar/cicy-inapp-update.js

@@ -0,0 +1,82 @@
+// In-app cicy-code update over the container's OWN API — cicy-code's native
+// upgrade path (POST /api/cicy-update). The updater runs INSIDE the container
+// (setsid'd, survives the supervisor restart), so the desktop needs neither
+// `docker exec` nor a script push into /usr/local/bin — the two steps that kept
+// failing ("cannot execute: required file not found", EACCES, wrong container).
+//
+// The host still resolves the version (fast, host network) and PINS it via
+// `target`, so the container never runs its own slow `npm view`.
+const http = require("node:http");
+
+function httpJson(method, port, urlPath, { token = "", body = null, timeoutMs = 15000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = body == null ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: "127.0.0.1", port, path: urlPath, method, timeout: timeoutMs,
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        ...(payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : {}),
+      },
+    }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        const text = Buffer.concat(chunks).toString("utf8");
+        let json = null;
+        try { json = text ? JSON.parse(text) : null; } catch {}
+        resolve({ status: res.statusCode || 0, json, text });
+      });
+    });
+    req.on("error", reject);
+    req.on("timeout", () => { req.destroy(new Error("timeout")); });
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+// GET /api/health → running version (or null while the server is restarting).
+async function healthVersion(port) {
+  try {
+    const r = await httpJson("GET", port, "/api/health", { timeoutMs: 3000 });
+    return r.status === 200 && r.json && r.json.version ? String(r.json.version) : null;
+  } catch { return null; }
+}
+
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Returns { started, ok, reason, version }.
+//  started=false → caller should fall back to its legacy path (API unreachable,
+//                   rejected token, updater missing in this image, …).
+//  started=true  → the container is updating; ok tells whether the new version
+//                   came back healthy within waitMs.
+async function inAppUpdate({ port = 8008, token, target, registry = "", emit = () => {}, waitMs = 300000, pollMs = 3000, sleep = defaultSleep, now = Date.now } = {}) {
+  if (!token) return { started: false, reason: "no_token" };
+  let res;
+  try {
+    res = await httpJson("POST", port, "/api/cicy-update", { token, body: { target: target || "", registry }, timeoutMs: 20000 });
+  } catch (e) {
+    return { started: false, reason: `api_unreachable: ${e.message}` };
+  }
+  if (res.status === 401 || res.status === 403) return { started: false, reason: `unauthorized (${res.status})` };
+  if (res.status !== 200 || !res.json) return { started: false, reason: `http ${res.status}` };
+  if (res.json.started !== true) {
+    const err = String(res.json.error || "");
+    if (/already up to date/i.test(err)) return { started: true, ok: true, alreadyLatest: true, version: String(res.json.current || target || "") };
+    return { started: false, reason: err || "not started" };
+  }
+  const want = String(res.json.target || target || "");
+  emit({ phase: "image", status: "running", message: `cicy-code → v${want} (in-app)` });
+  const deadline = now() + waitMs;
+  let sawDown = false;
+  while (now() < deadline) {
+    const v = await healthVersion(port);
+    if (v === null) sawDown = true;
+    else if (v === want) return { started: true, ok: true, version: v };
+    // Same old version still answering: the updater is installing (npm) — keep
+    // waiting; once it repoints + restarts, health drops and comes back new.
+    await sleep(pollMs);
+  }
+  return { started: true, ok: false, reason: sawDown ? "restarted but not healthy in time" : "updater did not switch version in time", version: want };
+}
+
+module.exports = { inAppUpdate, healthVersion, httpJson };

package/src/sidecar/wsl-docker.js

@@ -23,6 +23,7 @@ const log = require("electron-log"); // persisted main.log — bootstrap timing/
 const { gatewayKeyPresentInEnv } = require("./gateway-key-health");
 const { t } = require("../i18n"); // 打开/读 token 的可见日志走 i18n
 const { shouldSkipCicyUpdate } = require("./cicy-runtime-health");
+const { inAppUpdate } = require("./cicy-inapp-update");
 const protect = require("./docker-protect"); // 容器保护:自动流程禁止 rm/shutdown
 
 // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro.
@@ -655,6 +656,13 @@ async function ensureFreshImage({ emit } = {}) {
 // 容器内部视角的健康:docker exec 进容器用 node 探 127.0.0.1:8008。用来区分「容器真挂了」和
 // 「容器好好的、只是 WSL 的 localhost 转发坏了」(后者 Windows 侧 :8008 打不通,实测
 // `wsl --shutdown` 后 75 秒恢复)。
+// 容器内健康、Windows 却连不上 :port 时给用户/日志的统一说明(bootstrap 与守护循环共用)。
+function RELAY_UNREACHABLE_HINT(port = 8008) {
+  return `容器内 cicy-code 正常,但 Windows 连不上 127.0.0.1:${port}(WSL localhost 转发或 Windows TCP 端口异常;` +
+    `若桌面端日志里出现 connect EADDRINUSE,多半是 Windows 动态端口被占满/被 Hyper-V 保留段吞掉)。` +
+    `已自动重置过一次 WSL 仍不通时,请在管理员 PowerShell 执行:` +
+    ` netsh int ipv4 show excludedportrange protocol=tcp; netsh int ipv4 set dynamicport tcp start=49152 num=16384; 然后重启 Windows。`;
+}
 async function insideHealthy(container = "cicy-code-docker-8008", port = 8008) {
   try {
     await wslRun(`docker exec ${container} node -e "fetch('http://127.0.0.1:${port}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"`, { timeout: 20000 });
@@ -1373,7 +1381,17 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
   if (!healthy && !protect.guard(log, "auto-update after health miss")) {
     healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 }); // 保护开启:只等,不自动改容器
   }
+  // Windows 侧探不到 ≠ 容器坏了。先从容器内部探一次:内部健康 = WSL localhost 转发 / Windows 端口
+  // 出了问题(实测 connect EADDRINUSE 连外网也报),这时绝不能再跑 update()「修复」——它会
+  // SIGTERM 重启 cicy-code,把正在跑的 agent 全部打断,而且对转发问题毫无帮助。
+  let relayBroken = false;
   if (!healthy) {
+    try { relayBroken = await insideHealthy(container, port); } catch {}
+  }
+  if (!healthy && relayBroken) {
+    log.warn(`[bootstrap] container healthy inside but 127.0.0.1:${port} unreachable from Windows → not touching the container`);
+    emit({ phase: "container", status: "running", message: RELAY_UNREACHABLE_HINT(port) });
+  } else if (!healthy) {
     emit({ phase: "container", status: "running", message: "服务尚未响应,正在检查并修复运行时完整性…" });
     try {
       const repaired = await update({ onProgress: emit, container, port });
@@ -1382,11 +1400,13 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
       log.warn(`[bootstrap] runtime auto-repair failed: ${e.message}`);
     }
   }
-  if (!healthy) healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 105000, everyMs: 3000 });
+  if (!healthy) healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: relayBroken ? 30000 : 105000, everyMs: 3000 });
   if (healthy) { done(); await ensureAutostart(); await ensureDesktopShortcut(volume, port); } // survive reboot + desktop shortcut
-  else fail("health_timeout");
+  else fail(relayBroken ? "relay_unreachable" : "health_timeout", relayBroken ? RELAY_UNREACHABLE_HINT(port) : "");
   let healthMessage = "Docker cicy-code 已就绪 🎉";
-  if (!healthy) {
+  if (!healthy && relayBroken) {
+    healthMessage = RELAY_UNREACHABLE_HINT(port);
+  } else if (!healthy) {
     let tail = "";
     try {
       const r = await wslRun(`docker logs --tail 60 ${container}`, { timeout: 15000 });
@@ -1472,7 +1492,10 @@ async function cicyRuntimePlatformReady(container) {
   const check = `target=$(readlink -f "$HOME/.local/bin/cicy-code" 2>/dev/null || true); ` +
