cicy-desktop 2.1.322 → 2.1.324

package/.github/workflows/build-wsl-package.yml

@@ -3,7 +3,7 @@ name: Build WSL Package
 # Bakes a single WSL2 rootfs that already contains Ubuntu 22.04 + Docker Engine
 # + the cicy-code image (pre-loaded into /var/lib/docker), so a Windows install
 # is just: wsl --import <this> → dockerd auto-starts → docker run. No apt, no
-# image pull/load on the customer machine. Uploaded to Aliyun OSS (CN-fast).
+# image pull/load on the customer machine. Uploaded to our Cloudflare R2 bucket.
 
 on:
   workflow_dispatch:
@@ -11,14 +11,21 @@ on:
       image:
         description: cicy-code image to embed
         default: cicybot/cicy-code:latest
-      oss_key:
-        description: OSS object key
+      r2_key:
+        description: R2 object key
         default: rootfs/cicy-wsl-latest.tar.gz
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+      # First — actions/checkout cleans the workspace, so it has to run before
+      # anything writes build artifacts into it. Needed for scripts/r2.mjs
+      # (this job used to fetch a standalone ossutil binary and never checked
+      # the repo out at all).
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Build base rootfs image (Ubuntu + Docker + autostart)
         run: |
           mkdir -p ctx
@@ -80,25 +87,27 @@ jobs:
           docker export "$cid" | gzip > cicy-wsl.tar.gz
           ls -lh cicy-wsl.tar.gz
 
-      - name: Upload to Aliyun OSS (public-read)
+      - name: Upload to Cloudflare R2
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
         run: |
-          curl -sL https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil64 -o ossutil && chmod +x ossutil
-          test -s ossutil && head -c4 ossutil | grep -q ELF || { echo "ossutil download bad"; exit 1; }
-          ./ossutil config -e oss-cn-shanghai.aliyuncs.com \
-            -i "${{ secrets.OSS_ACCESS_KEY_ID }}" -k "${{ secrets.OSS_ACCESS_KEY_SECRET }}"
-          ./ossutil cp cicy-wsl.tar.gz "oss://cicy-1372193042-cn/${{ inputs.oss_key }}" -f --acl public-read
-          echo "Uploaded: https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/${{ inputs.oss_key }}"
+          set -e
+          node scripts/r2.mjs put "${{ inputs.r2_key }}" cicy-wsl.tar.gz
 
       # macOS (colima) loads the cicy-code image tarball directly, NOT a WSL rootfs. So the
       # SAME run also republishes images/cicy-code-latest.tar.gz from the image already saved
       # at /tmp/cicy-image.tar — one workflow keeps BOTH platforms' docker images current
-      # (this OSS key had no producer, which is why macOS was stuck on a stale image).
-      - name: Publish cicy-code image tarball to OSS (macOS / colima)
+      # (this key had no producer, which is why macOS was stuck on a stale image).
+      - name: Publish cicy-code image tarball to R2 (macOS / colima)
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
         run: |
+          set -e
           gzip -c /tmp/cicy-image.tar > cicy-code-latest.tar.gz
           ls -lh cicy-code-latest.tar.gz
-          ./ossutil cp cicy-code-latest.tar.gz "oss://cicy-1372193042-cn/images/cicy-code-latest.tar.gz" -f --acl public-read
-          echo "Uploaded mac image: https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/images/cicy-code-latest.tar.gz"
+          node scripts/r2.mjs put images/cicy-code-latest.tar.gz cicy-code-latest.tar.gz
 
       - name: Upload artifact (backup)
         uses: actions/upload-artifact@v4

package/.github/workflows/linux-app-release.yml

@@ -82,30 +82,27 @@ jobs:
           fi
           npm run build:linux -- --x64 --config.linux.target=AppImage --config.publish.owner="$PUBLISH_OWNER" --config.publish.repo="$PUBLISH_REPO" --publish always
 
