cicy-desktop 2.1.329 → 2.1.331

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.329",
+  "version": "2.1.331",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/app-updater.js

@@ -21,7 +21,7 @@ const os = require("os");
 const { readGlobalConfig, updateGlobalConfig } = require("./utils/global-json");
 const https = require("https");
 const log = require("electron-log");
-const { R2_RELEASES_BASE } = require("./sidecar/mirrors");
+const { R2_RELEASES_BASE, buildUrlList } = require("./sidecar/mirrors");
 
 // ── 版本比较:>0 a 新于 b ─────────────────────────────────────────────────────
 function cmpVer(a, b) {
@@ -74,25 +74,76 @@ function headOk(url, redirects = 0) {
 }
 
 // ── 最新版本号 ────────────────────────────────────────────────────────────────
+// R2 优先(win/mac/linux 各自指针,两条 CI 版本可能不同步,所以各读各的),GitHub 兜底。
+//
+// 原先这里是「一律读 OSS,彻底不碰 GitHub」,理由是仓库可能私有。代价是 R2 一旦不可达,
+// 自更新就整条断掉 —— 而 fleet 里确实有一批 Windows 节点连 r2.deepfetch.de5.net 直接
+// ECONNRESET(GitHub 反而 ~300ms 可达),它们因此永远停在旧版、只能人工推包。
+// 现在 R2 仍是首选(仓库若再转私有,这条路不受影响),失败才回退 GitHub Release;
+// 两边都不通才算真失败。
+const GH_REPO = "cicy-ai/cicy-desktop";
+
+function fetchLatestVersionFromGitHub() {
+  return new Promise((resolve, reject) => {
+    const req = https.get(
+      `https://api.github.com/repos/${GH_REPO}/releases/latest`,
+      { headers: { "User-Agent": "cicy-desktop-updater", Accept: "application/vnd.github+json" }, timeout: 10000 },
+      (res) => {
+        if (res.statusCode !== 200) { res.resume(); return reject(new Error(`GitHub HTTP ${res.statusCode}`)); }
+        let body = "";
+        res.setEncoding("utf8");
+        res.on("data", (d) => (body += d));
+        res.on("end", () => {
+          try {
+            const tag = String((JSON.parse(body) || {}).tag_name || "").replace(/^v/, "");
+            tag ? resolve(tag) : reject(new Error("no tag_name"));
+          } catch (e) { reject(e); }
+        });
+      },
+    );
+    req.on("error", reject);
+    req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
+  });
+}
+
 async function fetchLatestVersion() {
-  // 版本清单**一律读 OSS**(win/mac/linux 各自指针),与网络判定无关 —— 彻底不碰 GitHub,
-  // 这样 cicy-desktop 仓库私有也不影响更新检查。win/mac 是两条独立 CI、版本可能不同步,读错
-  // 平台会 404,所以各读各的指针文件。
   const file = process.platform === "win32" ? "win-latest-version.txt"
     : process.platform === "darwin" ? "mac-latest-version.txt"
     : "linux-latest-version.txt";
-  return (await getText(`${R2_RELEASES_BASE}/${file}`)).trim().replace(/^v/, "");
+  try {
+    return (await getText(`${R2_RELEASES_BASE}/${file}`)).trim().replace(/^v/, "");
+  } catch (e) {
+    log.warn(`[app-updater] R2 版本指针不可达(${e.message}),回退 GitHub Release`);
+    return await fetchLatestVersionFromGitHub();
+  }
 }
 
