cicy-desktop 2.1.32 → 2.1.34

package/README.md

@@ -45,7 +45,41 @@ cicy-rpc open_window url=https://example.com
 cicy-rpc --json get_window_info win_id=1
 ```
 
-## Quick start
+## Run (end users, no clone)
+
+First run launches the Electron app and drops a desktop shortcut (Windows
+`.lnk` / macOS `.app` / Linux `.desktop`, all with the CiCy icon); double-click
+it afterwards.
+
+**CN needs the electron mirror.** A fresh machine has no cached electron
+binary, so electron's postinstall would hit GitHub releases and fail. Point
+`ELECTRON_MIRROR` + the npm registry at npmmirror.
+
+### Windows — global install (NOT npx)
+
+npx's libnpmexec lock false-positives as `ECOMPROMISED` / "Lock compromised" on
+Windows boxes with realtime antivirus (Defender touches `node_modules` mtimes
+mid-install → the lock heartbeat aborts). `npm i -g` has no such lock, so
+Windows installs globally and launches the global bin:
+
+```cmd
+cmd /c "set ELECTRON_MIRROR=https://npmmirror.com/mirrors/electron/&& npm i -g cicy-desktop --registry=https://registry.npmmirror.com&& cicy-desktop"
+```
+
+Re-run the same line to update. The generated `.lnk` runs the global
+`cicy-desktop` bin (no npx).
+
+### macOS / Linux — npx
+
+npx's lock works fine here:
+
+```bash
+ELECTRON_MIRROR=https://npmmirror.com/mirrors/electron/ npm_config_registry=https://registry.npmmirror.com npx -y cicy-desktop
+```
+
+Outside CN (or once electron is cached) a plain `npx -y cicy-desktop` is enough.
+
+## Quick start (development)
 
 ### 1. Install
 

package/bin/cicy-desktop

@@ -13,6 +13,11 @@ const GLOBAL_CONFIG_FILE = path.join(HOME, "global.json");
 const STATE_FILE = path.join(HOME, ".cicy-cluster.json");
 const LOGS_DIR = path.join(HOME, "logs");
 const PACKAGE_ROOT = path.join(__dirname, "..");
+// CN defaults: a fresh machine has no cached electron binary, so npx's electron
+// postinstall would hit GitHub releases and fail (ECOMPROMISED). Mirror it +
+// the npm registry to npmmirror (overridable via the same-named env vars).
+const ELECTRON_MIRROR = process.env.ELECTRON_MIRROR || "https://npmmirror.com/mirrors/electron/";
+const NPM_REGISTRY = process.env.CICY_NPM_REGISTRY || process.env.npm_config_registry || "https://registry.npmmirror.com";
 const MASTER_ENTRY = path.join(PACKAGE_ROOT, "src", "master", "master-main.js");
 
 // Resolve the electron binary to spawn. Prefers the project-local copy
@@ -375,8 +380,13 @@ function ensureMacDesktopApp() {
   const nodeDir = nodeBinDir();
   // do shell script needs node on PATH (GUI launch has a minimal PATH); the
   // trailing & + nohup + </dev/null lets the shell return so the applet quits.
+  // ELECTRON_MIRROR + npmmirror: a fresh CN machine has no cached electron
+  // binary, so npx's electron postinstall would try GitHub releases and fail
+  // (ECOMPROMISED / lock-compromised). Point it at npmmirror's electron mirror.
+  // Harmless elsewhere — only consulted when electron actually (re)downloads.
   const ascript =
     `do shell script "export PATH=\\"${nodeDir}:/usr/local/bin:/opt/homebrew/bin:$PATH\\" ; ` +
+    `export ELECTRON_MIRROR=\\"${ELECTRON_MIRROR}\\" ; export npm_config_registry=\\"${NPM_REGISTRY}\\" ; ` +
     `nohup npx -y cicy-desktop > /tmp/cicy-desktop.log 2>&1 < /dev/null &"`;
   const tmp = path.join(os.tmpdir(), `cicy-launch-${process.pid}.applescript`);
   fs.writeFileSync(tmp, ascript);
@@ -402,7 +412,7 @@ function ensureLinuxDesktopEntry() {
 `[Desktop Entry]
 Type=Application
 Name=CiCy Desktop
-Exec=sh -c 'export PATH="${nodeBinDir()}:$PATH"; exec npx -y cicy-desktop'
+Exec=sh -c 'export PATH="${nodeBinDir()}:$PATH"; export ELECTRON_MIRROR="${ELECTRON_MIRROR}"; export npm_config_registry="${NPM_REGISTRY}"; exec npx -y cicy-desktop'
 Icon=${icon}
 Terminal=false
 Categories=Development;
@@ -414,6 +424,13 @@ Categories=Development;
 function ensureWindowsShortcut() {
   // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a
   // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation).
+  //
+  // The shortcut runs the GLOBALLY-installed `cicy-desktop` bin, NOT
+  // `npx cicy-desktop`. npx's libnpmexec lock false-positives as
+  // "ECOMPROMISED / Lock compromised" on Windows boxes with realtime
+  // antivirus (Defender touches node_modules mtimes mid-install → the lock
+  // heartbeat aborts). `npm i -g` has no such lock, so Windows installs +
+  // launches via the global bin (see README "Run via npx" / install one-liner).
   const ico = path.join(PACKAGE_ROOT, "build", "icon.ico");
   const lnk = path.join(DESKTOP_DIR, "CiCy Desktop.lnk");
   const nodeDir = nodeBinDir();
@@ -422,7 +439,7 @@ function ensureWindowsShortcut() {
 `$ws = New-Object -ComObject WScript.Shell
 $s = $ws.CreateShortcut('${lnk.replace(/'/g, "''")}')
 $s.TargetPath = 'cmd.exe'
-$s.Arguments = '/c set PATH=${nodeDir};%PATH% && npx -y cicy-desktop'
+$s.Arguments = '/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop'
 $s.IconLocation = '${ico.replace(/'/g, "''")}'
 $s.Save()
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.32",
+  "version": "2.1.34",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {