cicy-desktop 2.1.334 → 2.1.336

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.334",
+  "version": "2.1.336",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/app-updater.js

@@ -146,30 +146,45 @@ async function firstReachable(urls) {
   return null;
 }
 
-// ── 下载(带进度,跟随重定向)──────────────────────────────────────────────────
-function download(url, dest, onProgress, redirects = 0) {
+// ── 下载(带进度、跟随重定向、断点续传)────────────────────────────────────
+// A single https.get with a 30s socket timeout used to BE the download: one
+// stall on a slow mirror and the update failed for good. That is not
+// theoretical — a fleet node sat on an old build for several releases with
+// "download failed: timeout" every 30 minutes, because its link to the CDN
+// could serve ranges fine but never sustained the whole 125MB inside one
+// socket. So: retry, and resume from what already landed instead of starting
+// over. A slow link now takes several passes and still finishes.
+function downloadOnce(url, dest, onProgress, startAt, redirects = 0) {
   return new Promise((resolve, reject) => {
     if (redirects > 6) return reject(new Error("too many redirects"));
-    const f = fs.createWriteStream(dest);
-    const req = https.get(url, { headers: { "User-Agent": "cicy-desktop" }, timeout: 30000 }, (res) => {
+    const headers = { "User-Agent": "cicy-desktop" };
+    if (startAt > 0) headers.Range = `bytes=${startAt}-`;
+    const req = https.get(url, { headers, timeout: 30000 }, (res) => {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        f.close(); try { fs.unlinkSync(dest); } catch {}
-        return download(res.headers.location, dest, onProgress, redirects + 1).then(resolve, reject);
+        res.resume();
+        return downloadOnce(res.headers.location, dest, onProgress, startAt, redirects + 1).then(resolve, reject);
+      }
+      // 206 = the server honoured the range → append. 200 with startAt means it
+      // ignored it → start the file over rather than corrupt it by appending.
+      const resuming = res.statusCode === 206;
+      if (res.statusCode !== 200 && !resuming) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode}`));
       }
-      if (res.statusCode !== 200) { f.close(); try { fs.unlinkSync(dest); } catch {} return reject(new Error(`HTTP ${res.statusCode}`)); }
-      const total = parseInt(res.headers["content-length"] || "0", 10) || 0;
-      let transferred = 0, lastEmit = 0;
+      const base = resuming ? startAt : 0;
+      const f = fs.createWriteStream(dest, resuming ? { flags: "a" } : {});
+      const len = parseInt(res.headers["content-length"] || "0", 10) || 0;
+      const total = base + len;
+      let transferred = base, lastEmit = 0;
       const startT = Date.now();
-      let winT = startT, winBytes = 0, bytesPerSec = 0;
+      let winT = startT, winBytes = transferred, bytesPerSec = 0;
       res.on("data", (chunk) => {
         transferred += chunk.length;
         const now = Date.now();
-        // 速度按 ~500ms 滑窗算,平滑不抖。
         if (now - winT >= 500) {
           bytesPerSec = (transferred - winBytes) / ((now - winT) / 1000);
           winT = now; winBytes = transferred;
         }
-        // 节流:每 ~120ms 或下载完才推一次(够顺滑又不刷爆 IPC)。
         if (now - lastEmit >= 120 || transferred === total) {
           lastEmit = now;
           const percent = total ? Math.min(100, Math.floor((transferred / total) * 100)) : 0;
@@ -177,15 +192,43 @@ function download(url, dest, onProgress, redirects = 0) {
           try { onProgress && onProgress({ percent, transferred, total, bytesPerSec, etaSec }); } catch {}
         }
       });
+      res.on("error", (e) => { f.close(); reject(e); });
       res.pipe(f);
-      f.on("finish", () => f.close(() => resolve()));
-      f.on("error", (e) => { try { fs.unlinkSync(dest); } catch {} reject(e); });
+      f.on("finish", () => f.close(() => resolve({ transferred, total })));
+      f.on("error", (e) => reject(e));
     });
-    req.on("error", (e) => { try { fs.unlinkSync(dest); } catch {} reject(e); });
+    req.on("error", reject);
     req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
   });
 }
 
