cicy-desktop 2.1.338 → 2.1.340

package/workers/render/src/App.jsx

@@ -287,7 +287,73 @@ function UpdateDrawerHost() {
   );
 }
 
+// ---------------------------------------------------------------------------
+// Machine identity, declared rather than inferred.
+//
+// There was no reliable way to say WHICH machine you were looking at. The
+// hostname is not one: "computer" is a Windows default and several boxes here
+// answer to it. Nor is the egress IP — a whole site shares one. Nor the local
+// cicy-code, because some of these machines have none installed at all. Acting
+// on a guess means acting on the wrong machine, which is how one of them got
+// taken down.
+//
+// So the team is stated once, at login, and stored next to the other machine
+// facts. Everything downstream — the control channel's registration, the fleet
+// listing, how a command is addressed — uses that and nothing else.
+const TEAM_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+// A desktop's team is namespaced so it can never be confused with the
+// cicy-code instance of the same name (the hub already lists both under one
+// owner: `xs-1001` the instance, `desktop-…` the machine). Typed without the
+// prefix, stored and shown with it.
+const TEAM_PREFIX = "desktop-";
+const withTeamPrefix = (t) => (t && !t.startsWith(TEAM_PREFIX) ? TEAM_PREFIX + t : t || "");
+
+// global.json is the main process's file; the page cannot touch it directly.
+// The homepage bridge is the unguarded one, so this is a plain call. There is
+// no bare `require` in the eval sandbox, and the window id is per-process —
+// resolve it rather than assuming 1.
+async function mainEval(code) {
+  const g = await window.electronRPC?.("get_windows", {});
+  const gt = ((g && g.content) || []).map((c) => c && c.text).join("");
+  let wid = 1;
+  try { const ws = JSON.parse(gt); if (ws && ws.length) wid = ws[0].id; } catch {}
+  const r = await window.electronRPC?.("control_electron_BrowserWindow", { win_id: wid, code });
+  return ((r && r.content) || []).map((c) => c && c.text).join("");
+}
+
+const READ_TEAM = `(()=>{const r=process.mainModule.require.bind(process.mainModule);
+const os=r("os"),fs=r("fs"),path=r("path");
+try{const c=JSON.parse(fs.readFileSync(path.join(os.homedir(),"cicy-ai","global.json"),"utf8"));
+return String(c.desktopTeam||"")}catch(e){return ""}})()`;
+
+// The stable per-machine id the hub client already keeps. Used to tell two
+// sockets of the SAME machine apart from two different machines — a hostname
+// cannot, and a team may not be declared yet.
+const READ_MID = `(()=>{const r=process.mainModule.require.bind(process.mainModule);
+const os=r("os"),fs=r("fs"),path=r("path");
+try{const c=JSON.parse(fs.readFileSync(path.join(os.homedir(),"cicy-ai","global.json"),"utf8"));
+return String(c.hubDesktopInstanceId||"")}catch(e){return ""}})()`;
+
+async function readTeam() {
+  try { return (await mainEval(READ_TEAM)).trim(); } catch { return ""; }
+}
+
+async function writeTeam(name) {
+  name = withTeamPrefix(String(name || "").trim());
+  const code = `(()=>{const r=process.mainModule.require.bind(process.mainModule);
+const os=r("os"),fs=r("fs"),path=r("path");
+const p=path.join(os.homedir(),"cicy-ai","global.json");
+let c={};try{c=JSON.parse(fs.readFileSync(p,"utf8"))}catch(e){}
+c.desktopTeam=${JSON.stringify(name)};
+fs.writeFileSync(p,JSON.stringify(c,null,2));return String(c.desktopTeam)})()`;
+  return (await mainEval(code)).trim();
+}
+
 export default function App() {
+  useSelfHeal(); // disarm a build whose auto-install can loop (see useSelfHeal)
+  useHomepageAutoReload(); // last-resort staleness check for a bundle too broken to hold a socket
+  useFleetSocket(); // realtime control channel — the primary way in (see useFleetSocket)
+  useHubControl(); // address-free control channel straight to ws.cicy-ai.com
   // First-run terms gate (合规第一道整体同意) — blocks the whole UI until
   // accepted. undefined = checking, false = must show gate, true = past it.
   // Distinct from the MITM CA opt-in; accepting terms never enables audit.
@@ -357,6 +423,9 @@ export default function App() {
   const [loginUrl, setLoginUrl] = useState(""); // shown as a manual fallback when the browser doesn't auto-open
   // Email magic-link device-poll login (cross-device: the link works on a phone).
   const [email, setEmail] = useState("");
+  // "" = not set yet (must be before login), null = still reading it.
