cicy-desktop 2.1.337 → 2.1.339

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.337",
+  "version": "2.1.339",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/src/app-updater.js

@@ -229,6 +229,41 @@ async function download(url, dest, onProgress) {
   throw lastErr || new Error("download failed");
 }
 
+// ── 自动安装的循环闸 ─────────────────────────────────────────────────────────
+// Auto-install kills the app by design (an installer cannot replace a running
+// exe). So if an install does NOT land, the app comes back on the old version,
+// the next check() tries the same thing, and the machine is stuck in a restart
+// loop that closes the user's window every time. That is not hypothetical — it
+// took the whole fleet down. The attempt is therefore remembered ACROSS
+// restarts, and a version that has already failed twice is not auto-installed
+// again until the cooldown passes; the update is still offered, just not forced.
+const AUTO_TRY_MAX = 2;
+const AUTO_TRY_COOLDOWN_MS = 6 * 60 * 60 * 1000;
+
+function readAutoTry() {
+  try { return readGlobalConfig(GLOBAL_JSON)?.desktopAutoInstall || {}; } catch { return {}; }
+}
+function noteAutoTry(version) {
+  const cur = readAutoTry();
+  const count = cur.version === version ? (cur.count || 0) + 1 : 1;
+  try {
+    updateGlobalConfig(GLOBAL_JSON, (c) => ({
+      ...(c || {}),
+      desktopAutoInstall: { version, count, at: Date.now() },
+    }));
+  } catch {}
+  return count;
+}
+function clearAutoTry() {
+  try { updateGlobalConfig(GLOBAL_JSON, (c) => { const n = { ...(c || {}) }; delete n.desktopAutoInstall; return n; }); } catch {}
+}
+function autoInstallAllowed(version) {
+  const t = readAutoTry();
+  if (t.version !== version) return true;
+  if ((t.count || 0) < AUTO_TRY_MAX) return true;
+  return Date.now() - (t.at || 0) > AUTO_TRY_COOLDOWN_MS;
+}
+
 // ── 状态机 + 广播 ─────────────────────────────────────────────────────────────
 let _win = null;
 let _state = { status: "idle", version: null, current: null, progress: null, filePath: null, error: null, autoUpdate: false, auto: false };
@@ -260,6 +295,9 @@ function init(mainWin) {
   _win = mainWin;
   _state.current = app.getVersion();
   _state.autoUpdate = getAutoUpdate();
+  // Running the version we last tried to install = that attempt worked; forget
+  // it so a future update to the same number is never wrongly blocked.
+  try { if (readAutoTry().version === _state.current) clearAutoTry(); } catch {}
   setTimeout(() => check().catch(() => {}), 15_000);      // 启动后探一次
   setInterval(() => check().catch(() => {}), 30 * 60 * 1000); // 每 30 分钟
 }
@@ -279,10 +317,15 @@ async function check() {
         log.info(`[app-updater] ${latest} 安装包就绪:${ready}`);
         broadcast({ status: "available", version: latest, current, progress: null, filePath: null, autoUpdate: getAutoUpdate(), auto: false });
         if (getAutoUpdate()) {
-          log.info(`[app-updater] auto-update on → downloading ${latest} and installing without asking`);
-          broadcast({ auto: true });
-          await downloadUpdate();
-          if (_state.status === "ready") installNow();
+          if (!autoInstallAllowed(latest)) {
+            log.warn(`[app-updater] ${latest} 已自动安装失败 ${AUTO_TRY_MAX} 次,冷却中 — 只提示不再自动装(避免反复关闭 app)`);
+          } else {
+            const n = noteAutoTry(latest);
+            log.info(`[app-updater] auto-update on → downloading ${latest} and installing without asking (attempt ${n}/${AUTO_TRY_MAX})`);
+            broadcast({ auto: true });
+            await downloadUpdate();
+            if (_state.status === "ready") installNow();
+          }
         }
       } else { log.info(`[app-updater] ${latest} 版本号已更新但所有来源都拿不到安装包(HEAD 非 200):${urls.join(" , ")} — 暂不提示更新`); broadcast({ status: "up-to-date", version: current, current }); }
     } else {
@@ -340,32 +383,47 @@ async function downloadUpdate() {
 
