cicy-desktop 2.1.334 → 2.1.335

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.334",
+  "version": "2.1.335",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/app-updater.js

@@ -146,30 +146,45 @@ async function firstReachable(urls) {
   return null;
 }
 
-// ── 下载(带进度,跟随重定向)──────────────────────────────────────────────────
-function download(url, dest, onProgress, redirects = 0) {
+// ── 下载(带进度、跟随重定向、断点续传)────────────────────────────────────
+// A single https.get with a 30s socket timeout used to BE the download: one
+// stall on a slow mirror and the update failed for good. That is not
+// theoretical — a fleet node sat on an old build for several releases with
+// "download failed: timeout" every 30 minutes, because its link to the CDN
+// could serve ranges fine but never sustained the whole 125MB inside one
+// socket. So: retry, and resume from what already landed instead of starting
+// over. A slow link now takes several passes and still finishes.
+function downloadOnce(url, dest, onProgress, startAt, redirects = 0) {
   return new Promise((resolve, reject) => {
     if (redirects > 6) return reject(new Error("too many redirects"));
-    const f = fs.createWriteStream(dest);
-    const req = https.get(url, { headers: { "User-Agent": "cicy-desktop" }, timeout: 30000 }, (res) => {
+    const headers = { "User-Agent": "cicy-desktop" };
+    if (startAt > 0) headers.Range = `bytes=${startAt}-`;
+    const req = https.get(url, { headers, timeout: 30000 }, (res) => {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        f.close(); try { fs.unlinkSync(dest); } catch {}
-        return download(res.headers.location, dest, onProgress, redirects + 1).then(resolve, reject);
+        res.resume();
+        return downloadOnce(res.headers.location, dest, onProgress, startAt, redirects + 1).then(resolve, reject);
+      }
+      // 206 = the server honoured the range → append. 200 with startAt means it
+      // ignored it → start the file over rather than corrupt it by appending.
+      const resuming = res.statusCode === 206;
+      if (res.statusCode !== 200 && !resuming) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode}`));
       }
-      if (res.statusCode !== 200) { f.close(); try { fs.unlinkSync(dest); } catch {} return reject(new Error(`HTTP ${res.statusCode}`)); }
-      const total = parseInt(res.headers["content-length"] || "0", 10) || 0;
-      let transferred = 0, lastEmit = 0;
+      const base = resuming ? startAt : 0;
+      const f = fs.createWriteStream(dest, resuming ? { flags: "a" } : {});
+      const len = parseInt(res.headers["content-length"] || "0", 10) || 0;
+      const total = base + len;
+      let transferred = base, lastEmit = 0;
       const startT = Date.now();
-      let winT = startT, winBytes = 0, bytesPerSec = 0;
+      let winT = startT, winBytes = transferred, bytesPerSec = 0;
       res.on("data", (chunk) => {
         transferred += chunk.length;
         const now = Date.now();
-        // 速度按 ~500ms 滑窗算,平滑不抖。
         if (now - winT >= 500) {
           bytesPerSec = (transferred - winBytes) / ((now - winT) / 1000);
           winT = now; winBytes = transferred;
         }
-        // 节流:每 ~120ms 或下载完才推一次(够顺滑又不刷爆 IPC)。
         if (now - lastEmit >= 120 || transferred === total) {
           lastEmit = now;
           const percent = total ? Math.min(100, Math.floor((transferred / total) * 100)) : 0;
@@ -177,15 +192,43 @@ function download(url, dest, onProgress, redirects = 0) {
           try { onProgress && onProgress({ percent, transferred, total, bytesPerSec, etaSec }); } catch {}
         }
       });
+      res.on("error", (e) => { f.close(); reject(e); });
       res.pipe(f);
-      f.on("finish", () => f.close(() => resolve()));
-      f.on("error", (e) => { try { fs.unlinkSync(dest); } catch {} reject(e); });
+      f.on("finish", () => f.close(() => resolve({ transferred, total })));
+      f.on("error", (e) => reject(e));
     });
-    req.on("error", (e) => { try { fs.unlinkSync(dest); } catch {} reject(e); });
+    req.on("error", reject);
     req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
   });
 }
 