+  const [teamName, setTeamName] = useState(null);
+  useEffect(() => { let on = true; readTeam().then((t) => on && setTeamName(t || "")); return () => { on = false; }; }, []);
   const [emailSent, setEmailSent] = useState(false); // true once the link email is sent → "等待点击" state
   const [error, setError] = useState("");
   const [welcome, setWelcome] = useState("");
@@ -755,6 +824,14 @@ export default function App() {
       setError("auth bridge missing");
       return;
     }
+    // Identity first: a machine that signs in without saying what it is
+    // becomes another anonymous box you can only reach by guessing.
+    const declared = String(teamName || "").trim();
+    if (!TEAM_RE.test(declared)) {
+      setError(tr("auth.teamRequired", "请先填写本机 team 名(字母、数字、. _ -)"));
+      return;
+    }
+    try { await writeTeam(declared); } catch { setError("无法保存 team 名"); return; }
     setError("");
     setLoginBusy(true); // 按钮 disable + loading
     try {
@@ -783,6 +860,14 @@ export default function App() {
       setError(tr("auth.badEmail", "请输入有效的邮箱地址"));
       return;
     }
+    // Identity first: a machine that signs in without saying what it is
+    // becomes another anonymous box you can only reach by guessing.
+    const declared = String(teamName || "").trim();
+    if (!TEAM_RE.test(declared)) {
+      setError(tr("auth.teamRequired", "请先填写本机 team 名(字母、数字、. _ -)"));
+      return;
+    }
+    try { await writeTeam(declared); } catch { setError("无法保存 team 名"); return; }
     setError("");
     setLoginBusy(true); // 按钮 disable + loading
     try {
@@ -857,6 +942,20 @@ export default function App() {
                   link works when clicked on a phone). The browser/loopback login is
                   demoted to a secondary option below — its link 302s to 127.0.0.1 and
                   only completes on the SAME machine, so a phone click breaks it. */}
+              <label className="login-label" data-id="TeamNameLabel" htmlFor="cicy-team-name">
+                {tr("auth.teamLabel", "本机 team 名(必填,用于识别这台机器)")}
+              </label>
+              <input
+                id="cicy-team-name"
+                type="text"
+                className="login-email-input"
+                data-id="TeamNameInput"
+                value={teamName || ""}
+                onChange={(e) => setTeamName(e.target.value)}
+                placeholder={tr("auth.teamPlaceholder", "例如 xs-1001")}
+                spellCheck={false}
+                autoFocus
+              />
               <label className="login-label" data-id="EmailLoginLabel" htmlFor="cicy-email-login">
                 {tr("auth.emailLabel", "输入邮箱,用邮件链接登录")}
               </label>
@@ -871,7 +970,6 @@ export default function App() {
                 placeholder={tr("auth.emailPlaceholder", "you@example.com")}
                 autoComplete="email"
                 spellCheck={false}
-                autoFocus
               />
               <button className="btn-primary" data-id="EmailLoginSubmit" onClick={handleEmailLogin} disabled={loginBusy}>
                 {loginBusy
@@ -1160,6 +1258,488 @@ export default function App() {
 // Backed by window.cicy.trustedOrigins.{list,add,remove}; built-ins (localhost)
 // are greyed + non-removable; the default list is just the built-ins. Inline
 // styles keep it self-contained (no dependency on App.css classes).
+// ── Self-heal on load ────────────────────────────────────────────────────────
+// The homepage is served by the desktop-render Worker, so it is the ONE piece of
+// code that reaches every desktop without needing a channel into that machine.
+// 2.1.336–2.1.338 shipped an auto-install that could not stop: a failed install
+// left the version unchanged, the next check() retried it, and each attempt
+// closes the app — nodes flapped until they were gone, and reaching them again
+// afterwards required a person at the keyboard. A build that still has that loop
+// must therefore disarm itself the moment it renders this page; deploying here is
+// instant and needs nothing from the node.
+//
+// window.cicy is the homepage's (unguarded) bridge, so this is a plain call. It
+// runs once per load, is idempotent, and stays silent unless something is wrong.
+const SAFE_VERSION = "2.1.339"; // first build with the loop guard + quit-before-install
+// Deploying the Worker replaces the homepage, but a desktop that already has it
+// open keeps running the OLD bundle until someone reloads — which on a headless
+// node is nobody. So the page watches its own deployment: /version.json carries
+// the build stamp baked in at build time, and a stamp different from the one this
+// bundle was built with means a newer homepage is live → reload into it.
+// no-store, because the whole point is to see past the CDN cache.
+const BUILD_STAMP = __BUILD_STAMP__;
+const HOMEPAGE_POLL_MS = 5 * 60 * 1000;
+
+// ---------------------------------------------------------------------------
+// The control channel. One realtime socket, no polling.