     `dest=$(dirname "$(dirname "$target")" 2>/dev/null); ` +
     `case "$(uname -m)" in x86_64) p=cicy-code-linux-x64;; aarch64|arm64) p=cicy-code-linux-arm64;; *) exit 1;; esac; ` +
-    `[ -x "$target" ] && { [ -f "$dest/lib/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/cicy-code/node_modules/$p/package.json" ]; }`;
+    // readlink -f 会一路解析到 <prefix>/lib/node_modules/cicy-code/bin/cicy-code.js,此时 $dest 就是
+    // 包目录本身,平台包在 $dest/node_modules/<p>(实际布局)。之前只查 $dest/lib/... 两种 → 永远 false
+    // → 每轮 bootstrap 都把「更新 cicy-code」当修复跑一遍 → 更新脚本 SIGTERM 重启 cicy-code,打断所有 agent。
+    `[ -x "$target" ] && { [ -f "$dest/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/cicy-code/node_modules/$p/package.json" ]; }`;
   try { await wslRun(`docker exec ${container} bash -lc '${check}'`, { timeout: 15000 }); return true; }
   catch { return false; }
 }
@@ -1513,6 +1536,28 @@ async function update({ onProgress, container = "cicy-code-docker", port = 8008
   }
   // 宿主机没解析出版本 → 给个可见提示(诊断:让用户/我们知道是 host 网络问题,而非容器)。
   if (!latest) emit({ phase: "image", status: "running", message: t("docker.updating.hostResolveFail") });
+  // 3) 首选:cicy-code 自己的升级方式 —— 容器内 API `POST /api/cicy-update`,把宿主机解析好
+  //    的版本 pin 进去。更新脚本在容器里自己跑(setsid,扛得住 supervisor 重启),desktop
+  //    不再 docker exec、不再往 /usr/local/bin 推脚本(这两步就是"required file not found"
+  //    / EACCES / 打错容器 的来源)。API 打不通或被拒才回落到下面的老路径。
+  const apiRegistry = net === "global" ? "https://registry.npmjs.org" : net === "cn" ? "https://registry.npmmirror.com" : "";
+  try {
+    const token = await readContainerToken(port, container, `cicy-team-${port}`, { onLog: (ev) => emit({ phase: "image", status: ev.status === "error" ? "running" : ev.status, message: ev.message }) });
+    const r = await inAppUpdate({ port, token, target: latest || "", registry: apiRegistry, emit });
+    log.info(`[wsl-docker] update via API: ${JSON.stringify(r)}`);
+    if (r.started) {
+      if (r.alreadyLatest) {
+        emit({ phase: "done", status: "done", message: t("docker.updating.alreadyLatest", { v: r.version || current }) });
+        return { ok: true, alreadyLatest: true, version: r.version || current };
+      }
+      const doneMsg = r.ok ? t("docker.updating.doneVersion", { v: r.version }) : t("docker.updating.notReady");
+      emit({ phase: "done", status: r.ok ? "done" : "error", message: doneMsg });
+      return { ok: r.ok, version: r.version || latest || null, inApp: true };
+    }
+    emit({ phase: "image", status: "running", message: `in-app update unavailable (${r.reason}) → docker exec` });
+  } catch (e) {
+    emit({ phase: "image", status: "running", message: `in-app update failed (${e.message}) → docker exec` });
+  }
   // 3) 真要装:cp desktop 自带的脚本进容器(随 desktop 发版下发,不依赖镜像),把**已解析
   //    的具体版本**作参数传进去 → 脚本跳过自己的 npm view,容器里不再有版本查询的卡顿。
   emit({ phase: "image", status: "running", message: latest ? t("docker.updating.toVersion", { v: latest }) : t("docker.updating.pulling") });
@@ -1662,7 +1707,7 @@ async function readMihomoSelections(container = "cicy-code-docker-8008") {
 }
 
