cicy-desktop 2.1.327 → 2.1.328

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.327",
+  "version": "2.1.328",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {
@@ -144,10 +144,10 @@
   "//optionalDependencies": "(2026-06 回调): mac/linux 改回 native cicy-code(:8008,colima 在 16G mac 上压垮内存)→ 重新内置 cicy-code-<plat> / cicy-mihomo-<plat>,localbin.fromBundle 零网络 seed(npm 仅作更新通道,带 npmmirror→npmjs 回退)。这些由 scripts/sync-runtime-deps.cjs 在 tag-push 时同步到最新版。npm 的 os/cpu 字段保证每个平台只装自己那份。Windows 仍走 docker(WSL :8009),它那份 cicy-code-windows 用不到但 bundle 着无害。",
   "optionalDependencies": {
     "electron": "41.0.3",
-    "cicy-code-darwin-x64": "2.3.595",
-    "cicy-code-darwin-arm64": "2.3.595",
-    "cicy-code-linux-x64": "2.3.595",
-    "cicy-code-linux-arm64": "2.3.595",
+    "cicy-code-darwin-x64": "2.3.596",
+    "cicy-code-darwin-arm64": "2.3.596",
+    "cicy-code-linux-x64": "2.3.596",
+    "cicy-code-linux-arm64": "2.3.596",
     "cicy-code-windows-x64": "2.3.193",
     "cicy-mihomo-darwin-x64": "1.10.4",
     "cicy-mihomo-darwin-arm64": "1.10.4",

package/src/backends/hub-client.js

@@ -352,6 +352,12 @@ async function instances() {
       agents: Array.isArray(i.agents) ? i.agents.length : undefined,
     }))
     .sort((x, y) => Number(y.online) - Number(x.online) || x.name.localeCompare(y.name));
+  // Every host in this list was fetched with the owner's own token, so each one
+  // provably belongs to the owner's tenant — trust the whole set for owner-scoped
+  // dangerous RPC (each node is served at its own <node>.hub.cicy-ai.com subdomain).
+  try {
+    hubTrust.recordOwnerHubHosts(out.map((i) => i.host));
+  } catch {}
   return { ok: true, owner: res.json.owner || a.owner, viaSidecar, instances: out };
 }
 

package/src/utils/hub-trust.js

@@ -1,23 +1,25 @@
 // Copyright 2026 CiCy AI
 // SPDX-License-Identifier: Apache-2.0
 
-// Owner-hub trust — the ONE origin a hub-logged-in desktop treats as "its owner
-// commanding it", so rpc_call from the operator's own ws-hub control surface can
-// drive dangerous tools (exec_*/file_*/electron_inject) on this machine WITHOUT a
-// per-call consent modal that nobody is present to click.
+// Owner-hub trust — the SET of hub hosts a hub-logged-in desktop treats as "its
+// owner commanding it", so rpc_call from the operator's own ws-hub control surface
+// (or any of the owner's own nodes) can drive dangerous tools (exec_*/file_*/
+// electron_inject) on this machine WITHOUT a per-call consent modal nobody is
+// present to click.
 //
-// Scope (deliberately the narrowest that still gives fleet control):
-//   • ALL teams under the same login email share ONE origin —
-//     https://<tenant>.hub.cicy-ai.com (teams/projects are hash paths under it),
-//     confirmed across the fleet. So owner-trust is a single hub host, not a set.
-//   • That host is captured ONLY from an authenticated source: a hub grant minted
-//     with THIS desktop's own hubAuth token (hub-client.grantUrl / hub:open).
-//     Minting a grant proves the host belongs to this desktop's owner email —
-//     no origin-string guessing, no email→slug derivation.
-//   • Persisted under hubAuth so it survives restart (the deadlock repro was "also
-//     after restart"); cleared the moment the desktop logs out.
-//   • Suffix-locked to `.hub.cicy-ai.com`: even a corrupted store can't promote an
-//     arbitrary origin to owner trust.
+// Scope (the narrowest boundary that still gives fleet control):
+//   • Each of the owner's nodes is served at its OWN subdomain
+//     https://<node>.hub.cicy-ai.com (confirmed from the live instances list) —
+//     so owner-trust is a SET of hosts, not one.
+//   • Every host in the set is captured ONLY from an authenticated source proven
+//     to belong to THIS desktop's owner email:
+//       – a hub grant minted with this desktop's own hubAuth token (grantUrl), and
+//       – the instances() list fetched with that same token.
+//     Both prove the host is the owner's; no origin-string guessing, no
+//     email→slug derivation, no bare `.hub.cicy-ai.com` wildcard (that would
+//     trust a DIFFERENT tenant's subdomain).
+//   • Persisted under hubAuth so it survives restart; cleared on logout.
+//   • Every host is suffix-locked to an exact single-label <tenant>.hub.cicy-ai.com.
 const os = require("os");
 const path = require("path");
 const { readGlobalConfig, updateGlobalConfig } = require("./global-json");
@@ -62,55 +64,125 @@ function loggedIn() {
   }
 }
 