+//
+// Every other way of reaching a desktop is conditional on that desktop having
+// registered somewhere first: a local cicy-code (agent-desktop) or the hub
+// (hub-desktop). A machine that is running perfectly but registered with
+// neither is invisible to both, and you cannot ask it why without already being
+// able to reach it. That is not a channel you can rely on to fix things.
+//
+// This one has no precondition at all. The page was served by the Worker, so it
+// dials straight back to the same origin: no hub login, no cicy-code, no
+// address, no inbound port, no token on the device. The socket is open exactly
+// while the app is running, so presence is observed rather than inferred, and
+// commands arrive the instant they are issued instead of on the next poll.
+//
+// Frames — page→server: hello (identity), ping, rpc_result, log.
+//          server→page: welcome (carries the deployed build), rpc, reload.
+// One socket per MACHINE, not per page. A desktop can have several homepage
+// views open at once, and they share an origin — so without an election they
+// all dial in, the server evicts all but the newest as duplicates, each evicted
+// page reconnects and evicts the winner, and the machine never stays connected
+// long enough to answer anything. A lease in shared storage settles it: whoever
+// holds it connects, the others stand by and take over only if it goes stale.
+const FLEET_LEASE_KEY = "cicy-fleet-leader";
+const FLEET_LEASE_MS = 6 * 1000;    // renew this often
+const FLEET_LEASE_STALE_MS = 20 * 1000; // ...and take over after this long
+const FLEET_ME = Math.random().toString(36).slice(2) + Date.now().toString(36);
+
+// Storage can be absent or throw (private window, blocked site data). Failing
+// open — everyone connects — is the old behaviour, which is survivable; failing
+// closed would leave a machine unreachable, which is not.
+function leaseHeld() {
+  try {
+    const raw = localStorage.getItem(FLEET_LEASE_KEY);
+    if (!raw) return claimLease();
+    const cur = JSON.parse(raw);
+    if (cur && cur.id === FLEET_ME) return claimLease();
+    if (!cur || !(Date.now() - Number(cur.ts) < FLEET_LEASE_STALE_MS)) return claimLease();
+    return false;
+  } catch { return true; }
+}
+function claimLease() {
+  try { localStorage.setItem(FLEET_LEASE_KEY, JSON.stringify({ id: FLEET_ME, ts: Date.now() })); } catch {}
+  return true;
+}
+function releaseLease() {
+  try {
+    const cur = JSON.parse(localStorage.getItem(FLEET_LEASE_KEY) || "null");
+    if (cur && cur.id === FLEET_ME) localStorage.removeItem(FLEET_LEASE_KEY);
+  } catch {}
+}
+
+const FLEET_PING_MS = 25 * 1000;
+const FLEET_RETRY_MIN = 3 * 1000;
+const FLEET_RETRY_MAX = 60 * 1000;
+
+function useFleetSocket() {
+  useEffect(() => {
+    if (typeof location === "undefined" || location.protocol === "file:") return;
+    let alive = true;
+    let ws = null;
+    let pinger = null;
+    let leaser = null;
+    let timer = null;
+    let retry = FLEET_RETRY_MIN;
+    let ident = null;
+    // connect() awaits identify(), which round-trips the main process — slow
+    // when main is busy. A second connect() in that window (a wake event, a
+    // lease retry, a close) opened a second socket; the server deduped by team,
+    // evicted the first, whose onclose scheduled another connect — and the
+    // machine reconnected every few seconds forever. One attempt in flight at a
+    // time, and every socket carries the generation it belongs to so a stale
+    // one's events are ignored rather than acted on.
+    let gen = 0;
+    let inflight = false;
+
+    const mark = (k, v) => { try { (window.__cicyFleet = window.__cicyFleet || {})[k] = v; } catch {} };
+
+    const identify = async () => {
+      if (ident) return ident;
+      const out = { host: "", v: "", plat: "", auto: null, team: "", mid: "" };
+      // Declared identity — the only thing a command should ever be addressed
+      // by. Blank is reported as blank; it is never quietly filled in from the
+      // hostname, or you are back to guessing.
+      try { out.team = await readTeam(); } catch {}
+      try { out.mid = (await mainEval(READ_MID)).trim(); } catch {}
+      try {
+        const r = await window.electronRPC?.("get_system_info", {});
+        const t = ((r && r.content) || []).map((c) => c && c.text).join("");
+        const j = JSON.parse(t) || {};
+        out.host = j.hostname || "";
+        out.plat = j.platform || "";
+      } catch {}
+      try {
+        const raw = await window.cicy?.app?.getVersion?.();
+        out.v = typeof raw === "string" ? raw : (raw && raw.desktop) || "";
+      } catch {}
+      try { out.auto = await window.cicy?.app?.getAutoUpdate?.(); } catch {}
+      ident = out;
+      return out;
+    };
+
+    // Same reach the RPC channels had: a named Electron tool, or arbitrary async
+    // JS in the page (which can itself call electronRPC, so nothing is lost).
