cicy-desktop 2.1.315 → 2.1.317

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.315",
+  "version": "2.1.317",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/sidecar-ipc.js

@@ -170,6 +170,8 @@ function register({ sidecarLogPath } = {}) {
   // WSL 功能启用后必须重启 Windows 才能继续。不等人:自动安排 90 秒后重启(桌面上会有
   // 系统倒计时提示),UI 可「取消」或「立即重启」。每次开机只安排一次。
   let _rebootScheduled = false;
+  let _tcpRepairDone = false;        // Windows 端口修复每次进程只做一次(需要 UAC)
+  let _relayMissesAfterRepair = 0;   // 端口修复后仍连不上的轮数 → 3 轮自动重启
   let _relayMisses = 0, _relayResetDone = false; // WSL localhost 转发自愈(见 daemon 循环)
   let _unknownStreak = 0, _wslRepairDone = false; // WSL 卡死自愈(见 daemon 循环)
   let _softRetryAt = 0; // 非硬失败(如 docker_install_failed)也退避 2 分钟,别每 35 秒重跑一遍
@@ -181,13 +183,13 @@ function register({ sidecarLogPath } = {}) {
     if (delta) { c = Math.max(0, c + delta); try { fs.mkdirSync(path.dirname(REBOOT_COUNT_FILE), { recursive: true }); fs.writeFileSync(REBOOT_COUNT_FILE, JSON.stringify({ count: c, ts: Date.now() })); } catch {} }
     return c;
   }
-  function scheduleReboot(delaySec = 90) {
+  function scheduleReboot(delaySec = 90, why = "") {
     if (_rebootScheduled || process.platform !== "win32") return false;
     if (delaySec > 10 && rebootCount() >= 2) { log.warn("[docker] auto-reboot skipped: already rebooted 2× for WSL without success"); return false; }
     _rebootScheduled = true;
     rebootCount(+1);
     try {
-      require("child_process").execFile("shutdown", ["/r", "/t", String(delaySec), "/c", "CiCy Desktop: WSL2 功能已启用,需要重启 Windows 才能继续安装 Docker;登录后会自动继续。可在 CiCy Desktop 里取消。"], { windowsHide: true }, (err) => {
+      require("child_process").execFile("shutdown", ["/r", "/t", String(delaySec), "/c", why || "CiCy Desktop: WSL2 功能已启用,需要重启 Windows 才能继续安装 Docker;登录后会自动继续。可在 CiCy Desktop 里取消。"], { windowsHide: true }, (err) => {
         if (err) { _rebootScheduled = false; log.warn(`[docker] schedule reboot failed: ${err.message}`); }
         else log.info(`[docker] Windows reboot scheduled in ${delaySec}s (WSL features enabled)`);
       });
@@ -277,6 +279,37 @@ function register({ sidecarLogPath } = {}) {
             return;
           }
           if (_relayMisses < 2) { log.warn(`[docker-daemon] :${APP_PORT} unreachable from Windows but healthy inside (${_relayMisses}/2)`); return; }
+          // 已重置过一次 WSL 仍不通:bootstrap 对此无能为力(以前它会跑「修复=更新」把 cicy-code
+          // 重启掉)。自愈继续往下走:
+          //   1) 一次 UAC 修 Windows 端口(net stop winnat → 重设动态端口范围 → net start winnat),30s 复探;
+          //   2) 修完仍连续 3 轮不通 → 自动重启 Windows(沿用上限 2 次)。
+          if (_relayResetDone) {
+            const hint = (appDocker.RELAY_UNREACHABLE_HINT && appDocker.RELAY_UNREACHABLE_HINT(APP_PORT)) || `container healthy inside but 127.0.0.1:${APP_PORT} unreachable from Windows`;
+            if (!_tcpRepairDone && appDocker.elevatedTcpRepair) {
+              _tcpRepairDone = true;
+              _lastBootstrapError = { reason: "relay_unreachable", message: "容器正常但 Windows 连不上 :8008 → 正在修复 Windows TCP 端口(请在 UAC 弹窗点「是」)…", ts: Date.now() };
+              await refreshDockerStatus();
+              auditDestructiveIpc(log, "docker:self-heal-windows-tcp", null, { container: APP_CONTAINER });
+              let r = { ok: false, detail: "" };
+              try { r = await appDocker.elevatedTcpRepair({ emit: () => {} }); } catch (e) { r = { ok: false, detail: e.message }; }
+              log.warn(`[docker-daemon] windows tcp repair ok=${r.ok}: ${r.detail}`);
+              await new Promise((res) => setTimeout(res, 30000));
+              _relayMissesAfterRepair = 0;
+              await refreshDockerStatus();
+              return;
+            }
+            _relayMissesAfterRepair += 1;
+            if (_relayMissesAfterRepair >= 3 && !_rebootScheduled && rebootCount() < 2) {
+              _lastBootstrapError = { reason: "relay_unreachable", message: "容器正常但 Windows 连不上 :8008,端口修复无效 → 90 秒后自动重启 Windows 修复", ts: Date.now() };
+              log.warn("[docker-daemon] relay still unreachable after tcp repair → auto reboot");
+              scheduleReboot(90, "Windows 无法连接本机 :8008(端口异常),自动重启修复");
+              await refreshDockerStatus();
+              return;
+            }
+            if (!_lastBootstrapError || _lastBootstrapError.reason !== "relay_unreachable" || !/端口修复无效|正在修复/.test(_lastBootstrapError.message)) { _lastBootstrapError = { reason: "relay_unreachable", message: hint, ts: Date.now() }; log.warn(`[docker-daemon] ${hint}`); }
+            await refreshDockerStatus();
+            return;
+          }
         } else { _relayMisses = 0; }
       } else if (s.running) { _relayMisses = 0; }
       if (!s.running && !s.unknown && _autoBootstrapPaused && Date.now() < _autoBootstrapRetryAt) {

