cicy-desktop 2.1.316 → 2.1.317

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.316",
+  "version": "2.1.317",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/sidecar-ipc.js

@@ -170,6 +170,8 @@ function register({ sidecarLogPath } = {}) {
   // WSL 功能启用后必须重启 Windows 才能继续。不等人:自动安排 90 秒后重启(桌面上会有
   // 系统倒计时提示),UI 可「取消」或「立即重启」。每次开机只安排一次。
   let _rebootScheduled = false;
+  let _tcpRepairDone = false;        // Windows 端口修复每次进程只做一次(需要 UAC)
+  let _relayMissesAfterRepair = 0;   // 端口修复后仍连不上的轮数 → 3 轮自动重启
   let _relayMisses = 0, _relayResetDone = false; // WSL localhost 转发自愈(见 daemon 循环)
   let _unknownStreak = 0, _wslRepairDone = false; // WSL 卡死自愈(见 daemon 循环)
   let _softRetryAt = 0; // 非硬失败(如 docker_install_failed)也退避 2 分钟,别每 35 秒重跑一遍
@@ -181,13 +183,13 @@ function register({ sidecarLogPath } = {}) {
     if (delta) { c = Math.max(0, c + delta); try { fs.mkdirSync(path.dirname(REBOOT_COUNT_FILE), { recursive: true }); fs.writeFileSync(REBOOT_COUNT_FILE, JSON.stringify({ count: c, ts: Date.now() })); } catch {} }
     return c;
   }
-  function scheduleReboot(delaySec = 90) {
+  function scheduleReboot(delaySec = 90, why = "") {
     if (_rebootScheduled || process.platform !== "win32") return false;
     if (delaySec > 10 && rebootCount() >= 2) { log.warn("[docker] auto-reboot skipped: already rebooted 2× for WSL without success"); return false; }
     _rebootScheduled = true;
     rebootCount(+1);
     try {
-      require("child_process").execFile("shutdown", ["/r", "/t", String(delaySec), "/c", "CiCy Desktop: WSL2 功能已启用,需要重启 Windows 才能继续安装 Docker;登录后会自动继续。可在 CiCy Desktop 里取消。"], { windowsHide: true }, (err) => {
+      require("child_process").execFile("shutdown", ["/r", "/t", String(delaySec), "/c", why || "CiCy Desktop: WSL2 功能已启用,需要重启 Windows 才能继续安装 Docker;登录后会自动继续。可在 CiCy Desktop 里取消。"], { windowsHide: true }, (err) => {
         if (err) { _rebootScheduled = false; log.warn(`[docker] schedule reboot failed: ${err.message}`); }
         else log.info(`[docker] Windows reboot scheduled in ${delaySec}s (WSL features enabled)`);
       });
@@ -277,11 +279,34 @@ function register({ sidecarLogPath } = {}) {
             return;
           }
           if (_relayMisses < 2) { log.warn(`[docker-daemon] :${APP_PORT} unreachable from Windows but healthy inside (${_relayMisses}/2)`); return; }
-          // 已重置过一次仍不通:bootstrap 对此无能为力(而且以前它会跑「修复=更新」把 cicy-code
-          // 重启掉)。只把原因和修复提示写进卡片,每 10 分钟记一次日志,不再反复 bootstrap。
