cicy-desktop 2.1.332 → 2.1.333

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.332",
+  "version": "2.1.333",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/backends/homepage-window.js

@@ -4,24 +4,23 @@
 // Homepage window — primary CiCy Desktop window. Singleton; closing it
 // does NOT quit the app.
 //
-// URL selection: the bundled local file:// SPA by DEFAULT — works offline, fast,
-// no remote dependency, no mixed-content concerns when embedding the
-// team-assistant webview (the cicy-desktop preload's IPC bridge still attaches).
+// URL selection: the homepage IS the deployed web build
+// (https://desktop.cicy-ai.com — the desktop-render Worker). Shipping homepage
+// changes then means deploying the Worker, not shipping a new desktop build.
 //
-// The same SPA is also deployed as the desktop-render Worker on
-// https://desktop.cicy-ai.com, which is what makes "ship UI without shipping the
-// app" possible. Pointing the homepage at it is OPT-IN, and deliberately not the
-// default: the home tab runs homepage-preload, whose bridge is the UNGUARDED
-// "rpc" channel (no origin gate, no dangerous-tool gate — see utils/rpc-guard),
-// because it was only ever loaded from file://. A remote origin on that channel
-// gets ungated exec_*/file_* on every desktop, so whoever controls the domain
-// controls the fleet. Turn it on per machine with CICY_HOMEPAGE_URL (any URL) or
-// prefs.homepageRemote:true (uses REMOTE_HOMEPAGE), and only for an origin you
-// trust exactly as much as the bundled bundle itself.
+// The bundled file:// snapshot stays in the package as the FALLBACK: a
+// main-frame load failure, or a load that never commits within 15s (a blank 200
+// from a broken deploy), swaps to it — a CDN outage can never leave the app with
+// no homepage. Set CICY_HOMEPAGE_URL to point somewhere else (e.g. a vite dev
+// server), or prefs.homepageRemote:false to pin a machine to the snapshot.
 //
-// Either way the remote load is never a one-way door: a main-frame failure (or a
-// load that never commits) falls back to the bundled snapshot, so a CDN outage
-// cannot leave the app with no homepage.
+// Note what this grants: the home tab runs homepage-preload, whose bridge is the
+// UNGUARDED "rpc" channel — no origin gate, no dangerous-tool gate (see
+// utils/rpc-guard), because it predates the homepage ever being remote. The
+// homepage origin therefore has ungated exec_*/file_* on the machine, so
+// desktop.cicy-ai.com must be treated as first-party code, exactly like the
+// bundle it replaces: whoever can deploy that Worker can run commands on every
+// desktop.
 
 const path = require("path");
 const { BrowserWindow } = require("electron");
@@ -49,10 +48,11 @@ function readHomepagePrefs() {
 function pickHomepageURL() {
   const env = String(process.env.CICY_HOMEPAGE_URL || "").trim();
   if (env) return env;
+  // Opt OUT only: an explicit false pins this machine to the bundled snapshot.
   try {
-    if (readHomepagePrefs().homepageRemote === true) return REMOTE_HOMEPAGE;
+    if (readHomepagePrefs().homepageRemote === false) return LOCAL_URL;
   } catch {}
-  return LOCAL_URL;
+  return REMOTE_HOMEPAGE;
 }
 
 // Fall back to the bundled snapshot when a remote homepage fails to load or

package/test/homepage-remote.test.js

@@ -54,23 +54,36 @@ function loadPicker() {
   return mod.exports;
 }
 
-test("defaults to the bundled file:// snapshot", () => {
+test("defaults to the deployed web build", () => {
   withHome(() => {
-    const { pickHomepageURL, LOCAL_URL } = loadPicker();
-    assert.equal(pickHomepageURL(), LOCAL_URL);
-    assert.match(pickHomepageURL(), /^file:\/\//);
+    const { pickHomepageURL, REMOTE_HOMEPAGE } = loadPicker();
+    assert.equal(pickHomepageURL(), REMOTE_HOMEPAGE);
+    assert.equal(REMOTE_HOMEPAGE, "https://desktop.cicy-ai.com/");
   });
 });
 
-test("prefs.homepageRemote opts in to the deployed Worker", () => {
+test("prefs.homepageRemote:false pins a machine to the bundled snapshot", () => {
   withHome((home) => {
     fs.writeFileSync(
       path.join(home, "cicy-ai", "db", "prefs.json"),
-      JSON.stringify({ homepageRemote: true })
+      JSON.stringify({ homepageRemote: false })
     );
-    const { pickHomepageURL, REMOTE_HOMEPAGE } = loadPicker();
-    assert.equal(pickHomepageURL(), REMOTE_HOMEPAGE);
-    assert.equal(REMOTE_HOMEPAGE, "https://desktop.cicy-ai.com/");
+    const { pickHomepageURL, LOCAL_URL } = loadPicker();
+    assert.equal(pickHomepageURL(), LOCAL_URL);
+    assert.match(pickHomepageURL(), /^file:\/\//);
+  });
+});
+
+test("any value other than an explicit false stays on the web build", () => {
+  withHome((home) => {
+    for (const v of [true, "false", 0, null]) {
+      fs.writeFileSync(
+        path.join(home, "cicy-ai", "db", "prefs.json"),
+        JSON.stringify({ homepageRemote: v })
+      );
+      const { pickHomepageURL, REMOTE_HOMEPAGE } = loadPicker();
+      assert.equal(pickHomepageURL(), REMOTE_HOMEPAGE, `homepageRemote=${JSON.stringify(v)}`);
+    }
   });
 });
 
@@ -78,7 +91,7 @@ test("CICY_HOMEPAGE_URL wins over prefs and the default", () => {
   withHome((home) => {
     fs.writeFileSync(
       path.join(home, "cicy-ai", "db", "prefs.json"),
-      JSON.stringify({ homepageRemote: true })
+      JSON.stringify({ homepageRemote: false })
     );
     process.env.CICY_HOMEPAGE_URL = "http://127.0.0.1:5173/";
     try {
@@ -89,11 +102,11 @@ test("CICY_HOMEPAGE_URL wins over prefs and the default", () => {
   });
 });
 
-test("a malformed prefs file falls back to local rather than throwing", () => {
+test("a malformed prefs file keeps the default rather than throwing", () => {
   withHome((home) => {
     fs.writeFileSync(path.join(home, "cicy-ai", "db", "prefs.json"), "{ not json");
-    const { pickHomepageURL, LOCAL_URL } = loadPicker();
-    assert.equal(pickHomepageURL(), LOCAL_URL);
+    const { pickHomepageURL, REMOTE_HOMEPAGE } = loadPicker();
+    assert.equal(pickHomepageURL(), REMOTE_HOMEPAGE);
   });
 });