-      # AppImage + 版本指针传到 OSS —— app-updater 现已全走 OSS(不碰 GitHub),linux 也要在
-      # OSS 上有 versioned AppImage(CiCy-Desktop-<ver>.AppImage)和自己的指针 linux-latest-version.txt。
+      # AppImage + 版本指针传到 R2 —— app-updater 现已全走 R2(不碰 GitHub),linux 也要在
+      # R2 上有 versioned AppImage(CiCy-Desktop-<ver>.AppImage)和自己的指针 linux-latest-version.txt。
       # 和 mac/win 同一 bucket/凭证。electron-builder 默认产物名含空格,重命名成代码约定的连字符名。
-      - name: Upload AppImage to OSS (versioned + latest pointer)
+      - name: Upload AppImage to R2 (versioned + latest pointer)
         if: startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
-          OSS_AK: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          OSS_SK: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
         run: |
           set -e
-          if [ -z "${OSS_AK:-}" ] || [ -z "${OSS_SK:-}" ]; then echo "::warning::OSS creds missing — skip"; exit 0; fi
+          if [ -z "${R2_ACCOUNT_ID:-}" ] || [ -z "${R2_API_TOKEN:-}" ]; then echo "::warning::R2 creds missing — skip"; exit 0; fi
           VER="${GITHUB_REF_NAME#v}"
-          curl -sL https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil64 -o ossutil && chmod +x ossutil
-          test -s ossutil && head -c4 ossutil | grep -q ELF || { echo "ossutil download bad"; exit 1; }
-          ./ossutil config -e oss-cn-shanghai.aliyuncs.com -i "$OSS_AK" -k "$OSS_SK"
-          BASE="oss://cicy-1372193042-cn/releases"
-          HOST="https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases"
+          BASE="releases"
+          HOST="https://r2.deepfetch.de5.net/releases"
           APP=$(ls dist/*.AppImage 2>/dev/null | head -1)
           [ -n "$APP" ] && [ -f "$APP" ] || { echo "::error::no AppImage built"; exit 1; }
           DEST="CiCy-Desktop-$VER.AppImage"
-          ./ossutil cp "$APP" "$BASE/$DEST" -f --acl public-read
-          ./ossutil cp "$APP" "$BASE/CiCy-Desktop-latest.AppImage" -f --acl public-read || true
+          node scripts/r2.mjs put "$BASE/$DEST" "$APP"
+          node scripts/r2.mjs put "$BASE/CiCy-Desktop-latest.AppImage" "$APP" || true
           # 版本指针最后写(包传完再更新),避免版本号涨了但包还没就位。
           printf '%s' "$VER" > linux-latest-version.txt
-          ./ossutil cp linux-latest-version.txt "$BASE/linux-latest-version.txt" -f --acl public-read
-          echo "OSS linux: $HOST/$DEST"
+          node scripts/r2.mjs put "$BASE/linux-latest-version.txt" linux-latest-version.txt
+          echo "R2 linux: $HOST/$DEST"

package/.github/workflows/mac-app-release.yml

@@ -191,46 +191,42 @@ jobs:
             echo "uploaded $PKG ($(du -h "$PKG" | cut -f1))"
           done
 