-// ── 安装包 URL(分平台 + 分网络)+ 本地文件名 ────────────────────────────────
+// ── 安装包来源(有序候选)+ 本地文件名 ──────────────────────────────────────
+// 返回 { file, urls } —— urls 是按优先级排好的候选:R2 → GitHub 直连 → ghproxy 镜像。
+// 调用方依次尝试,第一个能下的算数(见 check() 的 HEAD 探测和 downloadUpdate 的重试)。
+//
+// 注意 Windows 两边**文件名不同**:R2 上是 cicy-desktop-<ver>.exe(CI 传的版本化副本),
+// GitHub Release 里是 electron-builder 产出的 CiCy-Desktop-Setup-<ver>.exe。
+// mac 的 pkg 和 linux 的 AppImage 两边同名。`file` 只是本地落盘名,保持原样不变。
 function assetFor(version) {
   const plat = process.platform;
   const arch = process.arch === "arm64" ? "arm64" : "x64";
-  // 三端安装包**全部从 OSS 拉**,与网络无关 —— 不再拼 GitHub 下载 URL,仓库私有也能更新。
   const file = plat === "win32" ? `cicy-desktop-${version}.exe`
     : plat === "darwin" ? `cicy-desktop-${version}-${arch}.pkg`
     : `CiCy-Desktop-${version}.AppImage`;
-  return { url: `${R2_RELEASES_BASE}/${file}`, file };
+  const ghName = plat === "win32" ? `CiCy-Desktop-Setup-${version}.exe` : file;
+  const ghUrl = `https://github.com/${GH_REPO}/releases/download/v${version}/${ghName}`;
+  // buildUrlList("global") = [直连, ...镜像];R2 排在最前面。
+  const urls = [`${R2_RELEASES_BASE}/${file}`, ...buildUrlList(ghUrl, "global")];
+  return { file, urls, url: urls[0] };
+}
+
+// 第一个 HEAD 得到 200/206 的候选;都不行返回 null。
+async function firstReachable(urls) {
+  for (const u of urls) {
+    if (await headOk(u)) return u;
+  }
+  return null;
 }
 
 // ── 下载(带进度,跟随重定向)──────────────────────────────────────────────────
@@ -179,9 +230,10 @@ async function check() {
     if (latest && cmpVer(latest, current) > 0) {
       // 「先出包再更新版本」客户端保险:版本号涨了不代表包传完了。先 HEAD 确认本平台安装包
       // 真能下(200),否则当成「还没就绪」继续显已是最新,避免用户点下载 404。
-      const { url } = assetFor(latest);
-      const ready = await headOk(url);
+      const { urls } = assetFor(latest);
+      const ready = await firstReachable(urls);
       if (ready) {
+        log.info(`[app-updater] ${latest} 安装包就绪:${ready}`);
         broadcast({ status: "available", version: latest, current, progress: null, filePath: null, autoUpdate: getAutoUpdate(), auto: false });
         if (getAutoUpdate()) {
           log.info(`[app-updater] auto-update on → downloading ${latest} and installing without asking`);
@@ -189,7 +241,7 @@ async function check() {
           await downloadUpdate();
           if (_state.status === "ready") installNow();
         }
-      } else { log.info(`[app-updater] ${latest} 版本号已更新但安装包未就位(HEAD 非 200):${url} — 暂不提示更新`); broadcast({ status: "up-to-date", version: current, current }); }
+      } else { log.info(`[app-updater] ${latest} 版本号已更新但所有来源都拿不到安装包(HEAD 非 200):${urls.join(" , ")} — 暂不提示更新`); broadcast({ status: "up-to-date", version: current, current }); }
     } else {
       broadcast({ status: "up-to-date", version: latest || current, current });
     }
@@ -208,16 +260,26 @@ async function downloadUpdate() {
   if (!version) { broadcast({ status: "error", error: "no version" }); return _state; }
   _downloading = true;
   try {
-    const { url, file } = assetFor(version);
+    const { urls, file } = assetFor(version);
     // 下到 ~/Downloads(用户能直接找到安装包);目录不存在则建。
     const dir = app.getPath("downloads");
     try { fs.mkdirSync(dir, { recursive: true }); } catch {}
     const dest = path.join(dir, file);
-    log.info(`[app-updater] downloading ${url} → ${dest}`);
     broadcast({ status: "downloading", progress: { percent: 0, transferred: 0, total: 0 }, filePath: null });
-    await download(url, dest, (p) => broadcast({ status: "downloading", progress: p }));
-    broadcast({ status: "ready", filePath: dest, progress: { percent: 100 } });
-    return _state;
+    // 逐个候选试(R2 → GitHub → 镜像):一个源断了就换下一个,全断才算失败。
+    let lastErr = null;
+    for (const url of urls) {
+      try {
+        log.info(`[app-updater] downloading ${url} → ${dest}`);
+        await download(url, dest, (p) => broadcast({ status: "downloading", progress: p }));
+        broadcast({ status: "ready", filePath: dest, progress: { percent: 100 } });
+        return _state;
+      } catch (e) {
+        lastErr = e;
+        log.warn(`[app-updater] 源失败(${url}):${e.message}`);
+      }
+    }
+    throw lastErr || new Error("no source available");
   } catch (e) {
     log.warn("[app-updater] download failed:", e.message);
     broadcast({ status: "error", error: e.message });