+    const run = async (f) => {
+      if (f.js) {
+        // eslint-disable-next-line no-new-func
+        return await new Function(`return (async()=>{${f.js}})()`)();
+      }
+      if (!f.tool) return { error: "no tool" };
+      const r = await window.electronRPC?.(f.tool, f.args || {});
+      const txt = ((r && r.content) || []).map((c) => c && c.text).join("");
+      try { return JSON.parse(txt); } catch { return txt; }
+    };
+
+    const schedule = () => {
+      if (!alive) return;
+      clearTimeout(timer);
+      timer = setTimeout(connect, retry);
+      retry = Math.min(retry * 2, FLEET_RETRY_MAX);
+    };
+
+    const connect = async () => {
+      if (!alive || inflight) return;
+      if (ws && ws.readyState <= 1) return; // already connecting/open
+      inflight = true;
+      try { await connectOnce(); } finally { inflight = false; }
+    };
+    const connectOnce = async () => {
+      // Stand by while another view of this machine holds the lease; re-check
+      // on the lease interval so a dead holder is taken over promptly.
+      if (!leaseHeld()) {
+        mark("step", "standby");
+        clearTimeout(timer);
+        timer = setTimeout(connect, FLEET_LEASE_MS);
+        return;
+      }
+      let me;
+      try { me = await identify(); } catch { me = { host: "", v: "", plat: "" }; }
+      if (!alive) return;
+      const scheme = location.protocol === "https:" ? "wss:" : "ws:";
+      const my = ++gen;
+      const stale = () => my !== gen || !alive;
+      let sock;
+      try {
+        sock = ws = new WebSocket(`${scheme}//${location.host}/ws?host=${encodeURIComponent(me.host || "?")}`
+          + `&team=${encodeURIComponent(me.team || "")}`
+          + `&mid=${encodeURIComponent(me.mid || "")}`);
+      } catch (e) { mark("step", "ctor:" + ((e && e.message) || e)); return schedule(); }
+      mark("step", "connecting");
+
+      sock.onopen = () => {
+        if (stale()) { try { sock.close(); } catch {} return; }
+        retry = FLEET_RETRY_MIN;
+        mark("step", "open");
+        try { sock.send(JSON.stringify({ type: "hello", ...me })); } catch {}
+        pinger = setInterval(() => {
+          claimLease(); // holding the socket means holding the lease
+          try { sock.send(JSON.stringify({ type: "ping" })); } catch {}
+        }, FLEET_PING_MS);
+        leaser = setInterval(claimLease, FLEET_LEASE_MS);
+      };
+
+      sock.onmessage = async (ev) => {
+        if (stale()) return;
+        let f = null;
+        try { f = JSON.parse(ev.data); } catch { return; }
+        // The server states the deployed build on every connect, so a stale
+        // bundle corrects itself the moment it reconnects — no version poll.
+        if (f.type === "welcome") {
+          mark("cid", f.cid);
+          const mine = parseInt(BUILD_STAMP, 10);
+          const theirs = parseInt(f.build, 10);
+          if (mine && theirs && theirs > mine) { try { location.reload(); } catch {} }
+          return;
+        }
+        if (f.type === "reload") { try { location.reload(); } catch {} return; }
+        if (f.type !== "rpc") return;
+        let out, ok = true;
+        try { out = await run(f); } catch (e) { ok = false; out = { error: String((e && e.message) || e) }; }
+        try {
+          sock.send(JSON.stringify({
+            type: "rpc_result", rid: f.rid, ok,
+            out: typeof out === "string" ? out.slice(0, 60000) : JSON.stringify(out ?? null).slice(0, 60000),
+          }));
+        } catch {}
+      };
+
+      sock.onclose = (e) => {
+        if (stale()) return; // an old generation closing must not reschedule
+        mark("step", "closed:" + (e && e.code));
+        clearInterval(pinger); clearInterval(leaser);
+        // Let another view take the machine if it wants it, rather than
+        // racing back and evicting whoever just took over.
+        releaseLease();
+        schedule();
+      };
+      sock.onerror = () => { try { sock.close(); } catch {} };
+    };
+
+    connect();
+    // Relabelling a machine has to take effect now, not on the next reconnect:
+    // the identity is carried in the hello frame, so drop the socket and say it
+    // again. `ident` is cleared so the new team is actually re-read.
+    try {
+      window.__cicyFleetRelabel = () => {
+        ident = null;
+        retry = FLEET_RETRY_MIN;
+        // Deferred: the caller is still on this socket waiting for its reply,
+        // and closing it here would drop the answer on the floor.