-      # Publish the .pkg installers to OSS (CN-fast). GitHub release downloads stall from
-      # mainland China, so users in CN pull from OSS instead. Each arch gets a versioned key
+      # Publish the .pkg installers to our R2 bucket. GitHub release downloads stall from
+      # mainland China, so users in CN pull from the CDN instead. Each arch gets a versioned key
       # plus a stable cicy-desktop-mac-<arch>-latest.pkg alias a download page can hard-link.
       # Same bucket/creds as the Windows latest.exe step.
-      - name: Upload .pkg to OSS (versioned + per-arch latest alias)
-        continue-on-error: true   # OSS is a convenience mirror — never fail the release
+      - name: Upload .pkg to R2 (versioned + per-arch latest alias)
+        continue-on-error: true   # the CDN mirror is a convenience — never fail the release
         shell: bash
         env:
-          OSS_AK: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          OSS_SK: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
         run: |
           set -uo pipefail
           VER="${{ steps.meta.outputs.version }}"
-          if [ -z "${OSS_AK:-}" ] || [ -z "${OSS_SK:-}" ]; then
-            echo "::warning::OSS creds missing — skipping OSS mirror"; exit 0
+          if [ -z "${R2_ACCOUNT_ID:-}" ] || [ -z "${R2_API_TOKEN:-}" ]; then
+            echo "::warning::R2 creds missing — skipping CDN mirror"; exit 0
           fi
-          curl -fsSL -o ossutil.zip "https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil-v1.7.18-mac-arm64.zip"
-          unzip -oq ossutil.zip
-          OSS="./ossutil-v1.7.18-mac-arm64/ossutil"; chmod +x "$OSS"
-          "$OSS" config -e oss-cn-shanghai.aliyuncs.com -i "$OSS_AK" -k "$OSS_SK"
-          BASE="oss://cicy-1372193042-cn/releases"
-          HOST="https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases"
+          BASE="releases"
+          HOST="https://r2.deepfetch.de5.net/releases"
           for ARCH in x64 arm64; do
             PKG="cicy-desktop-$VER-$ARCH.pkg"
-            [ -f "$PKG" ] || { echo "::warning::$PKG not built — skipping OSS for $ARCH"; continue; }
-            "$OSS" cp "$PKG" "$BASE/$PKG" -f --acl public-read || { echo "::warning::OSS versioned upload failed $ARCH"; continue; }
-            "$OSS" cp "$PKG" "$BASE/cicy-desktop-mac-$ARCH-latest.pkg" -f --acl public-read || echo "::warning::OSS latest upload failed $ARCH"
-            echo "OSS $ARCH: $HOST/cicy-desktop-mac-$ARCH-latest.pkg"
+            [ -f "$PKG" ] || { echo "::warning::$PKG not built — skipping R2 for $ARCH"; continue; }
+            node scripts/r2.mjs put "$BASE/$PKG" "$PKG" || { echo "::warning::R2 versioned upload failed $ARCH"; continue; }
+            node scripts/r2.mjs put "$BASE/cicy-desktop-mac-$ARCH-latest.pkg" "$PKG" || echo "::warning::R2 latest upload failed $ARCH"
+            echo "R2 $ARCH: $HOST/cicy-desktop-mac-$ARCH-latest.pkg"
           done
           printf '%s' "$VER" > mac-latest-version.txt
-          "$OSS" cp mac-latest-version.txt "$BASE/mac-latest-version.txt" -f --acl public-read || true
+          node scripts/r2.mjs put "$BASE/mac-latest-version.txt" mac-latest-version.txt || true
 
-          # Prune —— 版本化 pkg 只保留最新 2 个版本(每版含 x64+arm64),更旧的删掉(省 OSS)。
+          # Prune —— 版本化 pkg 只保留最新 2 个版本(每版含 x64+arm64),更旧的删掉(省存储)。
           # 只匹配 cicy-desktop-<semver>-<arch>.pkg;mac-<arch>-latest.pkg 指针不含 semver、永远保留。非致命。
-          allvers=$("$OSS" ls "$BASE/cicy-desktop-" -s 2>/dev/null | grep -oE 'cicy-desktop-[0-9]+\.[0-9]+\.[0-9]+-(x64|arm64)\.pkg' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -uV || true)
+          allvers=$(node scripts/r2.mjs list "$BASE/cicy-desktop-" 2>/dev/null | grep -oE 'cicy-desktop-[0-9]+\.[0-9]+\.[0-9]+-(x64|arm64)\.pkg' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -uV || true)
           keep=$(echo "$allvers" | tail -2)
           for v in $allvers; do
             echo "$keep" | grep -qx "$v" && continue
             for ARCH in x64 arm64; do
-              "$OSS" rm "$BASE/cicy-desktop-$v-$ARCH.pkg" -f 2>/dev/null || true
+              node scripts/r2.mjs delete "$BASE/cicy-desktop-$v-$ARCH.pkg" 2>/dev/null || true
             done
             echo "Pruned old mac pkg version: $v"
           done