package/src/main.js

@@ -949,22 +949,29 @@ function ensureAutoLaunch() {
       // (它先起 master 再起 worker,直接起 electron.exe 会缺 master)。登录项指向一个
       // wscript 隐藏启动的 VBS → `cmd /c node .\bin\cicy-desktop`,全程无控制台窗口。
       const fromSource = !electronApp.isPackaged;
-      let opts;
+      let opts, runCmd;
       if (fromSource) {
         const vbs = writeSourceAutostartVbs();
         opts = { openAtLogin: want, path: "wscript.exe", args: ["//B", "//Nologo", vbs] };
+        runCmd = `wscript.exe //B //Nologo "${vbs}"`;
       } else {
         opts = { openAtLogin: want, args: ["--hidden"] };
+        runCmd = `"${process.execPath}" --hidden`;
       }
-      const cur = electronApp.getLoginItemSettings(
-        fromSource ? { path: opts.path, args: opts.args } : undefined
-      );
-      if (cur.openAtLogin !== want) {
+      const probe = () =>
+        electronApp.getLoginItemSettings(fromSource ? { path: opts.path, args: opts.args } : undefined);
+      if (probe().openAtLogin !== want) {
         electronApp.setLoginItemSettings(opts);
         log.info(
           `[autostart] openAtLogin → ${want}${fromSource ? ` (source: ${opts.path} ${opts.args.join(" ")})` : ""}`
         );
       }
+      // Read it back. setLoginItemSettings() returns without throwing on every
+      // Windows node of this fleet and still leaves openAtLogin false, with
+      // HKCU\...\Run untouched — so autostart silently never existed, and a node
+      // whose app went away (e.g. an installer closed it) never came back, not
+      // even after a reboot. When the API did not take, write the Run key.
+      if (probe().openAtLogin !== want) ensureWindowsRunKey(want, runCmd);
     } else if (process.platform === "linux") {
       if (!electronApp.isPackaged) return;
       ensureLinuxAutostart(want);
@@ -974,6 +981,27 @@ function ensureAutoLaunch() {
   }
 }
 
+// Fallback for the silently-failing setLoginItemSettings (see ensureAutoLaunch):
+// own the HKCU Run entry directly. Async so a slow reg.exe never delays startup;
+// failures are logged, never thrown — autostart is best-effort.
+const WIN_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const WIN_RUN_NAME = "CiCy Desktop";
+function ensureWindowsRunKey(want, command) {
+  try {
+    const { execFile } = require("child_process");
+    const args = want
+      ? ["add", WIN_RUN_KEY, "/v", WIN_RUN_NAME, "/t", "REG_SZ", "/d", command, "/f"]
+      : ["delete", WIN_RUN_KEY, "/v", WIN_RUN_NAME, "/f"];
+    execFile("reg", args, { windowsHide: true }, (err) => {
+      // deleting an absent value exits non-zero — that is the wanted end state.
+      if (err && want) log.warn(`[autostart] Run-key fallback failed: ${err.message}`);
+      else if (want) log.info(`[autostart] Run-key fallback wrote ${WIN_RUN_NAME} → ${command}`);
+    });
+  } catch (e) {
+    log.warn(`[autostart] Run-key fallback threw: ${e.message}`);
+  }
+}
+
 // 源码模式 Windows 登录自启的隐藏启动器(VBS)。写到 %LOCALAPPDATA%\cicy-desktop,幂等覆盖。
 // 继承当前的 CICY_DEBUG(用 start-cicy-desktop-win.bat 起的就带 =1),其余环境用登录时的用户环境。
 function writeSourceAutostartVbs() {

