cicy-desktop 2.1.330 → 2.1.332

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.330",
+  "version": "2.1.332",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/homepage-window.js

@@ -4,11 +4,24 @@
 // Homepage window — primary CiCy Desktop window. Singleton; closing it
 // does NOT quit the app.
 //
-// URL selection (HARDCODED — no env/dev-URL switch, no Vite, no remote): ALL
-// platforms load the bundled local file:// SPA — works offline, fast, no
-// remote dependency, no mixed-content concerns when embedding the
-// team-assistant webview (the cicy-desktop preload's IPC bridge still
-// attaches).
+// URL selection: the bundled local file:// SPA by DEFAULT — works offline, fast,
+// no remote dependency, no mixed-content concerns when embedding the
+// team-assistant webview (the cicy-desktop preload's IPC bridge still attaches).
+//
+// The same SPA is also deployed as the desktop-render Worker on
+// https://desktop.cicy-ai.com, which is what makes "ship UI without shipping the
+// app" possible. Pointing the homepage at it is OPT-IN, and deliberately not the
+// default: the home tab runs homepage-preload, whose bridge is the UNGUARDED
+// "rpc" channel (no origin gate, no dangerous-tool gate — see utils/rpc-guard),
+// because it was only ever loaded from file://. A remote origin on that channel
+// gets ungated exec_*/file_* on every desktop, so whoever controls the domain
+// controls the fleet. Turn it on per machine with CICY_HOMEPAGE_URL (any URL) or
+// prefs.homepageRemote:true (uses REMOTE_HOMEPAGE), and only for an origin you
+// trust exactly as much as the bundled bundle itself.
+//
+// Either way the remote load is never a one-way door: a main-frame failure (or a
+// load that never commits) falls back to the bundled snapshot, so a CDN outage
+// cannot leave the app with no homepage.
 
 const path = require("path");
 const { BrowserWindow } = require("electron");
@@ -19,9 +32,55 @@ const FIXED_WIDTH = 930;
 const FIXED_HEIGHT = 640;
 
 const LOCAL_INDEX = path.join(__dirname, "homepage-react", "index.html");
+const LOCAL_URL = `file://${LOCAL_INDEX}`;
+const REMOTE_HOMEPAGE = "https://desktop.cicy-ai.com/";
+const REMOTE_FALLBACK_MS = 15000;
+
+function readHomepagePrefs() {
+  try {
+    const os = require("os");
+    const p = path.join(os.homedir(), "cicy-ai", "db", "prefs.json");
+    return JSON.parse(require("fs").readFileSync(p, "utf8")) || {};
+  } catch {
+    return {};
+  }
+}
 
 function pickHomepageURL() {
-  return `file://${LOCAL_INDEX}`;
+  const env = String(process.env.CICY_HOMEPAGE_URL || "").trim();
+  if (env) return env;
+  try {
+    if (readHomepagePrefs().homepageRemote === true) return REMOTE_HOMEPAGE;
+  } catch {}
+  return LOCAL_URL;
+}
+
+// Fall back to the bundled snapshot when a remote homepage fails to load or
+// never commits. Idempotent per webContents; a no-op once we are already local.
+function wireRemoteFallback(wc) {
+  if (!wc || wc.isDestroyed() || wc.__cicyHomeFallbackWired) return;
+  let current = "";
+  try { current = wc.getURL(); } catch {}
+  if (!current || current.startsWith("file://")) {
+    // getURL() is empty until the first commit, so only skip a known-local load.
+    if (current) return;
+  }
+  wc.__cicyHomeFallbackWired = true;
+  let settled = false;
+  const toLocal = (reason) => {
+    if (settled || wc.isDestroyed()) return;
+    let url = "";
+    try { url = wc.getURL(); } catch {}
+    if (url.startsWith("file://")) { settled = true; return; }
+    settled = true;
+    log.warn(`[homepage] remote homepage unusable (${reason}) → bundled snapshot`);
+    try { wc.loadURL(LOCAL_URL); } catch (e) { log.error(`[homepage] fallback failed: ${e.message}`); }
+  };
+  wc.on("did-fail-load", (_e, code, desc, _url, isMainFrame) => {
+    if (isMainFrame) toLocal(`${code} ${desc}`);
+  });
+  wc.once("did-finish-load", () => { settled = true; });
+  setTimeout(() => toLocal(`no load within ${REMOTE_FALLBACK_MS}ms`), REMOTE_FALLBACK_MS);
 }
 