+          // 已重置过一次 WSL 仍不通:bootstrap 对此无能为力(以前它会跑「修复=更新」把 cicy-code
+          // 重启掉)。自愈继续往下走:
+          //   1) 一次 UAC 修 Windows 端口(net stop winnat → 重设动态端口范围 → net start winnat),30s 复探;
+          //   2) 修完仍连续 3 轮不通 → 自动重启 Windows(沿用上限 2 次)。
           if (_relayResetDone) {
             const hint = (appDocker.RELAY_UNREACHABLE_HINT && appDocker.RELAY_UNREACHABLE_HINT(APP_PORT)) || `container healthy inside but 127.0.0.1:${APP_PORT} unreachable from Windows`;
-            if (!_lastBootstrapError || _lastBootstrapError.reason !== "relay_unreachable") { _lastBootstrapError = { reason: "relay_unreachable", message: hint, ts: Date.now() }; log.warn(`[docker-daemon] ${hint}`); }
+            if (!_tcpRepairDone && appDocker.elevatedTcpRepair) {
+              _tcpRepairDone = true;
+              _lastBootstrapError = { reason: "relay_unreachable", message: "容器正常但 Windows 连不上 :8008 → 正在修复 Windows TCP 端口(请在 UAC 弹窗点「是」)…", ts: Date.now() };
+              await refreshDockerStatus();
+              auditDestructiveIpc(log, "docker:self-heal-windows-tcp", null, { container: APP_CONTAINER });
+              let r = { ok: false, detail: "" };
+              try { r = await appDocker.elevatedTcpRepair({ emit: () => {} }); } catch (e) { r = { ok: false, detail: e.message }; }
+              log.warn(`[docker-daemon] windows tcp repair ok=${r.ok}: ${r.detail}`);
+              await new Promise((res) => setTimeout(res, 30000));
+              _relayMissesAfterRepair = 0;
+              await refreshDockerStatus();
+              return;
+            }
+            _relayMissesAfterRepair += 1;
+            if (_relayMissesAfterRepair >= 3 && !_rebootScheduled && rebootCount() < 2) {
+              _lastBootstrapError = { reason: "relay_unreachable", message: "容器正常但 Windows 连不上 :8008,端口修复无效 → 90 秒后自动重启 Windows 修复", ts: Date.now() };
+              log.warn("[docker-daemon] relay still unreachable after tcp repair → auto reboot");
+              scheduleReboot(90, "Windows 无法连接本机 :8008(端口异常),自动重启修复");
+              await refreshDockerStatus();
+              return;
+            }
+            if (!_lastBootstrapError || _lastBootstrapError.reason !== "relay_unreachable" || !/端口修复无效|正在修复/.test(_lastBootstrapError.message)) { _lastBootstrapError = { reason: "relay_unreachable", message: hint, ts: Date.now() }; log.warn(`[docker-daemon] ${hint}`); }
             await refreshDockerStatus();
             return;
           }