+const DOWNLOAD_ATTEMPTS = 6;
+
+async function download(url, dest, onProgress) {
+  let lastErr = null;
+  for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt++) {
+    let have = 0;
+    try { have = fs.statSync(dest).size; } catch {}
+    try {
+      const r = await downloadOnce(url, dest, onProgress, have);
+      // A truncated body that ends cleanly still resolves, so only stop when the
+      // file is actually as long as the server said.
+      if (!r.total || r.transferred >= r.total) return;
+      lastErr = new Error(`short read ${r.transferred}/${r.total}`);
+    } catch (e) {
+      lastErr = e;
+    }
+    let now = 0;
+    try { now = fs.statSync(dest).size; } catch {}
+    log.warn(`[app-updater] download attempt ${attempt}/${DOWNLOAD_ATTEMPTS} failed (${lastErr.message}); have ${now} bytes`);
+    if (now <= have && attempt > 1) {
+      // two passes in a row moved nothing — the source is not just slow.
+      try { fs.unlinkSync(dest); } catch {}
+    }
+  }
+  throw lastErr || new Error("download failed");
+}
+
 // ── 状态机 + 广播 ─────────────────────────────────────────────────────────────
 let _win = null;
 let _state = { status: "idle", version: null, current: null, progress: null, filePath: null, error: null, autoUpdate: false, auto: false };
@@ -269,6 +312,12 @@ async function downloadUpdate() {
     // 逐个候选试(R2 → GitHub → 镜像):一个源断了就换下一个,全断才算失败。
     let lastErr = null;
     for (const url of urls) {
+      // Resume is per-SOURCE. The candidates are the same artifact today (CI
+      // uploads one exe under two names), but appending bytes from a second host
+      // onto a partial from the first would silently produce a corrupt installer
+      // the moment that stops being true — and nothing here verifies a hash
+      // before running it. Start each source from zero.
+      try { fs.unlinkSync(dest); } catch {}
       try {
         log.info(`[app-updater] downloading ${url} → ${dest}`);
         await download(url, dest, (p) => broadcast({ status: "downloading", progress: p }));
@@ -291,11 +340,40 @@ async function downloadUpdate() {
 
 // 用户点「安装」:拉起原生安装器(win NSIS / mac pkg)并退出 app;linux AppImage 在
 // 文件管理器里定位(AppImage 非安装器,用户自行替换运行)。
+// Windows install + relaunch, as ONE detached chain.
+//
+// shell.openPath() ran the NSIS installer INTERACTIVELY: on a machine with
+// nobody at the keyboard that is a wizard waiting forever for a click, and even
+// when it did install, nothing started the app again — NSIS runAfterFinish does
+// not fire on a /S install. Both together are why an unattended node that took
+// an update simply never came back; it had to be started by hand, and a headless
+// box has no hand. Observed on most of the fleet.
+//
+// So: /S for the install, and we own the relaunch. The chain is detached and in
+// its own process group, so it outlives the app the installer is about to kill;
+// cmd waits for the installer (no `start` on that leg), then gives Windows a
+// moment to release the files before launching the new exe hidden.
+function installWindows(installer) {
+  const { spawn } = require("child_process");
+  const exe = process.execPath;
+  const chain = `"${installer}" /S & timeout /t 20 /nobreak >nul & start "" "${exe}" --hidden`;
+  const ch = spawn(process.env.COMSPEC || "cmd.exe", ["/c", chain], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true,
+  });
+  ch.unref();
+  log.info(`[app-updater] silent install + relaunch chain started (pid ${ch.pid})`);
+  // Quit so the installer can replace the files it is about to overwrite.
+  setTimeout(() => { try { app.quit(); } catch {} }, 1500);
+}
+
 function installNow() {
   const f = _state.filePath;
   if (!f) return;
   try {
     if (process.platform === "linux") { shell.showItemInFolder(f); return; }
+    if (process.platform === "win32") { installWindows(f); return; }
     shell.openPath(f).then((err) => {
       if (err) log.warn("[app-updater] openPath failed:", err);
       else setTimeout(() => { try { app.quit(); } catch {} }, 800);