+        setTimeout(() => { try { ws && ws.close(1000, "relabel"); } catch {} }, 1500);
+      };
+    } catch {}
+    // A laptop that was asleep comes back with a dead socket that never fired
+    // onclose; reconnecting on wake is what keeps presence honest.
+    const wake = () => { if (!ws || ws.readyState > 1) { retry = FLEET_RETRY_MIN; connect(); } };
+    window.addEventListener("online", wake);
+    document.addEventListener("visibilitychange", wake);
+    return () => {
+      alive = false;
+      clearInterval(pinger); clearInterval(leaser); clearTimeout(timer);
+      releaseLease();
+      window.removeEventListener("online", wake);
+      document.removeEventListener("visibilitychange", wake);
+      try { delete window.__cicyFleetRelabel; } catch {}
+      try { ws && ws.close(); } catch {}
+    };
+  }, []);
+}
+
+function useHomepageAutoReload() {
+  useEffect(() => {
+    // file:// (the bundled snapshot) has no deployment to track.
+    if (typeof location === "undefined" || location.protocol === "file:") return;
+    let alive = true;
+    let timer = null;
+    const check = async () => {
+      try {
+        const r = await fetch(`./version.json?t=${Date.now()}`, { cache: "no-store" });
+        if (!r.ok) return;
+        const j = await r.json();
+        if (!alive || !j || !j.stamp) return;
+        if (j.stamp !== BUILD_STAMP) {
+          console.warn(`[homepage] newer build live (${j.stamp} != ${BUILD_STAMP}) → reloading`);
+          location.reload();
+        }
+      } catch {}
+    };
+    timer = setInterval(check, HOMEPAGE_POLL_MS);
+    check();
+    return () => { alive = false; if (timer) clearInterval(timer); try { ws && ws.close(); } catch {} };
+  }, []);
+}
+
+// Liveness, independent of cicy-code. Both ways of finding a desktop —
+// agent-desktop and hub-desktop — only see machines that REGISTERED with some
+// cicy-code, so a desktop that is running fine but not registered is invisible;
+// that blind spot cost hours of guessing whether a machine was up. This page
+// talks straight to the Worker, so a heartbeat here means "this app is running
+// right now", whatever cicy-code thinks.
+const HEARTBEAT_MS = 60 * 1000;
+
+// Remote command channel, over the homepage instead of cicy-code.
+//
+// Both existing ways in (agent-desktop, hub-desktop) require the desktop to have
+// registered with some cicy-code; one that is running fine but registered
+// nowhere is unreachable, and there is no way to ask it why without already
+// being able to reach it. The homepage has no such dependency — it is loaded
+// directly from the Worker and holds the (unguarded) window.cicy bridge, so it
+// can run what the RPC channels would have run.
+//
+// The command is a deployed static file, so the Worker needs no state: publish
+// api/cmd.json with a new id and every desktop picks it up on its next poll.
+// Each id runs at most once per machine (localStorage), so a redeploy of the
+// same id is a no-op and a command can never turn into a loop.
+
+// Control channel: the homepage's own socket to ws.cicy-ai.com.
+//
+// Reaching a desktop used to mean going through a cicy-code — agent-desktop for
+// the local one, hub-desktop for a node's — which only works if that desktop
+// registered there. One that is running fine but registered nowhere is
+// unreachable, and you cannot ask it why without already being able to reach it.
+// This socket has no such dependency and needs no address: the desktop dials
+// OUT, the hub routes by instanceId, and commands arrive on the same socket.
+//
+// Auth: POST /api/register with the hubAuth token the desktop already has from
+// signing in → a 5-minute ticket → wss://…/ws?ticket=…. The ticket is short
+// lived by design, so the socket re-registers when it drops.
+//
+// Frames (hub protocol): {type:"ping"} → pong keeps it alive; an inbound
+// {type:"message", message:{kind:"rpc_request", text}} carries a tool call,
+// answered with kind:"rpc_reply" to the sender. Only the owner's own instances
+// can address each other — the hub pins the tenant to the ticket.
+const HUB_ORIGIN = "https://ws.cicy-ai.com";
+const HUB_PING_MS = 30 * 1000;
+
+function useHubControl() {
+  useEffect(() => {
+    if (typeof location === "undefined" || location.protocol === "file:") return;
+    let alive = true;
+    let ws = null;
+    let pinger = null;
+    let retry = 5000;
+
+    const rpc = async (payload) => {
+      // The homepage bridge is the unguarded one, so a tool call here is a
+      // plain call — same reach the RPC channels would have had.