 let homepage = null;    // standalone fallback window (only if the tab engine fails)
@@ -40,6 +99,7 @@ async function openHomepage(opts = {}) {
     if (wc) {
       homeTabWc = wc;
       try { wc.once("destroyed", () => { if (homeTabWc === wc) homeTabWc = null; }); } catch {}
+      try { wireRemoteFallback(wc); } catch (e) { log.warn(`[homepage] fallback wiring: ${e.message}`); }
     }
     log.info(`[homepage] opened as profile-0 resident tab (wc=${wc && wc.id})`);
     return win;
@@ -103,6 +163,7 @@ async function openHomepageStandalone() {
 
   const target = pickHomepageURL();
   log.info(`[homepage] loading ${target}`);
+  try { wireRemoteFallback(homepage.webContents); } catch (e) { log.warn(`[homepage] fallback wiring: ${e.message}`); }
   homepage.loadURL(target);
 
   // Pipe renderer console + load failures to main-process stdout so we can

package/src/main.js

@@ -949,22 +949,29 @@ function ensureAutoLaunch() {
       // (它先起 master 再起 worker,直接起 electron.exe 会缺 master)。登录项指向一个
       // wscript 隐藏启动的 VBS → `cmd /c node .\bin\cicy-desktop`,全程无控制台窗口。
       const fromSource = !electronApp.isPackaged;
-      let opts;
+      let opts, runCmd;
       if (fromSource) {
         const vbs = writeSourceAutostartVbs();
         opts = { openAtLogin: want, path: "wscript.exe", args: ["//B", "//Nologo", vbs] };
+        runCmd = `wscript.exe //B //Nologo "${vbs}"`;
       } else {
         opts = { openAtLogin: want, args: ["--hidden"] };
+        runCmd = `"${process.execPath}" --hidden`;
       }
-      const cur = electronApp.getLoginItemSettings(
-        fromSource ? { path: opts.path, args: opts.args } : undefined
-      );
-      if (cur.openAtLogin !== want) {
+      const probe = () =>
+        electronApp.getLoginItemSettings(fromSource ? { path: opts.path, args: opts.args } : undefined);
+      if (probe().openAtLogin !== want) {
         electronApp.setLoginItemSettings(opts);
         log.info(
           `[autostart] openAtLogin → ${want}${fromSource ? ` (source: ${opts.path} ${opts.args.join(" ")})` : ""}`
         );
       }
+      // Read it back. setLoginItemSettings() returns without throwing on every
+      // Windows node of this fleet and still leaves openAtLogin false, with
+      // HKCU\...\Run untouched — so autostart silently never existed, and a node
+      // whose app went away (e.g. an installer closed it) never came back, not
+      // even after a reboot. When the API did not take, write the Run key.
+      if (probe().openAtLogin !== want) ensureWindowsRunKey(want, runCmd);
     } else if (process.platform === "linux") {
       if (!electronApp.isPackaged) return;
       ensureLinuxAutostart(want);
@@ -974,6 +981,27 @@ function ensureAutoLaunch() {
   }
 }
 
+// Fallback for the silently-failing setLoginItemSettings (see ensureAutoLaunch):
+// own the HKCU Run entry directly. Async so a slow reg.exe never delays startup;
+// failures are logged, never thrown — autostart is best-effort.
+const WIN_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const WIN_RUN_NAME = "CiCy Desktop";
+function ensureWindowsRunKey(want, command) {
+  try {
+    const { execFile } = require("child_process");
+    const args = want
+      ? ["add", WIN_RUN_KEY, "/v", WIN_RUN_NAME, "/t", "REG_SZ", "/d", command, "/f"]
+      : ["delete", WIN_RUN_KEY, "/v", WIN_RUN_NAME, "/f"];
+    execFile("reg", args, { windowsHide: true }, (err) => {
+      // deleting an absent value exits non-zero — that is the wanted end state.
+      if (err && want) log.warn(`[autostart] Run-key fallback failed: ${err.message}`);
+      else if (want) log.info(`[autostart] Run-key fallback wrote ${WIN_RUN_NAME} → ${command}`);
+    });
+  } catch (e) {
+    log.warn(`[autostart] Run-key fallback threw: ${e.message}`);
+  }
+}
+
 // 源码模式 Windows 登录自启的隐藏启动器(VBS)。写到 %LOCALAPPDATA%\cicy-desktop,幂等覆盖。
 // 继承当前的 CICY_DEBUG(用 start-cicy-desktop-win.bat 起的就带 =1),其余环境用登录时的用户环境。
 function writeSourceAutostartVbs() {