+const DOWNLOAD_ATTEMPTS = 6;
+
+async function download(url, dest, onProgress) {
+  let lastErr = null;
+  for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt++) {
+    let have = 0;
+    try { have = fs.statSync(dest).size; } catch {}
+    try {
+      const r = await downloadOnce(url, dest, onProgress, have);
+      // A truncated body that ends cleanly still resolves, so only stop when the
+      // file is actually as long as the server said.
+      if (!r.total || r.transferred >= r.total) return;
+      lastErr = new Error(`short read ${r.transferred}/${r.total}`);
+    } catch (e) {
+      lastErr = e;
+    }
+    let now = 0;
+    try { now = fs.statSync(dest).size; } catch {}
+    log.warn(`[app-updater] download attempt ${attempt}/${DOWNLOAD_ATTEMPTS} failed (${lastErr.message}); have ${now} bytes`);
+    if (now <= have && attempt > 1) {
+      // two passes in a row moved nothing — the source is not just slow.
+      try { fs.unlinkSync(dest); } catch {}
+    }
+  }
+  throw lastErr || new Error("download failed");
+}
+
 // ── 状态机 + 广播 ─────────────────────────────────────────────────────────────
 let _win = null;
 let _state = { status: "idle", version: null, current: null, progress: null, filePath: null, error: null, autoUpdate: false, auto: false };
@@ -269,6 +312,12 @@ async function downloadUpdate() {
     // 逐个候选试(R2 → GitHub → 镜像):一个源断了就换下一个,全断才算失败。
     let lastErr = null;
     for (const url of urls) {
+      // Resume is per-SOURCE. The candidates are the same artifact today (CI
+      // uploads one exe under two names), but appending bytes from a second host
+      // onto a partial from the first would silently produce a corrupt installer
+      // the moment that stops being true — and nothing here verifies a hash
+      // before running it. Start each source from zero.
+      try { fs.unlinkSync(dest); } catch {}
       try {
         log.info(`[app-updater] downloading ${url} → ${dest}`);
         await download(url, dest, (p) => broadcast({ status: "downloading", progress: p }));

package/test/app-updater-resume.test.js

@@ -0,0 +1,64 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// One https.get with a 30s socket timeout used to BE the download, so a single
+// stall failed the update for good. Observed in production: a node logged
+// "download failed: timeout" every 30 minutes across several releases while its
+// link served byte ranges from the same CDN perfectly well — it just could not
+// carry 125MB inside one socket. The download now retries and resumes.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "app-updater.js"), "utf8");
+const once = src.slice(
+  src.indexOf("function downloadOnce"),
+  src.indexOf("const DOWNLOAD_ATTEMPTS")
+);
+const outer = src.slice(
+  src.indexOf("async function download(url, dest, onProgress)"),
+  src.indexOf("// ── 状态机")
+);
+
+test("a resumed request asks for the missing range and appends", () => {
+  assert.match(once, /if \(startAt > 0\) headers\.Range = `bytes=\$\{startAt\}-`/);
+  assert.match(once, /const resuming = res\.statusCode === 206/);
+  assert.match(once, /fs\.createWriteStream\(dest, resuming \? \{ flags: "a" \} : \{\}\)/);
+});
+
+test("a server that ignores Range restarts the file instead of corrupting it", () => {
+  // 200 + startAt means the body is the WHOLE file; appending it after a partial
+  // would produce a longer, broken installer that still "downloads fine".
+  assert.match(once, /const base = resuming \? startAt : 0/);
+  assert.match(once, /const total = base \+ len/); // progress counts what is already on disk
+  assert.match(once, /if \(res\.statusCode !== 200 && !resuming\)/);
+});
+
+test("progress and completion are judged against the real total", () => {
+  assert.match(once, /resolve\(\{ transferred, total \}\)/);
+  // A truncated body ends the stream cleanly, so finishing early must not count.
+  assert.match(outer, /if \(!r\.total \|\| r\.transferred >= r\.total\) return/);
+  assert.match(outer, /short read \$\{r\.transferred\}\/\$\{r\.total\}/);
+});
+
+test("retries resume from disk, and give up only when nothing moves", () => {
+  assert.match(outer, /for \(let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt\+\+\)/);
+  assert.match(outer, /have = fs\.statSync\(dest\)\.size/);
+  assert.match(outer, /downloadOnce\(url, dest, onProgress, have\)/);
+  assert.match(outer, /if \(now <= have && attempt > 1\)/); // no progress twice → drop the partial
+  assert.match(src, /DOWNLOAD_ATTEMPTS = 6/);
+});
+
+test("switching source discards the partial rather than appending across hosts", () => {
+  const dl = src.slice(
+    src.indexOf("async function downloadUpdate"),
+    src.indexOf("function installNow")
+  );
+  const loop = dl.slice(dl.indexOf("for (const url of urls)"));
+  assert.match(loop, /fs\.unlinkSync\(dest\)/);
+  assert.ok(
+    loop.indexOf("fs.unlinkSync(dest)") < loop.indexOf("await download(url, dest"),
+    "the partial must be cleared BEFORE the next source starts"
+  );
+});