package/.github/workflows/seed-r2-release.yml

@@ -0,0 +1,112 @@
+name: Seed R2 from a GitHub release
+
+# Republish one version's installers from its GitHub release into the R2
+# bucket, under the same keys the release workflows write.
+#
+# This exists because R2 can fall behind the GitHub release: a release
+# workflow can fail after uploading to GitHub but before uploading to R2 (that
+# is exactly what the dead Aliyun OSS bucket caused for 2.1.323), and because
+# the R2 side had to be rebuilt from scratch when that bucket was disabled.
+#
+# Run it on a runner rather than from a workstation: the runner pulls GitHub's
+# own release assets at LAN speed and reaches R2 directly, with none of the
+# local proxy hops that make a 180MB transfer a coin flip.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to publish, without the leading v (e.g. 2.1.323)
+        required: true
+      advance_latest:
+        description: Also move the latest/* aliases and version pointers to this version
+        type: boolean
+        default: true
+
+concurrency:
+  group: cicy-desktop-seed-r2
+  cancel-in-progress: false
+
+jobs:
+  seed:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Download release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -e
+          mkdir -p assets
+          gh release download "v${{ inputs.version }}" --repo "$GITHUB_REPOSITORY" --dir assets --clobber
+          ls -lh assets
+
+      - name: Publish to R2
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
+        run: |
+          set -uo pipefail
+          VER="${{ inputs.version }}"
+          ADVANCE="${{ inputs.advance_latest }}"
+          BASE=releases
+          fail=0
+
+          put() {  # put <key> <file>
+            [ -f "$2" ] || { echo "::warning::missing $2 — skipping $1"; return 0; }
+            node scripts/r2.mjs put "$1" "$2" || { echo "::error::upload failed $1"; fail=1; }
+          }
+
+          EXE="assets/CiCy-Desktop-Setup-$VER.exe"
+          put "$BASE/cicy-desktop-$VER.exe" "$EXE"
+          put "$BASE/CiCy-Desktop-Setup-$VER.exe.blockmap" "assets/CiCy-Desktop-Setup-$VER.exe.blockmap"
+
+          for ARCH in x64 arm64; do
+            put "$BASE/cicy-desktop-$VER-$ARCH.pkg" "assets/cicy-desktop-$VER-$ARCH.pkg"
+          done
+
+          APP="assets/CiCy-Desktop-$VER.AppImage"
+          put "$BASE/CiCy-Desktop-$VER.AppImage" "$APP"
+
+          # electron-updater feeds — resolveFeedUrl() probes latest.yml to decide
+          # whether R2 is usable as the CN update feed at all, so these matter.
+          put "$BASE/latest.yml" "assets/latest.yml"
+          put "$BASE/latest-linux.yml" "assets/latest-linux.yml"
+
+          if [ "$ADVANCE" = "true" ]; then
+            put "$BASE/cicy-desktop-latest.exe"     "$EXE"
+            put "$BASE/cicy-desktop-win-latest.exe" "$EXE"
+            for ARCH in x64 arm64; do
+              put "$BASE/cicy-desktop-mac-$ARCH-latest.pkg" "assets/cicy-desktop-$VER-$ARCH.pkg"
+            done
+            put "$BASE/CiCy-Desktop-latest.AppImage" "$APP"
+
+            # Version pointers go LAST: a client that reads a new version number
+            # must find every installer already in place.
+            printf '%s' "$VER" > version.txt
+            for k in latest-version win-latest-version mac-latest-version linux-latest-version; do
+              put "$BASE/$k.txt" version.txt
+            done
+          fi
+
+          exit $fail
+
+      - name: Verify what is live
+        run: |
+          BASE=https://r2.deepfetch.de5.net/releases
+          VER="${{ inputs.version }}"
+          for k in \
+            "cicy-desktop-$VER.exe" "cicy-desktop-latest.exe" "cicy-desktop-win-latest.exe" \
+            "cicy-desktop-$VER-x64.pkg" "cicy-desktop-$VER-arm64.pkg" \
+            "cicy-desktop-mac-x64-latest.pkg" "cicy-desktop-mac-arm64-latest.pkg" \
+            "CiCy-Desktop-$VER.AppImage" "CiCy-Desktop-latest.AppImage" \
+            "latest.yml" "latest-linux.yml" "latest-version.txt"; do
+            code=$(curl -sI -o /dev/null -w '%{http_code}' "$BASE/$k")
+            printf '%-45s %s\n' "$k" "$code"
+          done

package/.github/workflows/windows-exe-release.yml

@@ -98,64 +98,68 @@ jobs:
             npm run build:win -- --config.publish.owner="$env:PUBLISH_OWNER" --config.publish.repo="$env:PUBLISH_REPO" --publish always
           }
 