package/test/autostart-run-key.test.js

@@ -0,0 +1,59 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// Windows autostart had no test and never worked. Measured across the fleet:
+// app.setLoginItemSettings({openAtLogin:true}) returns without throwing, yet
+// getLoginItemSettings() still reports false and HKCU\...\Run stays untouched
+// (the key exists and is writable — OneDrive lives there). So every Windows node
+// ran with no autostart at all, which is why one whose app went away never came
+// back, not even after a reboot. ensureAutoLaunch() now reads the setting back
+// and owns the Run entry itself when the API did not take.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "main.js"), "utf8");
+const fn = src.slice(
+  src.indexOf("function ensureAutoLaunch()"),
+  src.indexOf("function ensureWindowsRunKey")
+);
+
+test("windows autostart verifies the setting instead of trusting the API", () => {
+  // A single getLoginItemSettings() call before the write is not enough — the
+  // regression is entirely in what happens AFTER setLoginItemSettings().
+  assert.match(fn, /const probe = \(\) =>/);
+  assert.match(fn, /if \(probe\(\)\.openAtLogin !== want\) \{[^]*setLoginItemSettings\(opts\)/);
+  assert.match(fn, /if \(probe\(\)\.openAtLogin !== want\) ensureWindowsRunKey\(want, runCmd\)/);
+});
+
+test("the Run-key command differs for packaged vs source runs", () => {
+  // Packaged: the exe itself, hidden. Source: wscript running the VBS launcher,
+  // because starting electron.exe directly skips bin/cicy-desktop's master boot.
+  assert.match(fn, /runCmd = `"\$\{process\.execPath\}" --hidden`/);
+  assert.match(fn, /runCmd = `wscript\.exe \/\/B \/\/Nologo "\$\{vbs\}"`/);
+});
+
+test("ensureWindowsRunKey adds or removes the HKCU Run value, async and non-fatal", () => {
+  const helper = src.slice(
+    src.indexOf("function ensureWindowsRunKey"),
+    src.indexOf("// 源码模式 Windows 登录自启")
+  );
+  assert.match(
+    src,
+    /WIN_RUN_KEY = "HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"/
+  );
+  assert.match(
+    helper,
+    /\["add", WIN_RUN_KEY, "\/v", WIN_RUN_NAME, "\/t", "REG_SZ", "\/d", command, "\/f"\]/
+  );
+  assert.match(helper, /\["delete", WIN_RUN_KEY, "\/v", WIN_RUN_NAME, "\/f"\]/);
+  assert.match(helper, /execFile\("reg", args, \{ windowsHide: true \}/); // no console flash, no startup stall
+  assert.match(helper, /catch \(e\) \{[^]*log\.warn/); // best-effort: never throws into startup
+});
+
+test("autostart still defaults to on and is honoured per-platform", () => {
+  assert.match(fn, /const want = prefs\.openAtLogin !== false/);
+  assert.match(fn, /if \(process\.platform === "darwin"\)/);
+  assert.match(fn, /else if \(process\.platform === "linux"\)/);
+});