-function ownerHubHost() {
+// The trusted host set, read fresh from disk. Honours a legacy single
+// `ownerHubHost` string alongside the `ownerHubHosts` array.
+function _readHosts() {
   try {
-    return normHubHost(readGlobalConfig(GLOBAL_JSON)?.hubAuth?.ownerHubHost || "");
+    const a = readGlobalConfig(GLOBAL_JSON)?.hubAuth;
+    if (!a) return [];
+    const out = [];
+    const push = (h) => {
+      const n = normHubHost(h);
+      if (n && !out.includes(n)) out.push(n);
+    };
+    if (Array.isArray(a.ownerHubHosts)) a.ownerHubHosts.forEach(push);
+    if (a.ownerHubHome) push(a.ownerHubHome);
+    if (a.ownerHubHost) push(a.ownerHubHost); // legacy single-host field
+    return out;
   } catch {
-    return "";
+    return [];
   }
 }
 
-// Record the hub host proven to be the owner's (called on a successful grant).
-function recordOwnerHubHost(input) {
-  const host = normHubHost(input);
-  if (!host) return { ok: false };
-  if (ownerHubHost() === host) return { ok: true, host };
+function ownerHubHosts() {
+  return _readHosts();
+}
+
+// The primary "owner's own hub home" — used to build an "open my hub at project X"
+// URL. First host recorded via a grant (grantUrl); falls back to any known host.
+function ownerHubHost() {
+  try {
+    const home = normHubHost(readGlobalConfig(GLOBAL_JSON)?.hubAuth?.ownerHubHome || "");
+    if (home) return home;
+  } catch {}
+  return _readHosts()[0] || "";
+}
+
+// Add hosts to the trusted set (only while a token is present). `setHome` marks
+// the first one as the primary home (grants do this; the instances bulk load
+// doesn't, so a node subdomain never becomes "my hub home").
+function _addHosts(hosts, setHome) {
+  const norm = (Array.isArray(hosts) ? hosts : [hosts]).map(normHubHost).filter(Boolean);
+  if (!norm.length) return { ok: false, added: 0 };
+  const have = new Set(_readHosts());
+  const add = norm.filter((h) => !have.has(h));
+  let homeToSet = "";
   try {
     updateGlobalConfig(GLOBAL_JSON, (c) => {
-      if (c && c.hubAuth && c.hubAuth.token) c.hubAuth.ownerHubHost = host;
+      if (c && c.hubAuth && c.hubAuth.token) {
+        const cur = Array.isArray(c.hubAuth.ownerHubHosts) ? c.hubAuth.ownerHubHosts.slice() : [];
+        const s = new Set(cur);
+        if (c.hubAuth.ownerHubHost) {
+          const legacy = normHubHost(c.hubAuth.ownerHubHost);
+          if (legacy) s.add(legacy);
+          delete c.hubAuth.ownerHubHost; // migrate
+        }
+        norm.forEach((h) => s.add(h));
+        c.hubAuth.ownerHubHosts = Array.from(s);
+        if (setHome && !c.hubAuth.ownerHubHome) {
+          c.hubAuth.ownerHubHome = norm[0];
+          homeToSet = norm[0];
+        }
+      }
       return c;
     });
   } catch {
-    return { ok: false };
+    return { ok: false, added: 0 };
+  }
+  if (add.length || homeToSet) {
+    _audit({
+      kind: "auth",
+      gate: "owner-hub",
+      host: (add.length ? add : norm).join(","),
+      decision: setHome ? "record" : "record-bulk",
+    });
   }
-  _audit({ kind: "auth", gate: "owner-hub", host, decision: "record" });
-  return { ok: true, host };
+  return { ok: true, added: add.length };
+}
+
+// A single host proven to be the owner's (a grant). Also becomes the primary home.
+function recordOwnerHubHost(input) {
+  const host = normHubHost(input);
+  if (!host) return { ok: false };
+  const r = _addHosts([host], true);
+  return r.ok ? { ok: true, host } : { ok: false };
+}
+
+// Bulk: every host from the authenticated instances() list — all the owner's own
+// nodes. Does NOT change the primary home.
+function recordOwnerHubHosts(list) {
+  return _addHosts(list, false);
 }
 