-      # 推 exe 到 OSS。三件事(不再是"永远一个版本"):
+      # 推 exe 到 R2。三件事(不再是"永远一个版本"):
       #   1) 带版本号的永久副本 releases/cicy-desktop-<version>.exe — 历史 / 指定版本 / 回滚
       #   2) latest 指针 releases/cicy-desktop-latest.exe — 只前进:本次版本 < 已发布版本(更旧的
       #      构建后完成)则不覆盖,避免并发构建竞态把 latest 退回旧版
       #   3) releases/latest-version.txt — 记录 latest 当前是哪个版本,curl 一下即可核对,无需猜 exe
-      - name: Upload EXE to OSS (versioned + forward-only latest pointer)
+      #
+      # 原先发到 Aliyun OSS,该账号已停用(整桶 403 UserDisable),统一改走 scripts/r2.mjs。
+      - name: Upload EXE to R2 (versioned + forward-only latest pointer)
         shell: pwsh
         env:
-          OSS_AK: ${{ secrets.OSS_ACCESS_KEY_ID }}
-          OSS_SK: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_API_TOKEN:  ${{ secrets.R2_API_TOKEN }}
         run: |
+          $ErrorActionPreference = "Continue"
           $version = "${{ steps.meta.outputs.version }}"
-          Invoke-WebRequest -Uri "https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil-v1.7.18-windows-amd64.zip" -OutFile ossutil.zip
-          Expand-Archive -LiteralPath ossutil.zip -DestinationPath ossutil-dir -Force
-          $oss = "ossutil-dir\ossutil-v1.7.18-windows-amd64\ossutil.exe"
-          & $oss config -e oss-cn-shanghai.aliyuncs.com -i "$env:OSS_AK" -k "$env:OSS_SK"
+          if (-not $env:R2_ACCOUNT_ID -or -not $env:R2_API_TOKEN) {
+            Write-Host "::warning::R2 creds missing — skip"; exit 0
+          }
+          $r2   = "scripts/r2.mjs"
+          $base = "releases"
+          $host_ = "https://r2.deepfetch.de5.net/releases"
           $exe = Get-ChildItem dist\*.exe | Where-Object { $_.Name -match 'Setup' } | Select-Object -First 1
           if (-not $exe) { $exe = Get-ChildItem dist\*.exe | Select-Object -First 1 }
           if (-not $exe) { Write-Error "no exe found in dist"; exit 1 }
-          $base = "oss://cicy-1372193042-cn/releases"
 
           # 0) WSL2 内核裸文件(一次性,已存在就跳过):精简版 Windows 没有 msiexec 装不了
           #    wsl_update_x64.msi,桌面端改为直接下这个文件放到 System32\lxss\tools\kernel。
           $kernelKey = "$base/wsl-kernel/kernel"
-          & $oss stat "$kernelKey" 2>$null | Out-Null
+          node $r2 exists $kernelKey
           if ($LASTEXITCODE -ne 0) {
             Write-Host "Publishing raw WSL2 kernel -> $kernelKey"
             Invoke-WebRequest -Uri "https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi" -OutFile wsl_update_x64.msi
             $kdir = Join-Path $PWD "wsl-kernel-extract"
             Start-Process msiexec.exe -ArgumentList "/a","`"$PWD\wsl_update_x64.msi`"","/qn","TARGETDIR=$kdir" -Wait
             $kfile = Get-ChildItem $kdir -Recurse -File | Where-Object { $_.Name -eq "kernel" } | Select-Object -First 1
-            if ($kfile) { & $oss cp "$($kfile.FullName)" "$kernelKey" -f --acl public-read } else { Write-Warning "kernel not found in msi extract" }
-          } else { Write-Host "WSL2 kernel already on OSS, skip" }
+            if ($kfile) { node $r2 put $kernelKey "$($kfile.FullName)" } else { Write-Warning "kernel not found in msi extract" }
+          } else { Write-Host "WSL2 kernel already on R2, skip" }
 