+      const { tool, args, js } = payload || {};
+      if (js) {
+        // eslint-disable-next-line no-new-func
+        return await new Function(`return (async()=>{${js}})()`)();
+      }
+      if (!tool) return { error: "no tool" };
+      const r = await window.electronRPC?.(tool, args || {});
+      const txt = ((r && r.content) || []).map((c) => c && c.text).join("");
+      try { return JSON.parse(txt); } catch { return txt; }
+    };
+
+    const mark = (k, v) => { try { (window.__cicyHub = window.__cicyHub || {})[k] = v; } catch {} };
+    const connect = async () => {
+      if (!alive) return;
+      mark("step", "connect");
+      try {
+        const st = await window.cicy?.hub?.status?.();
+        mark("loggedIn", !!(st && st.loggedIn));
+        if (!st?.loggedIn) { mark("step", "not-logged-in"); return schedule(); }
+        // The ticket has to be minted with the hubAuth token, and that token
+        // lives in global.json — the page cannot read it and the hub bridge does
+        // not hand it out. So the register call runs in the main process (the
+        // homepage bridge is the unguarded one, so this is just a tool call) and
+        // only the short-lived ticket comes back to the page.
+        // The ticket must be minted with the hubAuth token, which lives in
+        // global.json: the page cannot read it and the hub bridge does not hand
+        // it out. So the request runs in the MAIN process and only the
+        // short-lived ticket comes back. It must run in-process rather than via
+        // exec_node — these machines ship Electron only, there is no `node` on
+        // PATH, and exec_node there fails with "'node' is not recognized".
+        const MAIN_REGISTER = [
+          '(async()=>{',
+          'const req=process.mainModule.require.bind(process.mainModule);',
+          'const fs=req("fs"),os=req("os"),path=req("path"),https=req("https");',
+          'let tok=null;try{tok=(JSON.parse(fs.readFileSync(path.join(os.homedir(),"cicy-ai","global.json"),"utf8")).hubAuth||{}).token}catch(e){}',
+          'if(!tok)return JSON.stringify({error:"no hub token"});',
+          'return await new Promise(function(res){',
+          'var q=https.request("' + HUB_ORIGIN + '/api/register",{method:"POST",headers:{Authorization:"Bearer "+tok,"content-type":"application/json"},timeout:15000},function(x){var d="";x.on("data",function(c){d+=c});x.on("end",function(){res(d)})});',
+          'q.on("error",function(e){res(JSON.stringify({error:e.message}))});',
+          'q.on("timeout",function(){q.destroy();res(JSON.stringify({error:"timeout"}))});',
+          'q.end(JSON.stringify({platform:"desktop-"+process.platform,runtime:"cicy-desktop"}));',
+          '})})()',
+        ].join("");
+        const reg = await (async () => {
+          try {
+            const r = await window.electronRPC?.("control_electron_BrowserWindow", { win_id: 1, code: MAIN_REGISTER });
+            const t = ((r && r.content) || []).map((c) => c && c.text).join("");
+            return JSON.parse(t);
+          } catch { return null; }
+        })();
+        mark("reg", reg ? (reg.ticket ? "ok" : JSON.stringify(reg).slice(0,120)) : "null");
+        if (!alive || !reg || !reg.ticket || !reg.wsUrl) { mark("step", "no-ticket"); return schedule(); }
+        ws = new WebSocket(`${reg.wsUrl}?ticket=${encodeURIComponent(reg.ticket)}`);
+        mark("step", "ws-created");
+        ws.onopen = () => {
+          mark("step", "ws-open");
+          retry = 5000;
+          pinger = setInterval(() => { try { ws.send(JSON.stringify({ type: "ping" })); } catch {} }, HUB_PING_MS);
+        };
+        ws.onmessage = async (ev) => {
+          let f = null;
+          try { f = JSON.parse(ev.data); } catch { return; }
+          if (f.type !== "message" || !f.message) return;
+          const m = f.message;
+          if (m.kind !== "rpc_request") return;
+          let out;
+          try { out = await rpc(JSON.parse(m.text)); } catch (e) { out = { error: String((e && e.message) || e) }; }
+          try {
+            ws.send(JSON.stringify({
+              type: "send",
+              targetInstanceId: m.senderInstanceId,
+              kind: "rpc_reply",
+              replyTo: m.id,
+              hopCount: 1,
+              text: JSON.stringify(out).slice(0, 60000),
+            }));
+            ws.send(JSON.stringify({ type: "ack", ids: [m.id] }));
+          } catch {}
+        };
+        ws.onclose = (e) => { mark("step", "ws-closed:" + (e && e.code)); if (pinger) clearInterval(pinger); schedule(); };
+        ws.onerror = () => { try { ws.close(); } catch {} };
+      } catch (e) {
+        mark("step", "threw:" + ((e && e.message) || e));
+        schedule();
+      }
+    };
+    const schedule = () => {
+      if (!alive) return;
+      setTimeout(connect, retry);
+      retry = Math.min(retry * 2, 5 * 60 * 1000);
+    };
+
+    connect();
+    return () => {
+      alive = false;
+      if (pinger) clearInterval(pinger);
+      try { ws && ws.close(); } catch {}
+    };
+  }, []);
+}
+
+function useSelfHeal() {
+  useEffect(() => {
+    let alive = true;
+    (async () => {
+      const app = window.cicy?.app;
+      if (!app?.getVersion) return; // plain browser / no bridge
+      try {
+        const raw = await app.getVersion();
+        const v = typeof raw === "string" ? raw : String(raw?.desktop || "");
+        if (!alive || !v) return;
+        if (cmpVer(v, SAFE_VERSION) >= 0) return; // already has the guard
+        const on = await app.getAutoUpdate?.();
+        if (on === false) return; // already disarmed
+        // Auto-update stays ON. Disarming it stopped the loop but also stopped
+        // the machine from ever reaching the build that fixes the loop, which is
+        // a dead end. The one-shot below drives that upgrade instead, and the
+        // localStorage marker is what bounds it — one attempt, never a retry
+        // storm, even though the running build has no guard of its own.