package/src/sidecar/docker.js

@@ -1013,7 +1013,50 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
   return { ok: healthy, container };
 }
 
+// Windows 侧「连 127.0.0.1 都 connect EADDRINUSE」= 动态 TCP 端口被占满 / 被 Hyper-V(winnat)
+// 的保留段吞掉。软件可修:重启 winnat 释放保留段 + 把动态端口范围重设为默认(49152-65535)。
+// 一次 UAC,结果写文件回读。返回 { ok, detail }。
+function elevatedTcpRepair({ emit } = {}) {
+  return new Promise(async (resolve) => {
+    if (process.platform !== "win32") return resolve({ ok: false, detail: "win-only" });
+    const dir = path.join(process.env.LOCALAPPDATA || os.tmpdir(), "cicy-desktop");
+    try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+    const ps1 = path.join(dir, "tcp-repair.ps1");
+    const resultFile = path.join(dir, "tcp-repair.result.txt");
+    try { fs.unlinkSync(resultFile); } catch {}
+    const script = [
+      '$ErrorActionPreference = "Continue"',
+      `$R = "${resultFile.replace(/"/g, '""')}"`,
+      'function Say($m) { Add-Content -Path $R -Value ("[" + (Get-Date -Format "HH:mm:ss") + "] " + $m) }',
+      '$S32 = Join-Path $env:SystemRoot "System32"; $NETSH = Join-Path $S32 "netsh.exe"; $NET = Join-Path $S32 "net.exe"',
+      'Say "start admin=$(([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(\'Administrators\'))"',
+      'try { $d = (& $NETSH int ipv4 show dynamicport tcp | Out-String) -replace "\s+"," "; Say ("before: " + $d.Trim()) } catch {}',
+      'try { $x = (& $NETSH int ipv4 show excludedportrange protocol=tcp | Out-String); $n = ([regex]::Matches($x, "^\s*\d+\s+\d+", "Multiline")).Count; Say ("excluded ranges: " + $n) } catch {}',
+      'try { $tw = (& (Join-Path $S32 "netstat.exe") -ano | Select-String "TIME_WAIT").Count; Say ("TIME_WAIT: " + $tw) } catch {}',
+      '& $NET stop winnat | Out-Null; Say ("net stop winnat exit=" + $LASTEXITCODE)',
+      '& $NETSH int ipv4 set dynamicport tcp start=49152 num=16384 | Out-Null; Say ("set dynamicport tcp exit=" + $LASTEXITCODE)',
+      '& $NETSH int ipv4 set dynamicport udp start=49152 num=16384 | Out-Null; Say ("set dynamicport udp exit=" + $LASTEXITCODE)',
+      '& $NET start winnat | Out-Null; Say ("net start winnat exit=" + $LASTEXITCODE)',
+      'try { $d = (& $NETSH int ipv4 show dynamicport tcp | Out-String) -replace "\s+"," "; Say ("after: " + $d.Trim()) } catch {}',
+      'Say "DONE"',
+    ].join("\r\n");
+    try { fs.writeFileSync(ps1, "\uFEFF" + script, "utf8"); } catch (e) { return resolve({ ok: false, detail: `写提权脚本失败: ${e.message}` }); }
+    const launched = await launchElevated("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-File", ps1], { emit });
+    if (!launched) return resolve({ ok: false, detail: "无法发起提权（UAC 被拒绝或不可用）" });
+    const t0 = Date.now(); let lines = [];
+    while (Date.now() - t0 < 3 * 60 * 1000) {
+      await new Promise((r) => setTimeout(r, 3000));
+      try { lines = fs.readFileSync(resultFile, "utf8").split(/\r?\n/).filter(Boolean); } catch {}
+      if (lines.some((l) => /DONE/.test(l))) break;
+      if (Date.now() - t0 > 90 * 1000 && lines.length === 0) break;
+    }
+    const detail = lines.map((l) => l.replace(/^\[[^\]]*\] /, "")).join(" | ");
+    resolve({ ok: /set dynamicport tcp exit=0/.test(detail) && /net start winnat exit=0/.test(detail), detail: detail || "提权后 90 秒内没有任何进展（UAC 可能没有被点击「是」）" });
+  });
+}
+
 module.exports = {
+  elevatedTcpRepair,
   start, stop, stopContainer, restart, checkStatus, loadImage, loadImageFromTarball,
   downloadImageTarball, imagePresent, dockerOk, installDocker,
   bootstrap, probeHealth, readContainerToken, dockerDesktopExe, desktopDir, downloadsDir, imageTarballPath,