           # 0b) 新版 WSL 的 MSI(一次性,已存在就跳过):老 Win10 自带旧版 WSL 反复死锁,桌面端改为装新版。
           $wslKey = "$base/wsl/wsl.x64.msi"
-          & $oss stat "$wslKey" 2>$null | Out-Null
+          node $r2 exists $wslKey
           if ($LASTEXITCODE -ne 0) {
             $rel = Invoke-RestMethod -Uri "https://api.github.com/repos/microsoft/WSL/releases/latest" -Headers @{ "User-Agent" = "cicy-desktop-ci" }
             $asset = $rel.assets | Where-Object { $_.name -match 'x64\.msi$' } | Select-Object -First 1
             if ($asset) {
               Write-Host "Publishing modern WSL $($rel.tag_name) -> $wslKey"
               Invoke-WebRequest -Uri $asset.browser_download_url -OutFile wsl.x64.msi
-              & $oss cp "wsl.x64.msi" "$wslKey" -f --acl public-read
+              node $r2 put $wslKey "wsl.x64.msi"
               Set-Content -Path wsl-version.txt -Value $rel.tag_name
-              & $oss cp "wsl-version.txt" "$base/wsl/version.txt" -f --acl public-read
+              node $r2 put "$base/wsl/version.txt" "wsl-version.txt"
             } else { Write-Warning "no x64 msi asset in microsoft/WSL latest" }
-          } else { Write-Host "modern WSL msi already on OSS, skip" }
+          } else { Write-Host "modern WSL msi already on R2, skip" }
 
           # 1) 永久版本化副本(unique key — 不会被后续发版覆盖)
           $verKey = "$base/cicy-desktop-$version.exe"
           Write-Host "Uploading versioned -> $verKey"
-          & $oss cp "$($exe.FullName)" "$verKey" -f --acl public-read
+          node $r2 put $verKey "$($exe.FullName)"
           if ($LASTEXITCODE -ne 0) { Write-Error "versioned upload failed"; exit 1 }
 
           # 2) latest 指针 — 只在本次版本 >= 已发布版本时前进
-          & $oss cp "$base/latest-version.txt" "current-latest.txt" -f 2>$null
-          $cur = if (Test-Path "current-latest.txt") { (Get-Content "current-latest.txt" -Raw).Trim() } else { "0.0.0" }
+          $cur = "0.0.0"
+          try { $cur = (Invoke-WebRequest -Uri "$host_/latest-version.txt" -UseBasicParsing).Content.Trim() } catch { $cur = "0.0.0" }
           $advance = $true
           try { $advance = ([version]$version -ge [version]$cur) } catch { $advance = $true }
           if ($advance) {
@@ -163,43 +167,43 @@ jobs:
             # 关键:版本指针(latest-version.txt)必须在所有安装包传完之后才写 —— 否则
             # updater 先读到新版本号、用户点下载,但 exe 还没传完 → 404。所以先把所有 exe
             # 传齐(versioned 已在上面传过 + latest + win-latest),最后才更新版本指针。
-            & $oss cp "$($exe.FullName)" "$base/cicy-desktop-latest.exe" -f --acl public-read
+            node $r2 put "$base/cicy-desktop-latest.exe" "$($exe.FullName)"
             if ($LASTEXITCODE -ne 0) { Write-Error "latest upload failed"; exit 1 }
             # Unified per-platform naming: cicy-desktop-<platform>-latest.<ext> so every OS
             # shares one URL shape (win + mac-x64 + mac-arm64). The bare cicy-desktop-latest.exe
             # / latest-version.txt are kept as backward-compat aliases for old links.
-            & $oss cp "$($exe.FullName)" "$base/cicy-desktop-win-latest.exe" -f --acl public-read
+            node $r2 put "$base/cicy-desktop-win-latest.exe" "$($exe.FullName)"
             if ($LASTEXITCODE -ne 0) { Write-Error "win-latest upload failed"; exit 1 }
             # —— 安装包全部就位,最后写版本指针(version file 永远最后)——
             Set-Content -NoNewline -Path "current-latest.txt" -Value $version
-            & $oss cp "current-latest.txt" "$base/latest-version.txt" -f --acl public-read
+            node $r2 put "$base/latest-version.txt" "current-latest.txt"
             if ($LASTEXITCODE -ne 0) { Write-Error "latest-version.txt upload failed"; exit 1 }
-            & $oss cp "current-latest.txt" "$base/win-latest-version.txt" -f --acl public-read
+            node $r2 put "$base/win-latest-version.txt" "current-latest.txt"
             if ($LASTEXITCODE -ne 0) { Write-Error "win-latest-version.txt upload failed"; exit 1 }
           } else {
             Write-Host "Skip latest: building $version < published $cur (older build — not clobbering newer latest)"
           }
 