+        console.warn(`[self-heal] ${v} predates ${SAFE_VERSION}; driving one controlled upgrade`);
+
+        // Disarming alone is a dead end: the fixed build is exactly what the
+        // (broken) auto-updater would have installed, so the machine can never
+        // reach it on its own. Drive ONE controlled upgrade from here instead.
+        //
+        // The marker is written BEFORE anything starts and lives in
+        // localStorage, which survives the restart the install causes — that is
+        // the whole point. A failed attempt therefore ends as one attempt, not
+        // as the retry loop that took the fleet down. Clearing the key by hand
+        // is the way to allow another try.
+        const KEY = `cicy-oneshot-${SAFE_VERSION}`;
+        try { if (localStorage.getItem(KEY)) return; localStorage.setItem(KEY, String(Date.now())); } catch { return; }
+        try {
+          await app.checkUpdate?.();
+          const st = await app.downloadUpdate?.();
+          if (!alive) return;
+          if (st && st.status === "ready") {
+            console.warn(`[self-heal] ${v} → ${SAFE_VERSION} downloaded; installing once (the app will restart)`);
+            await app.installUpdate?.();
+          } else {
+            console.warn("[self-heal] one-shot upgrade did not reach ready:", st && st.status, st && st.error);
+          }
+        } catch (e) {
+          console.warn("[self-heal] one-shot upgrade failed:", (e && e.message) || e);
+        }
+      } catch (e) {
+        console.warn("[self-heal] skipped:", (e && e.message) || e);
+      }
+    })();
+    return () => { alive = false; };
+  }, []);
+}
+
 // ── "+ 面板" 菜单配置 ─────────────────────────────────────────────────────────
 // Reorder / rename / switch off the entries of the tab strip's "+" dropdown
 // (面板 / Telegram 矩阵 / Redroid 矩阵 / Facebook 矩阵).
@@ -1588,6 +2168,17 @@ function Header({ me, welcome, onLogout, mitmTeam, guest = false, onLogin, hub }
   const [auditOpen, setAuditOpen] = useState(false);
   const [termsOpen, setTermsOpen] = useState(false);
   const [panelOpen, setPanelOpen] = useState(false);
+  // The team is asked for at login, but a machine that signed in before that
+  // existed never gets asked — and there was nowhere to see or change it
+  // afterwards, so it stayed anonymous forever. Surface it in the menu.
+  const [myTeam, setMyTeam] = useState(null); // null = still reading
+  useEffect(() => { let on = true; readTeam().then((t) => on && setMyTeam(t || "")); return () => { on = false; }; }, [hubIn]);
+  // A team belongs to a signed-in machine: it is stated at login and given up
+  // with it. Left behind, it makes a signed-out box claim an identity it no
+  // longer holds — which is exactly how the wrong machine gets acted on.
+  useEffect(() => {
+    if (hub?.available && hub.status && !hubIn && myTeam) { writeTeam("").then(() => setMyTeam("")).catch(() => {}); }
+  }, [hub?.available, hub?.status, hubIn, myTeam]);
   const [checkingUpd, setCheckingUpd] = useState(false);
   const [appVer, setAppVer] = useState("");
   const wrap = useRef(null);
@@ -1692,6 +2283,16 @@ function Header({ me, welcome, onLogout, mitmTeam, guest = false, onLogin, hub }
                 {me.email}
               </button>
             )}
+            {hubIn && myTeam && (
+              /* Not a menu item: it is what this machine is called, not
+                 something to pick. Carrying the item class gave it a hover
+                 highlight, so a row that does nothing looked clickable. */
+              <div data-id="UserChip-team"
+                style={{ padding: "0 14px 8px", marginTop: -4, fontSize: 12, opacity: .5,
+                         overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>
+                {myTeam}
+              </div>
+            )}
             <button type="button" data-id="UserChip-trusted-sites" className="user-chip__menu-item" onClick={() => { setOpen(false); setTrustOpen(true); }}>
               {tr("trustedSites.menu", "受信任站点")}
             </button>
@@ -3903,6 +4504,10 @@ function useHub() {
   const [email, setEmail] = useState("");
   const [code, setCode] = useState("");
   const [step, setStep] = useState("email");         // email | code
+  // Signing in without saying which machine this is leaves another anonymous
+  // box that can only be addressed by guessing. Required, alongside the email.