package/src/sidecar/host-mihomo.js

@@ -233,14 +233,23 @@ function start({ force = false } = {}) {
 
 // Full enable: ensure binary → copy+adapt container config → (re)start.
 // containerYaml is fetched by the caller (sidecar-ipc) via appDocker.
+// A missing container config is NOT fatal on its own: when the WSL/docker
+// cicy-code isn't installed (or is down) we run STANDALONE on the host's own
+// mihomo-host.yaml if one is already there, so the per-profile proxies keep
+// working instead of dying with the container — that's what lets Windows run
+// without WSL at all. Only "no container config AND no host config" leaves us
+// nothing to start. Standalone has no authoritative selection source, so the
+// selection sync is skipped rather than overriding whatever the host holds.
 async function enable({ containerYaml, selections = {}, emit } = {}) {
   await ensureBinary({ emit });
-  if (!containerYaml) throw new Error(tt("noContainerConfig"));
-  const changed = writeConfig(containerYaml);
+  let changed = false, standalone = false;
+  if (containerYaml) changed = writeConfig(containerYaml);
+  else if (fs.existsSync(HOST_CONFIG)) standalone = true;
+  else throw new Error(tt("noContainerConfig"));
   const res = start({ force: changed });
-  const synced = await syncSelections(selections);
+  const synced = standalone ? { updated: [] } : await syncSelections(selections);
   emit && emit({ phase: "chrome-proxy", status: "running", message: tt("ready") });
-  return { ok: true, ...res, ...synced };
+  return { ok: true, standalone, ...res, ...synced };
 }
 
 module.exports = {

package/test/app-updater-github-fallback.test.js

@@ -0,0 +1,81 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// The self-updater used to read BOTH the version pointer and the installer from
+// R2 only ("彻底不碰 GitHub"). That made auto-update fail closed on every node
+// that cannot reach r2.deepfetch.de5.net — a real slice of the fleet answers
+// ECONNRESET there while GitHub responds in ~300ms, so those boxes sat on an old
+// version until someone pushed a package by hand. R2 stays FIRST (a private repo
+// must keep working); GitHub is the fallback.
+//
+// app-updater requires electron at load time, so this asserts on source shape —
+// the same convention as app-updater-auto.test.js.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "app-updater.js"), "utf8");
+
+test("version pointer falls back to the GitHub release when R2 is unreachable", () => {
+  assert.match(src, /function fetchLatestVersionFromGitHub\(\)/);
+  assert.match(src, /api\.github\.com\/repos\/\$\{GH_REPO\}\/releases\/latest/);
+  assert.match(src, /tag_name/);
+  // R2 first, GitHub only in the catch — not the other way round.
+  const fn = src.slice(
+    src.indexOf("async function fetchLatestVersion()"),
+    src.indexOf("// ── 安装包来源")
+  );
+  assert.match(fn, /R2_RELEASES_BASE\}\/\$\{file\}/);
+  assert.match(fn, /catch \(e\) \{[^]*fetchLatestVersionFromGitHub\(\)/);
+  assert.ok(
+    fn.indexOf("R2_RELEASES_BASE") < fn.indexOf("fetchLatestVersionFromGitHub"),
+    "R2 must be tried first"
+  );
+});
+
+test("assetFor returns ordered candidates: R2 → GitHub → mirrors", () => {
+  const fn = src.slice(
+    src.indexOf("function assetFor(version)"),
+    src.indexOf("async function firstReachable")
+  );
+  assert.match(
+    fn,
+    /const urls = \[`\$\{R2_RELEASES_BASE\}\/\$\{file\}`, \.\.\.buildUrlList\(ghUrl, "global"\)\]/
+  );
+  // Windows is the one platform whose asset is named differently on each source:
+  // R2 keeps the CI's versioned copy, GitHub has electron-builder's Setup exe.
+  assert.match(fn, /ghName = plat === "win32" \? `CiCy-Desktop-Setup-\$\{version\}\.exe` : file/);
+  assert.match(fn, /releases\/download\/v\$\{version\}\/\$\{ghName\}/);
+  assert.match(fn, /return \{ file, urls, url: urls\[0\] \}/);
+});
+
+test("check() probes every candidate before declaring the package missing", () => {
+  assert.match(src, /async function firstReachable\(urls\)/);
+  assert.match(src, /for \(const u of urls\) \{[^]*if \(await headOk\(u\)\) return u;/);
+  const chk = src.slice(
+    src.indexOf("async function check()"),
+    src.indexOf("async function downloadUpdate()")
+  );
+  assert.match(chk, /const \{ urls \} = assetFor\(latest\)/);
+  assert.match(chk, /const ready = await firstReachable\(urls\)/);
+  assert.doesNotMatch(chk, /await headOk\(url\)/); // the old single-source probe is gone
+});
+
+test("downloadUpdate() retries the next source instead of failing on the first", () => {
+  const dl = src.slice(
+    src.indexOf("async function downloadUpdate()"),
+    src.indexOf("function installNow()")
+  );
+  assert.match(dl, /const \{ urls, file \} = assetFor\(version\)/);
+  assert.match(dl, /for \(const url of urls\) \{/);
+  assert.match(dl, /catch \(e\) \{[^]*lastErr = e/);
+  assert.match(dl, /throw lastErr \|\| new Error\("no source available"\)/);
+});
+
+test("mirrors helper is imported so CN keeps its ghproxy fallback", () => {
+  assert.match(
+    src,
+    /const \{ R2_RELEASES_BASE, buildUrlList \} = require\("\.\/sidecar\/mirrors"\)/
+  );
+});