-          # 3) 保留策略 — 只留最近 $KEEP 个版本化 exe(~130MB/个),旧的删掉,避免 OSS 无限膨胀。
+          # 3) 保留策略 — 只留最近 $KEEP 个版本化 exe(~130MB/个),旧的删掉,避免 bucket 无限膨胀。
           #    latest.exe / latest-version.txt 不在此列(名字不匹配 X.Y.Z),永远保留。
           $KEEP = 2
           $versions = @()
-          foreach ($l in (& $oss ls "$base/" 2>$null)) {
+          foreach ($l in (node $r2 list "$base/cicy-desktop-")) {
             if ($l -match 'releases/cicy-desktop-(\d+\.\d+\.\d+)\.exe\s*$') { $versions += $matches[1] }
           }
           $sorted = @($versions | Sort-Object { [version]$_ } -Descending)
           if ($sorted.Count -gt $KEEP) {
             foreach ($v in ($sorted | Select-Object -Skip $KEEP)) {
               Write-Host "Pruning old versioned exe: cicy-desktop-$v.exe"
-              & $oss rm "$base/cicy-desktop-$v.exe" -f 2>$null
+              node $r2 delete "$base/cicy-desktop-$v.exe"
             }
           } else {
             Write-Host "Retention: $($sorted.Count) versioned exe(s) <= keep $KEEP, nothing to prune"
           }
 
-          Write-Host "Versioned : https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases/cicy-desktop-$version.exe"
-          Write-Host "Latest    : https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases/cicy-desktop-latest.exe"
-          Write-Host "Version-of: https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/releases/latest-version.txt"
+          Write-Host "Versioned : $host_/cicy-desktop-$version.exe"
+          Write-Host "Latest    : $host_/cicy-desktop-latest.exe"
+          Write-Host "Version-of: $host_/latest-version.txt"
 
       - name: Publish release (drop draft, mark latest)
         # Only promote AFTER all assets uploaded successfully. autoUpdater on

package/bin/cicy-desktop

@@ -22,11 +22,12 @@ const STATE_FILE = path.join(HOME, ".cicy-cluster.json");
 const LOGS_DIR = path.join(HOME, "logs");
 const PACKAGE_ROOT = path.join(__dirname, "..");
 // Electron 二进制来源:**不用用户设任何变量**,自动判断网络。
-//   CN(或探测不通,兜底)→ 我们的 Aliyun OSS 镜像(CN-fast,三平台 zip 镜像在
-//     <OSS>electron/v<version>/electron-v<version>-<platform>.zip,正是 @electron/get 的布局)。
+//   CN(或探测不通,兜底)→ 我们的 Cloudflare R2 镜像(三平台 zip 镜像在
+//     <R2>electron/v<version>/electron-v<version>-<platform>.zip,正是 @electron/get 的布局)。
+//     原 Aliyun OSS 镜像已下线(账号停用,整桶 403 UserDisable)。
 //   海外 → electron 官方 GitHub release(不压我们 OSS,海外更快)。
 // 仍可用 ELECTRON_MIRROR 显式覆盖(power user / CI)。下载只在首次(无缓存)发生。
-const OSS_ELECTRON_MIRROR = "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/electron/";
+const R2_ELECTRON_MIRROR = "https://r2.deepfetch.de5.net/electron/";
 const GH_ELECTRON_BASE = "https://github.com/electron/electron/releases/download/";
 const NPM_REGISTRY = process.env.CICY_NPM_REGISTRY || process.env.npm_config_registry || "https://registry.npmmirror.com";
 const MASTER_ENTRY = path.join(PACKAGE_ROOT, "src", "master", "master-main.js");
@@ -111,11 +112,11 @@ function isCNNetwork() {
   } catch { return true; } // google 不可达 → CN/兜底,走 OSS
 }
 