 function clearOwnerHubHost() {
   try {
     updateGlobalConfig(GLOBAL_JSON, (c) => {
-      if (c && c.hubAuth) delete c.hubAuth.ownerHubHost;
+      if (c && c.hubAuth) {
+        delete c.hubAuth.ownerHubHost;
+        delete c.hubAuth.ownerHubHome;
+        delete c.hubAuth.ownerHubHosts;
+      }
       return c;
     });
   } catch {}
 }
 
-// The gate: is this origin the owner's own hub control surface (and are we still
-// its owner)? Suffix-locked AND matched against the captured host.
+// The gate: is this origin one of the owner's own hub hosts (and are we still
+// logged in)? Suffix-locked AND matched against the captured set.
 function isOwnerHubOrigin(originOrUrl) {
   if (!loggedIn()) return false;
-  const own = ownerHubHost();
-  if (!own) return false;
   const host = normHubHost(originOrUrl);
-  return !!host && host === own;
+  if (!host) return false;
+  return _readHosts().includes(host);
 }
 
 module.exports = {
   HUB_SUFFIX,
   normHubHost,
   ownerHubHost,
+  ownerHubHosts,
   recordOwnerHubHost,
+  recordOwnerHubHosts,
   clearOwnerHubHost,
   isOwnerHubOrigin,
 };

package/test/rpc-guard-owner-hub.test.js

@@ -79,6 +79,8 @@ test("hub-client records the owner hub host on a grant and clears it on logout",
     src.indexOf("function clearAuth") + 260
   );
   assert.match(clearAuth, /hubTrust\.clearOwnerHubHost\(\)/);
+  // instances() trusts every returned node host (each is the owner's own tenant).
+  assert.match(src, /hubTrust\.recordOwnerHubHosts\(out\.map\(\(i\) => i\.host\)\)/);
 });
 
 test("hub-trust: owner host is suffix-locked to <tenant>.hub.cicy-ai.com", () => {
@@ -114,12 +116,25 @@ test("hub-trust: owner host is suffix-locked to <tenant>.hub.cicy-ai.com", () =>
     });
     assert.equal(t.recordOwnerHubHost("https://limeng.hub.cicy-ai.com/").ok, true);
     assert.equal(t.isOwnerHubOrigin("https://limeng.hub.cicy-ai.com/#/project/9"), true);
-    assert.equal(t.isOwnerHubOrigin("https://other.hub.cicy-ai.com/"), false); // different tenant
+    assert.equal(t.isOwnerHubOrigin("https://other.hub.cicy-ai.com/"), false); // not recorded → not trusted
     assert.equal(t.recordOwnerHubHost("hub.cicy-ai.com").ok, false); // can't record bare suffix
 
-    // Logout clears trust.
+    // Trust is a SET, not a wildcard: each of the owner's node subdomains is
+    // trusted once the authenticated instances() list records it — and only then.
+    t.recordOwnerHubHosts([
+      "xs-1001.hub.cicy-ai.com",
+      "https://xs-2002.hub.cicy-ai.com/x",
+      "hub.cicy-ai.com", // dropped (bare suffix)
+    ]);
+    assert.equal(t.isOwnerHubOrigin("https://xs-1001.hub.cicy-ai.com/"), true);
+    assert.equal(t.isOwnerHubOrigin("https://xs-2002.hub.cicy-ai.com/#/y"), true);
+    assert.equal(t.isOwnerHubOrigin("https://xs-9999.hub.cicy-ai.com/"), false); // never recorded
+    assert.equal(t.ownerHubHost(), "limeng.hub.cicy-ai.com"); // home stays the first grant, not a node
+
+    // Logout clears the whole set.
     t.clearOwnerHubHost();
     assert.equal(t.isOwnerHubOrigin("https://limeng.hub.cicy-ai.com/"), false);
+    assert.equal(t.isOwnerHubOrigin("https://xs-1001.hub.cicy-ai.com/"), false);
   } finally {
     process.env.HOME = prevHome;
     if (prevUp === undefined) delete process.env.USERPROFILE;