 module.exports = {
-  insideHealthy, wslShutdown,
+  insideHealthy, wslShutdown, RELAY_UNREACHABLE_HINT,
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
   distroInstalled, dockerInstalled, dockerEngineUp, imagePresent, probeHealth, wslRun, hasGatewayKey,
   readMihomoConfig, readMihomoSelections, parseMihomoSelections,

package/test/cicy-inapp-update.test.js

@@ -0,0 +1,66 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const http = require("node:http");
+const { inAppUpdate } = require("../src/sidecar/cicy-inapp-update");
+
+function serve(handler) {
+  return new Promise((resolve) => {
+    const srv = http.createServer(handler);
+    srv.listen(0, "127.0.0.1", () => resolve({ srv, port: srv.address().port }));
+  });
+}
+
+test("inAppUpdate pins the host-resolved target, then waits for the new version to come back", async () => {
+  const seen = [];
+  let version = "2.3.571";
+  const { srv, port } = await serve((req, res) => {
+    let body = "";
+    req.on("data", (c) => { body += c; });
+    req.on("end", () => {
+      if (req.method === "POST" && req.url === "/api/cicy-update") {
+        seen.push({ auth: req.headers.authorization, body: JSON.parse(body) });
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ started: true, current: version, target: "2.3.573" }));
+        setTimeout(() => { version = "2.3.573"; }, 30);
+        return;
+      }
+      if (req.url === "/api/health") { res.setHeader("content-type", "application/json"); res.end(JSON.stringify({ status: "ok", version })); return; }
+      res.statusCode = 404; res.end();
+    });
+  });
+  try {
+    const r = await inAppUpdate({ port, token: "cicy_tok", target: "2.3.573", registry: "https://registry.npmmirror.com", pollMs: 10, waitMs: 5000 });
+    assert.equal(r.started, true);
+    assert.equal(r.ok, true);
+    assert.equal(r.version, "2.3.573");
+    assert.equal(seen[0].auth, "Bearer cicy_tok");
+    assert.deepEqual(seen[0].body, { target: "2.3.573", registry: "https://registry.npmmirror.com" });
+  } finally { srv.close(); }
+});
+
+test("inAppUpdate reports not-started so the caller can fall back", async () => {
+  const { srv, port } = await serve((req, res) => {
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify({ started: false, error: "updater not found: /usr/local/bin/cicy-code-update.sh" }));
+  });
+  try {
+    const r = await inAppUpdate({ port, token: "t", target: "2.3.573" });
+    assert.equal(r.started, false);
+    assert.match(r.reason, /updater not found/);
+  } finally { srv.close(); }
+  const unreachable = await inAppUpdate({ port: 1, token: "t", target: "2.3.573" });
+  assert.equal(unreachable.started, false);
+  assert.match(unreachable.reason, /api_unreachable/);
+  assert.equal((await inAppUpdate({ port, token: "", target: "x" })).reason, "no_token");
+});
+
+test("inAppUpdate treats 'already up to date' as success", async () => {
+  const { srv, port } = await serve((req, res) => {
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify({ started: false, current: "2.3.573", latest: "2.3.573", error: "already up to date" }));
+  });
+  try {
+    const r = await inAppUpdate({ port, token: "t", target: "2.3.573" });
+    assert.equal(r.started, true); assert.equal(r.ok, true); assert.equal(r.alreadyLatest, true);
+  } finally { srv.close(); }
+});

package/test/cicy-runtime-health.test.js

@@ -10,3 +10,26 @@ test("does not skip an update when the recorded version matches but the platform
 test("skips an update only when the recorded version matches and the runtime is complete", () => {
   assert.equal(shouldSkipCicyUpdate({ latest: "2.3.563", current: "2.3.563", platformReady: true }), true);
 });
+
+const fs = require("node:fs");
+const path = require("node:path");
+const readSrc = (p) => fs.readFileSync(path.join(__dirname, "..", p), "utf8");
+
+test("platform-ready check covers the real npm layout (<pkg>/node_modules/cicy-code-linux-x64)", () => {
+  const src = readSrc("src/sidecar/wsl-docker.js");
+  assert.match(src, /\[ -f "\$dest\/node_modules\/\$p\/package\.json" \]/);
+});
+
+test("bootstrap never runs the updater when the container is healthy inside (relay problem)", () => {
+  const src = readSrc("src/sidecar/wsl-docker.js");
+  const i = src.indexOf('begin("wait-health")');
+  const block = src.slice(i, i + 3500);
+  assert.match(block, /relayBroken = await insideHealthy\(container, port\)/);
+  assert.match(block, /else if \(!healthy\) \{[\s\S]*?await update\(/);
+  assert.match(block, /fail\(relayBroken \? "relay_unreachable" : "health_timeout"/);
+});
+
+test("daemon loop stops re-bootstrapping after the one-shot relay reset", () => {
+  const src = readSrc("src/backends/sidecar-ipc.js");
+  assert.match(src, /if \(_relayResetDone\) \{[\s\S]*?reason: "relay_unreachable"[\s\S]*?return;/);
+});