package/src/sidecar/wsl-docker.js

@@ -656,6 +656,13 @@ async function ensureFreshImage({ emit } = {}) {
 // 容器内部视角的健康:docker exec 进容器用 node 探 127.0.0.1:8008。用来区分「容器真挂了」和
 // 「容器好好的、只是 WSL 的 localhost 转发坏了」(后者 Windows 侧 :8008 打不通,实测
 // `wsl --shutdown` 后 75 秒恢复)。
+// 容器内健康、Windows 却连不上 :port 时给用户/日志的统一说明(bootstrap 与守护循环共用)。
+function RELAY_UNREACHABLE_HINT(port = 8008) {
+  return `容器内 cicy-code 正常,但 Windows 连不上 127.0.0.1:${port}(WSL localhost 转发或 Windows TCP 端口异常;` +
+    `若桌面端日志里出现 connect EADDRINUSE,多半是 Windows 动态端口被占满/被 Hyper-V 保留段吞掉)。` +
+    `已自动重置过一次 WSL 仍不通时,请在管理员 PowerShell 执行:` +
+    ` netsh int ipv4 show excludedportrange protocol=tcp; netsh int ipv4 set dynamicport tcp start=49152 num=16384; 然后重启 Windows。`;
+}
 async function insideHealthy(container = "cicy-code-docker-8008", port = 8008) {
   try {
     await wslRun(`docker exec ${container} node -e "fetch('http://127.0.0.1:${port}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"`, { timeout: 20000 });
@@ -1374,7 +1381,17 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
   if (!healthy && !protect.guard(log, "auto-update after health miss")) {
     healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 120000, everyMs: 3000 }); // 保护开启:只等,不自动改容器
   }
+  // Windows 侧探不到 ≠ 容器坏了。先从容器内部探一次:内部健康 = WSL localhost 转发 / Windows 端口
+  // 出了问题(实测 connect EADDRINUSE 连外网也报),这时绝不能再跑 update()「修复」——它会
+  // SIGTERM 重启 cicy-code,把正在跑的 agent 全部打断,而且对转发问题毫无帮助。
+  let relayBroken = false;
   if (!healthy) {
+    try { relayBroken = await insideHealthy(container, port); } catch {}
+  }
+  if (!healthy && relayBroken) {
+    log.warn(`[bootstrap] container healthy inside but 127.0.0.1:${port} unreachable from Windows → not touching the container`);
+    emit({ phase: "container", status: "running", message: RELAY_UNREACHABLE_HINT(port) });
+  } else if (!healthy) {
     emit({ phase: "container", status: "running", message: "服务尚未响应,正在检查并修复运行时完整性…" });
     try {
       const repaired = await update({ onProgress: emit, container, port });
@@ -1383,11 +1400,13 @@ async function _bootstrap({ onProgress, port = 8008, container = "cicy-code-dock
       log.warn(`[bootstrap] runtime auto-repair failed: ${e.message}`);
     }
   }
-  if (!healthy) healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: 105000, everyMs: 3000 });
+  if (!healthy) healthy = await docker.waitUntil(() => probeHealth(port), { totalMs: relayBroken ? 30000 : 105000, everyMs: 3000 });
   if (healthy) { done(); await ensureAutostart(); await ensureDesktopShortcut(volume, port); } // survive reboot + desktop shortcut
-  else fail("health_timeout");
+  else fail(relayBroken ? "relay_unreachable" : "health_timeout", relayBroken ? RELAY_UNREACHABLE_HINT(port) : "");
   let healthMessage = "Docker cicy-code 已就绪 🎉";
-  if (!healthy) {
+  if (!healthy && relayBroken) {
+    healthMessage = RELAY_UNREACHABLE_HINT(port);
+  } else if (!healthy) {
     let tail = "";
     try {
       const r = await wslRun(`docker logs --tail 60 ${container}`, { timeout: 15000 });
@@ -1473,7 +1492,10 @@ async function cicyRuntimePlatformReady(container) {
   const check = `target=$(readlink -f "$HOME/.local/bin/cicy-code" 2>/dev/null || true); ` +
     `dest=$(dirname "$(dirname "$target")" 2>/dev/null); ` +
     `case "$(uname -m)" in x86_64) p=cicy-code-linux-x64;; aarch64|arm64) p=cicy-code-linux-arm64;; *) exit 1;; esac; ` +
-    `[ -x "$target" ] && { [ -f "$dest/lib/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/cicy-code/node_modules/$p/package.json" ]; }`;
+    // readlink -f 会一路解析到 <prefix>/lib/node_modules/cicy-code/bin/cicy-code.js,此时 $dest 就是
+    // 包目录本身,平台包在 $dest/node_modules/<p>(实际布局)。之前只查 $dest/lib/... 两种 → 永远 false
+    // → 每轮 bootstrap 都把「更新 cicy-code」当修复跑一遍 → 更新脚本 SIGTERM 重启 cicy-code,打断所有 agent。
+    `[ -x "$target" ] && { [ -f "$dest/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/$p/package.json" ] || [ -f "$dest/lib/node_modules/cicy-code/node_modules/$p/package.json" ]; }`;
   try { await wslRun(`docker exec ${container} bash -lc '${check}'`, { timeout: 15000 }); return true; }
   catch { return false; }
 }
@@ -1685,7 +1707,7 @@ async function readMihomoSelections(container = "cicy-code-docker-8008") {
 }
 