package/src/sidecar/docker.js

@@ -1013,7 +1013,50 @@ async function bootstrap({ onProgress, port = 8008, container = CONTAINER, volum
   return { ok: healthy, container };
 }
 
+// Windows 侧「连 127.0.0.1 都 connect EADDRINUSE」= 动态 TCP 端口被占满 / 被 Hyper-V(winnat)
+// 的保留段吞掉。软件可修:重启 winnat 释放保留段 + 把动态端口范围重设为默认(49152-65535)。
+// 一次 UAC,结果写文件回读。返回 { ok, detail }。
+function elevatedTcpRepair({ emit } = {}) {
+  return new Promise(async (resolve) => {
+    if (process.platform !== "win32") return resolve({ ok: false, detail: "win-only" });
+    const dir = path.join(process.env.LOCALAPPDATA || os.tmpdir(), "cicy-desktop");
+    try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+    const ps1 = path.join(dir, "tcp-repair.ps1");
+    const resultFile = path.join(dir, "tcp-repair.result.txt");
+    try { fs.unlinkSync(resultFile); } catch {}
+    const script = [
+      '$ErrorActionPreference = "Continue"',
+      `$R = "${resultFile.replace(/"/g, '""')}"`,
+      'function Say($m) { Add-Content -Path $R -Value ("[" + (Get-Date -Format "HH:mm:ss") + "] " + $m) }',
+      '$S32 = Join-Path $env:SystemRoot "System32"; $NETSH = Join-Path $S32 "netsh.exe"; $NET = Join-Path $S32 "net.exe"',
+      'Say "start admin=$(([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(\'Administrators\'))"',
+      'try { $d = (& $NETSH int ipv4 show dynamicport tcp | Out-String) -replace "\s+"," "; Say ("before: " + $d.Trim()) } catch {}',
+      'try { $x = (& $NETSH int ipv4 show excludedportrange protocol=tcp | Out-String); $n = ([regex]::Matches($x, "^\s*\d+\s+\d+", "Multiline")).Count; Say ("excluded ranges: " + $n) } catch {}',
+      'try { $tw = (& (Join-Path $S32 "netstat.exe") -ano | Select-String "TIME_WAIT").Count; Say ("TIME_WAIT: " + $tw) } catch {}',
+      '& $NET stop winnat | Out-Null; Say ("net stop winnat exit=" + $LASTEXITCODE)',
+      '& $NETSH int ipv4 set dynamicport tcp start=49152 num=16384 | Out-Null; Say ("set dynamicport tcp exit=" + $LASTEXITCODE)',
+      '& $NETSH int ipv4 set dynamicport udp start=49152 num=16384 | Out-Null; Say ("set dynamicport udp exit=" + $LASTEXITCODE)',
+      '& $NET start winnat | Out-Null; Say ("net start winnat exit=" + $LASTEXITCODE)',
+      'try { $d = (& $NETSH int ipv4 show dynamicport tcp | Out-String) -replace "\s+"," "; Say ("after: " + $d.Trim()) } catch {}',
+      'Say "DONE"',
+    ].join("\r\n");
+    try { fs.writeFileSync(ps1, "\uFEFF" + script, "utf8"); } catch (e) { return resolve({ ok: false, detail: `写提权脚本失败: ${e.message}` }); }
+    const launched = await launchElevated("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-File", ps1], { emit });
+    if (!launched) return resolve({ ok: false, detail: "无法发起提权（UAC 被拒绝或不可用）" });
+    const t0 = Date.now(); let lines = [];
+    while (Date.now() - t0 < 3 * 60 * 1000) {
+      await new Promise((r) => setTimeout(r, 3000));
+      try { lines = fs.readFileSync(resultFile, "utf8").split(/\r?\n/).filter(Boolean); } catch {}
+      if (lines.some((l) => /DONE/.test(l))) break;
+      if (Date.now() - t0 > 90 * 1000 && lines.length === 0) break;
+    }
+    const detail = lines.map((l) => l.replace(/^\[[^\]]*\] /, "")).join(" | ");
+    resolve({ ok: /set dynamicport tcp exit=0/.test(detail) && /net start winnat exit=0/.test(detail), detail: detail || "提权后 90 秒内没有任何进展（UAC 可能没有被点击「是」）" });
+  });
+}
+
 module.exports = {
+  elevatedTcpRepair,
   start, stop, stopContainer, restart, checkStatus, loadImage, loadImageFromTarball,
   downloadImageTarball, imagePresent, dockerOk, installDocker,
   bootstrap, probeHealth, readContainerToken, dockerDesktopExe, desktopDir, downloadsDir, imageTarballPath,

package/test/cicy-runtime-health.test.js

@@ -33,3 +33,15 @@ test("daemon loop stops re-bootstrapping after the one-shot relay reset", () =>
   const src = readSrc("src/backends/sidecar-ipc.js");
   assert.match(src, /if \(_relayResetDone\) \{[\s\S]*?reason: "relay_unreachable"[\s\S]*?return;/);
 });
+
+test("relay still broken after wsl reset → one-shot elevated Windows TCP repair, then auto reboot", () => {
+  const d = readSrc("src/sidecar/docker.js");
+  assert.match(d, /function elevatedTcpRepair/);
+  assert.match(d, /net stop winnat/);
+  assert.match(d, /set dynamicport tcp start=49152 num=16384/);
+  const s = readSrc("src/backends/sidecar-ipc.js");
+  const i = s.indexOf("if (_relayResetDone) {");
+  const block = s.slice(i, i + 3000);
+  assert.match(block, /appDocker\.elevatedTcpRepair\(/);
+  assert.match(block, /_relayMissesAfterRepair >= 3[\s\S]*?scheduleReboot\(90/);
+});