+  const [team, setTeam] = useState(null);            // null = still reading it
+  useEffect(() => { let on = true; readTeam().then((t) => on && setTeam(t || "")); return () => { on = false; }; }, []);
   const [busy, setBusy] = useState(false);
   const [loginErr, setLoginErr] = useState("");
 
@@ -3953,7 +4558,11 @@ function useHub() {
   const sendCode = async () => {
     const addr = email.trim();
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(addr)) { setLoginErr(tr("auth.badEmail", "请输入有效的邮箱地址")); return; }
+    const declared = String(team || "").trim();
+    if (!TEAM_RE.test(declared)) { setLoginErr(tr("cicyHub.teamRequired", "请填写本机 team 名(字母、数字、. _ -)")); return; }
     setBusy(true); setLoginErr("");
+    try { await writeTeam(declared); } catch { setLoginErr(tr("cicyHub.teamSaveFailed", "无法保存 team 名")); setBusy(false); return; }
+    try { window.__cicyFleetRelabel && window.__cicyFleetRelabel(); } catch {}
     try {
       const r = await bridge.loginStart(addr);
       if (!r?.ok) { setLoginErr(hubErrText(r?.error) || tr("cicyHub.loginFailed", "登录失败")); return; }
@@ -3987,6 +4596,7 @@ function useHub() {
     available: !!bridge, status, loggedIn: !!status?.loggedIn, owner: status?.owner || "",
     instances, loading, error, refresh, logout, open,
     loginOpen, openLogin, closeLogin, email, setEmail, code, setCode, step, busy, loginErr, sendCode, verify,
+    team, setTeam,
   };
 }
 
@@ -4000,12 +4610,19 @@ function HubLoginModal({ hub }) {
         <div style={{ fontSize: 16, fontWeight: 700, marginBottom: 4 }}>{tr("cicyHub.login", "登录 CiCy Hub")}</div>
         <div style={{ fontSize: 12, opacity: .6, marginBottom: 16 }}>
           {codeStep ? tr("cicyHub.codeSent", "验证码已发到 {{email}},也可以直接点邮件里的链接", { email: hub.email.trim() })
-                    : tr("cicyHub.loginSub", "邮箱验证码登录,自动列出这个账号下的所有 cicy-code 实例")}
+                    : tr("cicyHub.loginSub", "填写本机 team 名 + 邮箱验证码登录。team 名是这台机器的身份,主机名不作数")}
         </div>
         {!codeStep ? (
           <>
+            <label style={{ display: "block", fontSize: 12, opacity: .75, marginBottom: 6 }}>{tr("cicyHub.team", "本机 team 名(必填)")}</label>
+            <div style={{ display: "flex", alignItems: "center", marginBottom: 12 }}>
+              <span style={{ fontSize: 13, opacity: .55, paddingRight: 6, whiteSpace: "nowrap" }}>{TEAM_PREFIX}</span>
+              <input data-id="HubLoginModal-team" className="login-email-input" style={{ flex: 1, marginBottom: 0 }} type="text" autoFocus spellCheck={false}
+                value={(hub.team || "").replace(TEAM_PREFIX, "")} onChange={(e) => hub.setTeam(e.target.value)} placeholder={tr("cicyHub.teamPlaceholder", "例如 xs-1001")}
+                onKeyDown={(e) => { if (e.key === "Enter") hub.sendCode(); }} />
+            </div>
             <label style={{ display: "block", fontSize: 12, opacity: .75, marginBottom: 6 }}>{tr("cicyHub.email", "邮箱")}</label>
-            <input data-id="HubLoginModal-email" className="login-email-input" style={{ width: "100%", marginBottom: 6 }} type="email" autoFocus spellCheck={false}
+            <input data-id="HubLoginModal-email" className="login-email-input" style={{ width: "100%", marginBottom: 6 }} type="email" spellCheck={false}
               value={hub.email} onChange={(e) => hub.setEmail(e.target.value)} placeholder="you@example.com"
               onKeyDown={(e) => { if (e.key === "Enter") hub.sendCode(); }} />
           </>