 module.exports = {
-  insideHealthy, wslShutdown,
+  insideHealthy, wslShutdown, RELAY_UNREACHABLE_HINT,
   bootstrap, status, restart, stop, dockerRestart, recreate, update, upgrade, runContainer, readContainerToken,
   distroInstalled, dockerInstalled, dockerEngineUp, imagePresent, probeHealth, wslRun, hasGatewayKey,
   readMihomoConfig, readMihomoSelections, parseMihomoSelections,

package/test/cicy-runtime-health.test.js

@@ -10,3 +10,38 @@ test("does not skip an update when the recorded version matches but the platform
 test("skips an update only when the recorded version matches and the runtime is complete", () => {
   assert.equal(shouldSkipCicyUpdate({ latest: "2.3.563", current: "2.3.563", platformReady: true }), true);
 });
+
+const fs = require("node:fs");
+const path = require("node:path");
+const readSrc = (p) => fs.readFileSync(path.join(__dirname, "..", p), "utf8");
+
+test("platform-ready check covers the real npm layout (<pkg>/node_modules/cicy-code-linux-x64)", () => {
+  const src = readSrc("src/sidecar/wsl-docker.js");
+  assert.match(src, /\[ -f "\$dest\/node_modules\/\$p\/package\.json" \]/);
+});
+
+test("bootstrap never runs the updater when the container is healthy inside (relay problem)", () => {
+  const src = readSrc("src/sidecar/wsl-docker.js");
+  const i = src.indexOf('begin("wait-health")');
+  const block = src.slice(i, i + 3500);
+  assert.match(block, /relayBroken = await insideHealthy\(container, port\)/);
+  assert.match(block, /else if \(!healthy\) \{[\s\S]*?await update\(/);
+  assert.match(block, /fail\(relayBroken \? "relay_unreachable" : "health_timeout"/);
+});
+
+test("daemon loop stops re-bootstrapping after the one-shot relay reset", () => {
+  const src = readSrc("src/backends/sidecar-ipc.js");
+  assert.match(src, /if \(_relayResetDone\) \{[\s\S]*?reason: "relay_unreachable"[\s\S]*?return;/);
+});
+
+test("relay still broken after wsl reset → one-shot elevated Windows TCP repair, then auto reboot", () => {
+  const d = readSrc("src/sidecar/docker.js");
+  assert.match(d, /function elevatedTcpRepair/);
+  assert.match(d, /net stop winnat/);
+  assert.match(d, /set dynamicport tcp start=49152 num=16384/);
+  const s = readSrc("src/backends/sidecar-ipc.js");
+  const i = s.indexOf("if (_relayResetDone) {");
+  const block = s.slice(i, i + 3000);
+  assert.match(block, /appDocker\.elevatedTcpRepair\(/);
+  assert.match(block, /_relayMissesAfterRepair >= 3[\s\S]*?scheduleReboot\(90/);
+});