-// 决定 electron zip 的下载地址(不用用户设变量):ELECTRON_MIRROR 显式覆盖 > CN→OSS > 海外→官方 GitHub。
+// 决定 electron zip 的下载地址(不用用户设变量):ELECTRON_MIRROR 显式覆盖 > CN→R2 > 海外→官方 GitHub。
 function electronZipUrl() {
   const { zip } = electronArtifact();
   if (process.env.ELECTRON_MIRROR) return { url: `${process.env.ELECTRON_MIRROR}v${ELECTRON_VERSION}/${zip}`, src: "ELECTRON_MIRROR" };
-  if (isCNNetwork()) return { url: `${OSS_ELECTRON_MIRROR}v${ELECTRON_VERSION}/${zip}`, src: "OSS(CN)" };
+  if (isCNNetwork()) return { url: `${R2_ELECTRON_MIRROR}v${ELECTRON_VERSION}/${zip}`, src: "R2(CN)" };
   return { url: `${GH_ELECTRON_BASE}v${ELECTRON_VERSION}/${zip}`, src: "GitHub(海外)" };
 }
 
@@ -615,7 +616,7 @@ function ensureMacDesktopApp() {
     : "cicy-desktop";
   // do shell script needs node + the global bin on PATH (GUI launch has a
   // minimal PATH); trailing & + nohup + </dev/null lets the shell return so the
-  // applet quits. 不再 export ELECTRON_MIRROR —— bin 自己按网络自动选(CN→OSS / 海外→GitHub)。
+  // applet quits. 不再 export ELECTRON_MIRROR —— bin 自己按网络自动选(CN→R2 / 海外→GitHub)。
   // npm_config_registry(npmmirror)留着给 cicy-code 子包下载用。
   const ascript =
     `do shell script "export PATH=\\"${nodeDir}:${gbin}:/usr/local/bin:/opt/homebrew/bin:$PATH\\" ; ` +

package/bin/preinstall.sh

@@ -1,32 +1,32 @@
-#!/bin/bash
-
-set -e
-
-echo "Installing electron globally..."
-
-if [ "$(uname)" = "Linux" ]; then
-  sudo npm install -g electron
-else
-  npm install -g electron
-fi
-
-if [ "$(uname)" = "Linux" ]; then
-  echo "Fixing chrome-sandbox permissions on Linux..."
-  ELECTRON_PATH=$(which electron)
-  ELECTRON_DIR=$(dirname "$ELECTRON_PATH")
-  SANDBOX_PATH="$ELECTRON_DIR/../lib/node_modules/electron/dist/chrome-sandbox"
-  
-  if [ -f "$SANDBOX_PATH" ]; then
-    if command -v sudo &> /dev/null; then
-      sudo chown root:root "$SANDBOX_PATH"
-      sudo chmod 4755 "$SANDBOX_PATH"
-      echo "chrome-sandbox permissions fixed"
-    else
-      echo "Warning: sudo not available, skipping chrome-sandbox permissions"
-    fi
-  else
-    echo "Warning: chrome-sandbox not found at $SANDBOX_PATH"
-  fi
-fi
-
+#!/bin/bash
+
+set -e
+
+echo "Installing electron globally..."
+
+if [ "$(uname)" = "Linux" ]; then
+  sudo npm install -g electron
+else
+  npm install -g electron
+fi
+
+if [ "$(uname)" = "Linux" ]; then
+  echo "Fixing chrome-sandbox permissions on Linux..."
+  ELECTRON_PATH=$(which electron)
+  ELECTRON_DIR=$(dirname "$ELECTRON_PATH")
+  SANDBOX_PATH="$ELECTRON_DIR/../lib/node_modules/electron/dist/chrome-sandbox"
+  
+  if [ -f "$SANDBOX_PATH" ]; then
+    if command -v sudo &> /dev/null; then
+      sudo chown root:root "$SANDBOX_PATH"
+      sudo chmod 4755 "$SANDBOX_PATH"
+      echo "chrome-sandbox permissions fixed"
+    else
+      echo "Warning: sudo not available, skipping chrome-sandbox permissions"
+    fi
+  else
+    echo "Warning: chrome-sandbox not found at $SANDBOX_PATH"
+  fi
+fi
+
 echo "Electron setup complete"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.322",
+  "version": "2.1.324",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -144,10 +144,10 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.591",
-    "cicy-code-darwin-arm64": "2.3.591",
-    "cicy-code-linux-x64": "2.3.591",
-    "cicy-code-linux-arm64": "2.3.591",
+    "cicy-code-darwin-x64": "2.3.593",
+    "cicy-code-darwin-arm64": "2.3.593",
+    "cicy-code-linux-x64": "2.3.593",
+    "cicy-code-linux-arm64": "2.3.593",
     "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",