 // 用户点「安装」:拉起原生安装器(win NSIS / mac pkg)并退出 app;linux AppImage 在
 // 文件管理器里定位(AppImage 非安装器,用户自行替换运行)。
-// Windows install + relaunch, as ONE detached chain.
+// Windows install + relaunch, as one hidden chain.
 //
 // shell.openPath() ran the NSIS installer INTERACTIVELY: on a machine with
 // nobody at the keyboard that is a wizard waiting forever for a click, and even
 // when it did install, nothing started the app again — NSIS runAfterFinish does
 // not fire on a /S install. Both together are why an unattended node that took
-// an update simply never came back; it had to be started by hand, and a headless
-// box has no hand. Observed on most of the fleet.
+// an update never came back; it had to be started by hand, and a headless box
+// has no hand.
 //
-// So: /S for the install, and we own the relaunch. The chain is detached and in
-// its own process group, so it outlives the app the installer is about to kill;
-// cmd waits for the installer (no `start` on that leg), then gives Windows a
-// moment to release the files before launching the new exe hidden.
+// The chain must also be INVISIBLE. Doing it with spawn(detached:true) put a
+// black console on screen counting down for 20 seconds during every update:
+// on Windows `detached` means CREATE_NEW_CONSOLE, which windowsHide cannot
+// suppress. So it goes through wscript + a one-line VBS with window style 0 —
+// the same hidden-launch trick writeSourceAutostartVbs() already uses — which
+// is genuinely windowless and detached from this process either way.
 function installWindows(installer) {
   const { spawn } = require("child_process");
   const exe = process.execPath;
-  const chain = `"${installer}" /S & timeout /t 20 /nobreak >nul & start "" "${exe}" --hidden`;
-  const ch = spawn(process.env.COMSPEC || "cmd.exe", ["/c", chain], {
+  const dir = path.join(process.env.LOCALAPPDATA || os.homedir(), "cicy-desktop");
+  fs.mkdirSync(dir, { recursive: true });
+  const vbs = path.join(dir, "update-install.vbs");
+  // VBS escapes a double quote by doubling it. cmd waits for the installer (no
+  // `start` on that leg), then the pause lets Windows release the replaced
+  // files before the new exe runs hidden.
+  // Wait for THIS process to exit before the installer starts: it cannot replace
+  // a running exe, and previously the chain and app.quit() raced — the installer
+  // could begin while the app was still up, fail, and leave the version
+  // unchanged, which is what fed the restart loop.
+  const cmd =
+    `cmd /c "timeout /t 8 /nobreak >nul & "${installer}" /S & timeout /t 20 /nobreak >nul & start "" "${exe}" --hidden"`;
+  const line = `sh.Run "${cmd.replace(/"/g, '""')}", 0, False`;
+  fs.writeFileSync(vbs, ['Set sh = CreateObject("WScript.Shell")', line, ""].join("\r\n"));
+  const ch = spawn("wscript.exe", ["//B", "//Nologo", vbs], {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
   });
   ch.unref();
-  log.info(`[app-updater] silent install + relaunch chain started (pid ${ch.pid})`);
-  // Quit so the installer can replace the files it is about to overwrite.
-  setTimeout(() => { try { app.quit(); } catch {} }, 1500);
+  log.info(`[app-updater] hidden install + relaunch chain started (pid ${ch.pid})`);
+  // Quit promptly — the chain waits 8s for us before touching anything.
+  setTimeout(() => { try { app.quit(); } catch {} }, 500);
 }
 
 function installNow() {

package/test/app-updater-install-relaunch.test.js

@@ -26,6 +26,17 @@ test("windows installs silently instead of opening a wizard nobody can click", (
   );
 });
 
+test("the chain is windowless — no console flashes during an update", () => {
+  // Regression: doing this with spawn(detached:true) put a black console on
+  // screen counting down for 20s on every update. On Windows `detached` means
+  // CREATE_NEW_CONSOLE, which windowsHide cannot suppress, so the runner has to
+  // be wscript + a window-style-0 VBS (same trick as writeSourceAutostartVbs).
+  assert.match(win, /spawn\("wscript\.exe", \["\/\/B", "\/\/Nologo", vbs\]/);
+  assert.match(win, /sh\.Run "\$\{cmd\.replace\(\/"\/g, '""'\)\}", 0, False/);
+  assert.match(win, /CreateObject\("WScript\.Shell"\)/);
+  assert.doesNotMatch(win, /spawn\(process\.env\.COMSPEC/); // the visible-console version
+});
+
 test("the relaunch is part of the same detached chain, so it outlives the app", () => {
   // The installer kills this process; a child in this process group would die
   // with it and the machine would stay down.
@@ -35,18 +46,31 @@ test("the relaunch is part of the same detached chain, so it outlives the app",
   assert.match(win, /windowsHide: true/);
 });
 
-test("the chain waits for the installer before relaunching", () => {
-  // No `start` on the installer leg → cmd blocks on it; then a pause so Windows
-  // releases the replaced files before the new exe runs.
+test("the chain is quit → install → settle → relaunch, in that order", () => {
+  // Three waits, each load-bearing:
+  //  8s  — this process must be GONE before the installer starts. Racing it is
+  //        what made installs fail, and a failed install fed the restart loop
+  //        that took the fleet down.
+  //  20s — let Windows release the replaced files before the new exe runs.
+  // No `start` on the installer leg, so cmd blocks until the install finishes.
   assert.doesNotMatch(win, /start "" "\$\{installer\}"/);
+  assert.match(win, /timeout \/t 8 \/nobreak >nul & "\$\{installer\}" \/S/);
   assert.match(win, /timeout \/t 20 \/nobreak/);
-  const order = [win.indexOf("/S"), win.indexOf("timeout /t"), win.indexOf('start "" "${exe}"')];
-  assert.ok(order[0] < order[1] && order[1] < order[2], "install → wait → relaunch, in that order");
+  const preWait = win.indexOf("timeout /t 8");
+  const install = win.indexOf('"${installer}" /S');
+  const settle = win.indexOf("timeout /t 20");
+  const relaunch = win.indexOf('start "" "${exe}"');
+  assert.ok(
+    preWait < install && install < settle && settle < relaunch,
+    "quit → install → settle → relaunch"
+  );
 });
 
-test("the app quits so the installer can replace its files", () => {
+test("the app quits promptly, well inside the chain's 8s head start", () => {
   assert.match(win, /app\.quit\(\)/);
-  assert.match(win, /setTimeout\(\(\) => \{ try \{ app\.quit\(\); \} catch \{\} \}, 1500\)/);
+  const m = win.match(/\}, (\d+)\);/);
+  assert.ok(m, "quit is scheduled");
+  assert.ok(Number(m[1]) < 8000, `quit delay ${m[1]}ms must be under the 8s head start`);
 });
 
 test("mac and linux keep their existing behaviour", () => {

package/test/app-updater-loop-guard.test.js

@@ -0,0 +1,55 @@
+// Copyright 2026 CiCy AI
+// SPDX-License-Identifier: Apache-2.0
+
+// Auto-install kills the app by design — an installer cannot replace a running
+// exe. So when an install does NOT land, the app comes back on the old version,
+// the next check() tries the same thing, and the machine sits in a restart loop
+// that closes the user's window every time. That is exactly what happened: the
+// fleet flapped up/down until every node was gone. A destructive automatic
+// action needs a stop condition, and it had none.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const src = fs.readFileSync(path.join(__dirname, "..", "src", "app-updater.js"), "utf8");
+
+test("the same version is not auto-installed forever", () => {
+  assert.match(src, /AUTO_TRY_MAX = 2/);
+  assert.match(src, /AUTO_TRY_COOLDOWN_MS = 6 \* 60 \* 60 \* 1000/);
+  const fn = src.slice(src.indexOf("function autoInstallAllowed"), src.indexOf("// ── 状态机"));
+  assert.match(fn, /if \(t\.version !== version\) return true/); // a new version always may
+  assert.match(fn, /if \(\(t\.count \|\| 0\) < AUTO_TRY_MAX\) return true/);
+  assert.match(fn, /Date\.now\(\) - \(t\.at \|\| 0\) > AUTO_TRY_COOLDOWN_MS/);
+});
+
+test("the attempt count survives the restart the install itself causes", () => {
+  // In-memory state would reset on every relaunch, which is precisely the thing
+  // the loop does — so the counter has to be on disk.
+  assert.match(src, /desktopAutoInstall: \{ version, count, at: Date\.now\(\) \}/);
+  assert.match(src, /readGlobalConfig\(GLOBAL_JSON\)\?\.desktopAutoInstall/);
+});
+
+test("check() gates the auto path and still offers the update", () => {
+  const chk = src.slice(
+    src.indexOf("async function check()"),
+    src.indexOf("async function downloadUpdate")
+  );
+  assert.match(chk, /if \(!autoInstallAllowed\(latest\)\) \{/);
+  assert.match(chk, /noteAutoTry\(latest\)/);
+  // blocked = do not install; the "available" broadcast above still happened, so
+  // the user can update by hand.
+  assert.ok(
+    chk.indexOf("autoInstallAllowed") < chk.indexOf("await downloadUpdate()"),
+    "the gate must come before the download"
+  );
+});
+
+test("a landed install clears the record", () => {
+  const init = src.slice(
+    src.indexOf("function init(mainWin)"),
+    src.indexOf("async function check()")
+  );
+  assert.match(init, /readAutoTry\(\)\.version === _state\.current/);
+  assert.match(init, /clearAutoTry\(\)/);
+});