package/test/autostart-run-key.test.js

@@ -0,0 +1,59 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// Windows autostart had no test and never worked. Measured across the fleet:
+// app.setLoginItemSettings({openAtLogin:true}) returns without throwing, yet
+// getLoginItemSettings() still reports false and HKCU\...\Run stays untouched
+// (the key exists and is writable — OneDrive lives there). So every Windows node
+// ran with no autostart at all, which is why one whose app went away never came
+// back, not even after a reboot. ensureAutoLaunch() now reads the setting back
+// and owns the Run entry itself when the API did not take.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "main.js"), "utf8");
+const fn = src.slice(
+  src.indexOf("function ensureAutoLaunch()"),
+  src.indexOf("function ensureWindowsRunKey")
+);
+
+test("windows autostart verifies the setting instead of trusting the API", () => {
+  // A single getLoginItemSettings() call before the write is not enough — the
+  // regression is entirely in what happens AFTER setLoginItemSettings().
+  assert.match(fn, /const probe = \(\) =>/);
+  assert.match(fn, /if \(probe\(\)\.openAtLogin !== want\) \{[^]*setLoginItemSettings\(opts\)/);
+  assert.match(fn, /if \(probe\(\)\.openAtLogin !== want\) ensureWindowsRunKey\(want, runCmd\)/);
+});
+
+test("the Run-key command differs for packaged vs source runs", () => {
+  // Packaged: the exe itself, hidden. Source: wscript running the VBS launcher,
+  // because starting electron.exe directly skips bin/cicy-desktop's master boot.
+  assert.match(fn, /runCmd = `"\$\{process\.execPath\}" --hidden`/);
+  assert.match(fn, /runCmd = `wscript\.exe \/\/B \/\/Nologo "\$\{vbs\}"`/);
+});
+
+test("ensureWindowsRunKey adds or removes the HKCU Run value, async and non-fatal", () => {
+  const helper = src.slice(
+    src.indexOf("function ensureWindowsRunKey"),
+    src.indexOf("// 源码模式 Windows 登录自启")
+  );
+  assert.match(
+    src,
+    /WIN_RUN_KEY = "HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"/
+  );
+  assert.match(
+    helper,
+    /\["add", WIN_RUN_KEY, "\/v", WIN_RUN_NAME, "\/t", "REG_SZ", "\/d", command, "\/f"\]/
+  );
+  assert.match(helper, /\["delete", WIN_RUN_KEY, "\/v", WIN_RUN_NAME, "\/f"\]/);
+  assert.match(helper, /execFile\("reg", args, \{ windowsHide: true \}/); // no console flash, no startup stall
+  assert.match(helper, /catch \(e\) \{[^]*log\.warn/); // best-effort: never throws into startup
+});
+
+test("autostart still defaults to on and is honoured per-platform", () => {
+  assert.match(fn, /const want = prefs\.openAtLogin !== false/);
+  assert.match(fn, /if \(process\.platform === "darwin"\)/);
+  assert.match(fn, /else if \(process\.platform === "linux"\)/);
+});