package/test/homepage-remote.test.js

@@ -0,0 +1,106 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// The homepage URL was hardcoded to file://, so deploying the same SPA as the
+// desktop-render Worker (desktop.cicy-ai.com) changed nothing on any desktop —
+// the app never fetched it. It can now be pointed at the web build, but only
+// deliberately: the home tab runs homepage-preload, whose bridge is the
+// UNGUARDED "rpc" channel, so a remote origin there gets ungated exec_*/file_*.
+// Hence opt-in + an automatic fall back to the bundled snapshot.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const SRC = path.join(__dirname, "..", "src", "backends", "homepage-window.js");
+const src = fs.readFileSync(SRC, "utf8");
+
+function withHome(fn) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "cicy-home-"));
+  const prevHome = process.env.HOME,
+    prevUp = process.env.USERPROFILE;
+  const prevUrl = process.env.CICY_HOMEPAGE_URL;
+  process.env.HOME = home;
+  process.env.USERPROFILE = home;
+  delete process.env.CICY_HOMEPAGE_URL;
+  fs.mkdirSync(path.join(home, "cicy-ai", "db"), { recursive: true });
+  try {
+    return fn(home);
+  } finally {
+    process.env.HOME = prevHome;
+    if (prevUp === undefined) delete process.env.USERPROFILE;
+    else process.env.USERPROFILE = prevUp;
+    if (prevUrl === undefined) delete process.env.CICY_HOMEPAGE_URL;
+    else process.env.CICY_HOMEPAGE_URL = prevUrl;
+  }
+}
+
+// homepage-window requires electron; exercise the real pickHomepageURL by
+// evaluating just that function plus the helper it depends on.
+function loadPicker() {
+  const start = src.indexOf("const LOCAL_INDEX");
+  const end = src.indexOf("// Fall back to the bundled snapshot");
+  const body = src.slice(start, end);
+  const mod = { exports: {} };
+  const fn = new Function(
+    "require",
+    "path",
+    "module",
+    "__dirname",
+    body + "\nmodule.exports = { pickHomepageURL, LOCAL_URL, REMOTE_HOMEPAGE };"
+  );
+  fn(require, path, mod, path.dirname(SRC));
+  return mod.exports;
+}
+
+test("defaults to the bundled file:// snapshot", () => {
+  withHome(() => {
+    const { pickHomepageURL, LOCAL_URL } = loadPicker();
+    assert.equal(pickHomepageURL(), LOCAL_URL);
+    assert.match(pickHomepageURL(), /^file:\/\//);
+  });
+});
+
+test("prefs.homepageRemote opts in to the deployed Worker", () => {
+  withHome((home) => {
+    fs.writeFileSync(
+      path.join(home, "cicy-ai", "db", "prefs.json"),
+      JSON.stringify({ homepageRemote: true })
+    );
+    const { pickHomepageURL, REMOTE_HOMEPAGE } = loadPicker();
+    assert.equal(pickHomepageURL(), REMOTE_HOMEPAGE);
+    assert.equal(REMOTE_HOMEPAGE, "https://desktop.cicy-ai.com/");
+  });
+});
+
+test("CICY_HOMEPAGE_URL wins over prefs and the default", () => {
+  withHome((home) => {
+    fs.writeFileSync(
+      path.join(home, "cicy-ai", "db", "prefs.json"),
+      JSON.stringify({ homepageRemote: true })
+    );
+    process.env.CICY_HOMEPAGE_URL = "http://127.0.0.1:5173/";
+    try {
+      assert.equal(loadPicker().pickHomepageURL(), "http://127.0.0.1:5173/");
+    } finally {
+      delete process.env.CICY_HOMEPAGE_URL;
+    }
+  });
+});
+
+test("a malformed prefs file falls back to local rather than throwing", () => {
+  withHome((home) => {
+    fs.writeFileSync(path.join(home, "cicy-ai", "db", "prefs.json"), "{ not json");
+    const { pickHomepageURL, LOCAL_URL } = loadPicker();
+    assert.equal(pickHomepageURL(), LOCAL_URL);
+  });
+});
+
+test("a remote homepage always has a way back to the bundled snapshot", () => {
+  assert.match(src, /wc\.on\("did-fail-load"/);
+  assert.match(src, /setTimeout\(\(\) => toLocal\(`no load within/); // blank page that never commits
+  assert.match(src, /if \(url\.startsWith\("file:\/\/"\)\) \{ settled = true; return; \}/); // never loops on local
+  assert.match(src, /wireRemoteFallback\(wc\)/); // resident home tab
+  assert.match(src, /wireRemoteFallback\(homepage\.webContents\)/); // standalone window
+});