package/test/app-updater-install-relaunch.test.js

@@ -0,0 +1,59 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// installNow() used shell.openPath() on the NSIS installer. On a machine with
+// nobody at the keyboard that is an interactive wizard waiting forever for a
+// click; and even when it did install, nothing started the app again, because
+// NSIS runAfterFinish does not fire on a /S install. Both together are why an
+// unattended node that took an update never came back — observed across most of
+// the fleet, each box needing a manual start.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "app-updater.js"), "utf8");
+const win = src.slice(src.indexOf("function installWindows"), src.indexOf("function installNow"));
+
+test("windows installs silently instead of opening a wizard nobody can click", () => {
+  assert.match(win, /"\$\{installer\}" \/S/);
+  const now = src.slice(src.indexOf("function installNow"), src.indexOf("module.exports"));
+  assert.match(now, /if \(process\.platform === "win32"\) \{ installWindows\(f\); return; \}/);
+  // the interactive path must no longer be what Windows takes
+  assert.ok(
+    now.indexOf('process.platform === "win32"') < now.indexOf("shell.openPath"),
+    "win32 must be handled before the openPath fallback"
+  );
+});
+
+test("the relaunch is part of the same detached chain, so it outlives the app", () => {
+  // The installer kills this process; a child in this process group would die
+  // with it and the machine would stay down.
+  assert.match(win, /detached: true/);
+  assert.match(win, /ch\.unref\(\)/);
+  assert.match(win, /start "" "\$\{exe\}" --hidden/);
+  assert.match(win, /windowsHide: true/);
+});
+
+test("the chain waits for the installer before relaunching", () => {
+  // No `start` on the installer leg → cmd blocks on it; then a pause so Windows
+  // releases the replaced files before the new exe runs.
+  assert.doesNotMatch(win, /start "" "\$\{installer\}"/);
+  assert.match(win, /timeout \/t 20 \/nobreak/);
+  const order = [win.indexOf("/S"), win.indexOf("timeout /t"), win.indexOf('start "" "${exe}"')];
+  assert.ok(order[0] < order[1] && order[1] < order[2], "install → wait → relaunch, in that order");
+});
+
+test("the app quits so the installer can replace its files", () => {
+  assert.match(win, /app\.quit\(\)/);
+  assert.match(win, /setTimeout\(\(\) => \{ try \{ app\.quit\(\); \} catch \{\} \}, 1500\)/);
+});
+
+test("mac and linux keep their existing behaviour", () => {
+  const now = src.slice(src.indexOf("function installNow"), src.indexOf("module.exports"));
+  assert.match(
+    now,
+    /if \(process\.platform === "linux"\) \{ shell\.showItemInFolder\(f\); return; \}/
+  );
+  assert.match(now, /shell\.openPath\(f\)/); // mac pkg still opens the GUI installer
+});

package/test/app-updater-resume.test.js

@@ -0,0 +1,64 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// One https.get with a 30s socket timeout used to BE the download, so a single
+// stall failed the update for good. Observed in production: a node logged
+// "download failed: timeout" every 30 minutes across several releases while its
+// link served byte ranges from the same CDN perfectly well — it just could not
+// carry 125MB inside one socket. The download now retries and resumes.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "app-updater.js"), "utf8");
+const once = src.slice(
+  src.indexOf("function downloadOnce"),
+  src.indexOf("const DOWNLOAD_ATTEMPTS")
+);
+const outer = src.slice(
+  src.indexOf("async function download(url, dest, onProgress)"),
+  src.indexOf("// ── 状态机")
+);
+
+test("a resumed request asks for the missing range and appends", () => {
+  assert.match(once, /if \(startAt > 0\) headers\.Range = `bytes=\$\{startAt\}-`/);
+  assert.match(once, /const resuming = res\.statusCode === 206/);
+  assert.match(once, /fs\.createWriteStream\(dest, resuming \? \{ flags: "a" \} : \{\}\)/);
+});
+
+test("a server that ignores Range restarts the file instead of corrupting it", () => {
+  // 200 + startAt means the body is the WHOLE file; appending it after a partial
+  // would produce a longer, broken installer that still "downloads fine".
+  assert.match(once, /const base = resuming \? startAt : 0/);
+  assert.match(once, /const total = base \+ len/); // progress counts what is already on disk
+  assert.match(once, /if \(res\.statusCode !== 200 && !resuming\)/);
+});
+
+test("progress and completion are judged against the real total", () => {
+  assert.match(once, /resolve\(\{ transferred, total \}\)/);
+  // A truncated body ends the stream cleanly, so finishing early must not count.
+  assert.match(outer, /if \(!r\.total \|\| r\.transferred >= r\.total\) return/);
+  assert.match(outer, /short read \$\{r\.transferred\}\/\$\{r\.total\}/);
+});
+
+test("retries resume from disk, and give up only when nothing moves", () => {
+  assert.match(outer, /for \(let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt\+\+\)/);
+  assert.match(outer, /have = fs\.statSync\(dest\)\.size/);
+  assert.match(outer, /downloadOnce\(url, dest, onProgress, have\)/);
+  assert.match(outer, /if \(now <= have && attempt > 1\)/); // no progress twice → drop the partial
+  assert.match(src, /DOWNLOAD_ATTEMPTS = 6/);
+});
+
+test("switching source discards the partial rather than appending across hosts", () => {
+  const dl = src.slice(
+    src.indexOf("async function downloadUpdate"),
+    src.indexOf("function installNow")
+  );
+  const loop = dl.slice(dl.indexOf("for (const url of urls)"));
+  assert.match(loop, /fs\.unlinkSync\(dest\)/);
+  assert.ok(
+    loop.indexOf("fs.unlinkSync(dest)") < loop.indexOf("await download(url, dest"),
+    "the partial must be cleared BEFORE the next source starts"
+  );
+});